Add git database locks and db_dir config

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
       matrix:
         # Linux runs the full Rust version matrix; Windows and macOS test stable only.
         os: [ubuntu-latest]
-        rust: [stable, beta, nightly, "1.87.0"]
+        rust: [stable, beta, nightly, "1.89.0"]
         include:
           - os: windows-latest
             rust: stable

CHANGELOG.md

@@ -8,6 +8,8 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) a
 ### Added
 - Add new `crates/bender-slang` crate that integrates the vendored Slang parser via a Rust/C++ bridge.
 - Add new `pickle` command (behind feature `slang`) to parse and re-emit SystemVerilog sources.
+- Add cross-process filesystem locks around git database and checkout operations so concurrent `bender` invocations against the same dependency serialize safely.
+- Add `db_dir` config field to share bare-repo and lock storage across projects without relocating per-project checkouts; older Bender versions silently ignore the field and fall back to their per-project default.
 
 ## 0.31.0 - 2026-03-03
 ### Fixed

Cargo.toml

@@ -11,7 +11,7 @@ description = "A dependency management tool for hardware projects."
 readme = "README.md"
 license = "Apache-2.0 OR MIT"
 edition = "2024"
-rust-version = "1.87.0"
+rust-version = "1.89.0"
 
 [workspace]
 members = ["crates/bender-slang"]

book/src/configuration.md

@@ -27,6 +27,15 @@ The directory where Bender stores cloned and checked-out dependencies.
 - **Default:** `.bender` in the project root.
 - **Example:** `database: /var/cache/bender_dependencies`
 
+### `db_dir`
+Optional override for the directory that holds bare git repositories and their lock files (i.e. `<db_dir>/git/db/` and `<db_dir>/git/locks/`). When set, it takes precedence over `database` (whether explicitly configured or left at its default) for these two paths only; the working-tree checkouts continue to follow `database` (or [`workspace.checkout_dir`](./manifest.md) in the project manifest). This makes it possible to share the heavy git data across projects on a persistent runner without also relocating per-project checkouts. See [Continuous Integration › Sharing the Database](./workflow/ci.md#sharing-the-database-across-runs-and-projects) for the recommended setup.
+- **Config Key:** `db_dir`
+- **Env Var:** `BENDER_DB_DIR` (used only when no configuration file sets `db_dir`; configuration files always take precedence).
+- **Default:** unset (falls back to `database`).
+- **Example:** `db_dir: /var/cache/bender_shared`
+
+> **Note:** Bender versions before 0.32 silently ignore this field and fall back to their per-project default, so it is safe to ship in a shared configuration that mixed bender versions may read.
+
 ### `git`
 The command or path used to invoke Git.
 - **Config Key:** `git`

book/src/local.md

@@ -40,6 +40,11 @@ For a detailed guide on using these commands for multi-package development, see
 # Change the directory where dependencies are stored (default is .bender)
 database: my_deps_cache
 
+# Share only the bare git repos and lock files across projects, while
+# keeping per-project checkouts under each project's own .bender/.
+# Bender versions before 0.32 silently ignore this field.
+db_dir: /var/cache/bender_shared
+
 # Use a custom git binary or wrapper
 git: /usr/local/bin/git-wrapper.sh
 ```

book/src/workflow/ci.md

@@ -87,16 +87,26 @@ cache:
 
 ## Sharing the Database Across Runs and Projects
 
-When jobs run on a persistent runner, the `database` directory (where Bender stores cloned repositories) can be shared across CI runs and even across projects to drastically reduce fetch times and disk usage.
+When jobs run on a persistent runner, the bare git repositories Bender clones can be shared across CI runs and even across projects to drastically reduce fetch times and disk usage. The recommended way is the [`db_dir`](../configuration.md#db_dir) setting, which relocates *only* the bare repos and lock files; per-project working-tree checkouts stay under each project's own `.bender/` directory and cannot collide.
 
-To enable this, point Bender at a shared location via a [`Bender.local`](../local.md) file (for example placed in a parent directory of the project so it is picked up automatically):
+Place a [`Bender.local`](../local.md) in a parent directory of your projects so it is picked up automatically:
 
