GitoxideLabs/gitoxide gix-v0.90.0

gix v0.90.0

on GitHub

New Features (BREAKING)

• add worktree locking and a lock override that preserves changes

  Expose Worktree::set_lock(Option<&BStr>) and worktree::Proxy::set_lock()
  so callers can protect linked worktrees from pruning, moving, or removal,
  including when their checkout is offline. Implement file handling in
  gix_worktree::set_lock(): preserve byte-oriented reasons, append Git's
  trailing newline when needed, and make unlocking idempotent. Reject the
  main worktree in the porcelain and avoid writing through lock-file symlinks.

  Previously Force::OverrideLock also discarded local changes and initialized
  submodules. Add Force::OverrideLockKeepChanges to bypass just the lock check,
  retaining status and submodule validation. This expands an exhaustive public
  enum, so adapt the Tix caller in the same commit; existing CLI force levels
  retain their behavior.

  Git reference: v2.56.0-116-g6de20f6092
  (6de20f6092dcf9bdb1c8efe03db4b70c82b423dd), builtin/worktree.c
  lock/unlock/removal, wrapper.c newline encoding, and
  t/t2403-worktree-move.sh. Git's worktree remove -ff bypasses both lock and
  cleanliness checks; the new mode deliberately permits bypassing only the lock.
  exposes a pre-existing unresolved with_fetch_options link in clone docs.

Test

• worktree removal with late writes to both roots Inject bounded writes through removal progress after scanning, proving that
  one-pass deletion leaves files while default retries finish.

Performance

• don't look for new packs before writing an object

Reverted (BREAKING)

• remove the obsolete max-performance-safe feature gix always uses zlib-rs, so the safe bundle no longer differs from
  max-performance. Make max-performance own the default cache setup and
  update defaults, cache tests, and developer commands. Downstream users of
  the removed name must select max-performance instead.

New Features

• add Submodule::resolved_url() for cloning
  Definitely went through the tests quickly, besides the usual
  'make it a shell script', but poked the URL resolution and Windows
  special cases.
  Some of the newly added drive-prefix tests are truly from another world,
  and I don't think I could ever have written those, for better or worse.

  Relative submodule URLs in .gitmodules refer to the superproject's
  upstream, even when that upstream uses ssh://, git://, or SCP syntax.
  Passing the existing Submodule::url() result directly to a clone treats
  ./ and ../ entries as local paths instead.

  Document url() as the raw configured accessor and add resolved_url()
  for cloning or fetching. Port Git's byte-oriented relative_url() rules
  from remote.c, select the current branch's remote or the default remote,
  and fall back to the superproject itself when the selected URL is missing.
  Make local paths absolute so the result does not depend on the caller's
  working directory. Honor configuration overrides as initialized URLs,
  avoiding a second remote-relative resolution of local URLs written by
  git submodule init.

  Validate transport and local URLs, traversal errors, default-remote
  selection, initialized overrides, unborn and bare repositories, and
  non-UTF-8 local paths in disposable repositories. Compare resolution with
  git submodule init; include native-separator coverage for Windows.

• expose selected global attribute paths

  Allow callers that retain detached diff results to track the attribute files
  selected by the repository. Reuse the existing resolver so permissions,
  configuration interpolation, fallback paths, and precedence stay consistent
  with the attribute stack.

  Return selected paths even when files are missing so their later creation can
  invalidate cached results. Per-directory attributes and info/attributes
  remain separate because their locations are already known to the caller.

• provide safe interrupt setup and handle SIGHUP

  Applications that only need the shared cancellation flag should not have to
  supply an unsafe signal callback. Add interrupt::init_handler_default() as a
  safe entry point while preserving the callback and grace policy of an existing
  registration, including when a UI runs inside the gix command.

  Treat Unix SIGHUP like the other termination signals so long-running work can
  observe cancellation and callers can restore terminal state before exiting.
  It previously bypassed the shared flag and terminated immediately. Repeated
  signals retain the existing forced-termination policy.

