fix(builder): append the mirror mappings only after a plain inherited count

Moving inherited git config after the mirror mappings could not win
precedence anyway (git breaks insteadOf ties by the order the
destination base was registered, so a system or global rewrite still
wins) and added edge cases of its own. The mappings are appended after
the inherited entries again, without reading or moving them. They are
used only when GIT_CONFIG_COUNT is unset, empty, or a plain count of at
most four digits once one leading "+" and leading zeros are dropped;
otherwise the git configuration is left alone, the build log says the
sources are fetched without the mirror, and the build runs as it does
today.

An image whose own git configuration (system, global or environment)
already rewrites a declared repository's URL keeps its rewrite: git
prefers it, and the build fetches that source as it does without a
mirror.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: saurabhmaheshwari-obin

AGENTS.md

@@ -162,10 +162,10 @@ into `templates/factory/code/pyproject.toml.tmpl` yourself.
   A git source is declared in the recipe (`git_source_downloads`) by the URL
   exactly as `uv.lock` records it up to its query, which is what uv hands git;
   the caller fetches it with its own credentials and the Dockerfile maps that
-  URL onto the mirror, ahead of inherited git config. A normalized URL would
-  miss the mirror silently. A source core refuses, or whose URL begins an
-  undeclared locked one (insteadOf matches by prefix), is not declared or
-  rendered; a warning names the package and why, and the build fetches it.
+  URL onto the mirror; a normalized URL would miss it silently. A source core
+  refuses, or whose URL begins an undeclared locked one (insteadOf is a
+  prefix match), is not declared; a warning says why. An image whose own git
+  config already rewrites a declared URL keeps that rewrite (git prefers it).
 - **The runtime image is pinned.** `docker-image` rejects a bare name and
   `:latest`. The default `ghcr.io/codefly-dev/python` companion is built from
   core and pinned by the digest of its multi-platform index — prefer it. Its tag

templates/builder/Dockerfile.tmpl

@@ -58,22 +58,20 @@ ENV UV_PROJECT_ENVIRONMENT=/app/.venv \
 # With the caller's mirrors, git reads each locked repository from its mirror
 # instead of the URL the lock records (uv hands git that URL unchanged), so no
 # credential is needed, and a commit missing from the mirror fails here rather
-# than prompting for one. The mirror mappings take the first entries of git's
-# environment configuration, so they win over an inherited rewrite of the same
-# URL, and the entries the environment already carries (GIT_CONFIG_COUNT, read
-# as git reads it) move after them, read by name and never evaluated. A count
-# git would reject is left as it is, for git to reject as before.
+# than prompting for one. The mappings are appended after the git configuration
+# the environment already carries, when its GIT_CONFIG_COUNT is a plain count;
+# otherwise the configuration is left alone and the sources are fetched as
+# without a mirror. An image whose own git configuration (system, global or
+# environment) already rewrites a declared repository's URL keeps its rewrite:
+# git prefers it, and the build fetches that source as it does without a mirror.
 RUN --mount=type=bind,from=uvsources,target=/uvsources \
     if [ -n "$(ls -A /uvsources)" ]; then \
-      n=${GIT_CONFIG_COUNT:-0}; n=${n#+}; while [ "${n#0}" != "$n" ] && [ -n "${n#0}" ]; do n=${n#0}; done; \
-      case $n in ''|*[!0-9]*) ;; *) \
-        i=$n; while [ "$i" -gt 0 ]; do i=$((i-1)); \
-          eval "k=\${GIT_CONFIG_KEY_$i}"; eval "v=\${GIT_CONFIG_VALUE_$i}"; \
-          export "GIT_CONFIG_KEY_$((i+{{len .GitSources}}))=$k" "GIT_CONFIG_VALUE_$((i+{{len .GitSources}}))=$v"; \
-        done; \
-        export GIT_CONFIG_COUNT=$((n+{{len .GitSources}})) GIT_TERMINAL_PROMPT=0{{range $i, $source := .GitSources}} \
-          GIT_CONFIG_KEY_{{$i}}='url.file:///uvsources/{{$source.Path}}.insteadOf' GIT_CONFIG_VALUE_{{$i}}='{{$source.Repository}}'{{end}};; \
-      esac; \
+      n=${GIT_CONFIG_COUNT:-0}; n=${n#+}; \
+      case $n in ''|*[!0-9]*) n= ;; *) while [ "${n#0}" != "$n" ] && [ -n "${n#0}" ]; do n=${n#0}; done; [ ${#n} -le 4 ] || n= ;; esac; \
+      if [ -z "$n" ]; then echo "inherited GIT_CONFIG_COUNT is not a plain count; git sources are fetched without the mirror"; \
+      else export GIT_TERMINAL_PROMPT=0{{range $i, $source := .GitSources}} \
+        "GIT_CONFIG_KEY_$((n+{{$i}}))=url.file:///uvsources/{{$source.Path}}.insteadOf" "GIT_CONFIG_VALUE_$((n+{{$i}}))="'{{$source.Repository}}'{{end}} \
+        GIT_CONFIG_COUNT=$((n+{{len .GitSources}})); fi; \
     fi && \
     mkdir -p /opt/uv/python && uv sync --frozen --no-dev --no-install-project --no-editable
 {{- else}}

