populate: refer to flakes as git+file: only with a usable .git

Writing the lock file of a git+file: flake, Nix runs Git, with the
repository's configuration and hooks, which may run commands.  A .git
in a source's directory can come from anywhere, e.g. one planted in a
materialized flake, or one a file source keeps.  So drawing inputs
refers to a flake as git+file: only if git_problems finds nothing wrong
with its .git directory, the way git sources check their work trees,
and else as path:.

lock-foreign-git plants a .git in a materialized flake and in a file
source that keeps it, whose configuration names an fsmonitor command.

1 files changed, 8 insertions, 3 deletions

diff --git a/pkgs/populate/src/sh.rs b/pkgs/populate/src/sh.rs
index f76a0f7..15da78c 100644
--- a/pkgs/populate/src/sh.rs
+++ b/pkgs/populate/src/sh.rs
@@ -812,14 +812,19 @@ use_state "$@"
 
     /// resolve PATH...: prints, for each PATH, what's there and where it
     /// resolves to, as two fields, each ending in a null byte.  The first
-    /// holds d if PATH is a directory, g if it has .git, s if it has
-    /// .gitmodules, and f if it has flake.nix.
+    /// holds d if PATH is a directory, g if it has a .git directory that
+    /// git_problems finds nothing wrong with, s if it has .gitmodules, and
+    /// f if it has flake.nix.  Nix runs Git in a git+file: flake, with the
+    /// repository's configuration and hooks, so it only gets such ones.
     pub const RESOLVE: &str = r#"
 for path; do
   resolved=$(readlink -f "$path") || resolved=
   flags=
   if test -d "$path"; then flags=${flags}d; fi
-  if test -e "$path"/.git; then flags=${flags}g; fi
+  if ! test -L "$path"/.git && test -d "$path"/.git; then
+    problems=$(git_problems "$path" 2>/dev/null) || problems=failed
+    if test -z "$problems"; then flags=${flags}g; fi
+  fi
   if test -e "$path"/.gitmodules; then flags=${flags}s; fi
   if test -e "$path"/flake.nix; then flags=${flags}f; fi
   printf '%s\0%s\0' "$flags" "$resolved"