refactor(ci): centralize the GIT_* environment scrub and migrate its callers

python/test/setup_metadata_test.py

@@ -25,6 +25,7 @@
 if str(REPO_ROOT) not in sys.path:
     sys.path.insert(0, str(REPO_ROOT))
 
+from scripts.lib import git_env  # noqa: E402
 from scripts.lib.safe_subprocess import run as run_command  # noqa: E402
 
 PYPROJECT = REPO_ROOT / "python" / "pyproject.toml"
@@ -297,7 +298,7 @@ def _git_tree(root: Path, files: dict[str, str]) -> Path:
         (root / name).write_text(text, encoding="utf-8")
     # Without the caller's GIT_* variables: under a commit hook GIT_INDEX_FILE
     # (and GIT_DIR) would turn these commands into writes to the caller's index.
-    environment = {k: v for k, v in os.environ.items() if not k.startswith("GIT_")}
+    environment = git_env.drop()
     git = shutil.which("git")
     assert git is not None, "git is not on PATH"
     for command in (["init", "-q"], ["add", "-A"]):

scripts/ci/check-research-digest-ids.py

@@ -26,6 +26,7 @@
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
 
+from scripts.lib import git_env
 from scripts.lib.safe_subprocess import (
     BinaryCommandResult,
     CommandOutputLimitExceeded,
@@ -178,7 +179,7 @@ def load_baseline(path: Path) -> dict[str, Any]:
 
 
 def _git_environment() -> dict[str, str]:
-    env = {key: value for key, value in os.environ.items() if not key.startswith("GIT_")}
+    env = git_env.drop()
     env.update({"GIT_CONFIG_GLOBAL": os.devnull, "GIT_CONFIG_NOSYSTEM": "1", "LC_ALL": "C"})
     return env
 

scripts/ci/check_agent_copyright_rule.py

@@ -20,6 +20,7 @@
 ROOT = Path(__file__).resolve().parents[2]
 sys.path.insert(0, str(ROOT))
 
+from scripts.lib import git_env  # noqa: E402
 from scripts.lib.safe_subprocess import CommandOutputLimitExceeded  # noqa: E402
 from scripts.lib.safe_subprocess import run as run_command  # noqa: E402
 
@@ -43,7 +44,7 @@ def git_environment(root: Path) -> dict[str, str]:
     """
     if root.resolve() == ROOT.resolve():
         return dict(os.environ)
-    return {key: value for key, value in os.environ.items() if not key.startswith("GIT_")}
+    return git_env.drop()
 
 
 def tracked_rules(root: Path) -> list[str]:

scripts/ci/check_flawfinder_new.py

@@ -28,14 +28,14 @@
 import collections
 import csv
 import io
-import os
 import shutil
 import sys
 import tempfile
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
 
+from scripts.lib import git_env
 from scripts.lib.safe_subprocess import run as run_command
 
 # Every suffix pre-commit's `identify` maps to the hook's types_or (c, c++,
@@ -99,7 +99,7 @@ def findings(flawfinder: str, source: Path) -> list[tuple[int, str, str]]:
 def git_output(git: str, args: list[str], cwd: Path) -> tuple[int, str]:
     # Read-only git in `cwd`; the hook's GIT_DIR / GIT_INDEX_FILE are dropped so
     # `cwd` alone names the repository.
-    env = {k: v for k, v in os.environ.items() if not k.startswith("GIT_")}
+    env = git_env.drop()
     proc = run_command(
         [git, *args],
         allowed_executables=(git,),

scripts/ci/check_licence_metadata.py

@@ -50,6 +50,7 @@
 REPO_ROOT = Path(__file__).resolve().parents[2]
 sys.path.insert(0, str(REPO_ROOT))
 
