test+scripts: bare-clone everywhere

Test helpers + scripts updated to match the bare-repo invariant from
openPublicStore. createTestRepo / createFullDataRepo now build the
bare gitdir + use a transient working-tree clone to seed initial
commits via push, then discard the working tree. seedFixtures opens
the bare directly via openRepo({ gitDir }).

New seedRawToml helper (apps/api/tests/helpers/seed-fixtures.ts) wraps
the transient-clone-push dance for ad-hoc TOML seeds — replaces the
identical-shape git-add-commit blocks that lived in account-claim,
auth, github-oauth, and saml tests.

internal-reload + import-laddr test rigs: local clone is --bare;
imp-laddr's ensureBranchCheckedOut uses update-ref + symbolic-ref
instead of git checkout. internal-reload's post-reload sanity check
reads the file via `git show HEAD:<path>` instead of filesystem.

scrub-data: source repo opens bare; .gitsheets configs copied to the
target via `git ls-tree` + `git show` instead of filesystem readdir.

All 241 API tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: themightychris

apps/api/scripts/import-laddr/importer.ts

@@ -557,34 +557,44 @@ async function ensureGitRepo(repo: string): Promise<void> {
 }
 
 /**
- * Check out the target branch in the working tree. On first run, create it
- * from `origin/<branch>` if available, falling back to `initialParent`
- * (typically `origin/empty`).
+ * Point HEAD at the target branch in the bare data repo. On first run,
+ * the branch ref is created from `origin/<branch>` if available, falling
+ * back to `initialParent` (typically `origin/empty`).
+ *
+ * Bare-friendly — no working tree to check out into. The branch ref is
+ * created/updated via `git update-ref`, and HEAD becomes a symbolic-ref
+ * pointing at it so subsequent transacts commit onto the right branch.
  */
 async function ensureBranchCheckedOut(
   repo: string,
   branch: string,
   initialParent: string,
 ): Promise<void> {
-  // Existing local branch: just switch.
-  try {
-    await exec('git', ['rev-parse', '--verify', `refs/heads/${branch}`], { cwd: repo });
-    await exec('git', ['checkout', branch], { cwd: repo });
-    return;
-  } catch {
-    // No local branch — fall through.
-  }
-  // No local branch yet. Try origin/<branch>, fall back to initialParent.
-  let parent: string;
+  // Resolve the parent commit hash: either the existing local branch (use
+  // it as-is), origin/<branch> if it exists, or the initialParent fallback.
+  let parentCommit: string;
   try {
-    await exec('git', ['rev-parse', '--verify', `refs/remotes/origin/${branch}`], {
-      cwd: repo,
-    });
-    parent = `origin/${branch}`;
+    const result = await exec('git', ['rev-parse', '--verify', `refs/heads/${branch}`], { cwd: repo });
+    parentCommit = result.stdout.trim();
   } catch {
-    parent = initialParent;
+    // No local branch — try origin/<branch>, fall back to initialParent.
+    let parentRef: string;
+    try {
+      await exec('git', ['rev-parse', '--verify', `refs/remotes/origin/${branch}`], {
+        cwd: repo,
+      });
+      parentRef = `refs/remotes/origin/${branch}`;
+    } catch {
+      parentRef = initialParent;
+    }
+    const result = await exec('git', ['rev-parse', '--verify', parentRef], { cwd: repo });
+    parentCommit = result.stdout.trim();
+    await exec('git', ['update-ref', `refs/heads/${branch}`, parentCommit], { cwd: repo });
   }
-  await exec('git', ['checkout', '-b', branch, parent], { cwd: repo });
+
+  // Point HEAD at the (now-existing) branch so subsequent gitsheets
+  // transacts commit onto it.
+  await exec('git', ['symbolic-ref', 'HEAD', `refs/heads/${branch}`], { cwd: repo });
 }
 
 // ---------------------------------------------------------------------------

apps/api/scripts/scrub-data.ts

@@ -476,7 +476,7 @@ export async function scrubRepo(opts: ScrubOptions): Promise<ScrubResult> {
   // -------------------------------------------------------------------------
   // 1. Open source repo
   // -------------------------------------------------------------------------
-  const sourceRepo = await openRepo({ workTree: source, gitDir: join(source, '.git') });
+  const sourceRepo = await openRepo({ gitDir: source });
   const sourceHeadHash = await sourceRepo.resolveRef('HEAD');
 
   // -------------------------------------------------------------------------
@@ -585,16 +585,24 @@ export async function scrubRepo(opts: ScrubOptions): Promise<ScrubResult> {
     await writeFile(fullPath, content, 'utf-8');
   }
 
