fix: harden pre-push against GIT_DIR-leak core.bare corruption (#2984) - #18
Merged
Conversation
* [wip] claim work on fix-core-bare-gitdir-leak * fix: gate the GIT_DIR-leak core.bare corruption class at pre-push Scrub hook-exported GIT_* in both pre-push hooks before any step runs, heal a pre-existing core.bare=true loudly at hook start, and fail the push (restoring the config) when core.bare flips mid-run. Fix the live writer (select-beta-to-promote.test.mjs fixture helper, introduced by PR 2957) with gitCleanEnv, widen gitCleanEnv to the root 8-var scrub list, and scrub the latent sites (guard-branch-switch and resolve-subtree-dirs shell fixtures, sync-open-knowledge-upstream, lume-patch apply.sh, visimer bridge fork). Add check:git-env-scrub, a zero-dep gate over hook-reachable script trees that also pins the hook scrub lines, with bidirectional self-tests, and Fixture D behavioral tests running the real hooks under a poisoned GIT_DIR. Document the symptom playbook in CI_RUNBOOK and the incident audit in public/open-knowledge/reports/core-bare-corruption-audit. * review: fix scrub comments, warn on unreadable scan dirs Correct the lume-patch scrub comment (clone, not init), enumerate all scrub-helper copies from the authoritative GIT_SCRUB_VARS comment, and make the scanner warn on non-ENOENT directory read errors instead of silently skipping. * review: mirror git-clean-env.mjs, fix guard comment, merge caller env Add git-clean-env.mjs to the public-open-knowledge Copybara allowlist (the mirrored release scripts now import it; without the entry the public repo's promote-stable and select-beta workflows would fail at module load) and regenerate the config. Correct the core_bare_is_true guard comment (the missing-config branch is deliberately not-corrupt, not fail-closed), merge caller env before the scrub in cc-task runChild, and fix a stale fixture count in the gate self-test docs. * review: verify steps fire after heal, enumerate bridge scrub copies Fixture D's heal test now asserts all six step sentinels fired after the repair (healing must let the run proceed), and the GIT_SCRUB_VARS sync comment enumerates the two bridge-script inline destructures alongside the four named helpers. GitOrigin-RevId: 05cc8f04e8311cfbe93fd73909b8bfe09f31334a
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Copybara-translated 1 Inkeep OSS change. Rebase-merge this PR so the prepared commit lands directly on public main.