  Exercise all supported termination signals and nested safe registration in
  isolated subprocesses. Four interrupt tests pass with the feature enabled and
  two pass without it.

• add Remote::default_branch() to learn the default branch of a remote without connecting to it.
  git clone and git remote set-head record the default branch of a remote in the symbolic reference
  refs/remotes/<name>/HEAD, which points to the remote-tracking branch of that branch, like
  refs/remotes/origin/main. Since Git 2.48, git fetch also creates it if it's missing.

• make repository paths absolute without reloading

  Went through the tests quite quickly, thinking their are deep and thorough
  as usual.

  Relative repository paths depend on the process current directory. Changing it
  after opening a repository can redirect checkout validation, Git-link handling,
  HEAD and object reads, or index persistence away from the intended repository.

  Add Repository::make_paths_absolute() to anchor the selected Git directory,
  common directory, worktree, index, and object database to the CWD captured at
  opening. Unlike reload(), this keeps runtime configuration, reference namespaces,
  and in-memory objects. Join paths lexically so missing worktrees remain supported
  and destination symlinks are still rejected. Leave existing clones unchanged,
  avoid partial updates on failure, and make repeated calls a no-op.

  Recreate relative reference and object stores through their existing APIs.
  Reset caches carrying relative index paths or store-specific pack IDs while
  preserving outstanding snapshots.

  Use an anchored repository view for initial checkout, and anchor global attribute
  paths before optional-file metadata checks. Document the interpolation helper
  and its captured-directory behavior.

  Cover CWD changes, main and linked worktrees, bare repositories, missing checkouts,
  index overrides, retained runtime state, idempotence, and failed reconstruction.
  Include a Windows-only test for rejecting unresolved drive-relative index paths
  without partially updating the repository.

• separate linked worktree registration from checkout

  Skipped over the tests, knowing they are very detailed
  can be trusted by now.

  Add Repository::prepare_add_worktree() with consuming checkout and explicit
  persistence. Persisted repositories can run their initial checkout later, even
  after their checkout directory is removed, while failed unpersisted checkouts
  roll back their owned data.

Bug Fixes

• create SHA-256 repositories for object_hash: None in SHA-256-only builds
  Previously a SHA-1 repository was created that the same build couldn't open.
  Now None falls back to the build's default object format.

• respect section trust for filesystem path protections

  GHSA-q54r-jf2p-rfr2 reports that path-protection configuration did not
  respect the section filter used for security-relevant settings. Use the
  filter for core.protectHFS, core.protectNTFS, and
  gitoxide.core.protectWindows, including the latter's early read for the
  reference store. Keep platform defaults and boolean error handling intact.

  Read-only fixtures exercise local and worktree configuration, full and
  reduced trust, custom filters, trusted API overrides, and malformed
  values in strict and lenient mode. Before the fix, reduced-trust settings
  replaced the defaults and a rejected malformed Windows setting prevented
  opening. Validation also exercises representative path names.

  Git baseline: the local Git reference identifies itself as v2.56.GIT.
  Its t/t1014-read-tree-confusing.sh and read-cache.c:verify_path_internal
  cover filesystem-specific path protections. Git's ownership policy in
  setup.c:ensure_valid_ownership rejects dubious ownership, whereas gix
  supports reduced trust by filtering configuration.

• match Git clone reference handling and preserve offline defaults

  The prior CI run failed check-mode because make_clone_refs.sh had a
  shebang without its executable bit. Its ARM32 tests also ran Git 2.47.3,
  which rejects clone --revision; the matrix mistook that unsupported
  option for a clone failure and disagreed with successful gix clones.

  Mark the fixture executable and detect revision support from git clone -h.
  Skip only revision baselines on older Git, retaining all 72 other cases
  and the independent gix revision tests. Modern Git still exercises all
  81 baseline cases. Capture help despite its expected nonzero exit status.

