Merge main from upstream

.github/dependabot.yaml

@@ -13,6 +13,10 @@ updates:
       interval: "daily"
     commit-message:
       prefix: "build"
+    groups:
+      golang.org:
+        patterns:
+          - "golang.org/*"
 
   - package-ecosystem: "gomod"
     directory: "/cli/go-git"

.github/workflows/cifuzz.yml

@@ -1,6 +1,11 @@
 name: CIFuzz
-on: [pull_request]
+on: 
+  pull_request:
+    branches:
+      - main
+
 permissions: {}
+
 jobs:
  Fuzzing:
    runs-on: ubuntu-latest
@@ -28,7 +33,7 @@ jobs:
        path: ./out/artifacts
    - name: Upload Sarif
      if: always() && steps.build.outcome == 'success'
-     uses: github/codeql-action/upload-sarif@v3
+     uses: github/codeql-action/upload-sarif@v3.28.10
      with:
       # Path to SARIF file relative to the root of the repository
       sarif_file: cifuzz-sarif/results.sarif

.github/workflows/codeql.yml

@@ -1,17 +1,21 @@
-name: "CodeQL"
-
+name: CodeQL
 on:
   push:
-    branches: [ "master" ]
+    branches:
+    - releases/v5.x
+    - main
   pull_request:
-    branches: [ "master" ]
+
   schedule:
     - cron: '00 5 * * 1'
 
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+
     permissions:
       actions: read
       contents: read
@@ -28,7 +32,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@03e7845b7bfcd5e7fb63d1ae8c61b0e791134fab # v2.22.11
+        uses: github/codeql-action/init@ff79de67cc25c7617163ae1e4b8aa23b902fdf15 # v2.22.11
         with:
           languages: ${{ matrix.language }}
           # xref: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
@@ -39,6 +43,6 @@ jobs:
         run: go build ./...
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@03e7845b7bfcd5e7fb63d1ae8c61b0e791134fab # v2.22.11
+        uses: github/codeql-action/analyze@ff79de67cc25c7617163ae1e4b8aa23b902fdf15 # v2.22.11
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/git.yml

@@ -1,7 +1,12 @@
-on: [push, pull_request]
 name: Git Compatibility
-permissions:
-  contents: read
+on:
+  push:
+    branches:
+    - releases/v5.x
+    - main
+  pull_request:
+
+permissions: {}
 
 jobs:
   test:
@@ -15,14 +20,17 @@ jobs:
         GIT_VERSION: ${{ matrix.git[0] }}
         GIT_DIST_PATH: .git-dist/${{ matrix.git[0] }}
 
+    permissions:
+      contents: read
+
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
 
     - name: Install Go
       uses: actions/setup-go@v5
       with:
-        go-version: 1.22.x
+        go-version: stable
 
     - name: Install build dependencies
       run: sudo apt-get update && sudo apt-get install gettext libcurl4-openssl-dev

.github/workflows/pr-validation.yml

@@ -1,5 +1,4 @@
-name: 'PR Validation'
-
+name: PR Validation
 on:
   pull_request:
     types:
@@ -8,18 +7,21 @@ on:
       - reopened
       - synchronize
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   check-commit-message:
     name: Check Commit Messages
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
       - name: Check Package Prefix
         uses: gsactions/commit-message-checker@v2
         with:
-          pattern: '^(\*|git|plumbing|utils|config|_examples|internal|storage|cli|build): .+'
+          pattern: '^(\*|docs|git|plumbing|utils|config|_examples|internal|storage|cli|build): .+'
           error: |
             Commit message(s) does not align with contribution acceptance criteria.
 

.github/workflows/stale-issues-bot.yaml

@@ -1,15 +1,18 @@
-name: "stale issues bot"
+name: stale issues bot
 on:
   schedule:
   - cron: "0 7 * * *"
 
-permissions:
-  issues: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   stale-bot:
     runs-on: ubuntu-latest
+
+    permissions:
+      issues: write
+      pull-requests: write
+
     steps:
     - uses: actions/stale@v9
       with:

.github/workflows/test.yml

@@ -1,16 +1,24 @@
-on: [push, pull_request]
 name: Test
-permissions:
-  contents: read
+on: 
+  push:
+    branches:
+    - releases/v5.x
+    - main
+  pull_request:
+
+permissions: {}
 
 jobs:
   version-matrix:
     strategy:
       fail-fast: false
       matrix:
-        go-version: [1.20.x, 1.21.x, 1.22.x]
+        go-version: [1.22.x, 1.23.x, 1.24.x]
         platform: [ubuntu-latest, macos-latest, windows-latest]
 
+    permissions:
+      contents: read
+
     runs-on: ${{ matrix.platform }}
     steps:
     - name: Checkout code
@@ -36,4 +44,4 @@ jobs:
       run: make test-coverage
 
