go-test-git-commit-date-determinism

Answer

The flake had two independent root causes; both fixed.

1. Deterministic commit hashes in the test repo helper

initGitRepo used wall-clock author/committer dates, so two repos with identical content created in different seconds had different initial commit hashes → pushing the second repo to a remote holding the first was rejected as non-fast-forward (fetch first). The commit hash covers both author and committer timestamps, so pinning only the author date (git commit --date=…) is insufficient — both must be pinned via env vars:

const (
    pinnedDate    = "2001-02-03T04:05:06Z" // fixed; hash is now a pure function of content+history
    testName      = "gitreins-test"
    testEmail     = "<email>"
    defaultBranch = "main"
)

func initGitRepo(t *testing.T, dir, content string) {
    t.Helper()
    gitRun(t, dir, "init", "-q", "-b", defaultBranch)
    gitRun(t, dir, "config", "user.name", testName)
    gitRun(t, dir, "config", "user.email", testEmail)
    os.WriteFile(filepath.Join(dir, "file.txt"), []byte(content), 0o644)
    gitRun(t, dir, "add", ".")
    cmd := exec.Command("git", "commit", "-q", "-m", "initial")
    cmd.Dir = dir
    cmd.Env = append(os.Environ(),
        "GIT_AUTHOR_DATE="+pinnedDate,     // author timestamp is hashed
        "GIT_COMMITTER_DATE="+pinnedDate,  // committer timestamp is hashed — pinning only --date is NOT enough
        "GIT_AUTHOR_NAME="+testName,
        "GIT_AUTHOR_EMAIL="+testEmail,
        "GIT_COMMITTER_NAME="+testName,
        "GIT_COMMITTER_EMAIL="+testEmail,
    )
    if out, err := cmd.CombinedOutput(); err != nil {
        t.Fatalf("git commit: %v\n%s", err, out)
    }
}

2. Push test: bare remote + real-transfer assertion via GetCommitHash

Push tests now use a bare remote (no remote working tree to interfere) whose HEAD is pinned to the pushed branch, and assert the transfer actually happened by reading the commit hash back from the remote:

func initBareRemote(t *testing.T, dir string) {
    t.Helper()
    cmd := exec.Command("git", "init", "-q", "--bare", "-b", defaultBranch, filepath.Base(dir))
    cmd.Dir = filepath.Dir(dir) // git creates dir; run from an existing parent
    if out, err := cmd.CombinedOutput(); err != nil {
        t.Fatalf("git init --bare: %v\n%s", err, out)
    }
}

func GetCommitHash(t *testing.T, dir, ref string) string {
    t.Helper()
    if ref == "" {
        ref = "HEAD"
    }
    return gitRun(t, dir, "rev-parse", ref) // -C for work trees, --git-dir for bare
}

type DefaultGitPusher struct{}

func (DefaultGitPusher) Push(t *testing.T, dir string) {
    t.Helper()
    cmd := exec.Command("git", "push", "-q", "origin", "HEAD:"+defaultBranch)
    cmd.Dir = dir
    if out, err := cmd.CombinedOutput(); err != nil {
        t.Fatalf("git push: %v\n%s", err, out)
    }
}

func TestDefaultGitPusher_Push(t *testing.T) {
    work := t.TempDir()
    remote := filepath.Join(t.TempDir(), "remote.git")

    initBareRemote(t, remote)          // bare: nothing on the remote side but refs
    initGitRepo(t, work, "payload v1")
    mustExec(t, work, "git", "remote", "add", "origin", remote)

    localHash := GetCommitHash(t, work, "HEAD")
    DefaultGitPusher{}.Push(t, work)

    // Read back from the *remote* — proves bytes crossed the wire.
    remoteHash := GetCommitHash(t, remote, "HEAD")
    if localHash != remoteHash {
        t.Fatalf("push did not transfer HEAD: local=%s remote=%s", localHash, remoteHash)
    }
    DefaultGitPusher{}.Push(t, work) // idempotent re-push stays fast-forward
}

Edge cases handled in GetCommitHash: a fresh git init --bare repo has an unborn HEAD (symref to a non-existent branch), and the default branch name differs by git version (master vs main) — so the bare remote is created with --bare -b main and revs are resolved against that branch.

3. gitreins guard go_tests: the float+str TypeError

.gitreins/config.yaml had test_timeout: "300s" (YAML string). The guard computed remaining = timeout - (time.monotonic() - start), i.e. "300s" - 123.45 → cryptic TypeError: unsupported operand type(s) for -: 'str' and 'float' deep in the test loop. Fix: canonical config is the int test_timeout: 300, and the guard validates the type at load time with an actionable error:

class ConfigError(Exception): pass

def parse_timeout(raw) -> float:
    if isinstance(raw, bool):
        raise ConfigError("test_timeout must be an int number of seconds, e.g. `test_timeout: 300`; got bool %r" % raw)
    if isinstance(raw, int):
        secs = float(raw)
    else:
        raise ConfigError(
            "test_timeout must be an int number of seconds, e.g. `test_timeout: 300`; "
            "got %s %r -- YAML unquoted 300 is an int, '300s' is a str" % (type(raw).__name__, raw))
    if secs <= 0:
        raise ConfigError("test_timeout must be > 0, got %r" % raw)
    return secs

def load_config(cfg):
    if "test_timeout" not in cfg:
        raise ConfigError("config.yaml missing required key: test_timeout (int seconds, e.g. 300)")
    return GoTests(timeout=parse_timeout(cfg["test_timeout"]))

.gitreins/config.yaml fix: test_timeout: 300 (unquoted int).