testdata/dockerfile/git-sources.golden

@@ -36,23 +36,21 @@ ENV UV_PROJECT_ENVIRONMENT=/app/.venv \
 # With the caller's mirrors, git reads each locked repository from its mirror
 # instead of the URL the lock records (uv hands git that URL unchanged), so no
 # credential is needed, and a commit missing from the mirror fails here rather
-# than prompting for one. The mirror mappings take the first entries of git's
-# environment configuration, so they win over an inherited rewrite of the same
-# URL, and the entries the environment already carries (GIT_CONFIG_COUNT, read
-# as git reads it) move after them, read by name and never evaluated. A count
-# git would reject is left as it is, for git to reject as before.
+# than prompting for one. The mappings are appended after the git configuration
+# the environment already carries, when its GIT_CONFIG_COUNT is a plain count;
+# otherwise the configuration is left alone and the sources are fetched as
+# without a mirror. An image whose own git configuration (system, global or
+# environment) already rewrites a declared repository's URL keeps its rewrite:
+# git prefers it, and the build fetches that source as it does without a mirror.
 RUN --mount=type=bind,from=uvsources,target=/uvsources \
     if [ -n "$(ls -A /uvsources)" ]; then \
-      n=${GIT_CONFIG_COUNT:-0}; n=${n#+}; while [ "${n#0}" != "$n" ] && [ -n "${n#0}" ]; do n=${n#0}; done; \
-      case $n in ''|*[!0-9]*) ;; *) \
-        i=$n; while [ "$i" -gt 0 ]; do i=$((i-1)); \
-          eval "k=\${GIT_CONFIG_KEY_$i}"; eval "v=\${GIT_CONFIG_VALUE_$i}"; \
-          export "GIT_CONFIG_KEY_$((i+2))=$k" "GIT_CONFIG_VALUE_$((i+2))=$v"; \
-        done; \
-        export GIT_CONFIG_COUNT=$((n+2)) GIT_TERMINAL_PROMPT=0 \
-          GIT_CONFIG_KEY_0='url.file:///uvsources/c9fa8363b851c2643d648edad1c8c7892904f717385511fe4771422d0817a55e.git.insteadOf' GIT_CONFIG_VALUE_0='https://git.example.invalid/acme/mono' \
-          GIT_CONFIG_KEY_1='url.file:///uvsources/d2b987abe743521016c33e82dba28324380629b9d2544f9e5213ee4299a3af6c.git.insteadOf' GIT_CONFIG_VALUE_1='ssh://git@git.example.invalid:2222/acme/tools.git';; \
-      esac; \
+      n=${GIT_CONFIG_COUNT:-0}; n=${n#+}; \
+      case $n in ''|*[!0-9]*) n= ;; *) while [ "${n#0}" != "$n" ] && [ -n "${n#0}" ]; do n=${n#0}; done; [ ${#n} -le 4 ] || n= ;; esac; \
+      if [ -z "$n" ]; then echo "inherited GIT_CONFIG_COUNT is not a plain count; git sources are fetched without the mirror"; \
+      else export GIT_TERMINAL_PROMPT=0 \
+        "GIT_CONFIG_KEY_$((n+0))=url.file:///uvsources/c9fa8363b851c2643d648edad1c8c7892904f717385511fe4771422d0817a55e.git.insteadOf" "GIT_CONFIG_VALUE_$((n+0))="'https://git.example.invalid/acme/mono' \
+        "GIT_CONFIG_KEY_$((n+1))=url.file:///uvsources/d2b987abe743521016c33e82dba28324380629b9d2544f9e5213ee4299a3af6c.git.insteadOf" "GIT_CONFIG_VALUE_$((n+1))="'ssh://git@git.example.invalid:2222/acme/tools.git' \
+        GIT_CONFIG_COUNT=$((n+2)); fi; \
     fi && \
     mkdir -p /opt/uv/python && uv sync --frozen --no-dev --no-install-project --no-editable
 

uv_git_sources_recipe_test.go

@@ -342,36 +342,45 @@ func runMapping(t *testing.T, lock string, env []string, script string) string {
 }
 