-  // Copy .gitsheets config from source
-  const sourceGitsheetsDir = join(source, '.gitsheets');
+  // Copy .gitsheets configs from source's HEAD tree (source is a bare clone,
+  // per specs/behaviors/storage.md → "The data clone is bare", so the configs
+  // live as git blobs rather than working-tree files).
   const targetGitsheetsDir = join(target, '.gitsheets');
   await mkdir(targetGitsheetsDir, { recursive: true });
-  const configFiles = await readdir(sourceGitsheetsDir, { withFileTypes: true }).catch(() => []);
-  for (const entry of configFiles) {
-    if (entry.isFile() && entry.name.endsWith('.toml')) {
-      const configContent = await readFile(join(sourceGitsheetsDir, entry.name), 'utf-8');
-      await writeFile(join(targetGitsheetsDir, entry.name), configContent, 'utf-8');
-    }
+  const lsTreeResult = await exec('git', [
+    '--git-dir', source,
+    'ls-tree', '--name-only', 'HEAD', '.gitsheets/',
+  ]);
+  const configFiles = lsTreeResult.stdout
+    .split('\n')
+    .filter((name) => name.endsWith('.toml'));
+  for (const path of configFiles) {
+    const blob = await exec('git', [
+      '--git-dir', source,
+      'show', `HEAD:${path}`,
+    ]);
+    await writeFile(join(target, path), blob.stdout, 'utf-8');
   }
 
   // -------------------------------------------------------------------------

apps/api/tests/account-claim.test.ts

@@ -21,13 +21,14 @@ import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import { type FastifyInstance } from 'fastify';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { writeFile, mkdir, readFile } from 'node:fs/promises';
+import { writeFile, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import bcrypt from 'bcryptjs';
 
 import { buildApp } from '../src/app.js';
 import { issueClaimPending, issueSession } from '../src/auth/jwt.js';
 import { createFullDataRepo, createPrivateStorageDir } from './helpers/test-full-repo.js';
+import { seedRawToml } from './helpers/seed-fixtures.js';
 
 const exec = promisify(execFile);
 const JWT_KEY = 'test-jwt-signing-key-at-least-32-chars!!';
@@ -52,7 +53,6 @@ async function seedPerson(
   id: string,
   opts: SeedPersonOpts = {},
 ): Promise<void> {
-  const git = (...args: string[]) => exec('git', args, { cwd: repoDir });
   const lines = [
     `id = "${id}"`,
     `slug = "${slug}"`,
@@ -68,14 +68,7 @@ async function seedPerson(
     lines.push(`slackSamlNameId = "${opts.slackSamlNameId}"`);
   }
 
-  await mkdir(join(repoDir, 'people'), { recursive: true });
-  await writeFile(join(repoDir, 'people', `${slug}.toml`), lines.join('\n'));
-  await git('add', `people/${slug}.toml`);
-  await git(
-    '-c', 'user.email=test@cfp.test',
-    '-c', 'user.name=test',
-    'commit', '-m', `seed person ${slug}`,
-  );
+  await seedRawToml(repoDir, `people/${slug}.toml`, lines.join('\n'), `seed person ${slug}`);
 }
 
 async function seedPrivateProfile(

apps/api/tests/auth.test.ts

@@ -20,17 +20,13 @@
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import { type FastifyInstance } from 'fastify';
 import { SignJWT } from 'jose';
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { writeFile, mkdir } from 'node:fs/promises';
-import { join } from 'node:path';
 
 import { buildApp } from '../src/app.js';
 import { mintSessionFor } from '../src/auth/issue.js';
 import { verifyAccess, verifyRefresh } from '../src/auth/jwt.js';
 import { createFullDataRepo, createPrivateStorageDir } from './helpers/test-full-repo.js';
+import { seedRawToml } from './helpers/seed-fixtures.js';
 
-const exec = promisify(execFile);
 const JWT_KEY = 'test-jwt-signing-key-at-least-32-chars!!';
 
 async function buildTestApp(
@@ -61,7 +57,6 @@ async function seedPerson(
   id: string,
   accountLevel = 'user',
 ): Promise<void> {
-  const git = (...args: string[]) => exec('git', args, { cwd: repoDir });
   const personToml = [
     `id = "${id}"`,
     `slug = "${slug}"`,
@@ -71,14 +66,7 @@ async function seedPerson(
     `updatedAt = "2026-05-01T00:00:00Z"`,
   ].join('\n');
 
