Skip to content

fix(gitter): fetch all tags and prune deleted refs - #6217

Open
nemmy-ballistix wants to merge 2 commits into
google:masterfrom
nemmy-ballistix:fix/cve5-new-release-tags
Open

nemmy-ballistix wants to merge 2 commits into
google:masterfrom
nemmy-ballistix:fix/cve5-new-release-tags

Conversation

@nemmy-ballistix

@nemmy-ballistix nemmy-ballistix commented Oct 22, 2026 •

Copy link
Copy Markdown

Overview

Related to #6216

gitter refreshes its clones with a plain git fetch origin. That only follows tags that point into fetched branch history, so a repo that tags releases on commits no branch contains (php-src does) gets no new tags after the initial clone. Tags moved upstream aren't updated either, and branches and tags deleted upstream are never removed.

fetchRepo now runs git fetch --tags --prune --prune-tags --force origin:

  • --tags fetches every tag, including tags on commits no branch contains.
  • --force updates a tag that was moved upstream instead of failing the fetch.
  • --prune and --prune-tags remove branches and tags that were deleted upstream.

Existing clones catch up on their next fetch, with no reclone. Because gitter builds its commit graph from git log --all, commits reachable only from a deleted branch or tag drop out of the graph on the next load.

This doesn't fix affected commit enumeration for php-src, which #6221 tracks. The vulnfeeds change from the first version of this PR will follow in a separate PR.

Testing

  • TestFetchRepo_SyncsTagsAndBranches clones a local upstream repo, then adds a tag no branch contains, moves a tag, deletes a tag and deletes a branch upstream. It checks that fetchRepo brings the clone in line with all four. With master's fetch, all four checks fail. With --tags --force alone, the two prune checks fail.
  • I ran the new fetch command on a php-src clone (1,535 tags, 574 branches). It updated four branches and removed nothing, and a second run changed nothing.
  • go vet, gofmt and golangci-lint are clean. The same seven network-dependent handler tests fail on master and on this branch, for example TestTagsHandler gets a 404 instead of a 403 from a live remote.

AI tools assisted with the investigation and the code. I reviewed the changes and the test results and stand behind them.

@google-cla

google-cla Bot commented Oct 22, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

A plain `git fetch origin` only follows tags that point into fetched
branch history, so a project that tags releases on commits outside
every branch (php-src does) gets no new tags after the initial clone.
Fetch all tags, let moved tags update, and prune branches and tags that
were deleted upstream so the clone stays in sync with the remote.
@nemmy-ballistix
nemmy-ballistix force-pushed the fix/cve5-new-release-tags branch from eb4c738 to 2d63150 Compare October 24, 2026 17:56
@nemmy-ballistix nemmy-ballistix changed the title fix: make new release tags reach the CVE5 converter fix(gitter): fetch all tags and prune deleted refs Oct 24, 2026
Ly-Joey
Ly-Joey previously approved these changes Oct 27, 2026

@Ly-Joey Ly-Joey left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank! Just one nit on the helper function.

Comment thread go/cmd/gitter/git_test.go Outdated
Comment on lines +52 to +61
git := func(dir string, args ...string) string {
t.Helper()
args = append([]string{"-c", "user.name=Test", "-c", "[email protected]"}, args...)
out, err := runCmd(ctx, dir, nil, "git", args...)
if err != nil {
t.Fatalf("git %v failed: %v", args, err)
}

return strings.TrimSpace(string(out))
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is an existing test helper function runGit(), you might want to reuse that?

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, thanks. The test now uses runGit for the setup.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants