Merge branch 'Byron:main' into main

Author: LuaKT

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: weekly
+  groups:
+    github-actions:
+      patterns: ["*"]

.github/workflows/ci.yml

@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     container: debian:buster
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Prerequisites
         run: apt-get update && apt-get install --no-install-recommends -y ca-certificates curl gcc libc-dev # gcc is required as OS abstraction
       - name: install Rust via Rustup
@@ -47,17 +47,17 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Setup dependencies
         run:
           sudo apt-get install tree
-      - uses: extractions/setup-just@v1
+      - uses: extractions/setup-just@v2
       - name: test
         env:
           CI: true
-          GITOXIDE_TEST_IGNORE_ARCHIVES: 1
+          GIX_TEST_IGNORE_ARCHIVES: 1
         run: just ci-test
 
   test-fast:
@@ -69,7 +69,7 @@ jobs:
           - ubuntu-latest
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Setup dependencies (macos)
@@ -79,10 +79,7 @@ jobs:
       - name: "cargo check default features"
         if: startsWith(matrix.os, 'windows')
         run: cargo check --all --bins --examples
-      - run: |
-          # it should never be a failure not to get the caches, as they can be regenerated.
-          git lfs fetch && git lfs checkout || true
-      - uses: taiki-e/install-action@v1
+      - uses: taiki-e/install-action@v2
         with:
           tool: nextest
       - name: "Test (nextest)"
@@ -94,15 +91,15 @@ jobs:
       matrix:
         target: [ armv7-linux-androideabi ]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:
           toolchain: stable
           targets: ${{ matrix.target }}
-      - uses: taiki-e/install-action@v1
+      - uses: taiki-e/install-action@v2
         with:
           tool: cross
       - name: "check"
@@ -135,7 +132,7 @@ jobs:
             target: i686-pc-windows-gnu
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Install Rust
         uses: dtolnay/rust-toolchain@master
         with:
@@ -150,18 +147,18 @@ jobs:
       - name: "Install prerequisites"
         run: vcpkg install  zlib:x64-windows-static-md
       - name: "Installation from crates.io: gitoxide"
-        run: cargo +${{ matrix.rust }} install --target ${{ matrix.target }} --target-dir install-artifacts --debug --force gitoxide
+        run: cargo +${{ matrix.rust }} install --target ${{ matrix.target }} --no-default-features --features max-pure --target-dir install-artifacts --debug --force gitoxide
         shell: msys2 {0}
 
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: stable
           components: clippy,rustfmt
-      - uses: extractions/setup-just@v1
+      - uses: extractions/setup-just@v2
       - name: Run cargo clippy
         run: just clippy -D warnings -A unknown-lints
       - name: Run cargo doc
@@ -189,7 +186,7 @@ jobs:
     continue-on-error: ${{ matrix.checks == 'advisories' }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: EmbarkStudios/cargo-deny-action@v1
         with:
           command: check ${{ matrix.checks }}

.github/workflows/cifuzz.yml

@@ -17,7 +17,7 @@ jobs:
        language: rust
        fuzz-seconds: 600
    - name: Upload Crash
-     uses: actions/upload-artifact@v3
+     uses: actions/upload-artifact@v4
      if: failure() && steps.build.outcome == 'success'
      with:
        name: artifacts

.github/workflows/cron.yml

@@ -9,7 +9,7 @@ jobs:
   stress:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - uses: Swatinem/rust-cache@v2
     - name: stress
       run: make stress

.github/workflows/msrv.yml

@@ -18,8 +18,13 @@ jobs:
           - windows-2019
           - ubuntu-latest
     runs-on: ${{ matrix.os }}
+    env:
+      # dictated by `firefox` to support the `helix` editor, but now driven by the `time` crate. IMPORTANT: adjust etc/msrv-badge.svg as well
+      rust_version: 1.67.0
     steps:
-      - uses: actions/checkout@v3
-      - uses: dtolnay/[email protected] # dictated by `firefox` to support the `helix` editor, but now driven by the `time` crate. IMPORTANT: adjust etc/msrv-badge.svg as well
-      - uses: extractions/setup-just@v1
+      - uses: actions/checkout@v4
+      - uses: extractions/setup-just@v2
+      - run: |
+          rustup toolchain install ${{ env.rust_version }} --profile minimal --no-self-update
+          rustup default ${{ env.rust_version }}
       - run: just ci-check-msrv

