[vaind]

Stacked on #156. Part of CW-2221.

The unit tests run the relay against a canned local server. None of them shows that a real git client gets through GitServer to GitHub or GitLab, with git's own request sequence, protocol v2, chunked pushes, and how git shows our refusals.

Approach

bin/git-server stands in for Sentry's git endpoint. It looks up the repository, signs grants and supplies the token. The real GitServer and GitRelay do the rest.

• Credentials: the same ones bin/github-server and bin/gitlab-server read, from .credentials, env vars or flags. It loads those scripts to reuse their token handling.
• Serve mode: bin/git-server github --repository OWNER/REPO serves the repository and prints a fetch grant, a push grant, and the git clone and git push commands that use them.
• Check mode: --check serves on a free port, runs git against it, and exits non-zero if any check fails. Nothing is prompted and the user's git config isn't used, so it can run in CI once there are credentials for a test repository. It checks that:
  • ls-remote and a shallow clone work with a fetch grant
  • a push with a fetch grant, and a grant for another repository, are refused with git's remote: message
  • a token the provider rejects fails without git asking for credentials
  • a repository the token can't see fails with the provider's own message, e.g. GitHub's Repository not found., which the relay passes on
• --push: also pushes a 256 KiB commit to a new branch and then deletes it. The commit is larger than http.postBuffer, so git sends it chunked. This writes to the repository, so it's opt-in.

Testing

• All checks, including --push, pass in GitLab mode against a local HTTPS git http-backend with Basic auth. The backend received the push chunked, and the test branch was deleted afterwards.
• Serve mode: cloned with the grant it printed.
• GitHub: all checks, including --push, pass against an internal test repository through a GitHub App installation token. The test branch was deleted afterwards.
• GitHub Enterprise: checked that the remote URL and username are right, but not run against a live instance.
• GitLab: not yet run against a live instance.

🤖 Generated with Claude Code

[linear-code]

CW-2221

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit ba90324. Configure here.}