+from scripts.lib import git_env  # noqa: E402
 from scripts.lib.safe_subprocess import (  # noqa: E402
     CommandTimedOut,
     CommandValidationError,
@@ -143,7 +144,7 @@ def git_environment(root: Path) -> dict[str, str]:
     caller's repository, so they are dropped."""
     if root.resolve() == REPO_ROOT.resolve():
         return dict(os.environ)
-    return {key: value for key, value in os.environ.items() if not key.startswith("GIT_")}
+    return git_env.drop()
 
 
 def tracked_files(root: Path, paths: list[Path]) -> set[Path]:

scripts/ci/check_render_on_master.py

@@ -29,7 +29,6 @@
 from __future__ import annotations
 
 import argparse
-import os
 import shutil
 import sys
 import tempfile
@@ -40,6 +39,7 @@
 REPO_ROOT = Path(__file__).resolve().parents[2]
 sys.path.insert(0, str(REPO_ROOT))
 
+from scripts.lib import git_env  # noqa: E402
 from scripts.lib.safe_subprocess import run as run_command  # noqa: E402
 
 # The files `make docs-render` writes; deliverables-check.sh keeps the same list
@@ -69,7 +69,7 @@ class Verdict:
 def git_environment() -> dict[str, str]:
     """The caller's environment without GIT_* variables, which would point git
     at another repository (a hook's, a test's)."""
-    return {key: value for key, value in os.environ.items() if not key.startswith("GIT_")}
+    return git_env.drop()
 
 
 def git(root: Path, *args: str) -> str:

scripts/ci/ffmpeg_patch_stack.py

@@ -23,6 +23,7 @@
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
 
+from scripts.lib import git_env
 from scripts.lib.safe_subprocess import CommandTimedOut
 from scripts.lib.safe_subprocess import run as run_command
 
@@ -159,7 +160,7 @@ def series(repo: Path) -> list[str]:
 
 def isolated_git_environment() -> dict[str, str]:
     """Caller environment without GIT_* (hooks export them; -C cannot override)."""
-    environment = {key: value for key, value in os.environ.items() if not key.startswith("GIT_")}
+    environment = git_env.drop()
     environment.update(
         LC_ALL="C",
         GIT_TERMINAL_PROMPT="0",

scripts/ci/lint-configured.py

@@ -13,7 +13,6 @@
 import concurrent.futures
 import hashlib
 import json
-import os
 import re
 import shlex
 import shutil
@@ -24,6 +23,7 @@
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
 
+from scripts.lib import git_env
 from scripts.lib.safe_subprocess import run as run_command
 
 SOURCE_SUFFIXES = {".c", ".cc", ".cpp", ".cxx", ".cu", ".hip", ".m", ".mm"}
@@ -39,7 +39,7 @@ def tracked_sources(root: Path) -> set[Path]:
         allowed_executables=(git,),
         check=True,
         capture_output=True,
-        env={key: value for key, value in os.environ.items() if not key.startswith("GIT_")},
+        env=git_env.drop(),
         timeout_seconds=60,
     )
     return {

scripts/ci/run_affected_suites.py

@@ -46,6 +46,7 @@
 sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
 
 from scripts.ci import suite_registry as registry_lib
+from scripts.lib import git_env
 from scripts.lib.safe_subprocess import CommandTimedOut, TextCommandResult
 from scripts.lib.safe_subprocess import run as run_command
 
@@ -83,7 +84,7 @@ class SuiteResult:
 
 def _env_without_git() -> dict[str, str]:
     drop = ("VIRTUAL_ENV", "PYTHONPATH", "PYTHONHOME")
-    return {k: v for k, v in os.environ.items() if not k.startswith("GIT_") and k not in drop}
+    return {k: v for k, v in git_env.drop().items() if k not in drop}
 
 
 def _git(root: Path, *args: str) -> str:

scripts/ci/scorecard_gate.py

@@ -28,6 +28,7 @@
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
 
+from scripts.lib import git_env
 from scripts.lib.safe_subprocess import run as run_command
 
