This isn't a valid key, and according to claude it's not possible to configure
it to get only security updates (I'm too lazy to read the docs). I suppose this
means we will now get pull requests for any updated dependencies, but maybe
that's useful; we'll see how annoying this gets.
Re-submission of #5422. Had a problem with my fork and had to delete it,
which closed the original PR. Apologies for the noise.
## Summary
This PR pins all GitHub Actions to immutable commit SHAs and extracts an
inline secret from a `run:` block into an `env:` mapping.
- Pin 7 unpinned actions to full 40-character SHAs
- Extract 1 inline secret from run block to env var
## How to verify
Review the diff, each change is mechanical and preserves workflow
behavior:
- **SHA pinning**: `action@v3` becomes `action@abc123 # v3`, original
version preserved as comment
- **Secret extraction**: `${{ secrets.* }}` in `run:` moves to `env:`
block, referenced as `"${ENV_VAR}"` in the script
- No workflow logic, triggers, or permissions are modified
I've been researching CI/CD supply chain attack vectors and submitting
fixes to affected repos. Based on that research I built a scanner called
Runner Guard and open sourced it
[here](https://github.com/Vigilant-LLC/runner-guard) so you can scan
yourself if you want to. I'll be posting more advisories over the next
few weeks [on Twitter](https://x.com/vigilance_one) if you want to stay
in the loop.
If you have any questions, reach out. I'll be monitoring comms.
\- Chris (dagecko)
### PR Description
It actually expect `branch.<name>.*`
`man git-config | rg "\s+branch\.\S+\$"` to show all possible keys.
```
panic: runtime error: slice bounds out of range [7:6]
goroutine 57 [running]:
github.com/jesseduffield/lazygit/pkg/commands/git_commands.(*ConfigCommands).Branches(0x110187428260, {0x15495d0, 0x110187190230})
lazygit/pkg/commands/git_commands/config.go:104 +0x8ef
github.com/jesseduffield/lazygit/pkg/commands/git_commands.(*BranchLoader).Load(0x1101873e6180, {0x1d77440, 0x0, 0x0}, 0x1101873e86e0, {0x0, 0x0, 0x0}, 0x1, 0x1101872a5e60,
...)
lazygit/pkg/commands/git_commands/branch_loader.go:121 +0x7cc
github.com/jesseduffield/lazygit/pkg/gui/controllers/helpers.(*RefreshHelper).refreshBranches(0x1101871ef1c0, 0x1, 0x0, 0x1)
lazygit/pkg/gui/controllers/helpers/refresh_helper.go:456 +0x328
github.com/jesseduffield/lazygit/pkg/gui/controllers/helpers.(*RefreshHelper).Refresh.func2.3()
lazygit/pkg/gui/controllers/helpers/refresh_helper.go:131 +0x45
github.com/jesseduffield/lazygit/pkg/gui/controllers/helpers.(*RefreshHelper).Refresh.func2.1.1({0x154b438, 0x110187b12260})
lazygit/pkg/gui/controllers/helpers/refresh_helper.go:106 +0x30
github.com/jesseduffield/gocui.(*Gui).onWorkerAux(0x110187278b40, 0x110187a92190, {0x154b438, 0x110187b12260})
lazygit/vendor/github.com/jesseduffield/gocui/gui.go:713 +0x8b
github.com/jesseduffield/gocui.(*Gui).OnWorker.func1()
lazygit/vendor/github.com/jesseduffield/gocui/gui.go:700 +0x3f
created by github.com/jesseduffield/gocui.(*Gui).OnWorker in goroutine 1
```
### Please check if the PR fulfills these requirements
* [x] Cheatsheets are up-to-date (run `go generate ./...`)
* [x] Code has been formatted (see
[here](https://github.com/jesseduffield/lazygit/blob/master/CONTRIBUTING.md#code-formatting))
* [ ] Tests have been added/updated (see
[here](https://github.com/jesseduffield/lazygit/blob/master/pkg/integration/README.md)
for the integration test guide)
* [x] Text is internationalised (see
[here](https://github.com/jesseduffield/lazygit/blob/master/CONTRIBUTING.md#internationalisation))
* [x] If a new UserConfig entry was added, make sure it can be
hot-reloaded (see
[here](https://github.com/jesseduffield/lazygit/blob/master/docs/dev/Codebase_Guide.md#using-userconfig))
* [x] Docs have been updated if necessary
* [x] You've read through your own file changes for silly mistakes etc
Add new config options for the sort order of files vs. directories, and
for sorting case sensitively or not.