     - name: Test Examples
-      run: go test -timeout 30s -v -run '^TestExamples$' github.com/go-git/go-git/v5/_examples --examples
+      run: go test -timeout 45s -v -run '^TestExamples$' github.com/go-git/go-git/v5/_examples --examples

COMPATIBILITY.md

@@ -34,6 +34,7 @@ compatibility status with go-git.
 | `merge`     |             | ⚠️ (partial) | Fast-forward only                       |                                                                                                 |
 | `mergetool` |             | ❌           |                                         |                                                                                                 |
 | `stash`     |             | ❌           |                                         |                                                                                                 |
+| `sparse-checkout`     |             | ✅           |                                         | - [sparse-checkout](_examples/sparse-checkout/main.go)                                                                                               |
 | `tag`       |             | ✅           |                                         | - [tag](_examples/tag/main.go) <br/> - [tag create and push](_examples/tag-create-push/main.go) |
 
 ## Sharing and updating projects

CONTRIBUTING.md

@@ -1,36 +1,50 @@
 # Contributing Guidelines
 
-source{d} go-git project is [Apache 2.0 licensed](LICENSE) and accepts
-contributions via GitHub pull requests.  This document outlines some of the
+The go-git project is [Apache 2.0 licensed](LICENSE) and accepts
+contributions via GitHub pull requests. This document outlines some of the
 conventions on development workflow, commit message formatting, contact points,
 and other resources to make it easier to get your contribution accepted.
 
 ## Support Channels
 
-The official support channels, for both users and contributors, are:
+The official support channels, for users are:
 
-- [StackOverflow go-git tag](https://stackoverflow.com/questions/tagged/go-git) for user questions.
-- GitHub [Issues](https://github.com/src-d/go-git/issues)* for bug reports and feature requests.
+- [StackOverflow go-git tag] for user questions.
+- GitHub [Issues]* for bug reports and feature requests.
 
 *Before opening a new issue or submitting a new pull request, it's helpful to
 search the project - it's likely that another user has already reported the
 issue you're facing, or it's a known issue that we're already aware of.
 
+In addition to the channels above, contributors are also able to join the go-git [discord server].
 
 ## How to Contribute
 
 Pull Requests (PRs) are the main and exclusive way to contribute to the official go-git project.
 In order for a PR to be accepted it needs to pass a list of requirements:
 
 - You should be able to run the same query using `git`. We don't accept features that are not implemented in the official git implementation.
-- The expected behavior must match the [official git implementation](https://github.com/git/git).
+- The expected behavior must match the [official git implementation].
 - The actual behavior must be correctly explained with natural language and providing a minimum working example in Go that reproduces it.
-- All PRs must be written in idiomatic Go, formatted according to [gofmt](https://golang.org/cmd/gofmt/), and without any warnings from [go lint](https://github.com/golang/lint) nor [go vet](https://golang.org/cmd/vet/).
+- All PRs must be written in idiomatic Go, formatted according to [gofmt], and without any warnings from [go vet].
 - They should in general include tests, and those shall pass.
 - If the PR is a bug fix, it has to include a suite of unit tests for the new functionality.
 - If the PR is a new feature, it has to come with a suite of unit tests, that tests the new functionality.
 - In any case, all the PRs have to pass the personal evaluation of at least one of the maintainers of go-git.
 
+### Branches
+
+The development branch is `main`, where all development takes place.
+All new features and bug fixes should target it. This was formely known as `v6-exp`,
+as it contains all the changes for `v6` - the next major release.
+
+The `releases/v5.x` branch is the branch for changes to the `v5` version,
+which is now in maintaince mode. To avoid having to divert efforts from `v6`,
+we will only be accepting bug fixes or CVE related dependency bumps for the
+`v5` release.
+
+Bug fixes that also impact `main`, should be fixed there first, and then backported to `v5`.
+
 ### Format of the commit message
 
 Every commit message should describe what was changed, under which context and, if applicable, the GitHub issue it relates to:
@@ -44,3 +58,10 @@ The format can be described more formally as follows:
 ```
 <package>: <subpackage>, <what changed>. [Fixes #<issue-number>]
 ```
+
+[discord server]: https://discord.gg/8hrxYEVPE5
+[StackOverflow go-git tag]: https://stackoverflow.com/questions/tagged/go-git
+[Issues]: https://github.com/go-git/go-git/issues
+[official git implementation]: https://github.com/git/git
+[gofmt]: https://golang.org/cmd/gofmt/
+[go vet]: https://golang.org/cmd/vet/

EXTENDING.md

@@ -42,7 +42,7 @@ New filesystems (e.g. cloud based storage) could be created by implementing `go-
 
 Git supports various transport schemes, including `http`, `https`, `ssh`, `git`, `file`. `go-git` defines the [transport.Transport interface](plumbing/transport/common.go#L48) to represent them.
 
