test: use inode identity instead of mtime to detect shallow rewrite

The test's case 1 and case 2 want to verify that git_ungraft.sh does
not rewrite `.git/shallow` when there are no candidates (case 1) or
when run with `--dry-run` (case 2). The previous implementation
compared `stat %Y` (seconds-precision mtime) before and after, which
proved flaky on CI: git's shallow-handling appears to touch the file
in place during read-only sub-commands run by the script, leaving
the inode unchanged but bumping mtime into a new second.

Switch to inode identity. The script's rewrite path is a tempfile
+ `mv`, which atomically replaces the file and therefore changes
its inode. The inode check precisely targets that rewrite and
ignores incidental in-place touches by unrelated git machinery.

Author: nh13

tests/test_git_ungraft.sh

@@ -3,13 +3,15 @@
 # Unit test for src/scripts/git_ungraft.sh.
 #
 # Builds a self-contained shallow clone from a local bare repo (no
-# network) and exercises three behaviors:
+# network) and exercises four behaviors:
 #   1. Before parents are fetched: no candidates, shallow file unchanged
-#      (mtime preserved).
+#      (inode identity preserved — see case 1 rationale below).
 #   2. --dry-run: prints "Would ungraft <sha>" lines without modifying
 #      .git/shallow.
 #   3. Default (non-dry) run: rewrites .git/shallow, removing the
 #      entries whose parents are now locally present.
+#   4. Run from a linked worktree: the script reads .git/shallow from
+#      the common git dir, not the per-worktree gitdir.
 
 set -euo pipefail
 
@@ -47,19 +49,24 @@ if [ ! -f "${shallow_file}" ]; then
 fi
 shallow_before="$(cat "${shallow_file}")"
 
-# --- case 1: no candidates, no rewrite, mtime preserved ---
+# --- case 1: no candidates, no rewrite, file not replaced ---
 # Parents of the shallow-boundary commit are NOT present locally, so
 # no entry is ungraftable.  The script must not rewrite the file.
-mtime_before="$(stat -f %m "${shallow_file}" 2>/dev/null || stat -c %Y "${shallow_file}")"
+# We check inode identity (not mtime): the script rewrites via
+# `mv "$tmp" "$shallow_file"`, which atomically replaces the file and
+# therefore changes its inode.  An mtime check is unreliable because
+# git's shallow-handling code may touch `.git/shallow` in place during
+# read-only sub-commands run by the script, producing flaky failures.
+inode_before="$(stat -f %i "${shallow_file}" 2>/dev/null || stat -c %i "${shallow_file}")"
 output="$(bash "${UNGRAFT}")"
-mtime_after="$(stat -f %m "${shallow_file}" 2>/dev/null || stat -c %Y "${shallow_file}")"
+inode_after="$(stat -f %i "${shallow_file}" 2>/dev/null || stat -c %i "${shallow_file}")"
 if [ "${output}" != "No candidate commits to ungraft" ]; then
     echo "FAIL (case 1): expected 'No candidate commits to ungraft'"
     echo "  got: ${output}"
     exit 1
 fi
-if [ "${mtime_before}" != "${mtime_after}" ]; then
-    echo "FAIL (case 1): .git/shallow mtime changed on no-op run"
+if [ "${inode_before}" != "${inode_after}" ]; then
+    echo "FAIL (case 1): .git/shallow inode changed on no-op run"
     exit 1
 fi
 if [ "$(cat "${shallow_file}")" != "${shallow_before}" ]; then
@@ -110,19 +117,21 @@ fi
 echo "Ungraftable candidate: ${ungraftable}"
 
