test: isolate the git environment in cmd/ git-subprocess tests#18
Merged
Conversation
The cmd/ test helpers scoped the repo (-C <tempdir>) but ran git with append(os.Environ()), which inherits host GIT_* (a stray GIT_DIR could redirect a command at the real repo) and reads the developer's real ~/.gitconfig. Add a package-cmd gitIsolatedEnv() mirroring the evals harness helper: strip every inherited GIT_* var, neutralise system/global config discovery (GIT_CONFIG_NOSYSTEM=1, GIT_CONFIG_GLOBAL=/dev/null), and pin a distinctive ferry-test identity via env. The repo's LOCAL .git/config is untouched, so the git-hardening tests still exercise their hostile local config. Also drops the bare 't <t@localhost>' fixture identity that made the recent mis-attribution leak hard to trace. Defence-in-depth for the concurrency-corruption hazard in issue #17. Refs #17.
REPPL
added a commit
that referenced
this pull request
Jul 18, 2026
Concurrent heavy git activity (a worktree add during an in-flight go test) once corrupted the working repo's state: core.bare flipped and an isolated test fixture's git identity leaked into the local config. The code-side hardening landed in #18; this records the operational guardrail in CONTRIBUTING.md and AGENTS.md, the remaining prevention item. Closes #17 Assisted-by: Claude:claude-fable-5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Defence-in-depth for the concurrency-corruption hazard in #17.
The
cmd/test helpers scoped the repo (-C <tempdir>) but ran git withappend(os.Environ(), …)— which inherits hostGIT_*(a strayGIT_DIRcould redirect a command at the real repo) and reads the developer's real~/.gitconfig.This adds a package-
cmdgitIsolatedEnv()mirroring theevals/harness helper:GIT_*variable,GIT_CONFIG_NOSYSTEM=1,GIT_CONFIG_GLOBAL=/dev/null),ferry-testidentity via env.The repo's LOCAL
.git/configis untouched, so the git-hardening tests still exercise their hostile local config (verified: cmd suite green). Also drops the baret <t@localhost>fixture identity that made the recent mis-attribution hard to trace — future leaks are now obviously test-originated.Refs #17. Test-only; no user-facing change. gofmt/vet/
go test ./...green.Note: the operational half of #17 (don't run git-mutating ops concurrently with a test/tooling run) remains a discipline/guardrail, not a code fix.
Assisted-by: Claude:claude-opus-4-8