Skip to content

agent_eval_tests: scrub GIT_DIR from fixture git spawns (hook-env escape, defense in depth) #504

Description

@justrach

Root cause found on release/v0.0.258 (fixed at the tier-1 layer in 87c8348): git exports GIT_DIR/GIT_PREFIX to hooks, and the fixture tests in src/agent_eval_tests.zig inherit them, so their 'git init/add/commit' in a tmpdir operated on the enclosing repo — re-marking the checkout bare (the recurring core.bare=true corruption), committing stray 'fixture' commits by 't t@example.com' onto the current branch (tmpdir treated as the work tree), and producing the hook-only 1-failed flake. eval-tier1.sh now unsets the family, but fixtureCmd (and the eval harness's own git spawns) should also pass a scrubbed child env so a direct 'GIT_DIR=… zig build test' can never escape either.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions