Repair stale CRLF shell files on production runner

[cvsz]

Summary

• restore the GHCR credential helper directly from the immutable Git index with core.autocrlf=false before execution
• compare the raw worktree hash with the committed blob and fail closed on any mismatch
• syntax-check the repaired helper before resolving credentials
• add a workflow regression test for ordering and integrity checks

Root cause

The failed historical run used a reused self-hosted worktree containing CRLF bytes. The Git blob was already LF, so adding .gitattributes did not rewrite an unchanged cached index entry.

Verification

• simulated CRLF worktree repaired to byte-identical LF Git blob
• targeted tests: 6/6 passed
• full pre-push lint, typecheck, test (71 script tests), and build passed

[gemini-code-assist]

Code Review

This pull request adds a new test to verify that the production deployment repairs stale self-hosted CRLF files before executing the GHCR helper. The reviewer suggested isolating the step's content before running assertions to prevent false positives from other parts of the workflow.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Asserting these regex patterns against the entire workflow string can lead to false positives if the commands exist in other steps, jobs, or commented-out code. To ensure these commands are specifically defined within the "Repair and verify shell helper checkout" step, slice the workflow string to isolate the step's content before running the assertions.

  const repairIndex = workflow.indexOf("Repair and verify shell helper checkout");
  const resolveIndex = workflow.indexOf("Resolve GHCR credential pair");
  assert.ok(repairIndex >= 0);
  assert.ok(resolveIndex > repairIndex);

  const nextStepIndex = workflow.indexOf("- name:", repairIndex + 1);
  const repairStepContent = workflow.slice(repairIndex, nextStepIndex >= 0 ? nextStepIndex : undefined);

  assert.match(repairStepContent, /git -c core\.autocrlf=false checkout-index --force/);
  assert.match(repairStepContent, /git hash-object --no-filters/);
  assert.match(repairStepContent, /git rev-parse "HEAD:\$helper"/);
  assert.match(repairStepContent, /bash -n "\$helper"/);