 ```yaml
-database: /var/cache/bender_shared
+db_dir: /var/cache/bender_shared
 ```
 
-This way, every job that runs in the runner reuses the already-fetched Git data instead of re-cloning from scratch. See [Configuration](../configuration.md) for more on the `database` setting.
+Every job on the runner now reuses the already-fetched Git data and serializes safely against concurrent jobs via per-dependency filesystem locks living next to the bare repos (`<db_dir>/git/locks/`).
+
+If you'd rather not place a `Bender.local` on the runner at all, exporting `BENDER_DB_DIR=/var/cache/bender_shared` in the job environment has the same effect — any project that explicitly sets `db_dir` in its own configuration overrides the env var.
+
+> **Bender versions before 0.32** silently ignore both `db_dir` and `BENDER_DB_DIR` and fall back to their normal per-project `.bender/` cache, so the shared config above is safe to deploy on a runner that still hosts pinned-to-old-bender projects — those projects simply won't benefit from the shared cache, but they won't misbehave either.
+
+### Sharing working-tree checkouts too
+
+If you want to share the bare repos *and* the per-dependency working-tree checkouts (uncommon), use [`database`](../configuration.md#database) instead of `db_dir`:
+
+```yaml
+database: /var/cache/bender_shared
+```
 
-> **Caveats:**
-> - **Checkout collisions:** When sharing the database, checkouts from different projects can collide if the top-level [`Bender.yml`](../manifest.md) does not specify a project-specific `workspace.checkout_dir`. Make sure each top-level project sets its own `checkout_dir` so that checkouts remain isolated even when the database is shared.
-> - **Concurrent runs:** Bender does not currently take a lock before performing Git operations on the shared database. Concurrent jobs that touch the same database may occasionally fail with Git errors. This is unlikely, but worth keeping in mind when sizing parallelism.
+Caveat: two top-level projects with the same name will collide on the same `<database>/git/checkouts/<name>-<hash>/` directory. Give each top-level project its own `workspace.checkout_dir` in [`Bender.yml`](../manifest.md) so the checkouts remain isolated.

src/cli.rs

@@ -505,9 +505,14 @@ fn load_config(from: &Path, warn_config_loaded: bool) -> Result<Config> {
         out = out.merge(cfg);
     }
 
-    // Assemble and merge the default configuration.
+    // Assemble and merge the default configuration. Env-var-supplied `db_dir`
+    // lives here so that any configuration file value still wins via
+    // `PartialConfig::merge` (which uses `self.or(other)`).
     let default_cfg = PartialConfig {
         database: Some(from.join(".bender").to_str().unwrap().to_string()),
+        db_dir: std::env::var("BENDER_DB_DIR")
+            .ok()
+            .filter(|s| !s.is_empty()),
         git: Some("git".into()),
         overrides: None,
         plugins: None,

src/cmd/audit.rs

@@ -150,47 +150,41 @@ pub fn run(sess: &Session, args: &AuditArgs) -> Result<()> {
         }
 
         // if up-to-date:
-        if let Some(ref current_version) = current_version {
-            if version_req_exists {
-                if let Some(highest_version) = highest_version {
-                    if *highest_version == *current_version && !args.only_update {
-                        audit_str.push_str(&format!(
-                            "  is \x1B[32;1mUp-to-date\x1B[m:\t@ {}\n",
-                            current_version_unwrapped
-                        ));
-                    }
-                }
-            }
+        if let Some(ref current_version) = current_version
+            && version_req_exists
+            && let Some(highest_version) = highest_version
+            && *highest_version == *current_version
+            && !args.only_update
+        {
+            audit_str.push_str(&format!(
+                "  is \x1B[32;1mUp-to-date\x1B[m:\t@ {}\n",
+                current_version_unwrapped
+            ));
         }
 
         // if not up-to-date but newest compatible:
-        if let Some(ref current_version) = current_version {
-            if version_req_exists {
-                if let Some(max_compatible) = max_compatible {
-                    if *max_compatible > *current_version {
-                        audit_str.push_str(&format!(
-                            "can \x1B[32;1mAuto-update\x1B[m:\t{} -> {}\n",
-                            current_version_unwrapped, max_compatible
-                        ));
-                    }
-                }
-            }
+        if let Some(ref current_version) = current_version
+            && version_req_exists
+            && let Some(max_compatible) = max_compatible
+            && *max_compatible > *current_version
+        {
+            audit_str.push_str(&format!(
+                "can \x1B[32;1mAuto-update\x1B[m:\t{} -> {}\n",
+                current_version_unwrapped, max_compatible
+            ));
         }
 
         // if not up-to-date and newest incompatible:
-        if let Some(current_version) = current_version {
-            if version_req_exists {
-                if let Some(highest_version) = highest_version {
-                    if *highest_version > current_version
-                        && (max_compatible.is_none() || *max_compatible.unwrap() < *highest_version)
-                    {
-                        audit_str.push_str(&format!(
-                            "     can \x1B[33;1mUpdate\x1B[m:\t{} -> {}\n",
-                            current_version_unwrapped, highest_version
-                        ));
-                    }
-                }
-            }
+        if let Some(current_version) = current_version
+            && version_req_exists
+            && let Some(highest_version) = highest_version
+            && *highest_version > current_version