 # --- case 2: --dry-run prints candidates without rewriting ---
-mtime_before="$(stat -f %m "${shallow_file}" 2>/dev/null || stat -c %Y "${shallow_file}")"
+# As in case 1, use inode identity to detect the script's `mv`-based
+# rewrite; mtime is unreliable here (see case 1 comment).
+inode_before="$(stat -f %i "${shallow_file}" 2>/dev/null || stat -c %i "${shallow_file}")"
 contents_before="$(cat "${shallow_file}")"
 dry_output="$(bash "${UNGRAFT}" --dry-run)"
-mtime_after="$(stat -f %m "${shallow_file}" 2>/dev/null || stat -c %Y "${shallow_file}")"
+inode_after="$(stat -f %i "${shallow_file}" 2>/dev/null || stat -c %i "${shallow_file}")"
 if ! grep -qxF "Would ungraft ${ungraftable}" <<< "${dry_output}"; then
     echo "FAIL (case 2): expected 'Would ungraft ${ungraftable}' in dry-run output"
     echo "--- dry-run output ---"
     echo "${dry_output}"
     echo "----------------------"
     exit 1
 fi
-if [ "${mtime_before}" != "${mtime_after}" ]; then
-    echo "FAIL (case 2): --dry-run changed .git/shallow mtime"
+if [ "${inode_before}" != "${inode_after}" ]; then
+    echo "FAIL (case 2): --dry-run replaced .git/shallow (inode changed)"
     exit 1
 fi
 if [ "$(cat "${shallow_file}")" != "${contents_before}" ]; then
@@ -146,4 +155,53 @@ if grep -qxF "${ungraftable}" "${shallow_file}"; then
 fi
 echo "PASS (case 3): ungraftable entry removed from .git/shallow"
 
+# --- case 4: works from a linked worktree ---
+# Regression guard: `.git/shallow` lives in the common git dir, not
+# the per-worktree gitdir.  The script must use `git rev-parse
+# --git-common-dir` so that running it from a linked worktree still
+# finds (and rewrites) the shallow file in the primary `.git`.  Using
+# `--absolute-git-dir` would silently no-op ("No candidate commits to
+# ungraft") in a linked worktree because `.git/worktrees/<name>/shallow`
+# does not exist.
+#
+# Build a fresh ungraftable state: case 3 cleared the previous
+# candidate, so fetch the head-parent's parent at --depth=1 so it
+# joins the shallow boundary and the head-parent becomes ungraftable
+# again.
+grandparent="$(git cat-file -p "${head_parent}" \
+    | awk '/^$/ { exit } $1 == "parent" { print $2 }' | head -n1)"
+if [ -z "${grandparent}" ]; then
+    echo "FAIL (case 4): could not determine grandparent SHA for worktree test"
+    exit 1
+fi
+git fetch --quiet --update-shallow --depth=1 origin \
+    "${grandparent}:__grandparent__"
+wt_candidate="${head_parent}"
+if ! git cat-file -e "${grandparent}^{commit}" 2>/dev/null; then
+    echo "FAIL (case 4): grandparent not local after fetch — test setup broken"
+    exit 1
+fi
+if ! grep -qxF "${wt_candidate}" "${shallow_file}"; then
+    echo "FAIL (case 4): expected ${wt_candidate} in .git/shallow"
+    cat "${shallow_file}"
+    exit 1
+fi
+
+WORKTREE="${TMP}/worktree"
+git -C "${CLIENT}" worktree add --quiet --detach "${WORKTREE}" >/dev/null
+wt_output="$(bash "${UNGRAFT}" -C "${WORKTREE}" --dry-run)"
+# The fix (--git-common-dir) makes the script find the shared
+# .git/shallow from the worktree and list the ungraftable entry.
+# The bug (--absolute-git-dir) would resolve to
+# .git/worktrees/<name>/shallow (nonexistent) and print
+# "No candidate commits to ungraft".
+if ! grep -qxF "Would ungraft ${wt_candidate}" <<< "${wt_output}"; then
+    echo "FAIL (case 4): script did not see .git/shallow from linked worktree"
+    echo "--- output ---"
+    echo "${wt_output}"
+    echo "--------------"
+    exit 1
+fi
+echo "PASS (case 4): script reads .git/shallow from linked worktree"
+
 echo "PASS: test_git_ungraft.sh"