fix(hlcc): use native shared repository permissions

server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py

@@ -26,6 +26,13 @@ STATE_ROOT = pathlib.Path("/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1")
 LEGACY_DB = STATE_ROOT / "data" / "owner-identity-source.db"
 OWNER_NAME = "bingshuo"
 CHANNEL_REPOSITORY = "guanghu-ice-heart"
+CHANNEL_REPOSITORY_PATH = (
+    STATE_ROOT
+    / "data"
+    / "repositories"
+    / OWNER_NAME
+    / f"{CHANNEL_REPOSITORY}.git"
+)
 LEGACY_REPOSITORY_URL = "https://guanghulab.com/fifth-domain/bingshuo/fifth-domain.git"
 SEED_COMMIT_NUMBER = "HLCC-ICE-000001"
 SEED_CONTRIBUTION_NUMBER = "ZY-CONTRIB-20260723-001"
@@ -473,6 +480,59 @@ def seed_fifth_domain_channel(binary: pathlib.Path) -> str:
         delete_bootstrap_token(channel_db, token_name)
 
 
+def configure_shared_channel_repository(
+    repository: pathlib.Path = CHANNEL_REPOSITORY_PATH,
+) -> str:
+    """Use Git's native shared-repository mode instead of a post-receive chmod."""
+    if not repository.is_dir():
+        raise RuntimeError("channel repository path unavailable")
+
+    subprocess.run(
+        [
+            "git",
+            "--git-dir",
+            str(repository),
+            "config",
+            "core.sharedRepository",
+            "group",
+        ],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    configured = subprocess.run(
+        [
+            "git",
+            "--git-dir",
+            str(repository),
+            "config",
+            "--get",
+            "core.sharedRepository",
+        ],
+        check=True,
+        capture_output=True,
+        text=True,
+    ).stdout.strip()
+    if configured not in {"1", "group"}:
+        raise RuntimeError("shared repository configuration verification failed")
+
+    obsolete_hook = (
+        repository
+        / "hooks"
+        / "post-receive.d"
+        / "guanghu-ice-heart-share"
+    )
+    if obsolete_hook.exists():
+        if obsolete_hook.is_symlink() or not obsolete_hook.is_file():
+            raise RuntimeError("obsolete sharing hook path is unsafe")
+        hook_text = obsolete_hook.read_text(encoding="utf-8")
+        if "post_receive_permissions_reconciled" not in hook_text:
+            raise RuntimeError("obsolete sharing hook identity mismatch")
+        obsolete_hook.unlink()
+
+    return "configured"
+
+
 def bootstrap() -> None:
     process: subprocess.Popen[bytes] | None = None
     try:
@@ -514,6 +574,8 @@ def bootstrap() -> None:
         migrate_owner_identity()
         set_status(stage="seeding-fifth-domain-channel")
         seed_fifth_domain_channel(binary)
+        set_status(stage="configuring-shared-repository")
+        configure_shared_channel_repository()
         set_status(mode="isolated-candidate", ready=True, stage="ready")
         return_code = process.wait()
         raise RuntimeError(f"candidate stopped with code {return_code}")