+            && (max_compatible.is_none() || *max_compatible.unwrap() < *highest_version)
+        {
+            audit_str.push_str(&format!(
+                "     can \x1B[33;1mUpdate\x1B[m:\t{} -> {}\n",
+                current_version_unwrapped, highest_version
+            ));
         }
     }
 

src/cmd/snapshot.rs

@@ -51,60 +51,56 @@ pub fn run(sess: &Session, args: &SnapshotArgs) -> Result<()> {
             path: override_path,
             ..
         } = dep
+            && override_path.starts_with(sess.root.join(&args.working_dir))
+            && let DependencySource::Path(dep_path) =
+                sess.dependency_source(sess.dependency_with_name(name)?)
+            && dep_path == *override_path
         {
-            if override_path.starts_with(sess.root.join(&args.working_dir)) {
-                if let DependencySource::Path(dep_path) =
-                    sess.dependency_source(sess.dependency_with_name(name)?)
-                {
-                    if dep_path == *override_path {
-                        // check state, skip & warn if dirty
-                        if !SysCommand::new(&sess.config.git)
-                            .arg("status")
-                            .arg("--porcelain")
-                            .current_dir(&dep_path)
-                            .output()
-                            .into_diagnostic()?
-                            .stdout
-                            .is_empty()
-                            && !args.no_skip
-                        {
-                            Warnings::SkippingDirtyDep { pkg: name.clone() }.emit();
-                            continue;
-                        }
+            // check state, skip & warn if dirty
+            if !SysCommand::new(&sess.config.git)
+                .arg("status")
+                .arg("--porcelain")
+                .current_dir(&dep_path)
+                .output()
+                .into_diagnostic()?
+                .stdout
+                .is_empty()
+                && !args.no_skip
+            {
+                Warnings::SkippingDirtyDep { pkg: name.clone() }.emit();
+                continue;
+            }
 
-                        // Get the git url and hash of the dependency
-                        let url = match String::from_utf8(
-                            SysCommand::new(&sess.config.git)
-                                .arg("remote")
-                                .arg("get-url")
-                                .arg("origin")
-                                .current_dir(&dep_path)
-                                .output()
-                                .into_diagnostic()?
-                                .stdout,
-                        ) {
-                            Ok(url) => url.trim_end_matches(&['\r', '\n'][..]).to_string(),
-                            Err(_) => bail!("Failed to get git url."),
-                        };
-                        let hash = match String::from_utf8(
-                            SysCommand::new(&sess.config.git)
-                                .arg("rev-parse")
-                                .arg("HEAD")
-                                .current_dir(&dep_path)
-                                .output()
-                                .into_diagnostic()?
-                                .stdout,
-                        ) {
-                            Ok(hash) => hash.trim_end_matches(&['\r', '\n'][..]).to_string(),
-                            Err(_) => bail!("Failed to get git hash."),
-                        };
+            // Get the git url and hash of the dependency
+            let url = match String::from_utf8(
+                SysCommand::new(&sess.config.git)
+                    .arg("remote")
+                    .arg("get-url")
+                    .arg("origin")
+                    .current_dir(&dep_path)
+                    .output()
+                    .into_diagnostic()?
+                    .stdout,
+            ) {
+                Ok(url) => url.trim_end_matches(&['\r', '\n'][..]).to_string(),
+                Err(_) => bail!("Failed to get git url."),
+            };
+            let hash = match String::from_utf8(
+                SysCommand::new(&sess.config.git)
+                    .arg("rev-parse")
+                    .arg("HEAD")
+                    .current_dir(&dep_path)
+                    .output()
+                    .into_diagnostic()?
+                    .stdout,
+            ) {
+                Ok(hash) => hash.trim_end_matches(&['\r', '\n'][..]).to_string(),
+                Err(_) => bail!("Failed to get git hash."),
+            };
 
-                        eprintln!("Snapshotting {} at {} from {}", name, hash, url);
+            eprintln!("Snapshotting {} at {} from {}", name, hash, url);
 
-                        snapshot_list.push((name.clone(), url, hash));
-                    }
-                }
-            }
+            snapshot_list.push((name.clone(), url, hash));
         }
     }
 

src/cmd/update.rs

@@ -88,15 +88,15 @@ pub fn run<'ctx>(
     }
 
     // Unlock dependencies recursively
-    if args.recursive {
-        if let Some(existing_locked) = existing {
-            let mut nochange = true;
-            while nochange {
-                nochange = false;
-                for dep in requested.clone().iter() {
-                    for needed_dep in existing_locked.packages[dep].dependencies.iter() {
-                        nochange |= requested.insert(needed_dep.clone());
-                    }
+    if args.recursive
+        && let Some(existing_locked) = existing
+    {
+        let mut nochange = true;
+        while nochange {
+            nochange = false;
+            for dep in requested.clone().iter() {
+                for needed_dep in existing_locked.packages[dep].dependencies.iter() {
+                    nochange |= requested.insert(needed_dep.clone());
                 }
             }
         }