Repository navigation
formula: provide fallback git identity in sandbox - #24066
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
The regression test should verify both fallback identity fields before approval.
Review effort: Lite
Findings: None
What changed in this PR
Adds a sandbox-local fallback Git identity so formula tests can commit without hostname-based identity detection.
Changes:
- Creates an isolated
.gitconfigwith fallback name and email. - Points sandboxed Git operations to that configuration.
- Adds regression coverage for the fallback identity.
| File | Summary |
|---|---|
Library/Homebrew/test/formula_spec.rb |
Tests fallback Git identity and sandbox environment behavior. |
Library/Homebrew/formula.rb |
Creates and uses the isolated Git configuration. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
MikeMcQuaid
reviewed
Sep 22, 2026
MikeMcQuaid
enabled auto-merge
September 22, 2026 14:39
wincent
added a commit
to wincent/wincent
that referenced
this pull request
Sep 25, 2026
Homebrew has this fascinating wart wherein if you ever run a "developer" command, it persists a flag and then assumes you want to track `HEAD` of `main` from there on. Fortunately, the manpage (https://docs.brew.sh/Manpage) documents an environment variable which will apparently avoid this: > HOMEBREW_UPDATE_TO_TAG > > If set, always use the latest stable tag (even if developer > commands have been run). From there, getting back to a released version can be done with: ``` brew developer off HOMEBREW_UPDATE_TO_TAG=1 brew update --force ``` It may still print "Already up-to-date" because it's doing a `git fetch`, but it will actually update the checkout to point at a released/tagged version, which you can verify with `brew --version`: ``` $ brew --version # before Homebrew 7.0.6-42-gddc6726 $ brew --version # after Homebrew 7.0.6 $ git -C /opt/homebrew branch --show-current stable ``` For context, the reason why I discovered this is that my Homebrew update today started running afoul of new sandboxing changes that are actively being iterated on: - Homebrew/brew#24034 ("sandbox: keep system temp dirs writable in offline installs", 2026-09-19) - Homebrew/brew@c9bfdc3 ("Extend sandboxing to package processing", 2026-09-21) - Homebrew/brew#24066 ("formula: provide fallback git identity in sandbox", 2026-09-22) - Homebrew/brew@d2b5dc5 ("Relax Git download credential sandboxing", 2026-09-23) - Homebrew/brew@c574884 ("Restore PATH for sandboxed Git downloads", 2026-09-24) I'd rather not go along for the ride of every intermediate broken state, so hopefully this keeps me on tagged/released versions from here on. Change-Id: nuvqzxwlypyplxqwqmvtzllltzmktlxt
2 of 7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
brew benchmarkresults.brewcommands to reproduce the bug?brew lgtm(style, typechecking and tests) locally?Used Claude Code (Claude Fable 5.1) to help understand the source of the problem and draft the code. Reviewed manually.
Sandboxed
brew testnullsGIT_CONFIG_GLOBAL, so a test that runsgit commitwithout configuringuser.nameanduser.emailrelies on git auto-detecting an identity from the hostname. Withdeny_network_access!that hostname lookup is blocked, so git fails with "unable to auto-detect email address" on any machine whose hostname needs DNS to resolve. For example,brew test sem-clifails locally. I attempted a fix forsem-cli, but realized the root cause was the sandbox.CI never spotted this because
brew test-botexportsHOMEBREW_GIT_NAMEandHOMEBREW_GIT_EMAILbefore running any test.This PR changes the sandbox by adding
.gitconfigwith a fallbackuser.nameanduser.emailin their isolatedHOME, andGIT_CONFIG_GLOBALpoints at that file instead of/dev/null.