From 2ed16ff88def7d60e66fbcd96a4637957400eb6b Mon Sep 17 00:00:00 2001
From: sloray <i@sloray.com>
Date: Thu, 15 Oct 2026 22:31:56 +0800
Subject: [PATCH] =?UTF-8?q?ci(diag):=20=E5=9C=A8=20Windows=20job=20?=
 =?UTF-8?q?=E9=87=8C=E5=8A=A0=E4=B8=80=E6=AE=B5=E4=B8=B4=E6=97=B6=E8=AF=8A?=
 =?UTF-8?q?=E6=96=AD=EF=BC=88=E6=9F=A5=E5=AE=8C=E5=88=A0=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

run 5 里 bash 那两个坑都过去了，卡在第三处：rustup 建临时文件被拒

    error: could not create temp file C:\Users\admin\.rustup\tmp\ajq4dt9h0_e7oonj_file
    拒绝访问。 (os error 5)

同一个账户在这个交互式会话里能往那个目录写、ACL 也是正常的（SYSTEM/Administrators/
TIMI\admin 全 F，没有 Deny）。runner 进程属主是 TIMI\admin，计划任务 GiteaRunner-Windows
是 admin / Limited（非提权）。所以差异只在 job 内部的令牌/完整性级别上 —— 让 job 自己
报：whoami、Mandatory Label、TEMP/TMP、RUSTUP_HOME/CARGO_HOME，并对 6 个候选目录逐个
做"建目录 + 写文件 + 删文件"探测。这是临时步骤，拿到结论就删。
---
 .github/workflows/build-client.yml | 33 ++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/.github/workflows/build-client.yml b/.github/workflows/build-client.yml
index 2a71a56..34b8c2b 100644
--- a/.github/workflows/build-client.yml
+++ b/.github/workflows/build-client.yml
@@ -336,6 +336,39 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # 临时诊断：rustup 写 C:\Users\admin\.rustup\tmp 被拒（os error 5），但同一个
+      # 账户在交互式会话里写得进去 —— 先让 job 自己说清楚"我是谁、哪种完整性级别、
+      # 哪些目录写得进去"。查完这一段就删。
+      - name: 诊断（临时，查完删）
+        shell: pwsh
+        run: |
+          "whoami          = $(whoami)"
+          "integrity       = $((whoami /groups | Select-String -Pattern 'Mandatory Label') -join ' ')"
+          "USERPROFILE     = $env:USERPROFILE"
+          "HOME            = $env:HOME"
+          "TEMP / TMP      = [$env:TEMP] / [$env:TMP]"
+          "TMPDIR          = [$env:TMPDIR]"
+          "RUSTUP_HOME     = [$env:RUSTUP_HOME]   CARGO_HOME = [$env:CARGO_HOME]"
+          "user-level TEMP = $([Environment]::GetEnvironmentVariable('TEMP','User'))"
+          $targets = @(
+            "$env:USERPROFILE\.rustup\tmp",
+            "$env:USERPROFILE\.cargo",
+            "$env:USERPROFILE\.cargo\registry",
+            'C:\Users\admin\runner\windows',
+            'C:\Users\admin\runner\windows\cache',
+            (Join-Path (Split-Path -Parent $env:GITHUB_WORKSPACE) 'ci-probe')
+          )
+          foreach ($p in $targets) {
+            $verdict = 'OK'
+            try {
+              New-Item -ItemType Directory -Force -Path $p -ErrorAction Stop | Out-Null
+              $f = Join-Path $p 'probe.txt'
+              Set-Content -Path $f -Value 'x' -ErrorAction Stop
+              Remove-Item $f -Force -ErrorAction SilentlyContinue
+            } catch { $verdict = "FAIL: $($_.Exception.Message)" }
+            "{0,-46} {1}" -f $verdict, $p
+          }
+
       # 宿主模式的 Windows runner 上，PATH 里的 `bash` 是 C:\Windows\System32\bash.exe
       # —— WSL 的启动器，而 WSL 在 runner 账户下起不来，报 E_ACCESSDENIED（日志里是
       # 一串 GBK 被当 UTF-8 解出来的乱码 + https://github.com/microsoft/WSL/issues）。