ci(downstream): test releases with CLI and Gix backends

The downstream runner always installed plain `GitPython` into a fresh
virtual environment, so starting it from a Gix-enabled environment still
exercised CLI. Add `--backend {cli,gix}`, retaining CLI as the default, and
pass the selection to tests and subprocesses through `GIT_PYTHON_BACKEND`.
Verify the imported checkout, selected backend and `gix.testtools` before
running downstream tests. Retain backend identity in result metadata and
expand the five-project CI matrix to ten jobs.

Both environments install GixPython 0.2.0 for fixture tooling. Move the local
SWE-bench checks' initial two-commit repositories and URL-rewrite configuration
into a Bash fixture; execute it at its final location because configuration
contains absolute fixture paths. Preserve tested clone/reset behavior and
best-effort cleanup. External upstream test files stay unchanged. Prepare
Rust and cache Cargo outputs in CI for source builds.

The four SWE-bench object/ref-format combinations passed with CLI and Gix on
the completed stack. Ruff lint/format, ShellCheck, actionlint and whitespace
checks passed at this commit. Other downstream releases and hosted CI were
not rerun for this fixture migration.

Author: codex

.github/workflows/downstream.yml

@@ -17,6 +17,7 @@ jobs:
       fail-fast: false
       matrix:
         project: [langchain, mlflow, bandit, swebench, datahub]
+        backend: [gix, cli]
     steps:
       - uses: actions/checkout@v7
         with:
@@ -28,10 +29,23 @@ jobs:
             sudo apt-get update
             sudo apt-get install --yes git
           fi
+      - name: Prepare Rust for GixPython fixture tooling
+        run: |
+          rustup update stable
+          rustup default stable
+          echo "CARGO_TARGET_DIR=$RUNNER_TEMP/gix-target" >> "$GITHUB_ENV"
+      - name: Cache GixPython builds
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            ${{ runner.temp }}/gix-target
+          key: downstream-gix-${{ runner.os }}-${{ hashFiles('gix-requirements.txt') }}
       - name: Install uv
         uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           version: '0.12.13'
           enable-cache: false
       - name: Test latest release against this checkout
-        run: uv run test/downstream/run.py "${{ matrix.project }}"
+        run: uv run test/downstream/run.py "${{ matrix.project }}" --backend "${{ matrix.backend }}"

test/downstream/README.md

@@ -5,16 +5,25 @@ Run released projects' GitPython-related tests against this checkout with
 
 ```sh
 uv run test/downstream/run.py bandit
+uv run test/downstream/run.py bandit --backend gix
 uv run test/downstream/run.py bandit --version 1.9.4
-for project in langchain mlflow bandit swebench datahub; do
-    uv run test/downstream/run.py "$project"
+for backend in gix cli; do
+    for project in langchain mlflow bandit swebench datahub; do
+        uv run test/downstream/run.py "$project" --backend "$backend"
+    done
 done
 ```
 
 The default resolves the latest release from PyPI each time. `--version` reproduces
-a release; `--python` selects the test interpreter (default: 3.12). The runner
-creates a fresh environment, replaces GitPython with this editable checkout, and checks
-the imported module before testing. Upstream test files are not modified.
+a release; `--python` selects the test interpreter (default: 3.12), including an
+existing interpreter's path. `--backend` selects `cli` (the default) or `gix`.
+The runner creates a fresh environment and installs this editable checkout,
+including the official GixPython release for `gix.testtools` on both backends.
+It sets `GIT_PYTHON_BACKEND` from `--backend` and verifies
+both the imported checkout and the selected backend before testing, and records
+the backend in `result.json` and the default work-directory name. Starting the
+runner from a Gix environment alone does not select Gix in the isolated test
+environment. Upstream test files are not modified.
 
 Source, the environment, frozen requirements, JUnit results, and release provenance
 are retained under `.cache/downstream/`. `--work-dir PATH` uses a new directory
@@ -35,7 +44,7 @@ and test-only dependencies are excluded. Downloads are not unique installations.
 | Project | Distribution downloads | Last tested release | Selected coverage |
 | --- | ---: | --- | --- |
 | LangChain Community | 27,882,881 | 0.4.2 | 2 upstream GitLoader tests: real clones, commits, checkout, tree traversal, ignored paths, and remote validation |
-| MLflow (`mlflow-skinny`) | 25,850,354 | 3.16.1 | 47 upstream tests: 31 repository/project/model-versioning cases plus 16 Git context and credential-redaction contract cases |
+| MLflow (`mlflow-skinny`) | 25,850,354 | 3.17.0 | 47 upstream tests: 31 repository/project/model-versioning cases plus 16 Git context and credential-redaction contract cases |
 | Bandit | 24,935,372 | 1.9.4 | 12 upstream baseline CLI tests: real repository creation, commits, branches, resets, discovery, and dirty state |
 | SWE-bench | 22,942,741 | 5.0.2 | 4 supplemental integration cases for `AutoContextManager`; no upstream tests cover its GitPython callers |
 | DataHub (`acryl-datahub`) | 5,019,402 | 1.7.0.14 | 7 upstream tests passed, 1 credential-dependent skip: public clone/checkout, SSH timeout, exception/redaction contracts, and configuration |
@@ -94,6 +103,8 @@ The private SSH-clone test retains its upstream skip: the runner removes its
 credential variable and needs no private credentials. `ssh`, public GitLab
 access, and local TCP sockets are needed for the selected tests.
 
