fix(ci): ignore graft files during source ancestry verification

Author: codex

docs/upstream-sync/ci-policy.md

@@ -42,7 +42,7 @@ documents, and tags.
 `scripts/ci/check-sync-ancestry.py --checkpoint SHA --target SHA --merge SHA`
 requires full commit IDs, resolves each exact object, proves checkpoint is an
 ancestor of the pinned upstream target, and proves the checkpoint is an exact non-first parent of the integration
-merge. Early batches do not need to contain the final campaign target. Git replacement refs are disabled
+merge. Early batches do not need to contain the final campaign target. Git replacement refs and graft files are disabled
 for these graph checks, so a synthetic replacement cannot manufacture the
 ancestry claim. The helper is local/manual and does not run hosted Actions.
 Jenkins runs its self-test, which constructs true and replacement-ref-faked
@@ -58,7 +58,7 @@ python3 scripts/ci/check-github-actions-policy.py
 python3 scripts/ci/test_github_actions_policy.py
   Ran 4 tests; OK (real workflows plus positive/negative fixtures)
 python3 scripts/ci/test_sync_ancestry.py
-  Ran 5 tests; OK (early checkpoint, exact parent, replacement-ref spoof, invalid inputs)
+  Ran 6 tests; OK (early checkpoint, exact parent, replacement/graft spoof, invalid inputs)
 git diff --check
   passed
 ```

scripts/ci/check-sync-ancestry.py

@@ -7,9 +7,10 @@
 import sys
 
 
+GIT_ENV = os.environ | {"GIT_NO_REPLACE_OBJECTS": "1", "GIT_GRAFT_FILE": os.devnull}
+
 def git(*args: str) -> str:
-    env = os.environ | {"GIT_NO_REPLACE_OBJECTS": "1"}
-    return subprocess.check_output(["git", *args], text=True, stderr=subprocess.PIPE, env=env).strip()
+    return subprocess.check_output(["git", *args], text=True, stderr=subprocess.PIPE, env=GIT_ENV).strip()
 
 
 def exact_commit(value: str) -> str:
@@ -26,7 +27,7 @@ def verify(checkpoint: str, target: str, merge: str) -> None:
     target = exact_commit(target)
     merge = exact_commit(merge)
     if subprocess.run(["git", "merge-base", "--is-ancestor", checkpoint, target],
-                      env=os.environ | {"GIT_NO_REPLACE_OBJECTS": "1"}, check=False).returncode:
+                      env=GIT_ENV, check=False).returncode:
         raise ValueError("checkpoint is not an ancestor of pinned target")
     parents = git("rev-list", "--parents", "-n", "1", merge).split()[1:]
     if len(parents) < 2:

scripts/ci/test_sync_ancestry.py

@@ -6,6 +6,7 @@
 import subprocess
 import tempfile
 import unittest
+from unittest import mock
 
 SCRIPT = Path(__file__).with_name("check-sync-ancestry.py")
 SPEC = importlib.util.spec_from_file_location("sync_ancestry", SCRIPT)
@@ -71,6 +72,17 @@ def test_rejects_ancestor_claim_using_replacement_ref(self):
         with self.assertRaises(ValueError):
             ancestry.verify(self.base, unrelated, self.merge)
 
+    def test_rejects_grafted_merge_parent(self):
+        self.git("commit", "--allow-empty", "-qm", "ordinary commit")
+        ordinary = self.git("rev-parse", "HEAD")
+        graft = self.repo / ".git" / "info" / "grafts"
+        graft.write_text(f"{ordinary} {self.base} {self.target}\n")
+        with self.assertRaises(ValueError):
+            ancestry.verify(self.target, self.target, ordinary)
+        with mock.patch.dict(os.environ, {"GIT_GRAFT_FILE": str(graft)}):
+            with self.assertRaises(ValueError):
+                ancestry.verify(self.target, self.target, ordinary)
+
     def test_rejects_non_merge_result_and_abbreviated_sha(self):
         with self.assertRaises(ValueError):
             ancestry.verify(self.base, self.target, self.target)