Sync LFS objects across repos.

[vorporeal]

Description

Git sync only transfers commits and LFS pointer files, which can leave the target repo referencing LFS objects that were never uploaded to its LFS store. This mirrors the referenced LFS objects during sync by detecting LFS pointer files, fetching the exact source objects, and pushing only those object IDs to the peer repo before the sync branch is pushed.

The implementation is intentionally conservative: private-to-public mirroring runs against the stripped clean snapshot, filters pointer-shaped files down to paths actually tracked by Git LFS, scans all pointers when .gitattributes changes, and logs the paths associated with each mirrored object. LFS payload materialization uses exact git cat-file --filters paths with historical attributes, avoids path-list parsing pitfalls, and fails closed if filters return the expected pointer instead of payload bytes.

This also enforces that text LFS payloads do not contain repo-sync private markers, wires that validation into the marker-check action, configures Git LFS filters in the sync workflow, and bounds pointer detection reads so large LFS payloads are not loaded into memory just to check for an unsmudged pointer.

Testing

• uv run pytest tests/stack/test_lfs.py tests/stack/test_git_ops.py tests/test_lfs_payload_validation.py tests/workflows/test_lfs_mirroring.py tests/workflows/test_sync_workflow_config.py
• uv run pytest tests
• git --no-pager diff --check

Co-Authored-By: Oz oz-agent@warp.dev

[vorporeal]

• Sync LFS objects across repos. #39 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.