Remove last git shell-out and fix dropped commit label

[thardeck]

This PR consolidates all git operations to go-git by replacing the last remaining shell-out to the git binary in production code. It also fixes a bug where the commit label is silently dropped when no other labels are set.

• Replace exec.Command("git", "rev-parse", "HEAD") with go-git's PlainOpenWithOptions + ResolveRevision. Add dir parameter to currentCommit to enable unit testing from arbitrary directories, including nested subdirectories within a repo. DetectDotGit: true walks parent directories to locate the .git root, matching the shell-out behavior.
• Fix bug in Apply.run where opts.Labels was set to a.Label instead of the local labels variable. When a.Label is nil but a commit is detected, labels is reassigned to a new map for the commit label — but opts.Labels remained nil, silently dropping the label. Now correctly uses labels.

Refers #4877

[Copilot]

Pull request overview

This PR removes the last production dependency on the external git binary by switching fleet apply’s currentCommit implementation from a git rev-parse HEAD shell-out to using go-git APIs.

Changes:

• Replace exec.Command("git", "rev-parse", "HEAD") with gogit.PlainOpenWithOptions + ResolveRevision("HEAD").
• Update Apply.run to call currentCommit(".") with an explicit directory argument.
• Add unit tests for currentCommit using an in-memory initialized go-git repo on disk.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
internal/cmd/cli/apply.go	Replaces git shell-out with go-git open + revision resolve logic.
internal/cmd/cli/apply_test.go	Adds TestCurrentCommit validating behavior for non-repo dirs and a simple repo HEAD.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

This PR removes the last production dependency on the git binary by switching fleet apply’s HEAD SHA detection from a git rev-parse HEAD exec to go-git’s repository APIs.

Changes:

• Replaced shell-out (os/exec) logic in currentCommit with go-git PlainOpenWithOptions(...DetectDotGit) + ResolveRevision("HEAD").
• Updated fleet apply to call currentCommit(".").
• Added unit tests validating behavior in non-git dirs, git repos, and nested subdirectories.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
internal/cmd/cli/apply.go	Replaces exec-based HEAD resolution with go-git and updates call site to pass a directory.
internal/cmd/cli/apply_test.go	Adds tests for currentCommit covering non-repo, repo, and nested directory cases.

Comments suppressed due to low confidence (1)

internal/cmd/cli/apply.go:109

• labels is a local copy of a.Label. When a.Label is nil and a.Commit is set, this code initializes and mutates labels but never assigns it back to a.Label (or otherwise ensures it’s used later), so the commit label can be silently dropped. Consider assigning a.Label = labels after adding fleet.CommitLabel, or ensure the downstream options use labels instead of a.Label.

	labels := a.Label
	if a.Commit == "" {
		a.Commit = currentCommit(".")
	}
	if a.Commit != "" {
		if labels == nil {
			labels = map[string]string{}
		}
		labels[fleet.CommitLabel] = a.Commit

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.