avoid holding locks during Export

Signed-off-by: Connor Braa <connor@dagger.io>

Author: cwlbraa

repository/git.go

@@ -181,6 +181,7 @@ func (r *Repository) propagateToWorktree(ctx context.Context, env *environment.E
 			"err", rerr)
 	}()
 
+	// Export environment without holding any git locks - this only writes to filesystem
 	if err := r.exportEnvironment(ctx, env); err != nil {
 		return err
 	}
@@ -189,23 +190,31 @@ func (r *Repository) propagateToWorktree(ctx context.Context, env *environment.E
 	if err != nil {
 		return fmt.Errorf("failed to get worktree path: %w", err)
 	}
+
 	// Protect commitWorktreeChanges to prevent concurrent writes to .git/worktrees/*/logs/HEAD
 	if err := r.lockManager.WithLock(ctx, LockTypeWorktree, func() error {
 		return r.commitWorktreeChanges(ctx, worktreePath, explanation)
 	}); err != nil {
 		return fmt.Errorf("failed to commit worktree changes: %w", err)
 	}
 
-	if err := r.saveState(ctx, env); err != nil {
-		return fmt.Errorf("failed to add notes: %w", err)
-	}
+	// Use git notes lock for all git notes operations
+	if err := r.lockManager.WithLock(ctx, LockTypeGitNotes, func() error {
+		if err := r.saveState(ctx, env); err != nil {
+			return fmt.Errorf("failed to add notes: %w", err)
+		}
 
-	slog.Info("Fetching container-use remote in source repository")
-	if _, err := RunGitCommand(ctx, r.userRepoPath, "fetch", containerUseRemote, env.ID); err != nil {
-		return err
-	}
+		slog.Info("Fetching container-use remote in source repository")
+		if _, err := RunGitCommand(ctx, r.userRepoPath, "fetch", containerUseRemote, env.ID); err != nil {
+			return err
+		}
 
-	if err := r.propagateGitNotes(ctx, gitNotesStateRef); err != nil {
+		if err := r.propagateGitNotesUnlocked(ctx, gitNotesStateRef); err != nil {
+			return err
+		}
+
+		return nil
+	}); err != nil {
 		return err
 	}
 
@@ -234,23 +243,27 @@ func (r *Repository) exportEnvironment(ctx context.Context, env *environment.Env
 	return nil
 }
 func (r *Repository) propagateGitNotes(ctx context.Context, ref string) error {
+	return r.lockManager.WithLock(ctx, LockTypeGitNotes, func() error {
+		return r.propagateGitNotesUnlocked(ctx, ref)
+	})
+}
+
+func (r *Repository) propagateGitNotesUnlocked(ctx context.Context, ref string) error {
 	fullRef := fmt.Sprintf("refs/notes/%s", ref)
 	fetch := func() error {
 		_, err := RunGitCommand(ctx, r.userRepoPath, "fetch", containerUseRemote, fullRef+":"+fullRef)
 		return err
 	}
 
-	return r.lockManager.WithLock(ctx, LockTypeGitNotes, func() error {
-		if err := fetch(); err != nil {
-			if strings.Contains(err.Error(), "[rejected]") {
-				if _, err := RunGitCommand(ctx, r.userRepoPath, "update-ref", "-d", fullRef); err == nil {
-					return fetch()
-				}
+	if err := fetch(); err != nil {
+		if strings.Contains(err.Error(), "[rejected]") {
+			if _, err := RunGitCommand(ctx, r.userRepoPath, "update-ref", "-d", fullRef); err == nil {
+				return fetch()
 			}
-			return err
 		}
-		return nil
-	})
+		return err
+	}
+	return nil
 }
 
 func (r *Repository) saveState(ctx context.Context, env *environment.Environment) error {
@@ -272,10 +285,8 @@ func (r *Repository) saveState(ctx context.Context, env *environment.Environment
 		return err
 	}
 
-	return r.lockManager.WithLock(ctx, LockTypeGitNotes, func() error {
-		_, err = RunGitCommand(ctx, worktreePath, "notes", "--ref", gitNotesStateRef, "add", "-f", "-F", f.Name())
-		return err
-	})
+	_, err = RunGitCommand(ctx, worktreePath, "notes", "--ref", gitNotesStateRef, "add", "-f", "-F", f.Name())
+	return err
 }
 
 func (r *Repository) loadState(ctx context.Context, worktreePath string) ([]byte, error) {

repository/repository.go

@@ -359,15 +359,17 @@ func (r *Repository) isDescendantOfCommit(ctx context.Context, ancestorCommit, e
 // Update saves the provided environment to the repository.
 // Writes configuration and source code changes to the worktree and history + state to git notes.
 func (r *Repository) Update(ctx context.Context, env *environment.Environment, explanation string) error {
-	return r.lockManager.WithLock(ctx, LockTypeGitNotes, func() error {
-		if err := r.propagateToWorktree(ctx, env, explanation); err != nil {
-			return err
-		}
-		if note := env.Notes.Pop(); note != "" {
+	if err := r.propagateToWorktree(ctx, env, explanation); err != nil {
+		return err
+	}
+
+	// Handle git notes outside the main propagation to avoid holding locks during export
+	if note := env.Notes.Pop(); note != "" {
+		return r.lockManager.WithLock(ctx, LockTypeGitNotes, func() error {
 			return r.addGitNote(ctx, env, note)
-		}
-		return nil
-	})
+		})
+	}
+	return nil
 }
 
 // Delete removes an environment from the repository.