python-semantic-release
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
@@ -341,6 +341,28 @@ jobs:
           python -c 'import pathlib, semantic_release; print(f"PKG_INSTALLED_DIR={pathlib.Path(semantic_release.__file__).resolve().parent}")' | Tee-Object -Variable cmdOutput
           echo $cmdOutput >> $env:GITHUB_OUTPUT
 
+      - name: Setup | Harden Windows runner for git-heavy tests
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          # 1. Exclude workspace & temp dirs from Defender real-time scanning
+          Add-MpPreference -ExclusionPath "${{ github.workspace }}"
+          Add-MpPreference -ExclusionPath "$env:TEMP"
+          Add-MpPreference -ExclusionProcess "git.exe"
+          Add-MpPreference -ExclusionProcess "python.exe"
+
+          # 2. Move temp (pytest tmp_path factory) to the faster D: drive
+          New-Item -ItemType Directory -Force -Path "D:\tmp" | Out-Null
+          "TEMP=D:\tmp" >> $env:GITHUB_ENV
+          "TMP=D:\tmp"  >> $env:GITHUB_ENV
+
+          # 3. Disable git background features that race with rapid repo churn
+          git config --global core.fsmonitor false
+          git config --global core.untrackedCache false
+          git config --global gc.auto 0
+          git config --global maintenance.auto false
+          git config --global core.longpaths true
+
       - name: Test | Run pytest -m e2e
         id: tests
         shell: pwsh
@@ -349,13 +371,13 @@ jobs:
           # Required for GitPython to work on Windows because of getpass.getuser()
           # USERNAME: "runneradmin"
           # COLUMNS: 150
-          # Because GHA is currently broken on Windows to pass these varables, we do it manually
+          # Because GHA is currently broken on Windows to pass these variables, we do it manually
         run: |
           $env:USERNAME = "runneradmin"
           $env:COLUMNS = 150
           pytest                                                    `
             -vv                                                     `
-            -nauto                                                  `
+            -n 2                                                    `
             -m e2e                                                  `
             `--cov=${{ steps.install.outputs.PKG_INSTALLED_DIR }}   `
             `--cov-context=test                                     `
@@ -377,7 +399,7 @@ jobs:
         if: ${{ failure() && steps.tests.outcome == 'failure' }}
         with:
           name: ${{ format('tested-repos-{0}-{1}', matrix.os, matrix.python-version) }}
-          path: ~/AppData/Local/Temp/pytest-of-runneradmin/pytest-current/*
+          path: D:\tmp\pytest-of-runneradmin\pytest-current\*
           include-hidden-files: true
           if-no-files-found: error
           retention-days: 1

diff --git a/src/semantic_release/cli/commands/changelog.py b/src/semantic_release/cli/commands/changelog.py
@@ -36,7 +36,12 @@ def get_license_name_for_release(tag_name: str, project_root: Path) -> str:
             toml_contents = git_repo.git.show(
                 f"{tag_name}:{proj_toml.relative_to(project_root)}"
             )
-            config_toml = tomlkit.parse(toml_contents)
+            # Normalize line endings: `git show` returns the blob verbatim, which
+            # may contain CRLF (or bare CR) when committed from Windows.
+            # tomlkit >= 0.15 rejects bare carriage returns as invalid characters.
+            config_toml = tomlkit.parse(
+                toml_contents.replace("\r\n", "\n").replace("\r", "")
+            )
             project_metadata = config_toml.unwrap().get("project", project_metadata)
             break
 

diff --git a/tests/util.py b/tests/util.py
@@ -8,8 +8,9 @@
 import string
 from contextlib import contextmanager, suppress
 from pathlib import Path
-from re import compile as regexp
+from re import compile as regexp, sub as regexp_sub
 from textwrap import indent
+from traceback import format_exception
 from typing import TYPE_CHECKING, Tuple
 
 from git import Git, Repo
@@ -51,6 +52,21 @@
     GitCommandWrapperType: TypeAlias = Git
 
 
+_ANSI_ESCAPE_RE = regexp(r"\x1b\[[0-9;]*[A-Za-z]")
+_CONTROL_CHARS_RE = regexp(r"[\x00-\x08\x0b\x0c\x0e-\x1f]")
+
+
+def sanitize_output(text: str) -> str:
+    r"""
+    Strip ANSI escape sequences and non-printable control characters from text.
+
+    Preserves tab (``\t``), newline (``\n``), and carriage return (``\r``).
+    This prevents control characters from corrupting assertion messages and JUnit
+    XML reports.
+    """
+    return regexp_sub(_CONTROL_CHARS_RE, "", regexp_sub(_ANSI_ESCAPE_RE, "", text))
+
+
 def get_func_qual_name(func: Callable[[Any], Any]) -> str:
     return str.join(".", filter(None, [func.__module__, func.__qualname__]))
 
@@ -61,15 +77,31 @@ def assert_exit_code(
     if result.exit_code == exit_code:
         return True
 
+    stdout = sanitize_output(result.output or "")
+    stderr = sanitize_output(getattr(result, "stderr", "") or "")
+    exc_info = result.exc_info
+    exc_lines = (
+        format_exception(exc_info[0], exc_info[1], exc_info[2]) if exc_info else []
+    )
+    exc_text = sanitize_output(str.join("", exc_lines))
+
     raise AssertionError(
         str.join(
             os.linesep,
             [
                 f"{result.exit_code} != {exit_code} (actual != expected)",
                 "",
-                # Explain what command failed
                 "Unexpected exit code from command:",
                 indent(f"'{str.join(' ', cli_cmd)}'", " " * 2),
+                "",
+                "Captured stdout:",
+                indent(stdout or "(empty)", " " * 2),
+                "",
+                "Captured stderr:",
+                indent(stderr or "(empty)", " " * 2),
+                "",
+                "Exception:",
+                indent(exc_text or "(none)", " " * 2),
             ],
         )
     )