mirror of
https://github.com/block/buzz.git
synced 2026-10-27 12:40:30 +00:00
3b2e50b15c
Git exports repository-local variables (`GIT_DIR`, `GIT_INDEX_FILE`, `GIT_WORK_TREE`, ...) into hook processes, and in linked worktrees `GIT_DIR` is absolute. Pre-push lanes inherited that environment unchanged, so any test fixture that spawns `git` in a temp dir (`git init --bare <tmp>`, `git config user.name ...`, `git commit`, `git push`) actually operated on the checkout being pushed. `current_dir(tmp)` and `git -C tmp` don't escape an inherited `GIT_DIR`. Because `.git/config` is shared by every worktree, one push from any worktree could silently rewrite the repo for all of them. In practice this set `core.bare=true` (breaking the main checkout with `fatal: this operation must be run in a work tree`), replaced the committer identity with a fixture `user.name=Agent`, disabled `commit.gpgSign`, and left fixture aliases behind. The fixtures that did this are the git-identity enforcement tests in #6177, which run in the `rust-tests` lane via `just test-unit`. The pre-push lanes that run test suites or builds now go through `scripts/without-git-env.sh`, which unsets the variables listed by `git rev-parse --local-env-vars` (git's own definition of repo-local state, the same set `git submodule` clears) and then `exec`s the lane, so each subprocess rediscovers the repository from its working directory. Transport, credential, and TLS settings (`GIT_SSH_COMMAND`, `GIT_ASKPASS`, `GIT_TERMINAL_PROMPT`, `GIT_SSL_*`) pass through untouched. Putting this at the hook boundary covers every current and future test without each suite having to defend itself. The `branch-skew` and `push-head-scope` guards run unwrapped: they spawn no fixtures, and `branch-skew`'s `git fetch` needs the caller's transport environment. `pre-commit` isn't wrapped either, since its `stage_fixed: true` lanes need the hook's `GIT_INDEX_FILE` to restage into the temporary index during `git commit <paths>`. Related: #6177 --------- Signed-off-by: Will Pfleger <wpfleger@block.xyz>
11 lines
444 B
Bash
Executable File
11 lines
444 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Git exports repository-local variables (GIT_DIR, GIT_INDEX_FILE, ...) to
|
|
# hooks. Pre-push lanes run test suites whose fixtures spawn git in temp dirs;
|
|
# with those variables inherited, fixtures operate on this checkout instead.
|
|
# Transport, credential, and TLS settings (GIT_SSH_COMMAND, GIT_ASKPASS, ...)
|
|
# are left intact.
|
|
set -euo pipefail
|
|
# shellcheck disable=SC2046
|
|
unset $(git rev-parse --local-env-vars)
|
|
exec "$@"
|