-  await mkdir(join(repoDir, 'people'), { recursive: true });
-  await writeFile(join(repoDir, 'people', `${slug}.toml`), personToml);
-  await git('add', `people/${slug}.toml`);
-  await git(
-    '-c', 'user.email=test@cfp.test',
-    '-c', 'user.name=test',
-    'commit', '-m', `seed person ${slug}`,
-  );
+  await seedRawToml(repoDir, `people/${slug}.toml`, personToml, `seed person ${slug}`);
 }
 
 // ---------------------------------------------------------------------------

apps/api/tests/cutover-mailout.test.ts

@@ -22,7 +22,7 @@ async function seedPerson(
   repoPath: string,
   fields: { id: string; slug: string; fullName?: string; githubUserId?: number; deletedAt?: string },
 ): Promise<void> {
-  const repo = await openRepo({ gitDir: `${repoPath}/.git`, workTree: repoPath });
+  const repo = await openRepo({ gitDir: repoPath });
   await repo.transact(
     { message: `seed person ${fields.slug}`, author: { name: 'test', email: 'test@cfp.test' } },
     async (tx) => {

apps/api/tests/github-oauth.test.ts

@@ -17,19 +17,17 @@
  */
 import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest';
 import { type FastifyInstance } from 'fastify';
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { writeFile, mkdir, readFile } from 'node:fs/promises';
+import { writeFile, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { SignJWT } from 'jose';
 
 import { buildApp } from '../src/app.js';
 import { verifyAccess, verifyRefresh, verifyClaimPending } from '../src/auth/jwt.js';
 import { verifyOAuthSession } from '../src/auth/oauth-session-cookie.js';
 import { createFullDataRepo, createPrivateStorageDir } from './helpers/test-full-repo.js';
+import { seedRawToml } from './helpers/seed-fixtures.js';
 import { createGitHubMock } from './helpers/mocks.js';
 
-const exec = promisify(execFile);
 const JWT_KEY = 'test-jwt-signing-key-at-least-32-chars!!';
 const GH_CLIENT_ID = 'test-client-id';
 const GH_CLIENT_SECRET = 'test-client-secret';
@@ -47,7 +45,6 @@ async function seedPerson(
   id: string,
   opts: SeedPersonOpts = {},
 ): Promise<void> {
-  const git = (...args: string[]) => exec('git', args, { cwd: repoDir });
   const lines = [
     `id = "${id}"`,
     `slug = "${slug}"`,
@@ -66,14 +63,7 @@ async function seedPerson(
     lines.push(`githubLinkedAt = "${opts.githubLinkedAt}"`);
   }
 
-  await mkdir(join(repoDir, 'people'), { recursive: true });
-  await writeFile(join(repoDir, 'people', `${slug}.toml`), lines.join('\n'));
-  await git('add', `people/${slug}.toml`);
-  await git(
-    '-c', 'user.email=test@cfp.test',
-    '-c', 'user.name=test',
-    'commit', '-m', `seed person ${slug}`,
-  );
+  await seedRawToml(repoDir, `people/${slug}.toml`, lines.join('\n'), `seed person ${slug}`);
 }
 
 /** Seed a PrivateProfile directly into the filesystem private store. */

apps/api/tests/helpers/seed-fixtures.ts

@@ -8,8 +8,54 @@
  * In production the write-api will construct these path fields from the
  * in-memory index at write time. Tests must do the same.
  */
+import { execFile } from 'node:child_process';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { promisify } from 'node:util';
+
 import { openRepo } from 'gitsheets';
 
