test(stack): stop the git fixtures inheriting the caller's repository

[patroza]

Why

The stack fixtures spawn git with the ambient environment. Git's repo-scoping variables — GIT_DIR, GIT_WORK_TREE and friends — override cwd when set, so a run inheriting them from a parent git process would have git init --bare <tmp> operate on the developer's real checkout instead: core.bare gets set on it, and git status / add / commit break until someone notices.

What

Scrub those variables before spawning, in both fixture helpers. This is the same precaution .githooks/pre-push already takes with git rev-parse --local-env-vars, hardcoded here so the fixture needs no working repository to discover the list.

How

Honest scope: this is hardening, not a diagnosed fix. A checkout did get core.bare set twice while I was working in this repository, and this was my hypothesis — but the experiment refutes it. Reverting the change and re-running the fixtures with GIT_DIR/GIT_WORK_TREE exported does not reproduce the corruption. The real trigger is still unidentified; prepare / install-git-hooks.mjs is the next place to look, since .git was modified at exactly those moments.

I'd rather ship this narrow and correctly described than let it carry a rationale I disproved.

It stands on its own terms regardless: a test fixture must not depend on the environment of whatever invoked it, and the ship gate runs vp run test, so hooks are a realistic caller.

Worth stating since it came up: --bare is not the problem and should not be removed. The fixtures need bare repos because git refuses to push into a non-bare checkout's current branch, and the tooling under test pushes to origin/upstream. It has nothing to do with force-push rules, which are server-side.

Remarks

Verified 38/38 pass normally; with GIT_DIR/GIT_WORK_TREE exported the fixtures no longer touch the real repository. The 19 failures that remain under those exported variables come from the production script inheriting them too — a separate question, and arguably it should fail loudly rather than silently act on the wrong repo.

Ownership: pnpm fork:overlay-owner resolves scripts/ to fork/changes.

🤖 Generated with Claude Code

[patroza]

Why

The stack fixtures spawn git with the ambient environment. Git's repo-scoping variables — GIT_DIR, GIT_WORK_TREE and friends — override cwd when set, so a run inheriting them from a parent git process would have git init --bare <tmp> operate on the developer's real checkout instead: core.bare gets set on it, and git status / add / commit break until someone notices.

What

Scrub those variables before spawning, in both fixture helpers. This is the same precaution .githooks/pre-push already takes with git rev-parse --local-env-vars, hardcoded here so the fixture needs no working repository to discover the list.

How

Honest scope: this is hardening, not a diagnosed fix. A checkout did get core.bare set twice while I was working in this repository, and this was my hypothesis — but the experiment refutes it. Reverting the change and re-running the fixtures with GIT_DIR/GIT_WORK_TREE exported does not reproduce the corruption. The real trigger is still unidentified; prepare / install-git-hooks.mjs is the next place to look, since .git was modified at exactly those moments.

I'd rather ship this narrow and correctly described than let it carry a rationale I disproved.

It stands on its own terms regardless: a test fixture must not depend on the environment of whatever invoked it, and the ship gate runs vp run test, so hooks are a realistic caller.

Worth stating since it came up: --bare is not the problem and should not be removed. The fixtures need bare repos because git refuses to push into a non-bare checkout's current branch, and the tooling under test pushes to origin/upstream. It has nothing to do with force-push rules, which are server-side.

Remarks

Verified 38/38 pass normally; with GIT_DIR/GIT_WORK_TREE exported the fixtures no longer touch the real repository. The 19 failures that remain under those exported variables come from the production script inheriting them too — a separate question, and arguably it should fail loudly rather than silently act on the wrong repo.

Ownership: pnpm fork:overlay-owner resolves scripts/ to fork/changes.

🤖 Generated with Claude Code

[patroza]

Why

The stack fixtures spawn git with the ambient environment. Git's repo-scoping variables — GIT_DIR, GIT_WORK_TREE and friends — override cwd when set, so a run inheriting them from a parent git process would have git init --bare <tmp> operate on the developer's real checkout instead: core.bare gets set on it, and git status / add / commit break until someone notices.

What

Scrub those variables before spawning, in both fixture helpers. This is the same precaution .githooks/pre-push already takes with git rev-parse --local-env-vars, hardcoded here so the fixture needs no working repository to discover the list.

How

Honest scope: this is hardening, not a diagnosed fix. A checkout did get core.bare set twice while I was working in this repository, and this was my hypothesis — but the experiment refutes it. Reverting the change and re-running the fixtures with GIT_DIR/GIT_WORK_TREE exported does not reproduce the corruption. The real trigger is still unidentified; prepare / install-git-hooks.mjs is the next place to look, since .git was modified at exactly those moments.

I'd rather ship this narrow and correctly described than let it carry a rationale I disproved.

It stands on its own terms regardless: a test fixture must not depend on the environment of whatever invoked it, and the ship gate runs vp run test, so hooks are a realistic caller.

