fix(git): stop native checkout/pull from running against the user's p… - #282
Open
Spelt wants to merge 1 commit into
Open
fix(git): stop native checkout/pull from running against the user's p…#282Spelt wants to merge 1 commit into
Spelt wants to merge 1 commit into
Conversation
…roject repo doClone and getWrapperFetch remove the module's .git link file when they finish, but CheckoutNative and PullNative later run plain "git checkout -f <ref>" / "git pull --force" with cwd set to modules/<dep>. Without a .git there, git walks up the directory tree, discovers the user's own project repository, and runs the command against it — silently switching the user's project to the dependency's branch (e.g. from development to master) and pulling it. Fix: - CheckoutNative and PullNative now write the .git link file (pointing at the cache git dir) before running, and remove it afterwards, same as getWrapperFetch already does for reset/fetch. - runCommand sets GIT_CEILING_DIRECTORIES to the modules dir so repo discovery can never escape into an enclosing repository, even if a .git link is missing for any other reason. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Project repo
doClone and getWrapperFetch remove the module's .git link file when they finish, but CheckoutNative and PullNative later run plain "git checkout -f " / "git pull --force" with cwd set to modules/. Without a .git there, git walks up the directory tree, discovers the user's own project repository, and runs the command against it — silently switching the user's project to the dependency's branch (e.g. from development to master) and pulling it.
Fix: