fix broken CI (see https://vielmetti.typepad.com/logbook/2022/10/git-security-fixes-lead-to-fatal-transport-file-not-allowed-error-in-ci-systems-cve-2022-39253.html)

try this

WIP

.github/workflows/ci.yml

@@ -73,8 +73,9 @@ jobs:
           restore-keys: |
             ${{runner.os}}-go-
       - name: Test code
+        # for file.allow thing see https://vielmetti.typepad.com/logbook/2022/10/git-security-fixes-lead-to-fatal-transport-file-not-allowed-error-in-ci-systems-cve-2022-39253.html
         run: |
-          PARALLEL_TOTAL=${{ matrix.parallelism }} PARALLEL_INDEX=${{ matrix.index }} go test pkg/integration/deprecated/*.go
+          git config --global protocol.file.allow always && PARALLEL_TOTAL=${{ matrix.parallelism }} PARALLEL_INDEX=${{ matrix.index }} go test pkg/integration/deprecated/*.go
   integration-tests:
     runs-on: ubuntu-latest
     name: "Integration Tests"

pkg/integration/components/runner.go

@@ -144,6 +144,7 @@ func createFixture(test *IntegrationTest, paths Paths) error {
 	shell.RunCommand(`git config user.email "CI@example.com"`)
 	shell.RunCommand(`git config user.name "CI"`)
 	shell.RunCommand(`git config commit.gpgSign false`)
+	shell.RunCommand(`git config protocol.file.allow always`)
 
 	test.SetupRepo(shell)
 

test/integration/submoduleAdd/setup.sh

@@ -11,6 +11,11 @@ git init
 
 git config user.email "CI@example.com"
 git config user.name "CI"
+# see https://vielmetti.typepad.com/logbook/2022/10/git-security-fixes-lead-to-fatal-transport-file-not-allowed-error-in-ci-systems-cve-2022-39253.html
+# NOTE: I don't think this actually works if it's only applied to the repo.
+# On CI we set the global setting, but given it's a security concern I don't want
+# people to do that for their locals.
+git config protocol.file.allow always
 
 echo test1 > myfile1
 git add .

test/integration/submoduleEnter/setup.sh

@@ -26,5 +26,5 @@ cd ..
 git clone --bare ./repo other_repo
 cd repo
 
-git submodule add ../other_repo
+git -c protocol.file.allow=always submodule add ../other_repo
 git commit -am "add submodule"

test/integration/submoduleRemove/setup.sh

@@ -23,5 +23,5 @@ cd ..
 git clone --bare ./repo other_repo
 cd repo
 
-git submodule add ../other_repo
+git -c protocol.file.allow=always submodule add ../other_repo
 git commit -am "add submodule"

test/integration/submoduleReset/setup.sh

@@ -23,5 +23,5 @@ cd ..
 git clone --bare ./repo other_repo
 cd repo
 
-git submodule add ../other_repo
+git -c protocol.file.allow=always submodule add ../other_repo
 git commit -am "add submodule"