-CI runs the same command against the latest release and fails when no test passes,
-including when all selected tests are skipped. Test dependency ranges only supply
-the upstream test harness; they do not pin the dependent's release.
+CI runs all five projects against the latest release with both CLI and Gix
+backends, for ten independent jobs. A backend mismatch or a run in which no
+test passes fails the job, including when all selected tests are skipped.
+Test dependency ranges only supply the upstream test harness; they do not pin
+the dependent's release.

test/downstream/checks/swebench.py

@@ -1,60 +1,54 @@
 """Supplemental checks: SWE-bench 5.0.2 ships no tests for its GitPython callers.
 
 Import the ordinary upstream utility module. The minimal environment only needs
-chardet and GitPython; no SWE-bench code or imported module is replaced.
+chardet, GitPython and GixPython fixtures; no SWE-bench code or imported module is replaced.
 """
 
-import subprocess
+import logging
 from pathlib import Path
 
 import pytest
+from gix import Error, testtools
 from git import Repo
 from swebench.inference.make_datasets.utils import (
     AutoContextManager,
     ingest_directory_contents,
 )
 
 
+@pytest.fixture
+def checkout_fixture(object_format, ref_format):
+    script = Path(__file__).resolve().parents[3] / "tests/fixtures/downstream-swebench.sh"
+    # The URL rewrite embeds the private fixture's absolute origin path.
+    try:
+        fixture = testtools.scripted_fixture_writable_with_args(
+            script, [object_format, ref_format], testtools.Creation.Execute
+        )
+    except Error:
+        raise RuntimeError("SWE-bench fixture script failed; see its captured output") from None
+    try:
+        yield fixture.path().resolve()
+    finally:
+        try:
+            fixture.close()
+        except Error:
+            logging.getLogger(__name__).warning("Could not completely clean up SWE-bench fixture")
+
+
 @pytest.mark.parametrize("object_format", ["sha1", "sha256"])
 @pytest.mark.parametrize("ref_format", ["files", "reftable"])
-def test_auto_context_manager_clones_and_resets(tmp_path, monkeypatch, object_format, ref_format):
+def test_auto_context_manager_clones_and_resets(checkout_fixture, monkeypatch, object_format, ref_format):
     """Clone, revisit commits and reuse the checkout with real GitPython."""
+    tmp_path = checkout_fixture
     origin = tmp_path / "origin"
-    origin.mkdir()
-    config = tmp_path / "gitconfig"
-    config.write_text("[user]\n name = GitPython Compatibility\n email = tests@example.invalid\n")
-    monkeypatch.setenv("GIT_CONFIG_GLOBAL", str(config))
+    monkeypatch.setenv("GIT_CONFIG_GLOBAL", str(tmp_path / "gitconfig"))
     monkeypatch.setenv("GIT_CONFIG_NOSYSTEM", "1")
     monkeypatch.setenv("GIT_DEFAULT_REF_FORMAT", ref_format)
     monkeypatch.setenv("GIT_ALLOW_PROTOCOL", "file")
     monkeypatch.setenv("GIT_TERMINAL_PROMPT", "0")
-
-    def git(*args):
-        return subprocess.run(
-            ["git", "-C", str(origin), *args], check=True, text=True, capture_output=True
-        ).stdout.strip()
-
-    git("init", "-b", "main", f"--object-format={object_format}", f"--ref-format={ref_format}")
-    (origin / "README.md").write_text("Local fixture\n")
-    (origin / "module.py").write_text("value = 1\n")
-    git("add", "--", "README.md", "module.py")
-    git("commit", "-m", "initial")
-    first_commit = git("rev-parse", "HEAD")
-    (origin / "module.py").write_text("value = 2\n")
-    git("commit", "-am", "second")
-    second_commit = git("rev-parse", "HEAD")
-
-    # Preserve SWE-bench's ordinary HTTPS URL construction while routing the
-    # transport to our local fixture. No network access or credentials are used.
-    git(
-        "config",
-        "--global",
-        f"url.{origin.as_uri()}.insteadOf",
-        "https://gitpython-tests@github.com/swe-bench-repos/fixture__project.git",
-    )
-    git("config", "--global", "protocol.file.allow", "always")
+    first_commit = (tmp_path / "first-commit").read_text().strip()
+    second_commit = (tmp_path / "second-commit").read_text().strip()
     root = tmp_path / "checkouts"
-    root.mkdir()
     instance = {"repo": "fixture/project", "base_commit": first_commit}
     original_cwd = Path.cwd()
     manager = AutoContextManager(instance, root_dir=str(root), token="gitpython-tests")

