Prevent test git commands from mutating the checkout's own git config

When a fixture directory has no .git, git repository discovery walks up
into the checkout itself, and a fixture `git config user.email` lands
in the checkout's shared .git/config, polluting the author identity of
subsequent commits in every worktree. Set GIT_CEILING_DIRECTORIES so
discovery can never escape tmp/, make the spec git helper refuse local
config writes outside tmp/, and fix a show_spec setup line that
silently skipped `git init` because sys_exec does not go through a
shell. The rubygems test helper gets the same ceiling since its tmp
also lives inside the checkout by default.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hsbt

spec/commands/show_spec.rb

@@ -164,7 +164,13 @@
     before :each do
       build_git "foo", path: lib_path("foo")
       File.open(lib_path("foo/Gemfile"), "w") {|f| f.puts "gemspec" }
-      sys_exec "rm -rf .git && git init", dir: lib_path("foo")
+      # sys_exec does not go through a shell, so this cannot be a single
+      # `rm -rf .git && git init` command: `&&` would be passed to `rm` as a
+      # literal argument, silently skipping the `git init` part and leaving a
+      # non-repository directory from which git would discover the rubygems
+      # checkout itself.
+      FileUtils.rm_rf lib_path("foo/.git")
+      git "init", lib_path("foo")
     end
 
     it "does not output git errors" do

spec/spec_helper.rb

@@ -147,6 +147,14 @@ def self.ruby=(ruby)
       ENV["GIT_CONFIG_NOSYSTEM"] = "1"
     end
 
+    # Prevent git commands spawned by specs (directly or through Bundler)
+    # from discovering the rubygems checkout itself when run in a directory
+    # that is not a fixture repository, e.g. a fixture whose .git has been
+    # deleted by a concurrent cleanup. Without this, repository discovery
+    # walks up into the checkout and a stray `git config` writes the fixture
+    # identity to the checkout's own (possibly worktree-shared) .git/config.
+    ENV["GIT_CEILING_DIRECTORIES"] = [Spec::Path.tmp_root.to_s, Spec::Path.source_root.to_s].uniq.join(File::PATH_SEPARATOR)
+
     # Disable git background maintenance. Since Git 2.46, commands like
     # `git commit` spawn a detached `git maintenance run --auto` process,
     # which briefly creates `.git/objects/maintenance.lock`. That races with

spec/support/subprocess.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "command_execution"
+require_relative "path"
 
 module Spec
   module Subprocess
@@ -31,9 +32,29 @@ def exitstatus
     end
 
     def git(cmd, path = Dir.pwd, options = {})
+      reject_git_config_pollution!(cmd, path)
       sh("git #{cmd}", options.merge(dir: path))
     end
 
+    # A local `git config` write in a directory without a `.git` makes git
+    # discover an enclosing repository, which can be the rubygems checkout
+    # itself, polluting its (possibly worktree-shared) `.git/config` with
+    # fixture identities. Only allow local config writes inside tmp/.
+    def reject_git_config_pollution!(cmd, path)
+      require "shellwords"
+      args = cmd.to_s.shellsplit
+      return unless args.first == "config"
+      return if args.any? {|a| ["--global", "--system", "-f", "--file"].include?(a) || a.start_with?("--file=") }
+      return if args.any? {|a| ["--get", "--get-all", "--get-regexp", "--get-urlmatch", "--list", "-l"].include?(a) }
+
+      dir = File.expand_path(path.to_s)
+      tmp_root = Spec::Path.tmp_root.to_s
+      return if dir == tmp_root || dir.start_with?(tmp_root + File::SEPARATOR)
+
+      raise "Refusing to run `git #{cmd}` in #{dir}: " \
+            "a local git config write outside tmp/ could end up in the checkout's own .git/config"
+    end
+
     def sh(cmd, options = {})
       dir = options[:dir]
       env = options[:env] || {}

test/rubygems/helper.rb

@@ -373,6 +373,12 @@ def setup
 
     @tempdir = Dir.mktmpdir("test_rubygems_", @tmp)
 
+    # @tmp lives inside the checkout by default, so stop git repository
+    # discovery from walking up into the checkout itself. Otherwise a git
+    # command run in a non-repository directory under @tempdir could mutate
+    # the checkout's own (possibly worktree-shared) .git/config.
+    ENV["GIT_CEILING_DIRECTORIES"] = File.realpath(top_srcdir)
+
     ENV["GEM_VENDOR"] = nil
     ENV["GEMRC"] = nil
     ENV["XDG_CACHE_HOME"] = nil
@@ -661,9 +667,9 @@ def git_gem(name = "a", version = 1)
 
     Dir.chdir directory do
       unless File.exist? ".git"
-        system @git, "init", "--quiet"
-        system @git, "config", "user.name",  "RubyGems Tests"
-        system @git, "config", "user.email", "rubygems@example"
+        system @git, "init", "--quiet", exception: true
+        system @git, "config", "user.name",  "RubyGems Tests", exception: true
+        system @git, "config", "user.email", "rubygems@example", exception: true
       end
 
       system @git, "add", gemspec