Why

GitRepo in infrahub_sdk.testing.repository creates the Git repositories that tests add to Infrahub as remotes. It creates them as the user that runs the tests, and the copy of src_directory keeps the permissions of the source. When the Infrahub containers that mount these repositories run as another user, for example when pytest runs as root and the containers do not:

• the containers cannot read a repository copied from a private directory, such as one from pytest's tmp_path (mode 0700), and fail with "does not appear to be a git repository"
• the containers cannot push to any of the repositories, and the push fails with "unpacker error"

The goal is to let a test create repositories that the containers can read and push to, without changing anything for existing callers.

What changed

• GitRepo has a new shared field, False by default.
• With shared=True, GitRepo.init gives every user read and write access to the repository after the first commit:
  • It sets core.sharedRepository to 0666, so that Git creates the files of a later commit or push with the same access.
  • It gives every user read and write access to the folders and files that exist already. Dulwich, which GitRepo uses to create the repository, does not apply core.sharedRepository itself.
  • It does not change symbolic links.
• With the default, shared=False, the behavior is the same as before. The new field is the last field of the dataclass, so callers that pass the other fields by position are not affected.

How to review

• infrahub_sdk/testing/repository.py: the new field and GitRepo._share.
• tests/unit/sdk/test_repository.py: one test checks that the default keeps the permissions of a private source, and one checks the permissions and the Git setting with shared=True.

How to test

uv run pytest tests/unit/sdk/test_repository.py

The unit tests check the permissions, but cannot run Git as a second user. The end-to-end check is running the Infrahub E2E tests that push to these repositories with the containers and pytest running as different users. This PR stays a draft until that check has passed.

🤖 Generated with Claude Code