Set the sort order's default from the former foldersFirst to mixed, so
this is a change in behavior. I find this useful because it now matches
git's order, so if you look at the diff of a commit, the TOC at the top
has the same order as the file tree you see when entering the commit.
Closes#4070.
Set the sort order's default from the former foldersFirst to mixed, so this is a
change in behavior. I find this useful because it now matches git's order, so if
you look at the diff of a commit, the TOC at the top has the same order as the
file tree you see when entering the commit.
When you rebase a branch and there are conflicts, lazygit asks you to
continue the rebase when it detects that all conflicts have been
resolved. However, it is common to make additional changes beyond just
fixing the conflicts (e.g. to fix build failures), and when doing that
while the "Continue the rebase?" prompt is showing, lazygit detects that
too and asks you if you want to stage those newly modified files too.
This is all well and good (and can be disabled for those who don't like
it); however, lazygit would treat out-of-date submodules as unstaged
changes and would offer to stage those as well, and this is pretty bad
and almost never what you want. Fix this by excluding submodules from
that second check.
When you rebase a branch and there are conflicts, lazygit asks you to continue
the rebase when it detects that all conflicts have been resolved. However, it is
common to make additional changes beyond just fixing the conflicts (e.g. to fix
build failures), and when doing that while the "Continue the rebase?" prompt is
showing, lazygit detects that too and asks you if you want to stage those newly
modified files too. This is all well and good (and can be disabled for those who
don't like it); however, lazygit would treat out-of-date submodules as unstaged
changes and would offer to stage those as well, and this is pretty bad and
almost never what you want. Fix this by excluding submodules from that second
check.
This is the same option as used by
pkg.commands.git_commands.diff.GetDiff().
This fixes some operations patch operation (tested with moving patch to
another commit) with `git config set --global color.ui always` (or
`color.diff always`).
The README says that this keybinding is ctrl+z, but the default
keybinding is shift+z — looks like this was changed in
376ca65807.
This PR updates the shortcut in the README to match the current
keybinding.
Previously, when showing subcommits of a branch or tag, scrolling down,
and then going out and entering subcommits again, it would select the
first commit but keep the previous scroll position, so that the
selection was not visible.
Previously, when showing subcommits of a branch or tag, scrolling down, and then
going out and entering subcommits again, it would select the first commit but
keep the previous scroll position, so that the selection was not visible. Always
scroll to the top to fix this.
When selecting a directory containing many changed files, or when
range-selecting many changed files, and then discarding them, this could
be so slow that lazygit appeared to hang; especially since there was no
UI feedback (e.g. a spinning status message).
This PR improves the performance greatly by batching the individual git
calls into a single one if possible. It still doesn't add UI feedback
though, hoping that the operation is now fast enough that it isn't
needed.
While we're at it, we fix a bug that would cause "Discard unstaged
changes" to discard more than just the visible files when filtering by
path.
Fixes#4581.
This is probably the less severe case, but it could still be an issue for people
who have many modified top-level files they want to discard, and have
showRootItemInFileTree set to false; they could select all those files by
pressing 'v' and '>'.
Previously it would iterate over all changed files and call git checkout or git
reset for each one, which can take forever if there are hundreds or thousands of
files. Now it batches these into a single command if possible (taking care of
still passing the individual path names to the git call rather than just the
directory, which is necessary for making it work correctly when filtering --
this was actually broken for the "Discard unstaged changes" command, which is
fixed here).