-The built-in implementations can be replaced by calling `client.InstallProtocol`.
+The built-in implementations can be replaced by calling `transport.Register`.
 
 An example of changing the built-in `https` implementation to skip TLS could look like this:
 
@@ -53,7 +53,7 @@ An example of changing the built-in `https` implementation to skip TLS could loo
 		},
 	}
 
-	client.InstallProtocol("https", githttp.NewClient(customClient))
+	transport.Register("https", githttp.NewClient(customClient))
 ```
 
 Some internal implementations enables code reuse amongst the different transport implementations. Some of these may be made public in the future (e.g. `plumbing/transport/internal/common`).

Makefile

@@ -14,6 +14,10 @@ GIT_REPOSITORY = http://github.com/git/git.git
 COVERAGE_REPORT = coverage.out
 COVERAGE_MODE = count
 
+# Defines the maximum time each fuzz target will be executed for.
+FUZZ_TIME ?= 10s
+FUZZ_PKGS = $(shell grep -r --include='**_test.go' --files-with-matches 'func Fuzz' . | xargs -I{} dirname {})
+
 build-git:
 	@if [ -f $(GIT_DIST_PATH)/git ]; then \
 		echo "nothing to do, using cache $(GIT_DIST_PATH)"; \
@@ -45,10 +49,6 @@ clean:
 	rm -rf $(GIT_DIST_PATH)
 
 fuzz:
-	@go test -fuzz=FuzzParser				$(PWD)/internal/revision
-	@go test -fuzz=FuzzDecoder				$(PWD)/plumbing/format/config
-	@go test -fuzz=FuzzPatchDelta			$(PWD)/plumbing/format/packfile
-	@go test -fuzz=FuzzParseSignedBytes		$(PWD)/plumbing/object
-	@go test -fuzz=FuzzDecode				$(PWD)/plumbing/object
-	@go test -fuzz=FuzzDecoder				$(PWD)/plumbing/protocol/packp
-	@go test -fuzz=FuzzNewEndpoint			$(PWD)/plumbing/transport
+	@for path in $(FUZZ_PKGS); do \
+		go test -fuzz=Fuzz -fuzztime=$(FUZZ_TIME) $$path; \
+	done

README.md

@@ -10,7 +10,7 @@ It's being actively developed since 2015 and is being used extensively by [Keyba
 Project Status
 --------------
 
-After the legal issues with the [`src-d`](https://github.com/src-d) organization, the lack of update for four months and the requirement to make a hard fork, the project is **now back to normality**.
+After the [legal issues](https://github.com/src-d/go-git/issues/1295#issuecomment-592965250) with the [`src-d`](https://github.com/src-d) organization, the lack of update for four months and the requirement to make a hard fork, the project is **now back to normality**.
 
 The project is currently actively maintained by individual contributors, including several of the original authors, but also backed by a new company, [gitsight](https://github.com/gitsight), where `go-git` is a critical component used at scale.
 

_examples/README.md

@@ -12,6 +12,7 @@ Here you can find a list of annotated _go-git_ examples:
       a repository using a GitHub personal access token.
     - [ssh private key](clone/auth/ssh/private_key/main.go) - Cloning a repository using a ssh private key.
     - [ssh agent](clone/auth/ssh/ssh_agent/main.go) - Cloning a repository using ssh-agent.
+- [config](config/main.go) - Explains how to work with config files. 
 - [commit](commit/main.go) - Commit changes to the current branch to an existent repository.
 - [push](push/main.go) - Push repository to default remote (origin).
 - [pull](pull/main.go) - Pull changes from a remote repository.
@@ -25,7 +26,6 @@ Here you can find a list of annotated _go-git_ examples:
 - [progress](progress/main.go) - Printing the progress information from the sideband.
 - [revision](revision/main.go) - Solve a revision into a commit.
 - [submodule](submodule/main.go) - Submodule update remote.
-- [azure devops](azure_devops/main.go) - Cloning Azure DevOps repositories.
 - [blame](blame/main.go) - Blame/annotate a commit.
 - [ls-remote](ls-remote/main.go) - List remote tags without cloning a repository.
 
@@ -34,3 +34,5 @@ Here you can find a list of annotated _go-git_ examples:
 - [clone with context](context/main.go) - Cloning a repository with graceful cancellation.
 - [storage](storage/README.md) - Implementing a custom storage system.
 - [sha256](sha256/main.go) - Init and committing repositories that use sha256 as object format.
+- [memory](memory/main.go) - Clone a repository into an in-memory dotgit storage and worktree.
+- [perf-clone](performance/clone/main.go) - Clone a repository with the least time and space complexity.