test/downstream/run.py

@@ -88,6 +88,7 @@ def main():
     profiles = json.loads((HERE / "projects.json").read_text())
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("project", choices=profiles)
+    parser.add_argument("--backend", choices=("cli", "gix"), default="cli", help="Backend to install and verify")
     parser.add_argument("--version", help="Release to reproduce; defaults to PyPI's latest release")
     parser.add_argument("--python", default="3.12", help="Python used by the isolated test environment")
     parser.add_argument("--work-dir", type=Path, help="New directory for retained source, environment, and results")
@@ -100,8 +101,8 @@ def main():
     else:
         cache = CHECKOUT / ".cache" / "downstream"
         cache.mkdir(parents=True, exist_ok=True)
-        work = Path(tempfile.mkdtemp(prefix=f"{args.project}-{version}-", dir=cache))
-    print(f"Testing {args.project} {version}; retained work directory: {work}", flush=True)
+        work = Path(tempfile.mkdtemp(prefix=f"{args.project}-{version}-{args.backend}-", dir=cache))
+    print(f"Testing {args.project} {version} with {args.backend}; retained work directory: {work}", flush=True)
 
     config = work / "gitconfig"
     config.write_text(
@@ -122,6 +123,7 @@ def main():
     python = bin_dir / ("python.exe" if os.name == "nt" else "python")
     env["PATH"] = str(bin_dir) + os.pathsep + env["PATH"]
     env["GITPYTHON_CHECKOUT"] = str(CHECKOUT)
+    env["GIT_PYTHON_BACKEND"] = args.backend
     for key in profile.get("unset_env", []):
         env.pop(key, None)
     env.update(profile.get("env", {}))
@@ -134,25 +136,35 @@ def expand(value):
     if profile.get("no_deps"):
         run(install + ["--no-deps"] + list(map(expand, profile["no_deps"])), env=env)
     # Replace the released dependency even if the downstream pins another version.
-    run(install + ["--reinstall-package", "gitpython", "-e", str(CHECKOUT)], env=env)
+    requirement = str(CHECKOUT) + "[gix]"
+    run(install + ["--reinstall-package", "gitpython", "-e", requirement], env=env)
 
     # Check the import used by tests and by downstream Python subprocesses.
     run(
         [
             str(python),
             "-c",
-            "import os, pathlib, git; "
+            "import os, pathlib, sys, git; from git import _backend; from gix import testtools; "
             "expected = pathlib.Path(os.environ['GITPYTHON_CHECKOUT']) / 'git' / '__init__.py'; "
             "assert pathlib.Path(git.__file__).resolve() == expected.resolve(), git.__file__; "
+            "print('GitPython backend:', _backend.name); "
+            "assert _backend.name == sys.argv[1], f'Expected {sys.argv[1]} backend, got {_backend.name}'; "
             "print('GitPython:', git.__file__); print(git.Git().version()); "
             "assert git.Git().version_info >= (2, 52), 'Git 2.52 or newer is required'",
+            args.backend,
         ],
         cwd=source,
         env=env,
     )
     with (work / "requirements-frozen.txt").open("w") as output:
         run(["uv", "pip", "freeze", "--python", str(python)], env=env, stdout=output)
-    result = {"project": args.project, "version": version, "source": provenance, "gitpython": str(CHECKOUT)}
+    result = {
+        "project": args.project,
+        "version": version,
+        "backend": args.backend,
+        "source": provenance,
+        "gitpython": str(CHECKOUT),
+    }
     result_path = work / "result.json"
     result_path.write_text(json.dumps(result, indent=2) + "\n")
     report = work / "junit.xml"

tests/fixtures/downstream-swebench.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -eu
+export GIT_AUTHOR_NAME='GitPython Compatibility' GIT_AUTHOR_EMAIL='tests@example.invalid'
+export GIT_COMMITTER_NAME="$GIT_AUTHOR_NAME" GIT_COMMITTER_EMAIL="$GIT_AUTHOR_EMAIL"
+export GIT_AUTHOR_DATE='2001-01-01T00:00:00 +0000'
+export GIT_COMMITTER_DATE="$GIT_AUTHOR_DATE"
+git init -q -b main --object-format="$1" --ref-format="$2" origin
+printf 'Local fixture\n' > origin/README.md
+printf 'value = 1\n' > origin/module.py
+git -C origin add README.md module.py
+git -C origin commit -qm initial
+git -C origin rev-parse HEAD > first-commit
+printf 'value = 2\n' > origin/module.py
+git -C origin commit -qam second
+git -C origin rev-parse HEAD > second-commit
+git config --file gitconfig user.name "$GIT_AUTHOR_NAME"
+git config --file gitconfig user.email "$GIT_AUTHOR_EMAIL"
+git config --file gitconfig "url.$PWD/origin.insteadOf" https://gitpython-tests@github.com/swe-bench-repos/fixture__project.git
+git config --file gitconfig protocol.file.allow always
+mkdir checkouts