When discarding a directory, we only want to discard those files that are
visible in the current filter view. The tests show that this already works
correctly for discarding all changes, but it doesn't for discarding only
unstaged changes: in this case, untracked files are handled correctly, but
changes to tracked files are discarded without respecting the filter.
We have integration tests for this functionality, but those only test the
behavior, not the performance. In these unit tests you can see that we make
individual calls to git checkout and git reset for each file, which is very slow
when there are lots of files.
Previously it would only check that *if* removeFile was called, the passed
argument was the expected one; but it didn't check whether it was called at all.
Improve this by recording the file names that are removed, and checking them at
the end of each scenario.
This is going to be even more important for the tests that we are about to add
in the next commit, because for those there can be several calls to removeFile
in a single scenario.
When switching to a different repo, and then back to the original one,
searching would no longer work. The reason is that our contexts set
callbacks on their views; when switching to a different repo we
instantiate a new set of contexts, so they will overwrite the views'
callbacks with their new ones, but when switching back to the original
repo, we reuse the old contexts because they are still in memory, but
they won't set their callbacks again since they only do this on
construction.
To fix this, replace the view-local callbacks with a global one on the
gui that takes the view as an argument, so that the callback can look up
the associated context dynamically.
When switching to a different repo, and then back to the original one, searching
would no longer work. The reason is that our contexts set callbacks on their
views; when switching to a different repo we instantiate a new set of contexts,
so they will overwrite the views' callbacks with their new ones, but when
switching back to the original repo, we reuse the old contexts because they are
still in memory, but they won't set their callbacks again since they only do
this on construction.
To fix this, replace the view-local callbacks with a global one on the gui that
takes the view as an argument, so that the callback can look up the associated
context dynamically.
Remove our dependency on go-git, which was including a ton of
third-party code for very little benefit.
In addition, this fixes the problem that lazygit wouldn't show any
branches or remotes for certain types of malformatted .git/config files,
e.g. when there's a config section like `[branch ""]`, `[remote ""]`, or
`[-remote "xyz"]`; see #3901 and #5112.
### PR Description
This PR adds support for clicking on arrows in the file changes list
view, so that a mouse can be used to expand/collapse directories. This
enhancement was raised here as issue #5088.
We have some documentation for the corresponding setters in IBaseContext, but
that's part of the controller infrastructure and not client facing. For somebody
implementing a new view, this is where they will probably look for what methods
they can override.
When this was originally introduced, it handled single clicks on a list entry
(treating them similar to a double-click by checking whether the click was on
the selected entry). Arguably it should have been called OnDoubleClick back then
already; but when we later changed it to do actual double-click detection (see
37197b8e9a), we should have renamed the methods.
If the showDivergenceFromBaseBranch config is not none, the expanded
branches panel would no longer show the remote branch and subject; the
reason was that we padded the name all the way to the right edge of the
view so that the divergence information is right-aligned.
To fix this, we simply don't right-align the divergence in half or full
screen mode. This is a bit unfortunate, but it's hard to do any better,
because we don't know the width of our column in advance. One thing I
tried is to make the divergence a separate column in that case (with an
explicit right-alignment set on it via getColumnAlignments; however,
this makes it harder to properly truncate the name when the window is
too narrow.
If the showDivergenceFromBaseBranch config is not none, the expanded branches
panel would no longer show the remote branch and subject; the reason was that we
padded the name all the way to the right edge of the view so that the divergence
information is right-aligned.
To fix this, we simply don't right-align the divergence in half or full screen
mode. This is a bit unfortunate, but it's hard to do any better, because we
don't know the width of our column in advance. One thing I tried is to make the
divergence a separate column in that case (with an explicit right-alignment set
on it via getColumnAlignments; however, this makes it harder to properly
truncate the name when the window is too narrow.
