test(sops): make registerSOPSSource idempotent in e2e tests

cmd/workspace/up/up_client.go

@@ -99,10 +99,12 @@ func (cmd *UpCmd) prepareClient(
 	// client's resolved WorkspaceConfig().Source, not the possibly-nil
 	// source parsed above.
 	if err := cmd.prepareResolvedWorkspaceSecrets(ctx, devsyConfig, client); err != nil {
+		_ = client.Delete(ctx, client2.DeleteOptions{Force: true, IgnoreNotFound: true})
 		return nil, err
 	}
 
 	if err := cmd.checkProviderUpdate(ctx, devsyConfig, client); err != nil {
+		_ = client.Delete(ctx, client2.DeleteOptions{Force: true, IgnoreNotFound: true})
 		return nil, err
 	}
 	return client, nil

e2e/tests/up/sops.go

@@ -14,6 +14,7 @@ import (
 )
 
 const (
+	sourceSubCmd       = "source"
 	sopsE2EPlaintext   = "SUPER_SECRET_TEST_VALUE_7B91"
 	sopsE2EMounted     = "mounted-value-77"
 	sopsE2EAgeIdentity = "AGE-SECRET-KEY-12UWYSAH2MRDQ5K4EWC4253PDTCSCS32Y5EFQ8TEN2SL3QYU2GN2SG88CZX" // gitleaks:allow
@@ -163,12 +164,13 @@ func unsetSOPSEnv(name string) {
 }
 
 func registerSOPSSource(ctx context.Context, dtc *dockerTestContext, name, filePath string) {
+	_, _ = dtc.f.ExecCommandOutput(ctx, []string{secretCmd, sourceSubCmd, "remove", name})
 	_, err := dtc.f.ExecCommandOutput(
 		ctx,
-		[]string{secretCmd, "source", "add", "sops", name, filePath},
+		[]string{secretCmd, sourceSubCmd, "add", "sops", name, filePath},
 	)
 	framework.ExpectNoError(err)
 	ginkgo.DeferCleanup(func() {
-		_, _ = dtc.f.ExecCommandOutput(ctx, []string{secretCmd, "source", "remove", name})
+		_, _ = dtc.f.ExecCommandOutput(ctx, []string{secretCmd, sourceSubCmd, "remove", name})
 	})
 }

pkg/git/inspect.go

@@ -112,10 +112,23 @@
 }
 
 func fetchInspectionCommit(ctx context.Context, repo *Repo, commit string) (string, error) {
-	if _, err := repo.run(ctx, "fetch", "--depth=1", "origin", commit); err != nil {
-		return "", fmt.Errorf("fetch commit %q: %w", commit, err)
+	if _, err := repo.run(ctx, "cat-file", "-e", commit+"^{commit}"); err == nil {
+		return commit, nil
 	}
-	return "FETCH_HEAD", nil
+	if _, err := repo.run(ctx, "fetch", "--depth=1", "origin", commit); err == nil {
+		return "FETCH_HEAD", nil
+	}
+	if _, err := repo.run(ctx, "fetch", "origin", "+refs/heads/*:refs/remotes/origin/*"); err == nil {
+		if _, err := repo.run(ctx, "cat-file", "-e", commit+"^{commit}"); err == nil {
+			return commit, nil
+		}
+	}
+	if _, err := repo.run(ctx, "fetch", "--unshallow", "origin"); err == nil {
+		if _, err := repo.run(ctx, "cat-file", "-e", commit+"^{commit}"); err == nil {
+			return commit, nil
+		}
+	}
+	return "", fmt.Errorf("fetch commit %q: commit not found in remote repository", commit)
 }
 
 // ReadFile returns the bytes for a path relative to the selected subpath
@@ -152,12 +165,10 @@
 // another repository-relative path.
 func cleanRepoRelativePath(kind, value string) (string, error) {
 	value = strings.TrimSpace(strings.ReplaceAll(value, "\\", "/"))
+	value = strings.TrimPrefix(value, "/")
 	if value == "" {
 		return "", nil
 	}
-	if strings.HasPrefix(value, "/") {
-		return "", fmt.Errorf("git %s %q must be relative to the repository root", kind, value)
-	}
 	clean := path.Clean(value)
 	if clean == "." {
 		return "", nil

pkg/git/inspect_test.go

@@ -51,7 +51,7 @@ func TestCleanInspectionSubPath(t *testing.T) {
 		{name: "dot", value: ".", want: ""},
 		{name: "simple", value: testSubPath, want: testSubPath},
 		{name: "trailing slash", value: testSubPath + "/", want: testSubPath},
-		{name: "absolute rejected", value: "/apps/bar", wantErr: true},
+		{name: "leading slash stripped", value: "/apps/bar", want: "apps/bar"},
 		{name: "parent escape rejected", value: "../bar", wantErr: true},
 		{name: "parent only rejected", value: "..", wantErr: true},
 	} {

pkg/secrets/project_config.go

@@ -100,12 +100,10 @@ func validateProjectSecret(value string, sources map[string]struct{}) error {
 // never be able to read arbitrary host files.
 func CleanProjectSourcePath(value string) (string, error) {
 	value = strings.TrimSpace(strings.ReplaceAll(value, "\\", "/"))
+	value = strings.TrimPrefix(value, "/")
 	if value == "" {
 		return "", fmt.Errorf("source path must not be empty")
 	}
-	if strings.HasPrefix(value, "/") {
-		return "", fmt.Errorf("source path %q must be relative to the repository root", value)
-	}
 	clean := path.Clean(value)
 	if clean == "." || clean == ".." || strings.HasPrefix(clean, "../") {
 		return "", fmt.Errorf("source path %q escapes the repository root", value)

pkg/secrets/project_config_test.go

@@ -34,7 +34,11 @@ func TestCleanProjectSourcePath(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, "config/secrets.enc.yaml", clean)
 
-	for _, bad := range []string{"", "/etc/passwd", "../secret", "a/../../secret"} {
+	cleanAbs, err := CleanProjectSourcePath("/config/secrets.enc.yaml")
+	require.NoError(t, err)
+	require.Equal(t, "config/secrets.enc.yaml", cleanAbs)
+
+	for _, bad := range []string{"", "../secret", "a/../../secret"} {
 		_, err := CleanProjectSourcePath(bad)
 		require.Error(t, err, bad)
 	}