• match Git clone reference handling and preserve offline defaults

  gix clones recorded remote HEAD as a direct object ID, losing the
  branch relationship needed by later fetches and Remote::default_branch().
  Bare clones also used the ordinary remote-tracking layout, while detached
  remote heads and custom destinations selected different references from
  git clone.

  Match Git's clone orchestration and reference selection:

  • Store bare-clone branches in refs/heads/*, without a default persisted
    fetch refspec, tracking HEAD, or branch upstream configuration. Keep
    explicit refspecs persistent and use WithWorktree plus fetch_only()
    for ordinary clones without a checkout.
  • Select the advertised symbolic target or guess a branch matching a
    detached HEAD, preferring init.defaultBranch, then master, then the
    first matching branch by name. Record the selected branch's first mapped
    peer before updating local HEAD, including overwriting a branch named
    HEAD; omit tracking HEAD when the selected target is excluded.
  • Detach and peel tag and revision selections, check out the selected
    HEAD, and align shallow selection, tag policy, initial packed-reference
    reflogs, and persisted revision configuration with Git. Preserve the
    reference directory required for repository discovery.

  Preserve fetch-source identity when deriving an offline default branch.
  Recognize refs/heads/ sources and exact heads/<name> sources, including
  an exact source whose mapping was deduplicated against a glob. Return
  None for sources whose branch cannot be identified offline, count all
  ambiguous mappings, and share reverse mapping with upstream-branch lookup.

  Consult Git's builtin/clone.c and remote.c, and add deterministic
  Git-produced baselines for 27 cases in normal, no-checkout, and bare modes.
  Compare complete references, relevant configuration, reflog IDs, checkout
  contents, shallow boundaries, and success or failure with installed Git.
  Keep source fixtures read-only and read their existing refs through gix.
  Update API docs, CLI help and update printing, and affected clone/fetch tests.

  Known difference: replacing a direct branch named HEAD with the tracking
  symref logs a null old object ID in gix-ref; Git logs the resolved target.
  The baseline test explicitly checks this exception. Replacement-only custom
  refspecs remain a gix extension rather than being compared with Git's
  supplementary clone mappings.

• resolve linked worktree submodules in their private Git directory

  Git stores each linked superproject's submodule repositories under
  .git/worktrees/<id>/modules/<name>, separately from the main worktree's
  .git/modules/<name> repositories. Using common_dir() for
  Submodule::git_dir() could open the main worktree's submodule before
  initialization or after deinitialization of the linked submodule.

  Derive the path from the superproject's git_dir() instead. Preserve name
  validation and the precedence of an existing submodule .git file.

  Cover initial checkout, initialization, and deinitialization using Git to
  populate a disposable linked worktree created by gix. Check that the main
  submodule remains populated and that linked repository state and opening
  follow its own lifecycle.

• honor replacement refs and bypass stale commit graphs

  Enable standard replacement refs by default and honor core.useReplaceRefs
  with the same polarity as Git. The presence of GIT_NO_REPLACE_OBJECTS
  disables them regardless of its value.

  Commit graphs contain original parent links, so skip them while object
  replacements are active, including when a caller forces or supplies a
  cache. Per-handle raw reads can still use the graph. Document the corrected
  opening and graph behavior.

  The regression first failed on the original code, then passed for ordinary
  open/discovery in bare and non-bare repositories, reopening after a graft,
  configuration and environment disablement, explicit raw reads, supplied
  and forced graphs, merge-base, and graph removal. All 503 gix integration
  tests passed; the regression also passed with only revision,sha1 enabled.
  Native rebuilt gix log and tix show match Git across two grafts in both
  repository kinds with pre-existing raw graphs.

Commit Statistics

• 36 commits contributed to the release over the course of 14 calendar days.
• 14 days passed between releases.
• 16 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details