[ogenstad]

Why

GitRepo in infrahub_sdk.testing.repository creates the Git repositories that tests add to Infrahub as remotes. It creates them as the user that runs the tests, and the copy of src_directory keeps the permissions of the source. When the Infrahub containers that mount these repositories run as another user, for example when pytest runs as root and the containers do not:

• the containers cannot read a repository copied from a private directory, such as one from pytest's tmp_path (mode 0700), and fail with "does not appear to be a git repository"
• the containers cannot push to any of the repositories, and the push fails with "unpacker error"

The goal is to let a test create repositories that the containers can read and push to, without changing anything for existing callers.

What changed

• GitRepo has a new shared field, False by default.
• With shared=True, GitRepo.init gives every user read and write access to the repository after the first commit:
  • It sets core.sharedRepository to 0666, so that Git creates the files of a later commit or push with the same access.
  • It gives every user read and write access to the folders and files that exist already. Dulwich, which GitRepo uses to create the repository, does not apply core.sharedRepository itself.
  • It does not change symbolic links.
• With the default, shared=False, the behavior is the same as before. The new field is the last field of the dataclass, so callers that pass the other fields by position are not affected.

How to review

• infrahub_sdk/testing/repository.py: the new field and GitRepo._share.
• tests/unit/sdk/test_repository.py: one test checks that the default keeps the permissions of a private source, and one checks the permissions and the Git setting with shared=True.

How to test

uv run pytest tests/unit/sdk/test_repository.py

The unit tests check the permissions, but cannot run Git as a second user. The end-to-end check is running the Infrahub E2E tests that push to these repositories with the containers and pytest running as different users. This PR stays a draft until that check has passed.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying infrahub-sdk-python with    Cloudflare Pages

Latest commit:	7bf7df0
Status:	✅  Deploy successful!
Preview URL:	https://c2b8b652.infrahub-sdk-python.pages.dev
Branch Preview URL:	https://pog-em-gitrepo-shared-access.infrahub-sdk-python.pages.dev

View logs

[codecov]

Codecov Report

❌ Patch coverage is 86.36364% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
infrahub_sdk/testing/repository.py	86.36%	1 Missing and 2 partials ⚠️

@@                  Coverage Diff                   @@
##           infrahub-release-1.12    #1470   +/-   ##
======================================================
  Coverage                  87.74%   87.74%           
======================================================
  Files                        155      155           
  Lines                      15517    15539   +22     
  Branches                    2085     2091    +6     
======================================================
+ Hits                       13615    13635   +20     
+ Misses                      1345     1344    -1     
- Partials                     557      560    +3     

Flag	Coverage Δ
integration-tests	42.48% <18.18%> (-0.04%)	⬇️
python-3.10	62.58% <86.36%> (+0.04%)	⬆️
python-3.11	62.58% <86.36%> (+0.04%)	⬆️
python-3.12	62.58% <86.36%> (+0.04%)	⬆️
python-3.13	62.57% <86.36%> (+0.04%)	⬆️
python-3.14	62.57% <86.36%> (+0.02%)	⬆️
python-3.15	62.57% <86.36%> (+0.02%)	⬆️
python-filler-3.12	23.12% <0.00%> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
infrahub_sdk/testing/repository.py	81.17% <86.36%> (+3.39%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="infrahub_sdk/testing/repository.py">

<violation number="1" location="infrahub_sdk/testing/repository.py:95">
P2: This only chmods the repository tree; a private `dst_directory` or ancestor still blocks other users from traversing to it. Under a mode-0700 temporary parent, `shared=True` therefore still fails for the other container user; make the path traversable or document this requirement.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: This only chmods the repository tree; a private dst_directory or ancestor still blocks other users from traversing to it. Under a mode-0700 temporary parent, shared=True therefore still fails for the other container user; make the path traversable or document this requirement.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At infrahub_sdk/testing/repository.py, line 95:

<comment>This only chmods the repository tree; a private `dst_directory` or ancestor still blocks other users from traversing to it. Under a mode-0700 temporary parent, `shared=True` therefore still fails for the other container user; make the path traversable or document this requirement.</comment>

<file context>
@@ -75,6 +78,33 @@ def init(self) -> None:
+        config.write_to_path()
+
+        root_directory = self.dst_directory / self.name
+        root_directory.chmod(0o777)
+        for root, directories, files in os.walk(root_directory):
+            for directory in directories:
</file context>