[SergK]

Summary

go-git holds packfiles in operator memory. Clone, push, checkout and commit now run the git binary. go-git keeps ref operations, init, remote link and ls-remote.

pkg/git/
├── provider.go      go-git: refs, Init, AddRemoteLink, ListRemoteBranches, CheckPermissions
└── cli.go           git binary: Clone, Push, Commit, Checkout, CheckoutRemoteBranch, CreateChildBranch

exec(git)
  buildEnv(remoteURL)
    ssh remote   GIT_SSH_COMMAND: StrictHostKeyChecking=yes, SSH_KNOWN_HOSTS, timeouts, key in /dev/shm
    https remote GIT_CONFIG_* extraHeader scoped to host, GIT_SSL_CAINFO from Go CA roots
    GIT_ALLOW_PROTOCOL=http:https:ssh, HOME=/tmp, GIT_CEILING_DIRECTORIES
  Setpgid; cancel: SIGTERM, then SIGKILL after grace
  error or lingering child: SIGKILL process group, remove .lock files

• Clone creates a local branch for every remote branch. A failed clone restores the destination.
• Base image: alpine 3.22.7, pinned git, openssh-client, ca-certificates. Templates and configs copied as 0755.

Evidence

• Before: not measured. The old go-git image 2.36.0 was not run against the large repository.
  After: testbed (kind, 1 Gi operator limit, GitLab over SSH), upstream kubernetes/kubernetes (62 branches, 1256 tags, 1.7 GB), four runs:

  clone github.com/kubernetes/kubernetes -> push to GitLab
  result:   created, available=true, failureCount=0
  refs:     62 branches, 1256 tags, release head == upstream head
  memory:   oom_kill 0, anon ~30 MB after push
  push:     18 to 44 min
  

  One run had a network failure on the first attempt. The operator cleaned up and the retry passed.

• Unit tests run the real git binary:

  exec: cancel kills process group (SIGTERM, then SIGKILL)
  exec: signal death or lingering child -> children dead, .lock removed
  Commit in a directory without .git inside another repo -> error, parent untouched
  Clone: empty remote, missing HEAD, ext:: URL rejected, branches and tags present
  buildEnv: token scoped to host, keyless ssh:// and scp-like get host key options
  

Merge Danger

Door: two-way. Revert the commit and roll back the image.

Blast Radius: operator-wide. Every Codebase clone, push, checkout and commit goes through the git binary.

• Not tested: Gerrit, Bitbucket, token auth, custom CA bundle, SSH clone with a key.
• Behavior change: git:// and file:// remote URLs are rejected.
• The image now depends on the git and ssh binaries.
• Base image moves from alpine 3.18 to 3.22.

[epmd-edp]

Pipeline review-codebase-operator-master-w2hrj — ✓ Passed

Status	Task	Duration
✓ Passed	github-set-pending-status	43s
✓ Passed	fetch-repository	14s
✓ Passed	init-values	6s
✓ Passed	get-cache	2m21s
✓ Passed	commit-validate	5s
✓ Passed	dockerfile-lint	7s
✓ Passed	helm-lint	7s
✓ Passed	helm-docs	18s
✓ Passed	build	2m40s
✓ Passed	sonar	31s
✓ Passed	save-cache	1m24s
✓ Passed	buildkit-build	25s
✓ Passed	github-report-pipeline-status	20s

Pushing new commits re-runs this pipeline automatically.
To re-run it without new commits, comment /recheck.