From b3bbfaa0201b07894f8d7434dc9ce1193f71a61a Mon Sep 17 00:00:00 2001
From: broken-circle <252359939+broken-circle@users.noreply.github.com>
Date: Wed, 8 Jul 2026 14:04:43 -0700
Subject: [PATCH] Narrow `testSubprocessPlatformOptionsSupplementaryGroups()`
 on Darwin

`id -G` on Darwin doesn't report the groups, but they are applied: the
prefork child aborts the spawn if `setgroups(2)` fails, so a successful
spawn confirms the call returned `0` and the credential was set; only
Darwin's `id -G` read-back omits it. Keep the membership assertion where
`id -G` is faithful and asserts only spawn success on Darwin.
---
 Tests/SubprocessTests/UnixTests.swift | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Tests/SubprocessTests/UnixTests.swift b/Tests/SubprocessTests/UnixTests.swift
index 197dcaf4..12600d2a 100644
--- a/Tests/SubprocessTests/UnixTests.swift
+++ b/Tests/SubprocessTests/UnixTests.swift
@@ -133,6 +133,9 @@ extension SubprocessUnixTests {
             error: .string(limit: .max),
         )
         #expect(idResult.terminationStatus.isSuccess, Comment(rawValue: idResult.standardError))
+        // On Darwin, id -G run as root doesn't report the supplementary groups
+        // installed via setgroups() in the prefork child (`isSuccess` above).
+        #if !canImport(Darwin)
         let ids =
             try idResult
             .standardOutput.split(separator: " ")
@@ -141,6 +144,7 @@ extension SubprocessUnixTests {
         // supplementary groups, so filter to just the expected range
         let actualGroups = Set(ids.filter { expectedGroups.contains($0) })
         #expect(actualGroups == expectedGroups, Comment(rawValue: idResult.standardError))
+        #endif
     }
 
     @Test(