 // TestGitSourceMappingInTheBuilderImage runs the rendered mapping where it
-// runs: the mirror wins over an inherited rewrite of the same URL, inherited
-// entries survive whatever form their count takes, and a source left out of
-// the declaration is not rewritten by a mapping that begins it.
+// runs: appended after the git configuration the environment carries when its
+// count is plain, leaving that configuration alone otherwise, and never
+// rewriting a source left out of the declaration.
 func TestGitSourceMappingInTheBuilderImage(t *testing.T) {
 	if _, err := exec.LookPath("docker"); err != nil {
 		t.Skip("docker is not installed: the mapping cannot be run")
 	}
 	const mono = "https://git.example.invalid/acme/mono"
 	mirror := "file:///uvsources/" + services.GitSourceMirrorPath(mono)
-	t.Run("inherited rewrite of a declared URL", func(t *testing.T) {
-		out := runMapping(t, gitSourcesLock, []string{"GIT_CONFIG_COUNT=2",
-			"GIT_CONFIG_KEY_0=url.https://proxy.invalid/.insteadOf", "GIT_CONFIG_VALUE_0=" + mono,
-			"GIT_CONFIG_KEY_1=user.name", "GIT_CONFIG_VALUE_1=inherited $HOME `x` \"q\""},
-			"git ls-remote --get-url "+mono+" && git config --get user.name && git config --get url.https://proxy.invalid/.insteadOf && echo count=$GIT_CONFIG_COUNT")
-		require.Equal(t, mirror+"\ninherited $HOME `x` \"q\"\n"+mono+"\ncount=4\n", out)
-	})
-	for _, count := range []string{"01", "+1"} {
+	inherited := []string{"GIT_CONFIG_KEY_0=user.name", "GIT_CONFIG_VALUE_0=inherited"}
+	for _, count := range []string{"", "1", "01", "+1"} {
 		t.Run("count "+count, func(t *testing.T) {
-			out := runMapping(t, gitSourcesLock, []string{"GIT_CONFIG_COUNT=" + count, "GIT_CONFIG_KEY_0=user.name", "GIT_CONFIG_VALUE_0=inherited"},
-				"git ls-remote --get-url "+mono+" && git config --get user.name && echo count=$GIT_CONFIG_COUNT")
-			require.Equal(t, mirror+"\ninherited\ncount=3\n", out)
+			env := append([]string{"GIT_CONFIG_COUNT=" + count}, inherited...)
+			if count == "" {
+				env = nil
+			}
+			out := runMapping(t, gitSourcesLock, env, "git ls-remote --get-url "+mono+" && { git config --get user.name || true; } && echo count=$GIT_CONFIG_COUNT")
+			want := mirror + "\ninherited\ncount=3\n"
+			if count == "" {
+				want = mirror + "\ncount=2\n"
+			}
+			require.Equal(t, want, out)
 		})
 	}
-	t.Run("count 08", func(t *testing.T) {
-		env := []string{"GIT_CONFIG_COUNT=08"}
-		for i := 0; i < 8; i++ {
-			env = append(env, fmt.Sprintf("GIT_CONFIG_KEY_%d=test.k%d", i, i), fmt.Sprintf("GIT_CONFIG_VALUE_%d=v%d", i, i))
-		}
-		out := runMapping(t, gitSourcesLock, env, "git ls-remote --get-url "+mono+" && git config --get test.k0 && git config --get test.k7 && echo count=$GIT_CONFIG_COUNT")
-		require.Equal(t, mirror+"\nv0\nv7\ncount=10\n", out)
+	for _, count := range []string{" 1", "-0", "99999", "abc"} {
+		t.Run("count "+count, func(t *testing.T) {
+			env := append([]string{"GIT_CONFIG_COUNT=" + count}, inherited...)
+			out := runMapping(t, gitSourcesLock, env, `echo "count=[$GIT_CONFIG_COUNT] keys=$(env | grep -c '^GIT_CONFIG_KEY_') prompt=[$GIT_TERMINAL_PROMPT]"`)
+			require.Equal(t, "inherited GIT_CONFIG_COUNT is not a plain count; git sources are fetched without the mirror\ncount=["+count+"] keys=1 prompt=[]\n", out)
+		})
+	}
+	// The limitation, as it is today without a mirror: an image whose own git
+	// configuration rewrites a declared URL keeps its rewrite, which git
+	// prefers, so the source is fetched where the image says, not broken.
+	t.Run("inherited rewrite of a declared URL", func(t *testing.T) {
+		out := runMapping(t, gitSourcesLock, []string{"GIT_CONFIG_COUNT=1",
+			"GIT_CONFIG_KEY_0=url.https://proxy.invalid/.insteadOf", "GIT_CONFIG_VALUE_0=" + mono},
+			"git ls-remote --get-url "+mono+" && echo count=$GIT_CONFIG_COUNT")
+		require.Equal(t, "https://proxy.invalid/\ncount=3\n", out)
 	})
 	t.Run("an undeclared source the declared URL begins", func(t *testing.T) {
 		out := runMapping(t, lockWith(mono, mono+"@v1", "https://git.example.invalid/acme/tools"), nil,