 VERSION = "v5.6.0"
@@ -219,7 +220,7 @@ def assess(report: dict[str, object], scope: str, repository: str, sha: str) ->
 
 def git(root: Path, *args: str) -> bytes:
     # ADR-1239: neither -C nor temporary repositories isolate inherited GIT_*.
-    env = {key: value for key, value in os.environ.items() if not key.startswith("GIT_")}
+    env = git_env.drop()
     env.update(GIT_CONFIG_NOSYSTEM="1", GIT_CONFIG_GLOBAL=os.devnull)
     executable = shutil.which("git")
     if executable is None:

scripts/ci/suite_registry.py

@@ -48,6 +48,7 @@
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
 
+from scripts.lib import git_env
 from scripts.lib.safe_subprocess import CommandTimedOut
 from scripts.lib.safe_subprocess import run as run_command
 
@@ -223,7 +224,7 @@ def tracked_files(root: Path) -> list[str]:
     if git is None:
         raise RegistryError("git is not on PATH")
     # A hook parent's GIT_DIR / GIT_INDEX_FILE would point git at another repo.
-    env = {key: value for key, value in os.environ.items() if not key.startswith("GIT_")}
+    env = git_env.drop()
     result = run_command(
         [git, "-C", str(root), "ls-files", "-z"],
         allowed_executables=(git,),

scripts/ci/test_ffmpeg_patch_smoke_safety.py

@@ -14,6 +14,7 @@
 sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
 
 from scripts.ci import ffmpeg_shared_series_fixture as shared_series
+from scripts.lib import git_env
 from scripts.lib.safe_subprocess import TextCommandResult
 from scripts.lib.safe_subprocess import run as run_command
 
@@ -33,9 +34,7 @@ class SmokeSafety(unittest.TestCase):
     def git(self, path: Path, *args: str) -> str:
         # Isolate setup and assertions before injecting fake caller variables
         # into the smoke script itself. -C alone cannot select the fixture.
-        environment = {
-            key: value for key, value in os.environ.items() if not key.startswith("GIT_")
-        }
+        environment = git_env.drop()
         environment.update(GIT_CONFIG_NOSYSTEM="1", GIT_CONFIG_GLOBAL=os.devnull)
         git = shutil.which("git")
         self.assertIsNotNone(git)
@@ -153,7 +152,7 @@ def configure_caller_environment(self) -> None:
         self.before_head = self.git(self.caller, "rev-parse", "HEAD")
         self.before_index = (self.caller / ".git/index").read_bytes()
         self.checkout = self.root / "ffmpeg-checkout"
-        self.env = {key: value for key, value in os.environ.items() if not key.startswith("GIT_")}
+        self.env = git_env.drop()
         self.env.update(
             {
                 "GIT_CONFIG_NOSYSTEM": "1",

scripts/ci/test_ffmpeg_patch_stack.py

@@ -19,6 +19,7 @@
 sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
 
 from scripts.ci import ffmpeg_shared_series_fixture as shared_series
+from scripts.lib import git_env
 from scripts.lib.safe_subprocess import run as run_command
 
 SPEC = importlib.util.spec_from_file_location(
@@ -51,7 +52,7 @@ def test_shared_series_inputs_check_out_with_lf(self) -> None:
             [git, "-C", str(repo), "check-attr", "eol", "--", *paths],
             allowed_executables={git},
             # The caller's GIT_DIR or GIT_WORK_TREE would point git at another repository.
-            env={key: value for key, value in os.environ.items() if not key.startswith("GIT_")},
+            env=git_env.drop(),
             capture_output=True,
             text=True,
             check=True,
@@ -105,9 +106,7 @@ class RealReplay(unittest.TestCase):
     def git(self, path: Path, *args: str) -> str:
         # Fixed Git executable and fixture-owned arguments; no shell.
         # Fixture setup needs isolation too: -C does not override hook GIT_*.
-        environment = {
-            key: value for key, value in os.environ.items() if not key.startswith("GIT_")
-        }
+        environment = git_env.drop()
         environment.update(GIT_CONFIG_NOSYSTEM="1", GIT_CONFIG_GLOBAL=os.devnull)
         git = shutil.which("git")
         self.assertIsNotNone(git)