test(ci): instrument test_git_ungraft case 2 with strace + sha256 (investigation)

Temporary diagnostic branch only — not for merge.

Adds strace (Linux) around the --dry-run invocation in case 2 and
captures sha256 alongside inode before/after.  Goal: identify which
process+syscall is flipping .git/shallow's inode on ubuntu-24.04,
and whether contents change or only the inode (atomic rename with
same bytes).

Also sets fail-fast: false on the shell-tests matrix so the flake
does not cancel the other OS runs.

Author: nh13

.github/workflows/tests.yml

@@ -55,6 +55,7 @@ jobs:
           tests/*.sh
   shell-tests:
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-24.04, ubuntu-22.04, macos-15, macos-14]
     runs-on: ${{ matrix.os }}
@@ -65,6 +66,9 @@ jobs:
       uses: fulcrumgenomics/gha-timer@d0d886fa587c7f4f714e64d84aa6e274e818d48b # v1.1.1
       with:
         skip-banner: true
+    - name: Install strace (Linux only, for flake investigation)
+      if: runner.os == 'Linux'
+      run: sudo apt-get update && sudo apt-get install -y strace
     - name: Run shell unit tests
       shell: bash
       run: |

tests/test_git_ungraft.sh

@@ -156,10 +156,56 @@ echo "Ungraftable candidate: ${ungraftable}"
 # --- case 2: --dry-run prints candidates without rewriting ---
 # As in case 1, use inode identity to detect the script's `mv`-based
 # rewrite; mtime is unreliable here (see case 1 comment).
+#
+# INSTRUMENTED (temporary, for flake investigation): also capture sha256
+# and, when strace is available, the syscall trace around the dry-run
+# invocation.  The two-part invariant is:
+#   (a) the script's own `mv` must not fire on --dry-run  (inode identity)
+#   (b) no process (script or sub-git) must change the bytes of shallow
+#       (sha256 identity)
+# Contents-changing without our `mv` would be a real regression; inode-
+# changing without contents-changing would indicate a sub-git internal
+# rewrite is crossing our invariant.  Strace disambiguates which PID
+# and syscall did the work.
 inode_before="$(stat -f %i "${shallow_file}" 2>/dev/null || stat -c %i "${shallow_file}")"
+sha_before="$(shasum -a 256 "${shallow_file}" | awk '{print $1}')"
 contents_before="$(cat "${shallow_file}")"
-dry_output="$(bash "${UNGRAFT}" --dry-run)"
+echo "[case 2 pre]  inode=${inode_before} sha256=${sha_before}  git=$(git --version)"
+
+strace_log=""
+if command -v strace >/dev/null 2>&1; then
+    strace_log="${TMP}/case2.strace"
+    # -f: follow forks into git subprocesses.
+    # Trace the superset of syscalls any write to .git/shallow could use
+    # (atomic tempfile-rename, in-place write, unlink+create).  Swallow
+    # strace failures (e.g. ptrace restricted) and fall back to a plain
+    # run so we still exercise the assertion.
+    if ! dry_output="$(strace -f -o "${strace_log}" \
+            -e trace=openat,creat,rename,renameat,renameat2,unlink,unlinkat,write \
+            bash "${UNGRAFT}" --dry-run 2>&1)"; then
+        echo "[case 2]  strace invocation failed; retrying without it"
+        strace_log=""
+        dry_output="$(bash "${UNGRAFT}" --dry-run)"
+    fi
+else
+    echo "[case 2]  strace not installed; running without syscall trace"
+    dry_output="$(bash "${UNGRAFT}" --dry-run)"
+fi
+
 inode_after="$(stat -f %i "${shallow_file}" 2>/dev/null || stat -c %i "${shallow_file}")"
+sha_after="$(shasum -a 256 "${shallow_file}" | awk '{print $1}')"
+echo "[case 2 post] inode=${inode_after} sha256=${sha_after}"
+
+# Always dump any syscall on the shallow file so we see the baseline
+# even on passing runs.  Grep on the basename so relative-path and
+# absolute-path writes both surface.
+if [ -n "${strace_log}" ] && [ -f "${strace_log}" ]; then
+    echo "[case 2 trace] strace entries mentioning 'shallow':"
+    if ! grep -F shallow "${strace_log}" | head -200; then
+        echo "  (no matches)"
+    fi
+fi
+
 if ! grep -qxF "Would ungraft ${ungraftable}" <<< "${dry_output}"; then
     echo "FAIL (case 2): expected 'Would ungraft ${ungraftable}' in dry-run output"
     echo "--- dry-run output ---"
@@ -169,6 +215,19 @@ if ! grep -qxF "Would ungraft ${ungraftable}" <<< "${dry_output}"; then
 fi
 if [ "${inode_before}" != "${inode_after}" ]; then
     echo "FAIL (case 2): --dry-run replaced .git/shallow (inode changed)"
+    echo "  inode_before=${inode_before} inode_after=${inode_after}"
+    echo "  sha256_before=${sha_before}"
+    echo "  sha256_after =${sha_after}"
+    if [ "${sha_before}" = "${sha_after}" ]; then
+        echo "  (contents identical — atomic rewrite with same bytes)"
+    else
+        echo "  (contents DIFFERED — real rewrite, not a same-bytes swap)"
+    fi
+    if [ -n "${strace_log}" ] && [ -f "${strace_log}" ]; then
+        echo "--- strace entries touching 'shallow' (first 500) ---"
+        grep -F shallow "${strace_log}" | head -500
+        echo "------------------------------------------------------"
+    fi
     exit 1
 fi
 if [ "$(cat "${shallow_file}")" != "${contents_before}" ]; then