Filter out GIT_WORK_TREE from cloner environment variables

private/pkg/git/cloner.go

@@ -77,12 +77,13 @@ func (c *cloner) CloneToBucket(
 	depthArg := strconv.Itoa(int(depth))
 
 	envContainer = app.NewEnvContainerWithOverrides(envContainer, map[string]string{
-		// In the case where this is being run in an environment where GIT_DIR and GIT_INDEX_FILE
-		// are set, e.g. within a submodule, we want to treat this as a stand-alone, non-bare
-		// clone rather than interacting with an existing GIT_DIR and GIT_INDEX_FILE.
-		// So we filter out GIT_DIR and GIT_INDEX_FILE from our environment variables.
+		// In the case where this is being run in an environment where GIT_DIR, GIT_INDEX_FILE,
+		// or GIT_WORK_TREE are set, e.g. within a submodule or git worktree, we want to treat
+		// this as a stand-alone, non-bare clone rather than interacting with an existing git
+		// directory. So we filter out these variables from our environment.
 		"GIT_DIR":        "",
 		"GIT_INDEX_FILE": "",
+		"GIT_WORK_TREE":  "",
 	})
 
 	baseDir, err := tmp.NewDir(ctx)

private/pkg/git/git_test.go

@@ -370,6 +370,21 @@ func TestGitCloner(t *testing.T) {
 		assert.Equal(t, "// commit 2", string(content))
 	})
 
+	t.Run("env_override=GIT_WORK_TREE", func(t *testing.T) {
+		t.Parallel()
+		readBucket := readBucketForName(ctx, t, workDir, readBucketForNameOptions{
+			envOverrides: map[string]string{
+				// Simulates running inside a git worktree where GIT_WORK_TREE
+				// points at the worktree's working directory.
+				"GIT_WORK_TREE": workDir,
+			},
+		})
+
+		content, err := storage.ReadPath(ctx, readBucket, "a.proto")
+		require.NoError(t, err)
+		assert.Equal(t, "// commit 2", string(content))
+	})
+
 	t.Run("env_override=GIT_DIR,GIT_INDEX_FILE", func(t *testing.T) {
 		t.Parallel()
 		tempDir := t.TempDir()