[Defilan]

What

TestRemoteURL in pkg/foreman/agent/repo failed for contributors whose git configuration rewrites GitHub HTTPS URLs to SSH (a global url."git@github.com:".insteadOf rule), and the standard override GIT_CONFIG_GLOBAL=/dev/null did not help because runGit's minimal environment dropped it. Three changes:

• Clone now builds its env through baseEnv() instead of a hand-built HOME-only slice; it was the one git call site the forwarding did not reach.
• baseEnv() now forwards GIT_CONFIG_GLOBAL, GIT_CONFIG_SYSTEM and GIT_CONFIG_NOSYSTEM to the git subprocess when they are set (and non-empty). They hold file paths and flags, not credentials, so the no-secrets intent is unchanged. Empty values are skipped: git has no defined behavior for an empty filename, and /dev/null is the documented way to skip a level.
• The package's tests are now hermetic: TestMain pins HOME, XDG_CONFIG_HOME, GIT_CONFIG_GLOBAL, GIT_CONFIG_SYSTEM and GIT_CONFIG_NOSYSTEM to empty temp files, so a developer's ~/.gitconfig (or a shell-exported GIT_CONFIG_GLOBAL, which baseEnv now forwards) cannot change test results. GIT_CONFIG_NOSYSTEM=1 also covers a rewrite in /etc/gitconfig, which HOME cannot.

Why

Fixes #2013.

Defect class: a test reads ambient machine state (the developer's git configuration reaches git remote get-url through HOME), and the caller-controlled standard override for exactly that state is dropped by the minimal subprocess environment. Production is unaffected: the only caller, pushedRemoteMismatch (pkg/foreman/agent/executor_native.go), compares the repository name and gitRemoteOwnerRepo parses both the HTTPS and the scp-style SSH form.

How

• baseEnv() is the single composition point: every git path in the package (branch, clone, push, auth, RemoteURL) builds env = baseEnv() and appends Auth.Env(), so one forwarding point covers all call sites.
• An audit of every runGit call site (branch, commit, diff, push, clone) found no other hand-built env: git.go owns PATH, auth.go defines Auth.Env(), and every remaining caller derives from baseEnv(), so the composition-point claim above now covers every git path including Clone. The runGit doc comment's contract ("callers append HOME, GIT_*, and the Auth env via extraEnv") is preserved.
• Hermeticity is package-wide via TestMain, not per-test, so future tests inherit it. HOME and XDG_CONFIG_HOME alone are not enough once GIT_CONFIG_GLOBAL is forwarded: a shell-exported GIT_CONFIG_GLOBAL would re-leak, so all three location variables are pinned to empty files created in a temp dir.
• Verified against git's documented semantics (git(1), ENVIRONMENT): GIT_CONFIG_GLOBAL/GIT_CONFIG_SYSTEM replace the whole configuration level (setting one disables both standard files of that level; /dev/null skips it), and GIT_CONFIG_NOSYSTEM is documented for exactly this "predictable environment" use together with HOME and XDG_CONFIG_HOME. GIT_CONFIG_GLOBAL/SYSTEM date to git 2.32; older gits ignore the forwarded variables, which is harmless.

Tests

• TestRemoteURLGitConfigGlobalForwarding: sets an insteadOf rule in a temp global config, points GIT_CONFIG_GLOBAL at it, and expects RemoteURL to return the rewritten SSH URL. Fails on code that drops the variable (verified: RemoteURL(fork) = "https://github.com/Defilan/LLMKube.git", want the insteadOf-rewritten URL).
• TestBaseEnv: pins the subprocess contract. HOME only by default; the three variables forwarded verbatim when set; set-but-empty skipped; a sentinel secret and PATH never forwarded. Falsified by appending os.Environ() (secret, PATH and empty-value assertions all failed) and by dropping the empty-value guard (empty GIT_CONFIG_SYSTEM forwarded).
• TestGitEnvIsHermetic: pins TestMain itself (HOME under the OS temp dir, GIT_CONFIG_NOSYSTEM=1). Falsified by removing the Setenvs (HOME = "/Users/defilan", want a directory under .../T/).
• TestCloneGitConfigGlobalForwarding: clones through an insteadOf rule that rewrites the URL to a local bare repo and asserts the clone lands on the seeded commit. Falsified by reverting Clone to the hand-built env (git then fetches example.invalid literally and exits 128).
• TestRemoteURL unchanged; it is the detector for the reported bug. Reproduced before the fix with a hostile HOME containing the insteadOf rule (RemoteURL(fork) = "git@github.com:Defilan/LLMKube.git", want the fork URL; GIT_CONFIG_GLOBAL=/dev/null did not help) and the same hostile environment passes after the fix, along with a hostile GIT_CONFIG_GLOBAL.

Out of scope

Other git-exec sites outside this package (pkg/foreman/slicer/integrate.go, pkg/foreman/agent/tools/run_integrate.go, run_reconcile.go) do not use runGit/baseEnv and were left alone; #2013 scopes this fix to pkg/foreman/agent/repo.

AI assistance

Written by GLM-5.3-Flash NVFP4 (GLM-5.3-Flash, local inference on 3x NVIDIA GB10s running LLMKube) and reviewed and signed off by Christopher Maher.

Checklist

• Tests added/updated
• make test passes locally
• make lint passes locally
• Commit messages follow conventional commits
• All commits are signed off (git commit -s) per DCO
• AI assistance (if any) is disclosed above, per CONTRIBUTING.md
• Documentation updated (if user-facing change)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!