fix(hlcc): use native shared repository permissions

server-tools/hololake-code-channel/jd-candidate/test_owner_migration.py

@@ -6,6 +6,7 @@ import importlib.util
 import json
 import pathlib
 import sqlite3
+import subprocess
 import tempfile
 import unittest
 
@@ -138,5 +139,50 @@ class OwnerMigrationTests(unittest.TestCase):
         self.assertEqual(MODULE.migrate_owner_identity(self.old, self.new, self.receipt), "already-present")
 
 
+class SharedRepositoryTests(unittest.TestCase):
+    def test_configures_native_group_sharing_and_removes_only_known_hook(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary:
+            repository = pathlib.Path(temporary) / "channel.git"
+            subprocess.run(["git", "init", "--bare", str(repository)], check=True, capture_output=True)
+            hook = repository / "hooks" / "post-receive.d" / "guanghu-ice-heart-share"
+            hook.parent.mkdir(parents=True)
+            hook.write_text(
+                "#!/bin/sh\nprintf '%s\\n' post_receive_permissions_reconciled\n",
+                encoding="utf-8",
+            )
+
+            self.assertEqual(
+                MODULE.configure_shared_channel_repository(repository),
+                "configured",
+            )
+            configured = subprocess.run(
+                [
+                    "git",
+                    "--git-dir",
+                    str(repository),
+                    "config",
+                    "--get",
+                    "core.sharedRepository",
+                ],
+                check=True,
+                capture_output=True,
+                text=True,
+            ).stdout.strip()
+            self.assertIn(configured, {"1", "group"})
+            self.assertFalse(hook.exists())
+
+    def test_refuses_unknown_hook_content(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary:
+            repository = pathlib.Path(temporary) / "channel.git"
+            subprocess.run(["git", "init", "--bare", str(repository)], check=True, capture_output=True)
+            hook = repository / "hooks" / "post-receive.d" / "guanghu-ice-heart-share"
+            hook.parent.mkdir(parents=True)
+            hook.write_text("#!/bin/sh\nexit 0\n", encoding="utf-8")
+
+            with self.assertRaisesRegex(RuntimeError, "identity mismatch"):
+                MODULE.configure_shared_channel_repository(repository)
+            self.assertTrue(hook.exists())
+
+
 if __name__ == "__main__":
     unittest.main()