Mos
92a63e7027
ci/woodpecker/pr/ci Pipeline was canceled
be-coder-07 (#1089 review 131) showed the precondition guard exited 0 when the scratch dir turned out to be inside a git worktree: ( cd "$TMP" && git rev-parse --git-dir ) && { echo "SKIP"; exit 0; } so pointing TMPDIR beneath a git worktree made this test PASS against unchanged main. A skip that exits 0 is indistinguishable from a pass -- the same defect this suite exists to catch, in the suite itself. Now: set GIT_CEILING_DIRECTORIES to the PHYSICAL path (it is matched physically, and /tmp is commonly a symlink, so a logical path silently disables the ceiling), and if the outside-a-repo precondition still cannot be established, FAIL with an explicit message rather than skipping. Replaying be-coder-07's attack (TMPDIR beneath a worktree): before: fix rc=0, main rc=0 <- both "pass", the vulnerability after: fix rc=1, main rc=1 <- both refuse; no false pass either way Normal conditions are unchanged and still discriminate: fix rc=0, main rc=1. The test refuses to report a result it cannot establish. That is weaker than running under a hostile TMPDIR and strictly better than lying about it. Reported-by: be-coder-07