Fix checkout skipping files with paths starting with '.git' (#2098)

Author: jelmer

NEWS

@@ -33,6 +33,11 @@
  * Support ``GIT_TRACE_PACKET`` in ``dulwich.cli``.
    (Jelmer Vernooij)
 
+ * Fix ``porcelain.checkout`` incorrectly skipping files whose paths start
+   with ``.git`` (such as ``.github/``, ``.gitignore``, ``.gitattributes``)
+   during working tree and index updates, leaving staged changes after a
+   clean checkout. (Jelmer Vernooij)
+
  * Fix cloning of SHA-256 repositories by including ``object-format`` and
    ``agent`` capabilities in Git protocol v2 ``ls-refs`` and ``fetch``
    commands. (Jelmer Vernooij)

dulwich/index.py

@@ -2736,9 +2736,7 @@ def update_working_tree(
             if change.type in (CHANGE_MODIFY, CHANGE_DELETE) and change.old:
                 path = change.old.path
                 assert path is not None
-                if path.startswith(b".git") or not validate_path(
-                    path, validate_path_element
-                ):
+                if not validate_path(path, validate_path_element):
                     continue
 
                 full_path = _tree_to_fs_path(repo_path, path, tree_encoding)
@@ -2779,9 +2777,7 @@ def update_working_tree(
             # Remove file/directory
             assert change.old is not None and change.old.path is not None
             path = change.old.path
-            if path.startswith(b".git") or not validate_path(
-                path, validate_path_element
-            ):
+            if not validate_path(path, validate_path_element):
                 continue
 
             full_path = _tree_to_fs_path(repo_path, path, tree_encoding)
@@ -2810,9 +2806,7 @@ def update_working_tree(
                 and change.new.mode is not None
             )
             path = change.new.path
-            if path.startswith(b".git") or not validate_path(
-                path, validate_path_element
-            ):
+            if not validate_path(path, validate_path_element):
                 continue
 
             full_path = _tree_to_fs_path(repo_path, path, tree_encoding)

tests/porcelain/__init__.py

@@ -4547,6 +4547,60 @@ def test_checkout_to_commit_sha(self) -> None:
         porcelain.checkout(self.repo, self._sha)
         self.assertEqual(self._sha, self.repo.head())
 
+        # Working tree and index should be clean after checkout
+        status = list(porcelain.status(self.repo))
+        self.assertEqual([{"add": [], "delete": [], "modify": []}, [], []], status)
+
+    def test_checkout_files_starting_with_dotgit(self) -> None:
+        # Regression test: paths starting with ".git" (like .github/, .gitignore,
+        # .gitattributes) were incorrectly skipped during checkout, leaving the
+        # index out of sync with HEAD.
+        github_dir = os.path.join(self.repo.path, ".github", "workflows")
+        os.makedirs(github_dir)
+
+        github_file = os.path.join(github_dir, "ci.yml")
+        gitignore_file = os.path.join(self.repo.path, ".gitignore")
+
+        with open(github_file, "w") as f:
+            f.write("# version 1\n")
+        with open(gitignore_file, "w") as f:
+            f.write("*.pyc\n")
+
+        porcelain.add(self.repo, paths=[github_file, gitignore_file])
+        sha1 = porcelain.commit(
+            self.repo,
+            message=b"add .github and .gitignore",
+            committer=b"Jane <jane@example.com>",
+            author=b"John <john@example.com>",
+        )
+
+        # Update those files in a second commit
+        with open(github_file, "w") as f:
+            f.write("# version 2\n")
+        with open(gitignore_file, "w") as f:
+            f.write("*.pyc\n*.pyo\n")
+
+        porcelain.add(self.repo, paths=[github_file, gitignore_file])
+        porcelain.commit(
+            self.repo,
+            message=b"update .github and .gitignore",
+            committer=b"Jane <jane@example.com>",
+            author=b"John <john@example.com>",
+        )
+
+        # Checkout the first commit (going back to v1)
+        porcelain.checkout(self.repo, sha1)
+
+        # Working tree and index should be clean (no staged changes)
+        status = list(porcelain.status(self.repo))
+        self.assertEqual([{"add": [], "delete": [], "modify": []}, [], []], status)
+
+        # Working tree files should have v1 content
+        with open(github_file) as f:
+            self.assertEqual("# version 1\n", f.read())
+        with open(gitignore_file) as f:
+            self.assertEqual("*.pyc\n", f.read())
+
     def test_checkout_to_head(self) -> None:
         new_sha = self._commit_something_wrong()