Re: [PATCH] receive-pack: fix updateInstead with core.worktree

From: Junio C Hamano <gitster@pobox.com>
Date: May 25, 2026, 00:20 UTC
Message-ID: <xmqqfr3ggx1h.fsf@gitster.g>
In-Reply-To: <20260522154418.5883-1-hi@alyssa.is>

Alyssa Ross <hi@alyssa.is> writes:

> This used to work, but when push_to_checkout() started being called
> before push_to_deploy(), ...

We tend to try describing where things started breaking a bit more precisely. The above seems to say that you know that in the past push_to__checkout() was not called before push_to_deploy(), and it no longer is the case these days? Can you spell out in what commit that change happened (refer to the commit using the "git show -s --pretty=reference" format)? I.e.

	... but when X started doing Y at a8cc5943 (hooks: fix an
	obscure TOCTOU "did we just run a hook?" race, 2022-03-07),
	<<this bad thing>> started to happen.

It isn't really we are exercising "checkout" and "deploy" both at the same time, but an old commit started to always call _checkout only to see if that actually invokes the hook, and if it didn't, then call _deploy. The intent still is to use either one of these, but as you exactly identified what is wrong in the current code, the call to _checkout that is only done to probe if it is used at all started to contaminate the environment with that commit.

So this change ...

> -	strvec_pushf(env, "GIT_WORK_TREE=%s", absolute_path(work_tree));
>  	strvec_pushv(&opt.env, env->v);
> +	strvec_pushf(&opt.env, "GIT_WORK_TREE=%s", absolute_path(work_tree));
>  	strvec_push(&opt.args, hash_to_hex(hash));

... looks like absolutely the right thing to do.  And ...

Show 20 quoted lines

>  	if (run_hooks_opt(the_repository, push_to_checkout_hook, &opt))
>  		return "push-to-checkout hook declined";
> diff --git a/t/t5516-fetch-push.sh b/t/t5516-fetch-push.sh
> index 117cfa051f..f51fb11a6d 100755
> --- a/t/t5516-fetch-push.sh
> +++ b/t/t5516-fetch-push.sh
> @@ -1791,6 +1791,17 @@ test_expect_success 'updateInstead with push-to-checkout hook' '
>  	)
>  '
>  
> +test_expect_success 'denyCurrentBranch and core.worktree' '
> +	test_when_finished "rm -fr cloned cloned.git" &&
> +	git clone --separate-git-dir cloned.git . cloned &&
> +	git --git-dir cloned.git config receive.denyCurrentBranch updateInstead &&
> +	git --git-dir cloned.git config core.worktree "$PWD/cloned" &&
> +        test_commit raspberry &&
> +	git push cloned.git HEAD:main &&
> +	test_path_exists cloned/raspberry.t &&
> +	test_must_fail git push --delete cloned.git main
> +'

... a test that protects similar breakage in the future is also excellent.

Show 5 quoted lines

>  test_expect_success 'denyCurrentBranch and worktrees' '
>  	test_when_finished "rm -fr cloned && git worktree remove --force new-wt" &&
>  	git worktree add new-wt &&
>
> base-commit: aec3f587505a472db67e9462d0702e7d463a449d