Given a block of consecutive changed lines, staging only some of those
changes didn't always work. Consider the following scenario:
```diff
@@ -1,5 +1,5 @@
a
-b
-c
-d
+b'
+c'
+d'
e
```
Trying to stage only the change to "d" worked already as expected, but
staging either "b" or "c" didn't; the order of the deleted and added
lines in staged changes were wrong. We don't solve the "c" case in this
PR, as it's probably uncommon enough so that it doesn't matter too much,
and it seems to be quite a bit harder than the other two (and git gui
doesn't support it either, for the record). But we fix the "b" case
here, which is probably the most common one.
Fixes#5103.
This fixes the problem; a consequence of this change is that given the following
scenario:
@@ -1,3 +1,3 @@
1
-2
+2b
3
staging only the line `+2b` will put it *before* the unchanged `2` line, rather
than after it as you might expect (the changed unit tests demonstrate this).
Since this should be a pretty uncommon scenario, I guess it is an ok compromise.
As you can see in the changed tests, while the behavior of what gets staged is
fixed now, it doesn't always correctly select the next line to stage. We'll
address this in the next commit.
This is a pretty special case (see comment in the test for details). It is
working correctly, but I almost broke it during development, so it's good to
cover it with a test.
Given a block of consecutive changed lines, trying to stage only some of them
doesn't work correctly in all cases:
- if the staged lines are the last lines in the block of changes, it already
works
- when staging some changes in the middle of the block, it doesn't work as
desired, but we also don't try to fix this case in this branch, because it's
harder to do, and not as common as the other two
- staging the first lines of the block doesn't work as desired, and we will fix
that in this branch.
### PR Description
When a branch is checked out by another worktree, show the worktree name
in the label, e.g. "(worktree cosmos2)" instead of just "(worktree)", so
you can immediately see which worktree holds it.
When looking at a diff in diffing mode in the branches or tags panels
(e.g. after pressing `W` on a branch and then selecting a different
branch to diff it against the first one) it wasn't possible to change
the diff context size using `{` and `}`, or the rename threshold using
`(` and `)`.
Fixes#5254.
Actually, we simply enable them in any panel, even those that can never show a
diff. Since the commands show a toast, that's enough feedback to understand what
happened; the change will take effect the next time you switch to a panel that
does show diffs.
Same for ( and ) to change the rename threshold.
We did already have code to prevent clicks in inactive views behind a
popup, but it wasn't good enough. This PR fixes two problems:
- if the previously focused view (behind the panel) was a list view, it
would look like the click would select a different row, because gocui
would still set the view's cursor position, which is used to draw the
highlighted row
- it was still possible to click on tab headers, and this would dismiss
the panel
Fixes#5256.
This fixes two problems:
- if the previously focused view (behind the panel) was a list view, it would
look like the click would select a different row, because gocui would still
set the view's cursor position, which is used to draw the highlighted row
- it was still possible to click on tab headers, and this would dismiss the
panel
The symptom of the bug was that confirmation panels with wrapped text
were one character too wide, which could sometimes result in them being
one line too heigh. One concrete example is the "Discard file changes"
confirmation that appears when pressing `d` in the commit files panel.
I got confused when I investigated the bug that was fixed in the previous
commit, so hopefully these will be helpful for the next person reading this
code.
The symptom of the bug was that confirmation panels with wrapped text were one
character too wide, which could sometimes result in them being one line too
heigh. One concrete example is the "Discard file changes" confirmation that
appears when pressing `d` in the commit files panel.
I got very confused when investigating this bug, and the reason is that
getPopupPanelDimensionsAux took two parameters panelWidth and panelHeight, but
the second was actually contentHeight. Rename it to contentHeight, and change
the first one to also be the content width rather than the panel width. This is
easier for clients, and less confusing.
This commit implements the ability to cycle backward through different
all branches log visualization modes, complementing the existing forward
cycling functionality. Users can now press 'A' (Shift+a) to cycle in
reverse through the available log graph views, improving navigation
efficiency when they overshoot their desired view.
