From 15c4731037494ab5ad39a0893257a1638b18bc47 Mon Sep 17 00:00:00 2001 From: karanb192 Date: Thu, 20 Aug 2026 09:52:41 +0530 Subject: [PATCH] test(guard-pack): isolate the hook child from the runner's git branch The env-passthrough test asserts a default-mode force-push to a feature branch returns {} (allowed), but git-safety's push-on-protected guard reads the current branch via git in process.cwd(). runHook spawned the child without a cwd, so it inherited the runner's working dir. On push-to-main CI runs HEAD is main, the guard fired, and the test saw a deny instead of {}. PR runs checked out a detached merge ref, so they stayed green and the failure only ever showed on pushes to main. Spawn the child in the isolated TMP_HOME (not a git repo), so branchOnly guards read '' for the branch regardless of where CI is sitting. Test-only; git-safety's production behavior is unchanged (in real use the hook process cwd is the project dir). Full suite 1584/0 with HEAD on main, the exact condition that was failing. --- plugins/guard-pack/tests/guard-pack.test.js | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/plugins/guard-pack/tests/guard-pack.test.js b/plugins/guard-pack/tests/guard-pack.test.js index 75f596d..720f991 100644 --- a/plugins/guard-pack/tests/guard-pack.test.js +++ b/plugins/guard-pack/tests/guard-pack.test.js @@ -31,7 +31,10 @@ function runHook(payload, envOverrides = {}) { delete env[key]; } } - const child = spawn('node', [SCRIPT_PATH], { env }); + // cwd is the isolated TMP_HOME (not a git repo) so branchOnly guards like + // git-safety's push-on-protected read '' for the branch instead of leaking + // in whatever branch CI happens to be on (push-to-main runs were HEAD=main). + const child = spawn('node', [SCRIPT_PATH], { env, cwd: TMP_HOME }); let stdout = ''; let stderr = ''; child.stdout.on('data', (d) => { stdout += d; });