Skip to content

Commit 96c3f41

Browse files
DeusDataDeusData
authored
Merge pull request #2337 from DeusData/fix/issue-2003
fix(tests): ignore an inherited git repository environment (#2003)
2 parents cb7d937 + cf72f1a commit 96c3f41

5 files changed

Lines changed: 169 additions & 0 deletions

File tree

‎scripts/test.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,6 +357,12 @@ else
357357
make -f Makefile.cbm test-par ${MAKE_ARGS[@]+"${MAKE_ARGS[@]}"}
358358
fi
359359

360+
# Step 3a: the runner must ignore an inherited git repository environment
361+
# (#2003: the pre-commit hook exports GIT_DIR, which overrides `git -C` and
362+
# pointed fixture git commands at the committer's real repository).
363+
echo "=== Step 3a: inherited git environment isolation (#2003) ==="
364+
bash "$ROOT/tests/test_git_env_isolation_contract.sh" "$ROOT/$BUILD_DIR/test-runner"
365+
360366
# Step 4: C++ large-TU index-hang regression guard (#410). Runs the PROD binary
361367
# in a subprocess with a wall-clock timeout — a hang must fail, not block the run.
362368
# Opt-in via CBM_RUN_HANG_TEST=1 (it needs the prod binary, which the ASan unit

‎tests/repro/repro_main.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ int tf_fail_count = 0;
2626
int tf_skip_count = 0;
2727

2828
#include "test_framework.h"
29+
#include "test_helpers.h"
2930
#include "repro_runner.h"
3031
#include "foundation/compat.h" /* cbm_setenv — #845 supervisor kill switch */
3132
#include "daemon/bootstrap.h" /* refuse the developer's default daemon rendezvous */
@@ -139,6 +140,8 @@ int main(void) {
139140
* loudly instead of reaching it. */
140141
cbm_daemon_bootstrap_forbid_default_runtime_for_test(true);
141142
#endif
143+
/* #2003: fixture git commands must never reach the caller's repository. */
144+
th_clear_git_repo_env();
142145

143146
/* Unbuffered: a reproduction may crash/_exit (or a sanitizer may _exit on a
144147
* leak) before stdio flushes — keep every printed line so the summary and the

‎tests/test_git_env_isolation_contract.sh‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
#!/usr/bin/env bash
2+
# Contract (#2003): the test runner must be immune to an inherited git
3+
# repository environment.
4+
#
5+
# Git exports GIT_DIR, GIT_INDEX_FILE, ... into hooks, and those variables take
6+
# precedence over `git -C <dir>`. The pre-commit hook runs the suite, so every
7+
# fixture git command in the runner used to act on the committer's REAL
8+
# repository: fixture assertions failed, and branches, commits and linked
9+
# worktrees were written into the contributor's clone. The runner now clears
10+
# git's local-env list at startup (th_clear_git_repo_env in tests/test_helpers.h).
11+
#
12+
# This drives the real runner with those variables aimed at a throwaway decoy
13+
# repository and asserts both halves: the git fixture suite passes, and the
14+
# decoy is left exactly as it was (no refs, no linked worktrees).
15+
#
16+
# Usage: tests/test_git_env_isolation_contract.sh [path/to/test-runner]
17+
set -euo pipefail
18+
19+
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
20+
RUNNER="${1:-$ROOT/build/c/test-runner}"
21+
SUITE="git_context"
22+
23+
if [ ! -x "$RUNNER" ]; then
24+
echo "FAIL: test runner not found at '$RUNNER'; build it first (make -f Makefile.cbm build/c/test-runner)." >&2
25+
exit 1
26+
fi
27+
if ! command -v git >/dev/null 2>&1; then
28+
echo "SKIP: git is not on PATH, so there is no git environment to leak."
29+
exit 0
30+
fi
31+
32+
# This script's own git calls must address the decoy, not whatever repository
33+
# the caller (e.g. the pre-commit hook) exported.
34+
while IFS= read -r variable; do
35+
unset "$variable"
36+
done < <(git rev-parse --local-env-vars)
37+
38+
WORK="$(mktemp -d "${TMPDIR:-/tmp}/cbm-git-env-XXXXXX")"
39+
cleanup() { rm -rf "$WORK"; }
40+
trap cleanup EXIT
41+
42+
decoy_state() {
43+
printf 'refs:\n'
44+
git -C "$1" for-each-ref
45+
printf 'worktrees:\n'
46+
git -C "$1" worktree list --porcelain
47+
}
48+
49+
# Baseline: the same suite in a clean environment. Comparing summaries (not just
50+
# exit codes) matters: with GIT_WORK_TREE inherited, fixture commits fail and
51+
# the suite SKIPs as "git not available" instead of failing -- a silent green.
52+
BASE_LOG="$WORK/baseline.log"
53+
"$RUNNER" "$SUITE" >"$BASE_LOG" 2>&1 || {
54+
echo "FAIL: '$SUITE' is red even in a clean environment; fix that first." >&2
55+
grep -E 'FAIL|passed' "$BASE_LOG" >&2 || true
56+
exit 1
57+
}
58+
59+
summary() { grep -E '^ *[0-9]+ passed' "$1" | tail -1; }
60+
BASE_SUMMARY="$(summary "$BASE_LOG")"
61+
FAILED=0
62+
63+
# Two inherited shapes: GIT_DIR alone (the reported `GIT_DIR=... scripts/test.sh`
64+
# case: fixture git commands write into the decoy) and the full set a hook
65+
# exports (fixture commits fail, so the suite degrades to SKIPs).
66+
check_variant() {
67+
local name="$1"
68+
local decoy="$WORK/decoy-$name"
69+
shift
70+
git init -q "$decoy"
71+
local before
72+
before="$(decoy_state "$decoy")"
73+
local -a assignments=()
74+
local var
75+
for var in "$@"; do
76+
assignments+=("$var=$decoy$(git_env_suffix "$var")")
77+
done
78+
local log="$WORK/runner-$name.log"
79+
local rc
80+
set +e
81+
env "${assignments[@]}" "$RUNNER" "$SUITE" >"$log" 2>&1
82+
rc=$?
83+
set -e
84+
local env_summary after
85+
env_summary="$(summary "$log")"
86+
after="$(decoy_state "$decoy")"
87+
if [ "$rc" -ne 0 ]; then
88+
echo "FAIL[$name]: '$SUITE' exited $rc with an inherited git environment." >&2
89+
grep -E 'FAIL|passed' "$log" >&2 || true
90+
FAILED=1
91+
fi
92+
if [ -z "$BASE_SUMMARY" ] || [ "$BASE_SUMMARY" != "$env_summary" ]; then
93+
echo "FAIL[$name]: '$SUITE' behaves differently with an inherited git environment." >&2
94+
echo " clean env: ${BASE_SUMMARY:-<no summary>}" >&2
95+
echo " inherited env: ${env_summary:-<no summary>}" >&2
96+
grep -E 'FAIL|SKIP' "$log" >&2 || true
97+
FAILED=1
98+
fi
99+
if [ "$before" != "$after" ]; then
100+
echo "FAIL[$name]: the test runner modified the repository named by the inherited GIT_DIR." >&2
101+
echo "--- before ---" >&2
102+
echo "$before" >&2
103+
echo "--- after ---" >&2
104+
echo "$after" >&2
105+
FAILED=1
106+
fi
107+
}
108+
109+
# Where each exported variable points inside a repository, as a hook sees it.
110+
git_env_suffix() {
111+
case "$1" in
112+
GIT_WORK_TREE) printf '' ;;
113+
GIT_INDEX_FILE) printf '/.git/index' ;;
114+
*) printf '/.git' ;;
115+
esac
116+
}
117+
118+
check_variant git-dir GIT_DIR
119+
check_variant hook-env GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_COMMON_DIR
120+
121+
if [ "$FAILED" -ne 0 ]; then
122+
exit 1
123+
fi
124+
echo "PASS: test runner ignores an inherited git repository environment (#2003)."