+const execAsync = promisify(execFile);
+
+/**
+ * Write a raw TOML file into a bare gitsheets repo via a transient
+ * working-tree clone. The bare-repo invariant
+ * (specs/behaviors/storage.md → "The data clone is bare") rules out the
+ * traditional `git add` / `git commit` flow against the data path — this
+ * helper does the transient-clone-push dance once per call so test
+ * fixtures can land arbitrary file shapes.
+ *
+ * `relPath` is the path within the working tree (e.g. `people/jane.toml`).
+ * `commitMessage` is used verbatim; author/committer default to the
+ * test identity.
+ */
+export async function seedRawToml(
+  bareRepoPath: string,
+  relPath: string,
+  toml: string,
+  commitMessage: string,
+): Promise<void> {
+  const wt = await mkdtemp(join(tmpdir(), 'cfp-seed-wt-'));
+  try {
+    await execAsync('git', ['clone', bareRepoPath, wt]);
+    await execAsync('git', ['config', 'user.email', 'test@cfp.test'], { cwd: wt });
+    await execAsync('git', ['config', 'user.name', 'cfp test'], { cwd: wt });
+    await execAsync('git', ['config', 'commit.gpgsign', 'false'], { cwd: wt });
+    await execAsync('git', ['config', 'core.hooksPath', '/dev/null'], { cwd: wt });
+
+    const absPath = join(wt, relPath);
+    await mkdir(dirname(absPath), { recursive: true });
+    await writeFile(absPath, toml);
+
+    await execAsync('git', ['add', relPath], { cwd: wt });
+    await execAsync('git', ['commit', '-m', commitMessage], { cwd: wt });
+    await execAsync('git', ['push', 'origin', 'main'], { cwd: wt });
+  } finally {
+    await rm(wt, { recursive: true, force: true });
+  }
+}
+
 const NOW = '2026-05-01T00:00:00Z';
 const NOW2 = '2026-05-10T00:00:00Z';
 
@@ -34,7 +80,7 @@ export interface SeededFixtures {
  * Returns the IDs/slugs for use in assertions.
  */
 export async function seedFixtures(repoPath: string): Promise<SeededFixtures> {
-  const repo = await openRepo({ gitDir: `${repoPath}/.git`, workTree: repoPath });
+  const repo = await openRepo({ gitDir: repoPath });
 
   const projectId = uuid(1);
   const personId = uuid(2);

apps/api/tests/helpers/test-full-repo.ts

@@ -43,31 +43,42 @@ export interface FullTestRepo {
  * for full-app tests where the store plugin boots the real openPublicStore().
  */
 export async function createFullDataRepo(): Promise<FullTestRepo> {
-  const dir = await mkdtemp(join(tmpdir(), 'cfp-full-data-'));
-  const git = (...args: string[]) => execFileAsync('git', args, { cwd: dir });
+  const root = await mkdtemp(join(tmpdir(), 'cfp-full-data-'));
+  const bareDir = join(root, 'data.git');
+  const seedDir = join(root, 'seed');
 
-  await git('init', '-b', 'main');
-  await git('config', 'user.email', 'test@cfp.test');
-  await git('config', 'user.name', 'cfp test');
-  await git('config', 'commit.gpgsign', 'false');
-  await git('config', 'core.hooksPath', '/dev/null');
-  await git('commit', '--allow-empty', '-m', 'initial');
+  // Bare gitdir — the path tests pass to openPublicStore. Matches the
+  // production bare-repo invariant (specs/behaviors/storage.md).
+  await execFileAsync('git', ['init', '--bare', '-b', 'main', bareDir]);
+  await execFileAsync('git', ['config', 'receive.denyCurrentBranch', 'ignore'], { cwd: bareDir });
 
-  // Write all sheet configs
-  await mkdir(join(dir, '.gitsheets'), { recursive: true });
+  // Transient working-tree clone for seeding the sheet configs.
+  await execFileAsync('git', ['init', '-b', 'main', seedDir]);
+  const seedGit = (...args: string[]) => execFileAsync('git', args, { cwd: seedDir });
+  await seedGit('config', 'user.email', 'test@cfp.test');
+  await seedGit('config', 'user.name', 'cfp test');
+  await seedGit('config', 'commit.gpgsign', 'false');
+  await seedGit('config', 'core.hooksPath', '/dev/null');
+  await seedGit('commit', '--allow-empty', '-m', 'initial');
+
+  await mkdir(join(seedDir, '.gitsheets'), { recursive: true });
   for (const [name, config] of Object.entries(SHEET_CONFIGS)) {
-    await writeFile(join(dir, '.gitsheets', `${name}.toml`), config);
+    await writeFile(join(seedDir, '.gitsheets', `${name}.toml`), config);
   }
-  await git('add', '.gitsheets');
-  await git('commit', '-m', 'chore: add all gitsheets sheet configs');
+  await seedGit('add', '.gitsheets');
+  await seedGit('commit', '-m', 'chore: add all gitsheets sheet configs');
+
+  await seedGit('remote', 'add', 'origin', bareDir);
+  await seedGit('push', 'origin', 'main');
+  await rm(seedDir, { recursive: true, force: true });
 
   let cleaned = false;
   return {
-    path: dir,
+    path: bareDir,
     cleanup: async () => {
       if (cleaned) return;
       cleaned = true;
-      await rm(dir, { recursive: true, force: true });
+      await rm(root, { recursive: true, force: true });
     },
   };
 }