[siracozmen01]

Problem

Studio runs git for its Changes tab with -C <game directory>, and its test sets up a throwaway repository the same way. Both gave git this process's whole environment. When GIT_DIR, GIT_WORK_TREE, GIT_INDEX_FILE or git's other repository variables are set, git works in the repository they name: -C only changes the working directory.

Git sets GIT_DIR for a hook it runs from a linked worktree. So the pre-push hook's tools/check.sh changed, pushed from a git worktree checkout, ran GitRunsOnlyInATrustedRepositoryAndNeverItsReadersPrograms against the engine's own repository: the test's git init, git config and commits wrote core.bare = true, a file monitor program, an external diff, two diff drivers and a test author into the engine's .git/config, and put two commits that delete every file on the worktree's branch. The test then failed and the push stopped. Studio started from a shell that exported GIT_DIR would do the same with an author's status, add and commit.

Fixes #224.

Change

• process::ChildSettings gains withheld: environment variables of this process a child is not given, by name, in any case on Windows, whose names ignore case. Every other variable is given as before.
• studio::gitRepositoryVariables() lists the variables git rev-parse --local-env-vars prints, the ones that tell git which repository, index, objects and settings to use. VersionControl starts git without them, so the game's directory is the repository git works in.
• The test's own git helper withholds them too.

Tests

• process: AChildIsNotGivenTheVariablesWithheldFromIt. A variable withheld by name reads as unset in the child, and another variable set beside it is given. On Windows the name is withheld in another case.
• studio: GitRunsOnlyInATrustedRepositoryAndNeverItsReadersPrograms now runs with GIT_DIR and GIT_WORK_TREE naming another directory, as a hook is started, and checks that nothing made that directory. Without the fix, it fails (see Verification).

Verification

• process's tests: 5 of 5, the new one among them.
• studio's Git cases: 2 of 2 with the fix. With the test's own git helper giving git the environment as before, GitRunsOnlyInATrustedRepositoryAndNeverItsReadersPrograms fails: its setup goes to the other directory, so the game's repository has no commit hook and the trusted commit leaves no marker (expected std::filesystem::exists(kMarks / "hook")).
• The pre-push hook's tools/check.sh changed passed on this branch, pushed from the main checkout.
• After the leak, rawframe-engine/.git/config was restored by hand to its clone's settings and the two stray commits were taken off the local branch; neither reached GitHub.

[siracozmen01]

Review at 3b2def5: no change needed, with one search not verified below. I read the code; I did not run it. Checks were still pending when I read them.

The list. gitRepositoryVariables() has the 15 names of git's own local_repo_env, which is what git rev-parse --local-env-vars prints and the set git itself clears when it moves into another repository: GIT_ALTERNATE_OBJECT_DIRECTORIES, GIT_CONFIG, GIT_CONFIG_PARAMETERS, GIT_CONFIG_COUNT, GIT_OBJECT_DIRECTORY, GIT_DIR, GIT_WORK_TREE, GIT_IMPLICIT_WORK_TREE, GIT_GRAFT_FILE, GIT_INDEX_FILE, GIT_NO_REPLACE_OBJECTS, GIT_REPLACE_REF_BASE, GIT_PREFIX, GIT_SHALLOW_FILE, GIT_COMMON_DIR. The variables a hook is given, GIT_DIR, GIT_INDEX_FILE and GIT_PREFIX (plus GIT_WORK_TREE in a worktree), are all in it. Withholding GIT_CONFIG_COUNT also turns off its GIT_CONFIG_KEY_n and GIT_CONFIG_VALUE_n pairs.

The others named in the request are rightly kept, since none of them picks a repository:

• GIT_CONFIG_GLOBAL, GIT_CONFIG_SYSTEM and GIT_CONFIG_NOSYSTEM choose the author's own user and system settings, the identity among them.
• GIT_CEILING_DIRECTORIES can only stop discovery, and -C already names the repository.
• GIT_NAMESPACE applies to fetch and push, not to status, add or commit.

Where git is started.

• In version_control.cpp the only process::Child::start is in VersionControl::start, which now passes the list.
• In version_control_test.cpp the only start is the git helper, which passes it too.
• Not verified: whether Studio or another test starts git anywhere else. Please grep modules/ (and tools/ if it matters) for Child::start, posix_spawn, CreateProcess, popen and system( whose program is git.

The process change.

• POSIX matches the name before the first = exactly.
• Windows matches with CompareStringOrdinal(..., TRUE) and skips a leading = for the per-drive entries.
• The new process test withholds rawframe_withheld against RAWFRAME_WITHHELD on Windows, so the case rule is exercised, and the variable set beside it is still given.

The Studio test sets GIT_DIR and GIT_WORK_TREE to a directory that does not exist, so it fails without either half of the fix:

• With the helper unfixed, the setup goes elsewhere (the body shows that case).
• With VersionControl unfixed, its git has no repository at GIT_DIR, so the trusted commit makes no hook marker and runAll does not count 2.
• !exists(kElsewhere) checks that nothing was made there.
• Both variables are cleared before the test returns.

The body has Problem, Change, Tests and Verification, and has no column-0 word( or type(scope): line.