Repository navigation
testidentity: no test identity reaches a commit, and no test's git the checkout - #104
Merged
Merged
Conversation
…e checkout Twice a test in spin wrote its author into the checkout's .git/config and every worktree committed as it, to GitHub. Two halves, the same as spin#1196's: - internal/gittest is how a test here runs git: under the temporary directory, with git's search stopped at the checkout and the temporary directory, no inherited GIT_ variable, no global or system configuration, and an author at go-tools.invalid. A package whose own code runs git fences its tests in TestMain. internal/gitexec's test fails on a test that runs git another way, and on such a package without the fence. mutate's TestTheLinesAChange... ran `git config user.email` in a fresh temp repository - safe until a hook's GIT_DIR or a lost init sends it to the checkout - and goes through gittest like the rest. - cmd/testidentity, released with the other commands so every repository runs it under `go tool task`: a commit since the base whose author or committer is at a reserved domain, has no dot, or is spelled in the tree's tests and fixtures, fails, with what to do. GitHub's noreply and bot addresses are real by rule; -allow is a ratchet with reasons. task lint runs it on this repository. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Nov 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to spin-stack/spin#1196. Twice a test in spin wrote
user.name "Ana Lima"/ana@corp.exampleinto a shared.git/config, and every worktree's commits carried it to GitHub. This makes that class impossible here and gives every repository the check.Tests here cannot reach the checkout's git
internal/gittest:Command/Runrun git only under the temporary directory, refuse-C/--git-dir/--work-tree, stop git's search at the temp root and the checkout (GIT_CEILING_DIRECTORIES), read no global or system config, drop every inheritedGIT_*(a hook'sGIT_DIR), and commit asgittest@go-tools.invalid.Fence()does the same for a package whose own code runs git, from itsTestMain.internal/mutate'sgit config user.email test@example.com: it ran in a fresh temp repo, so it was safe until a hook'sGIT_DIRor a lostinitsent it to the checkout. Ten packages whose code runs git now fence their tests. The site's CI example is copied into a repo of its own instead of being read in place.internal/gitexec: its test walks this module and fails on any test file that execs git itself, and on any package whose code runs git and whose tests don't fence it (spin's gitexec, ported).cmd/testidentity: the authors gate, for every repositoryBASE..HEAD(-base origin/main). It fails when a raw author or committer address is at a reserved domain (RFC 2606/6761 TLDs,.local,.internal,example.{com,net,org},home.arpa), has no dot, or appears in the tree's tests and fixtures (git ls-files: Go, JS/TS, Terraform tests, andtest(s)/,testdata/,fixtures/,e2e/,mocks/dirs).noreply@github.comaddresses pass by rule.-allowis a ratchet: every line needs a reason, and a line whose address no longer looks like a test's fails.go tool taskit is onPATH.task lintruns it on this repo. There is a site page.Checked:
task test,task lint,task mutate(92 refused, 0 survived),task site. The tests plant each failure: unfenced git, a TMPDIR inside the checkout, a hook's GIT_DIR, a commit by a test author or committer, a fixture address, a stale allow line, and a missing base.🤖 Generated with Claude Code