.github/workflows/release.yml

@@ -60,7 +60,7 @@ jobs:
         run: echo "${{ env.ARTIFACT_VERSION }}" > artifacts/release-version
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: artifacts
           path: artifacts
@@ -129,7 +129,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
@@ -161,7 +161,7 @@ jobs:
           echo "target dir is: ${{ env.TARGET_DIR }}"
 
       - name: Get release download URL
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: artifacts
           path: artifacts
@@ -211,7 +211,7 @@ jobs:
           fi
 
       - name: Upload release archive
-        uses: actions/[email protected].1
+        uses: actions/[email protected].2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

CHANGELOG.md

@@ -5,6 +5,67 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.36.0 (2024-05-22)
+
+### New Features
+
+ - <csr-id-886d6b58e4612ac21cc660ea4ddf1dd0b49d1c6e/> checkout respects options for `core.protectHFS` and `core.protectNTFS`.
+   This also adds `gitoxide.core.protectWindows` as a way to enforce
+   additional restrictions that are usually only available on Windows.
+   
+   Note that `core.protectNFS` is always enabled by default, just like
+   [it is in Git](https://github.com/git/git/commit/9102f958ee5254b10c0be72672aa3305bf4f4704).
+
+### Bug Fixes
+
+ - <csr-id-addf446f052ff74edcdb083f2b2968b313daa940/> more robustness in the face of a trampling-herd of threads loading a single index.
+   The motivating example is here: https://github.com/praetorian-inc/noseyparker/issues/179
+   
+   Previously, it was possible for a trampling herd of threads to consolidate the
+   disk state. Most of them would be 'needs-init' threads which could notice that
+   the initialization already happened, and just use that.
+   
+   But a thread might be late for the party and somehow manages to not get any
+   newly loaded index, and thus tries to consolidate with what's on disk again.
+   Then it would again determine no change, and return nothing, causing the caller
+   to abort and not find objects it should find because it wouldn't see the index
+   that it should have seen.
+   
+   The reason the thread got into this mess is that the 'is-load-ongoing' flagging
+   was racy itself, so it would not wait for ongoing loads and just conclude nothing
+   happened. An extra delay (by yielding) now assures it either seees the loading state
+   and waits for it, sees the newly loaded indices.
+   
+   Note that this issue can be reproduced with:
+   
+   ```
+   './target/release/gix -r repo-with-one-pack -t10 --trace odb stats --extra-header-lookup'
+   ```
+
+### Commit Statistics
+
+<csr-read-only-do-not-edit/>
+
+ - 6 commits contributed to the release over the course of 10 calendar days.
+ - 38 days passed between releases.
+ - 2 commits were understood as [conventional](https://www.conventionalcommits.org).
+ - 0 issues like '(#ID)' were seen in commit messages
+
+### Commit Details
+
+<csr-read-only-do-not-edit/>
+
+<details><summary>view details</summary>
+
+ * **Uncategorized**
+    - Merge branch 'various-fixes' ([`d6cd449`](https://github.com/Byron/gitoxide/commit/d6cd44930fb204b06e2b70fc6965e7705530c47a))
+    - Merge pull request from GHSA-7w47-3wg8-547c ([`79dce79`](https://github.com/Byron/gitoxide/commit/79dce79c62f6072aa2653780d590dc3993dfa401))
+    - Checkout respects options for `core.protectHFS` and `core.protectNTFS`. ([`886d6b5`](https://github.com/Byron/gitoxide/commit/886d6b58e4612ac21cc660ea4ddf1dd0b49d1c6e))
+    - Mark safety-related core-flags as planned ([`f3d5a69`](https://github.com/Byron/gitoxide/commit/f3d5a69bbe0ad14502ce617dc580cc2aa481bb0a))
+    - Merge branch 'status' ([`04ef31e`](https://github.com/Byron/gitoxide/commit/04ef31e9d6f5332d49037a5a4c248ebbb5aaf92b))
+    - More robustness in the face of a trampling-herd of threads loading a single index. ([`addf446`](https://github.com/Byron/gitoxide/commit/addf446f052ff74edcdb083f2b2968b313daa940))
+</details>
+
 ## 0.35.0 (2024-04-13)
 
 ### New Features