Only read from Git in app security check - #8841

WHY are these changes introduced?

shopify app security check asks Git which files are tracked, which are ignored, and where a repository's top level is. Answering doesn't need Git to:

• Run a file-system monitor (core.fsmonitor). ls-files and check-ignore start one whenever they read the index.
• Fetch a missing object. A partial clone does this through its transport command (core.sshCommand, remote.<name>.uploadpack), for example when a skip-worktree .gitignore isn't in the object store.
• Use a bare repository found in the working directory, such as one committed as ordinary files (HEAD, config, objects/, refs/), instead of the repository that contains the app.

Git takes the settings behind all three from the repository being scanned, so a scanned repository could make the check run a program or get its answers from the wrong place. The check now overrides them.

WHAT is this pull request doing?

Every Git command in the engine now goes through one runGit helper (scanners/git.ts). It applies four protections, kept in a named table:

path-rules.ts and secret-rules.ts lose their private copies of runGit.

Behaviour changes:

• Where Git's built-in file-system monitor is enabled globally (core.fsmonitor=true), scans no longer start a git fsmonitor--daemon for each scanned directory.
• If a scanned directory is itself a committed bare repository, Git refuses it. Secrets found there stay reported, because Git can't confirm they're untracked or ignored.

Tests (tests/untrusted-repository.test.ts):

• There is one fixture per case: a repository whose own .git/config names a monitor, a bare repository committed into a clone, and a partial clone missing an object. Each fixture first shows that plain Git runs the program it names, so a fixture that stops doing so fails instead of passing.
• Each protection is tested on its own against its fixture, and a protection added without a fixture fails type-checking.
• An end-to-end scan of each fixture runs nothing. For the first fixture, the scan still gets normal answers from Git.
• The tests run on Windows, which keeps checking that Git for Windows honours each protection, including the empty GIT_ALLOW_PROTOCOL.

How to manually test your changes?

1. Create a repository whose own settings name a file-system monitor:

   mkdir /tmp/untrusted && cd /tmp/untrusted && git init -q
   printf 'name = "x"\nclient_id = "abc123"\napplication_url = "https://example.com"\n' > shopify.app.toml
   git add . && git commit -qm init
   git config core.fsmonitor "echo ran >> /tmp/untrusted-marker; false"

2. Run git ls-files. /tmp/untrusted-marker appears, which shows the program runs.

3. Delete the marker. Run shopify app security check --path /tmp/untrusted. The marker doesn't appear.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add