GeezerVison

Copilot AI left a comment

<!-- agent -->
Repo.clone() and Repo.clone_from() did not reject the clone option that
redirects repository metadata to a caller-controlled path (GHSA-8mcc-hrx5-hvxc).
Regression coverage exercises both keyword and multi-option input through both
public clone APIs.

Add the option to the existing clone denylist, matching Repo.init()
and the documented allow_unsafe_options contract. Git itself registers

The Python package and Alpine test workflows failed across the submodule suite
because GitPython internally supplies --separate-git-dir when creating modern
submodule layouts. The new public clone guard correctly rejected that option,
but could not distinguish the library-generated path from caller input.

Validate caller-provided keyword and multi-options before adding the
library-controlled metadata path, then explicitly allow the resulting trusted
clone invocation. This preserves rejection of unsafe clone_multi_options while
restoring normal submodule creation. Update the one test that intentionally
invokes Repo.clone_from() with its own separate git directory to opt in
explicitly.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <[email protected]>
Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <[email protected]>