fix: do not require git to start up

Author: agateau-gg

changelog.d/20250515_155151_aurelien.gateau_dont_require_git.md

@@ -0,0 +1,3 @@
+### Fixed
+
+- `ggshield` no longer crashes when it can't find git.

ggshield/core/env_utils.py

@@ -6,7 +6,7 @@
 from dotenv import dotenv_values, load_dotenv
 
 from ggshield.core import ui
-from ggshield.utils.git_shell import get_git_root, is_git_dir
+from ggshield.utils.git_shell import get_git_root, is_git_available, is_git_dir
 from ggshield.utils.os import getenv_bool
 
 
@@ -37,7 +37,7 @@ def _find_dot_env() -> Optional[Path]:
         return env
 
     # If we are in a git checkout, look for a .env at the root of the checkout
-    if is_git_dir(os.getcwd()):
+    if is_git_available() and is_git_dir(os.getcwd()):
         env = get_git_root() / ".env"
         if env.is_file():
             return env

ggshield/utils/git_shell.py

@@ -59,6 +59,14 @@ class Filemode(Enum):
     UNKNOWN = "unknown"
 
 
+def is_git_available() -> bool:
+    try:
+        _get_git_path()
+        return True
+    except GitExecutableNotFound:
+        return False
+
+
 @lru_cache(None)
 def _get_git_path() -> str:
     git_path = which("git")
@@ -362,11 +370,11 @@ def get_last_commit_sha_of_branch(branch_name: str) -> Optional[str]:
 def get_repository_url_from_path(wd: Path) -> Optional[str]:
     """
     Returns one of the repository remote urls. Returns None if no remote are found,
-    or the directory is not a repository.
+    or the directory is not a repository or we don't have git so we can't know if the
+    directory is a repository.
     """
-    remotes_raw: List[str] = []
     try:
-        if not is_git_dir(wd):
+        if not is_git_available() or not is_git_dir(wd):
             return None
         remotes_raw = git(["remote", "-v"], cwd=wd).splitlines()
     except (subprocess.CalledProcessError, OSError):

tests/functional/secret/test_scan_path.py

@@ -1,4 +1,6 @@
 import json
+import shutil
+import sys
 from pathlib import Path
 
 import jsonschema
@@ -123,3 +125,35 @@ def test_scan_path_ignore_known_secrets(tmp_path: Path) -> None:
     # THEN only the unknown secret is reported
     assert f"KNOWN_SECRET='{KNOWN_SECRET}'" not in result.stdout
     assert f"UNKNOWN_SECRET='{UNKNOWN_SECRET}'" in result.stdout
+
+
+def create_fake_path(tmp_path: Path) -> Path:
+    # Create a bin dir
+    bin_path = (tmp_path / "bin").absolute()
+    bin_path.mkdir()
+
+    # Copy the binary of our interpreter to it
+    shutil.copy2(sys.executable, bin_path)
+
+    return bin_path
+
+
+def test_scan_path_works_if_git_not_found(monkeypatch, tmp_path: Path) -> None:
+    # GIVEN a test file with no secret
+    test_file = tmp_path / "hello"
+    test_file.write_text("harmless")
+
+    # AND a fake PATH containing only Python
+    fake_path = create_fake_path(tmp_path)
+    monkeypatch.setenv("PATH", str(fake_path))
+
+    # the name of the interpreter might be python3, not just python
+    python_filename = Path(sys.executable).name
+    assert shutil.which(python_filename) is not None
+
+    # AND git cannot be found
+    assert shutil.which("git") is None
+
+    # WHEN ggshield scans the test file
+    # THEN it does not fail
+    run_ggshield_scan("path", "--debug", str(test_file), cwd=tmp_path, expected_code=0)

tests/unit/utils/test_git_shell.py

@@ -10,6 +10,7 @@
 
 from ggshield.core.tar_utils import tar_from_ref_and_filepaths
 from ggshield.utils.git_shell import (
+    GitExecutableNotFound,
     InvalidGitRefError,
     NotAGitDirectory,
     check_git_dir,
@@ -22,6 +23,7 @@
     get_staged_filepaths,
     git,
     git_ls_unstaged,
+    is_git_available,
     is_git_dir,
     is_valid_git_commit_ref,
     simplify_git_url,
@@ -47,6 +49,12 @@ def _create_repository_with_remote(
     return local_repo
 
 
+@patch("ggshield.utils.git_shell._get_git_path")
+def test_is_git_available(_get_git_path_mock):
+    _get_git_path_mock.side_effect = GitExecutableNotFound()
+    assert not is_git_available()
+
+
 def test_git_shell():
     assert "usage: git" in git(["help"])