Worth stating since it came up: --bare is not the problem and should not be removed. The fixtures need bare repos because git refuses to push into a non-bare checkout's current branch, and the tooling under test pushes to origin/upstream. It has nothing to do with force-push rules, which are server-side.

Remarks

Verified 38/38 pass normally; with GIT_DIR/GIT_WORK_TREE exported the fixtures no longer touch the real repository. The 19 failures that remain under those exported variables come from the production script inheriting them too — a separate question, and arguably it should fail loudly rather than silently act on the wrong repo.

Ownership: pnpm fork:overlay-owner resolves scripts/ to fork/changes.

🤖 Generated with Claude Code

[patroza]

Why

The stack fixtures spawn git with the ambient environment. Git's repo-scoping variables — GIT_DIR, GIT_WORK_TREE and friends — override cwd when set, so a run inheriting them from a parent git process would have git init --bare <tmp> operate on the developer's real checkout instead: core.bare gets set on it, and git status / add / commit break until someone notices.

What

Scrub those variables before spawning, in both fixture helpers. This is the same precaution .githooks/pre-push already takes with git rev-parse --local-env-vars, hardcoded here so the fixture needs no working repository to discover the list.

How

Honest scope: this is hardening, not a diagnosed fix. A checkout did get core.bare set twice while I was working in this repository, and this was my hypothesis — but the experiment refutes it. Reverting the change and re-running the fixtures with GIT_DIR/GIT_WORK_TREE exported does not reproduce the corruption. The real trigger is still unidentified; prepare / install-git-hooks.mjs is the next place to look, since .git was modified at exactly those moments.

I'd rather ship this narrow and correctly described than let it carry a rationale I disproved.

It stands on its own terms regardless: a test fixture must not depend on the environment of whatever invoked it, and the ship gate runs vp run test, so hooks are a realistic caller.

Worth stating since it came up: --bare is not the problem and should not be removed. The fixtures need bare repos because git refuses to push into a non-bare checkout's current branch, and the tooling under test pushes to origin/upstream. It has nothing to do with force-push rules, which are server-side.

Remarks

Verified 38/38 pass normally; with GIT_DIR/GIT_WORK_TREE exported the fixtures no longer touch the real repository. The 19 failures that remain under those exported variables come from the production script inheriting them too — a separate question, and arguably it should fail loudly rather than silently act on the wrong repo.

Ownership: pnpm fork:overlay-owner resolves scripts/ to fork/changes.

🤖 Generated with Claude Code

[patroza]

Why

The stack fixtures spawn git with the ambient environment. Git's repo-scoping variables — GIT_DIR, GIT_WORK_TREE and friends — override cwd when set, so a run inheriting them from a parent git process would have git init --bare <tmp> operate on the developer's real checkout instead: core.bare gets set on it, and git status / add / commit break until someone notices.

What

Scrub those variables before spawning, in both fixture helpers. This is the same precaution .githooks/pre-push already takes with git rev-parse --local-env-vars, hardcoded here so the fixture needs no working repository to discover the list.

How

Honest scope: this is hardening, not a diagnosed fix. A checkout did get core.bare set twice while I was working in this repository, and this was my hypothesis — but the experiment refutes it. Reverting the change and re-running the fixtures with GIT_DIR/GIT_WORK_TREE exported does not reproduce the corruption. The real trigger is still unidentified; prepare / install-git-hooks.mjs is the next place to look, since .git was modified at exactly those moments.

I'd rather ship this narrow and correctly described than let it carry a rationale I disproved.

It stands on its own terms regardless: a test fixture must not depend on the environment of whatever invoked it, and the ship gate runs vp run test, so hooks are a realistic caller.

Worth stating since it came up: --bare is not the problem and should not be removed. The fixtures need bare repos because git refuses to push into a non-bare checkout's current branch, and the tooling under test pushes to origin/upstream. It has nothing to do with force-push rules, which are server-side.

Remarks

Verified 38/38 pass normally; with GIT_DIR/GIT_WORK_TREE exported the fixtures no longer touch the real repository. The 19 failures that remain under those exported variables come from the production script inheriting them too — a separate question, and arguably it should fail loudly rather than silently act on the wrong repo.

Ownership: pnpm fork:overlay-owner resolves scripts/ to fork/changes.

🤖 Generated with Claude Code

[patroza]

Why

The stack fixtures spawn git with the ambient environment. Git's repo-scoping variables — GIT_DIR, GIT_WORK_TREE and friends — override cwd when set, so a run inheriting them from a parent git process would have git init --bare <tmp> operate on the developer's real checkout instead: core.bare gets set on it, and git status / add / commit break until someone notices.

What

Scrub those variables before spawning, in both fixture helpers. This is the same precaution .githooks/pre-push already takes with git rev-parse --local-env-vars, hardcoded here so the fixture needs no working repository to discover the list.