‎tests/test_helpers.h‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -226,4 +226,37 @@ static inline void th_cleanup(const char *path) {
226226
}
227227
}
228228

229+
/* ── Inherited git repository environment (#2003) ─────────────── */
230+
231+
/* Git exports repository-local variables into hooks (GIT_DIR, GIT_INDEX_FILE,
232+
* ...), and they take precedence over `git -C <dir>`. A test runner started
233+
* from a pre-commit hook (or any shell with GIT_DIR set) would otherwise point
234+
* every fixture's git command at the caller's real repository: branches and
235+
* worktrees get created there and fixture assertions fail. This is the list
236+
* `git rev-parse --local-env-vars` prints; runners clear it once at startup so
237+
* every spawned git (and every re-exec'd child) scopes to its fixture. */
238+
static const char *const th_git_repo_env_vars[] = {
239+
"GIT_ALTERNATE_OBJECT_DIRECTORIES",
240+
"GIT_CONFIG",
241+
"GIT_CONFIG_PARAMETERS",
242+
"GIT_CONFIG_COUNT",
243+
"GIT_OBJECT_DIRECTORY",
244+
"GIT_DIR",
245+
"GIT_WORK_TREE",
246+
"GIT_IMPLICIT_WORK_TREE",
247+
"GIT_GRAFT_FILE",
248+
"GIT_INDEX_FILE",
249+
"GIT_NO_REPLACE_OBJECTS",
250+
"GIT_REPLACE_REF_BASE",
251+
"GIT_PREFIX",
252+
"GIT_SHALLOW_FILE",
253+
"GIT_COMMON_DIR",
254+
};
255+
256+
static inline void th_clear_git_repo_env(void) {
257+
for (size_t i = 0U; i < sizeof(th_git_repo_env_vars) / sizeof(th_git_repo_env_vars[0]); i++) {
258+
(void)cbm_unsetenv(th_git_repo_env_vars[i]);
259+
}
260+
}
261+
229262
#endif /* TEST_HELPERS_H */

‎tests/test_main.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1028,6 +1028,9 @@ extern void suite_dump_verify_io(void);
10281028
extern void cbm_kind_in_set_free_cache(void);
10291029

10301030
int main(int argc, char **argv) {
1031+
/* #2003: never let a caller's GIT_DIR/GIT_INDEX_FILE/... redirect fixture
1032+
* git commands at the caller's real repository. */
1033+
th_clear_git_repo_env();
10311034
int memory_limit_probe_rc = tf_maybe_run_windows_memory_limit_probe(argc, argv);
10321035
if (memory_limit_probe_rc >= 0) {
10331036
return memory_limit_probe_rc;

0 commit comments

Comments
 (0)