From 8dfa3f18d42d852ece3f2d9cf1ae117acccc0b15 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 13 Nov 2026 21:09:17 +0000
Subject: populate: refer to flakes as git+file: only with a usable .git

Writing the lock file of a git+file: flake, Nix runs Git, with the
repository's configuration and hooks, which may run commands.  A .git
in a source's directory can come from anywhere, e.g. one planted in a
materialized flake, or one a file source keeps.  So drawing inputs
refers to a flake as git+file: only if git_problems finds nothing wrong
with its .git directory, the way git sources check their work trees,
and else as path:.

lock-foreign-git plants a .git in a materialized flake and in a file
source that keeps it, whose configuration names an fsmonitor command.
---
 tests/scenarios.nix | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

(limited to 'tests/scenarios.nix')

diff --git a/tests/scenarios.nix b/tests/scenarios.nix
index 5d08e2e..43b63b4 100644
--- a/tests/scenarios.nix
+++ b/tests/scenarios.nix
@@ -2187,6 +2187,51 @@ assert !(krops.isLocalTarget (targets.remote "/"));
         }
       ];
     }))
+    # A .git that a materialized flake got, and one that a file source
+    # keeps, which Nix uses for the git+file: URL of the flake there: writing
+    # its lock file, Nix runs Git, with that repository's configuration.
+    (s "lock-foreign-git" (let
+      elsewhere = "/var/krops-elsewhere";
+      sources = alt // {
+        x.flake-input = {
+          url = "/fixtures/top"; name = "dep"; inherit fetchOnTarget;
+          materialize = true;
+          inputs.inner.follows = "alt";
+        };
+        y.file = {
+          path = "/fixtures/filesrc";
+          deleteExcluded = false;
+          filters = [ { type = "exclude"; pattern = "/.git"; } ];
+          inputs.dep.follows = "alt";
+        };
+      };
+    in {
+      isolate = true;
+      prepare = ''
+        rm -fR ${elsewhere}
+        mkdir -p ${elsewhere}
+      '';
+      phases = [
+        {
+          inherit sources;
+          # Repositories tracking only flake.nix, so the lock file changes.
+          mutate = ''
+            for name in x y; do
+              git -C "$T"/$name init -q
+              git -C "$T"/$name add flake.nix
+              git -C "$T"/$name -c user.name=x -c user.email=x@x commit -q -m x
+              git -C "$T"/$name config core.fsmonitor "touch ${elsewhere}/ran; false"
+            done
+          '';
+        }
+        {
+          inherit sources;
+          check = ''
+            test ! -e ${elsewhere}/ran || fail "a command in a .git directory ran"
+          '';
+        }
+      ];
+    }))
     # A file in populate's state replaced by a symlink to a file outside.
     (s "state-key" (let
       sources.x.flake-input = {
-- 
cgit v1.3.1