How

Honest scope: this is hardening, not a diagnosed fix. A checkout did get core.bare set twice while I was working in this repository, and this was my hypothesis — but the experiment refutes it. Reverting the change and re-running the fixtures with GIT_DIR/GIT_WORK_TREE exported does not reproduce the corruption. The real trigger is still unidentified; prepare / install-git-hooks.mjs is the next place to look, since .git was modified at exactly those moments.

I'd rather ship this narrow and correctly described than let it carry a rationale I disproved.

It stands on its own terms regardless: a test fixture must not depend on the environment of whatever invoked it, and the ship gate runs vp run test, so hooks are a realistic caller.

Worth stating since it came up: --bare is not the problem and should not be removed. The fixtures need bare repos because git refuses to push into a non-bare checkout's current branch, and the tooling under test pushes to origin/upstream. It has nothing to do with force-push rules, which are server-side.

Remarks

Verified 38/38 pass normally; with GIT_DIR/GIT_WORK_TREE exported the fixtures no longer touch the real repository. The 19 failures that remain under those exported variables come from the production script inheriting them too — a separate question, and arguably it should fail loudly rather than silently act on the wrong repo.

Ownership: pnpm fork:overlay-owner resolves scripts/ to fork/changes.

🤖 Generated with Claude Code

[patroza]

Why

The stack fixtures spawn git with the ambient environment. Git's repo-scoping variables — GIT_DIR, GIT_WORK_TREE and friends — override cwd when set, so a run inheriting them from a parent git process would have git init --bare <tmp> operate on the developer's real checkout instead: core.bare gets set on it, and git status / add / commit break until someone notices.

What

Scrub those variables before spawning, in both fixture helpers. This is the same precaution .githooks/pre-push already takes with git rev-parse --local-env-vars, hardcoded here so the fixture needs no working repository to discover the list.

How

Honest scope: this is hardening, not a diagnosed fix. A checkout did get core.bare set twice while I was working in this repository, and this was my hypothesis — but the experiment refutes it. Reverting the change and re-running the fixtures with GIT_DIR/GIT_WORK_TREE exported does not reproduce the corruption. The real trigger is still unidentified; prepare / install-git-hooks.mjs is the next place to look, since .git was modified at exactly those moments.

I'd rather ship this narrow and correctly described than let it carry a rationale I disproved.

It stands on its own terms regardless: a test fixture must not depend on the environment of whatever invoked it, and the ship gate runs vp run test, so hooks are a realistic caller.

Worth stating since it came up: --bare is not the problem and should not be removed. The fixtures need bare repos because git refuses to push into a non-bare checkout's current branch, and the tooling under test pushes to origin/upstream. It has nothing to do with force-push rules, which are server-side.

Remarks

Verified 38/38 pass normally; with GIT_DIR/GIT_WORK_TREE exported the fixtures no longer touch the real repository. The 19 failures that remain under those exported variables come from the production script inheriting them too — a separate question, and arguably it should fail loudly rather than silently act on the wrong repo.

Ownership: pnpm fork:overlay-owner resolves scripts/ to fork/changes.

🤖 Generated with Claude Code

[patroza]

Why

The stack fixtures spawn git with the ambient environment. Git's repo-scoping variables — GIT_DIR, GIT_WORK_TREE and friends — override cwd when set, so a run inheriting them from a parent git process would have git init --bare <tmp> operate on the developer's real checkout instead: core.bare gets set on it, and git status / add / commit break until someone notices.

What

Scrub those variables before spawning, in both fixture helpers. This is the same precaution .githooks/pre-push already takes with git rev-parse --local-env-vars, hardcoded here so the fixture needs no working repository to discover the list.

How

Honest scope: this is hardening, not a diagnosed fix. A checkout did get core.bare set twice while I was working in this repository, and this was my hypothesis — but the experiment refutes it. Reverting the change and re-running the fixtures with GIT_DIR/GIT_WORK_TREE exported does not reproduce the corruption. The real trigger is still unidentified; prepare / install-git-hooks.mjs is the next place to look, since .git was modified at exactly those moments.

I'd rather ship this narrow and correctly described than let it carry a rationale I disproved.

It stands on its own terms regardless: a test fixture must not depend on the environment of whatever invoked it, and the ship gate runs vp run test, so hooks are a realistic caller.

Worth stating since it came up: --bare is not the problem and should not be removed. The fixtures need bare repos because git refuses to push into a non-bare checkout's current branch, and the tooling under test pushes to origin/upstream. It has nothing to do with force-push rules, which are server-side.

Remarks

Verified 38/38 pass normally; with GIT_DIR/GIT_WORK_TREE exported the fixtures no longer touch the real repository. The 19 failures that remain under those exported variables come from the production script inheriting them too — a separate question, and arguably it should fail loudly rather than silently act on the wrong repo.

Ownership: pnpm fork:overlay-owner resolves scripts/ to fork/changes.

🤖 Generated with Claude Code