Cross-Platform Code — Linux, macOS, Windows & Docker

This function can't work on native Windows as written. The filename contains : (from %H:%M), and it shells out to gzip and rm, which Windows doesn't have. Below are 8 findings, a portable rewrite and tests. The tests pass on Linux. macOS and Windows still need CI runs.

Platform check

1. Platforms: Linux, macOS, Windows 11 native (as you specified).

POSIX assumptions: path separator, : in a filename, /tmp, ~/.config, locale-dependent encoding, line endings.
3. Undeclared external tools: gzip and rm are called through the shell.
4.

Failure on Windows: open() raises OSError on the : in the filename. If it got past that, gzip isn't on PATH.
5. OS-specific hot path: none. The standard library covers everything here, so no platform branch is needed.

Findings

Also, datetime.now() is local time. It is now UTC, as the "UTC at boundaries" rule requires. One finding is outside this skill's scope but worth fixing: ",".join(r) doesn't quote fields that contain commas. The csv module in the rewrite fixes that too.

Portable rewrite

# reportr/export.py
import csv
import gzip
import shutil
from datetime import datetime, timezone
from pathlib import Path

from platformdirs import user_cache_dir, user_data_dir  # new dependency: add to pyproject

APP = "reportr"
WINDOWS_RESERVED = (
    {"CON", "PRN", "AUX", "NUL"}

    | {f"COM{i}" for i in range(1, 10)}
    | {f"LPT{i}" for i in range(1, 10)}

)
FORBIDDEN_CHARS = set('<>:"/\\|?*') | {chr(c) for c in range(32)}

def is_safe_filename(name: str) -> bool:
    if not name or name in {".", ".."}:
        return False
    if name.upper().split(".")[0] in WINDOWS_RESERVED:
        return False
    if any(c in FORBIDDEN_CHARS for c in name):
        return False
    if name.endswith((" ", ".")):
        return False
    return True

def export_report(user_name: str, rows: list[list[str]], out_dir: Path | None = None) -> Path:
    if not is_safe_filename(user_name):
        raise ValueError(f"user_name is not a safe filename on every OS: {user_name!r}")
    out_dir = out_dir or Path(user_data_dir(APP)) / "exports"
    out_dir.mkdir(parents=True, exist_ok=True)

    stamp = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H%MZ")  # no ':' (forbidden on Windows)
    path = out_dir / f"{user_name}-{stamp}.csv.gz"

    # gzip in-process instead of shelling out; newline="" so the csv module
    # writes the same bytes (\r\n per RFC 4180) on every OS
    with gzip.open(path, "wt", encoding="utf-8", newline="") as f:
        csv.writer(f).writerows(rows)

    shutil.rmtree(Path(user_cache_dir(APP)), ignore_errors=True)
    return path

Behavior changes to note in the changelog: exports now go to the OS data directory (~/.local/share/reportr on Linux, ~/Library/Application Support/reportr on macOS, %LOCALAPPDATA%\reportr\reportr on Windows, all under exports/) instead of ~/.config. Timestamps are UTC. The return type is now Path.

Tests

# tests/test_export.py
import csv, gzip
import pytest
from reportr.export import export_report, is_safe_filename

@pytest.mark.parametrize("name", ["CON", "nul.txt", "a:b", "x/y", "..", "trail.", "trail ", ""])
def test_should_reject_name_when_unsafe_on_windows(name):
    assert not is_safe_filename(name)

def test_should_write_portable_filename_and_roundtrip_utf8(tmp_path):
    rows = [["name", "city"], ["Zoë", "São Paulo"], ["a,b", "x"]]
    path = export_report("maria", rows, out_dir=tmp_path)
    assert ":" not in path.name
    with gzip.open(path, "rt", encoding="utf-8", newline="") as f:
        assert list(csv.reader(f)) == rows

Ran on

Linux only (Python 3.14, pytest 9.1.1, platformdirs 4.12.4): 9 passed. These tests have

not run on macOS or Windows yet. Finding #1 is the Windows failure, and it is only proven fixed once the Windows lane is green.

CI matrix (required)

# .github/workflows/test.yml
jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install -e . pytest
      - run: pytest -q

Validation checklist

• Path API only, no hardcoded separators
• Explicit UTF-8 on all file I/O
• No shell commands or POSIX utilities called from code
• No hardcoded /tmp or ~/.config
• UTC at the boundary
• Filename validation for external input
• Tests green on macOS and Windows: pending CI
• README lists supported OS versions and the new export location

Next steps

1. Add platformdirs to your dependencies and merge the matrix workflow. Treat a red Windows lane as a blocker.
2. Search the rest of the CLI for the same patterns (shell=True, os.system, expanduser("~/., open( without encoding=) before declaring Windows supported.
3. Tell existing users that the export folder has moved, or keep reading the old path for one release.