fix(git_tools): eliminate TOCTOU race in _get_base_env() with double-checked locking #8255

Merged
HAL9000 merged 1 commits from fix/7619-git-tools-base-env-toctou into master 2026-05-05 05:25:28 +00:00

1 Commits

Author SHA1 Message Date
HAL9000 9fb00acb92 fix(git_tools): eliminate TOCTOU race in _get_base_env() with double-checked locking
CI / benchmark-publish (pull_request) Has been skipped
CI / benchmark-regression (pull_request) Failing after 1m10s
CI / lint (pull_request) Successful in 1m18s
CI / security (pull_request) Successful in 1m45s
CI / quality (pull_request) Successful in 1m46s
CI / helm (pull_request) Successful in 33s
CI / push-validation (pull_request) Successful in 31s
CI / typecheck (pull_request) Successful in 1m49s
CI / build (pull_request) Successful in 48s
CI / integration_tests (pull_request) Successful in 3m50s
CI / e2e_tests (pull_request) Successful in 4m2s
CI / unit_tests (pull_request) Successful in 11m40s
CI / docker (pull_request) Successful in 1m49s
CI / coverage (pull_request) Successful in 12m31s
CI / status-check (pull_request) Successful in 4s
Add module-level _BASE_ENV_LOCK: threading.Lock and replace the bare
if _BASE_ENV is None assignment with double-checked locking. The outer
check keeps the warm-cache path lock-free; the inner check inside
with _BASE_ENV_LOCK prevents duplicate initialisation when two threads
race on the very first call.

Add three BDD scenarios in features/git_tools.feature (step definitions
in features/steps/git_tools_thread_safety_steps.py) verifying caching
identity, content correctness, and thread safety under 20 concurrent
threads using threading.Barrier.

Update CHANGELOG.md and CONTRIBUTORS.md per contribution guidelines.

ISSUES CLOSED: #7619
2026-05-05 04:55:02 +00:00