fix: strip GIT_* env from test process to prevent worktree corruption#383
Merged
tomasz-tomczyk merged 1 commit intomainfrom Apr 29, 2026
Merged
fix: strip GIT_* env from test process to prevent worktree corruption#383tomasz-tomczyk merged 1 commit intomainfrom
tomasz-tomczyk merged 1 commit intomainfrom
Conversation
testutil_test.go's runGit helper inherited GIT_DIR / GIT_INDEX_FILE /
GIT_WORK_TREE from os.Environ(). When `go test ./...` ran inside a git
hook (e.g. .githooks/pre-commit during `git commit`), every git op in
test helpers — including `git config user.email`, `git branch -M main`,
and the test's `git commit -m initial` — targeted the parent repo
instead of the test's t.TempDir(), corrupting the active worktree:
HEAD renamed to main, two stray "initial" commits authored by Test
<test@test.com>, local user identity overwritten, and (via tests that
do `git config core.worktree`) the bare repo's core.bare flipped to
false with a tmpdir worktree path.
Fix in two layers:
- init() in testutil_test.go strips GIT_* from the process env once,
before any test code (including production paths like NewSessionFromGit
that exec git internally) runs.
- runGit additionally filters GIT_* and HOME from cmd.Env each call —
defense-in-depth against tests that t.Setenv("GIT_DIR", ...) for
their own purposes, and to avoid duplicate-HOME ambiguity in cmd.Env.
TestGitEnvLeakStripped guards against regression: asserts init()
cleared the well-known vars and that runGit ignores a re-set GIT_DIR.
Also rewrites .config/wt.toml to use `wt step copy-ignored` in
post-start instead of hand-rolled cp -R of node_modules in pre-start —
copy-ignored handles all gitignored files, post-start doesn't block
worktree creation, and stable command strings keep wt's approval cache
valid across edits.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #383 +/- ##
==========================================
+ Coverage 66.58% 66.59% +0.01%
==========================================
Files 19 19
Lines 8176 8176
==========================================
+ Hits 5444 5445 +1
+ Misses 2310 2309 -1
Partials 422 422
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
tomasz-tomczyk
added a commit
that referenced
this pull request
Apr 29, 2026
…#383) testutil_test.go's runGit helper inherited GIT_DIR / GIT_INDEX_FILE / GIT_WORK_TREE from os.Environ(). When `go test ./...` ran inside a git hook (e.g. .githooks/pre-commit during `git commit`), every git op in test helpers — including `git config user.email`, `git branch -M main`, and the test's `git commit -m initial` — targeted the parent repo instead of the test's t.TempDir(), corrupting the active worktree: HEAD renamed to main, two stray "initial" commits authored by Test <test@test.com>, local user identity overwritten, and (via tests that do `git config core.worktree`) the bare repo's core.bare flipped to false with a tmpdir worktree path. Fix in two layers: - init() in testutil_test.go strips GIT_* from the process env once, before any test code (including production paths like NewSessionFromGit that exec git internally) runs. - runGit additionally filters GIT_* and HOME from cmd.Env each call — defense-in-depth against tests that t.Setenv("GIT_DIR", ...) for their own purposes, and to avoid duplicate-HOME ambiguity in cmd.Env. TestGitEnvLeakStripped guards against regression: asserts init() cleared the well-known vars and that runGit ignores a re-set GIT_DIR. Also rewrites .config/wt.toml to use `wt step copy-ignored` in post-start instead of hand-rolled cp -R of node_modules in pre-start — copy-ignored handles all gitignored files, post-start doesn't block worktree creation, and stable command strings keep wt's approval cache valid across edits. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
runGitintestutil_test.goinheritedGIT_DIR/GIT_INDEX_FILE/GIT_WORK_TREEfrom the parent process. When.githooks/pre-commitrango test ./...during a realgit commit, every git op inside test helpers targeted the parent repo instead of the test'st.TempDir()— silently corrupting the active worktree (HEAD renamed tomain, strayinitialcommits authored byTest <test@test.com>, localuser.email/nameoverwritten, and via tests thatgit config core.worktree, the bare repo'score.bareflipped tofalse).init()stripsGIT_*once (covers production paths likeNewSessionFromGitthat exec git internally);runGitalso filtersGIT_*andHOMEper-call as defense-in-depth.TestGitEnvLeakStrippedto guard against regression..config/wt.tomlto usewt step copy-ignoredinpost-startinstead of hand-rolledcp -Rofnode_modulesinpre-start— covers all gitignored files, doesn't block worktree creation, keeps wt's approval cache stable across edits.Test plan
go test ./... -count=1passes (~29s).git commitenv (GIT_DIR/GIT_INDEX_FILE/GIT_WORK_TREEset), thengo test -run 'TestNewSessionFromGitLazyThreshold'corrupted the worktree as described.bare = truepreserved, no user identity leak.git commit(this PR) ran the full pre-commit hook includinggo test ./...without corruption — the fix self-validates.TestGitEnvLeakStrippedpasses.wt switch --create some-branch --base mainand confirmwt step copy-ignoredpopulatesnode_modules/e2e/node_modulesfrom the primary worktree (may requirewt config approvals addto re-approve the new command string).🤖 Generated with Claude Code