fix(streamer): prevent skipPath from over-matching .git prefix

pkg/shp/streamer/tar.go

@@ -24,13 +24,18 @@ func (t *Tar) skipPath(fpath string, stat fs.FileInfo) bool {
 	if !stat.Mode().IsRegular() {
 		return true
 	}
-	if strings.HasPrefix(fpath, path.Join(t.src, ".git")) {
-		return true
+	relPath, err := filepath.Rel(t.src, fpath)
+	if err == nil {
+		cleanPath := filepath.ToSlash(relPath)
+		if cleanPath == ".git" || strings.HasPrefix(cleanPath, ".git/") {
+			return true
+		}
 	}
-	if t.gitIgnore == nil {
-		return false
+
+	if t.gitIgnore != nil {
+		return t.gitIgnore.MatchesPath(fpath)
 	}
-	return t.gitIgnore.MatchesPath(fpath)
+	return false
 }
 
 // Create the actual tar by inspecting all files in source path, skipping some.

pkg/shp/streamer/tar_test.go

@@ -3,6 +3,7 @@ package streamer
 import (
 	"archive/tar"
 	"io"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -26,6 +27,7 @@ func Test_Tar(t *testing.T) {
 
 	tarReader := tar.NewReader(reader)
 	counter := 0
+	foundGitIgnore := false
 	for {
 		header, err := tarReader.Next()
 		if err != nil {
@@ -37,10 +39,20 @@ func Test_Tar(t *testing.T) {
 		counter++
 		name := header.Name
 
+		cleanName := filepath.ToSlash(name)
+		// On windows, trimPrefix might fail to trim the prefix cleanly due to slash mismatch, leaving ../../../ prefix.
+		if cleanName == ".gitignore" || strings.HasSuffix(cleanName, "/.gitignore") {
+			// Ensure it's not a vendor or nested gitignore
+			if !strings.Contains(cleanName, "vendor/") {
+				foundGitIgnore = true
+			}
+		}
+
 		// making sure that undesired entries are not present on the list of files caputured by the
 		// tar helper
-		g.Expect(strings.HasPrefix(name, ".git/")).To(o.BeFalse())
-		g.Expect(strings.HasPrefix(name, "_output/")).To(o.BeFalse())
+		g.Expect(strings.Split(cleanName, "/")).NotTo(o.ContainElement(".git"), "should not contain a .git path component")
+		g.Expect(strings.HasPrefix(cleanName, "_output/")).To(o.BeFalse())
 	}
+	g.Expect(foundGitIgnore).To(o.BeTrue(), "expected .gitignore to be included in the tarball")
 	g.Expect(counter > 10).To(o.BeTrue())
 }