In commit 11092ef as part of our response to CVE-2022-24826 we revised the "does not look in current directory for git with credential helper" test (which was first added in commit 10c4ffc to check for the issue in CVE-2021-21237) to use a new helper program which simulates a malicious Git executable.

In order to avoid invoking this executable while setting up our test conditions we generally remove it from the working directory as soon as possible, but we have to at least leave it there while running git add git.exe in order to add it to the current Git index. Therefore we now explicitly set the PATH environment variable before running this command to include a minimal set of necessary directories, specifically the ones for the real Git executable and our test Git LFS executable.

However, since in some cases our CI tests fail because git add wants to run a shell script and the sh.exe binary is not available in our restricted PATH, we add that binary's location to the PATH we use when running git add git.exe in this test. The specific error seen in some CI runs is as follows; the z.dat file is added to the index in a prior step:

mingw64/bin/git.exe add git.exe
error: cannot spawn sh: No such file or directory
error: cannot fork to run subprocess 'git-lfs filter-process'
fatal: z.dat: clean filter 'lfs' failed