Fixes#5302
## Problem
When `.git/info` directory does not exist (can happen with bare clones,
manual deletion, or certain Git configurations), selecting "Add to
.git/info/exclude" fails with:
```
open <repo-path>/.git/info/exclude: no such file or directory
```
The `Exclude` function used `os.OpenFile` with `os.O_CREATE` which
creates the file but not its parent directory.
## Fix
Added `os.MkdirAll` to create the `.git/info` directory (with 0755
permissions) before attempting to open the exclude file. `MkdirAll` is a
no-op if the directory already exists, so existing behavior is
unchanged.
## Test
Added integration test `file/exclude_without_info_dir` that:
1. Removes `.git/info` directory during repo setup
2. Attempts to exclude a file via the menu
3. Verifies `.git/info/exclude` is created with the correct content
Test fails without the fix, passes with it.
Tested locally on macOS ARM (Apple Silicon). Unit tests and integration
test pass.
### PR Description
The worktrees tab now displays the checked-out branch (or detached HEAD
state) for each worktree, making it much easier to see which worktree
holds which branch.
This is useful when you need to "unlock" a branch that's occupied by
another worktree: you can now clearly see which worktrees are on a
branch vs detached, without having to select each one individually.
Also rename the "(main)" label to "(main worktree)" to avoid confusion
with the common "main" branch name, and move it after the branch column.
### PR Description
Way back when I implemented filter functionality I could not muster the
motivation to apply it to the file views (files and commit files), but
it really should be used on them.
The text filter matches against the full file path (not just the
filename), which is more useful for navigating large directory trees.
When a text filter is active, all operations respect it consistently:
- **Diffs**: selecting a filtered directory shows only the diff of
visible files, not all files in the directory
- **Staging/unstaging**: pressing space on a filtered directory only
stages/unstages visible files
- **Toggle all (a)**: only toggles staging for visible files
- **Custom patch**: toggling a filtered directory only adds visible
files to the patch
Full disclosure, opus 4.6 wrote this entire PR but reviewing its changes
they seem reasonable, and I have done some local testing and everything
works as expected.
I always press 'd' in the patch building view, expecting that I can do
exactly what I can do in the staging view, to find out I need to go
space -> ctrl+p -> d and I think it's time to honour the muscle memory
and support this convenience keybinding. I recall we may have had a
debate about this in the past and if so I'm renewing my stance.
We don't add the commands to the menu when we're rebasing, so it's pointless to
check this in the handlers.
I guess alternatively we could add all commands always, and strike out the ones
that are not applicable using DisabledReasons. But we don't usually do this in
menus (except the global keybindings menu).
Only mention resetting the patch when there actually is one. This way users have
to read less text in the normal case, and the added note hopefully stands out
more if there is one. Also, separate the note from the previous text by a blank
line.
"Remove" can be confusing when a deleted file is selected; in this cases it
actually "un-removes" it. "Discard" hopefully makes it clearer that we are
talking about the change to a file, and not the file itself.
If the bottom line is hidden (by setting `gui.showBottomLine` to false
in the config), don't show the "Fetching..." status because it changes
the layout, which should happen only in response to user actions.
However, keep the status for the first fetch after startup, and right
after switching repos, because in these cases it is useful to see when
the fetch is done.
Closes#5242.
If the bottom line is hidden (by setting gui.showBottomLine to false in the
config), don't show the "Fetching..." status because it changes the layout,
which should happen only in response to user actions.
However, keep the status for the first fetch after startup, and right after
switching repos, because in these cases it is useful to see when the fetch is
done.
### PR Description
Tweak regexp such that a trailing ":" is not included in the file path
extracted from a lazygit-edit URL.
Previously, when matching a URL containing the ":" separator but no line
number, such as `lazygit-edit:///path/to/file.ext:`, the trailing
separator would be included in the matched file path, so lazygit would
open the non-existent file `/path/to/file.ext:`. Notably, such urls are
created when using delta with the hyperlink feature, as suggested in
https://github.com/jesseduffield/lazygit/blob/master/docs/Custom_Pagers.md#delta,
and clicking a file path rather than a line number.
Fixes#5308
Stefan HallerandGitHub
