From 9f76e3e70ab1c8e3427fa0744c182c75d34948f9 Mon Sep 17 00:00:00 2001
From: Michel Paulissen <862400+MichelPaulissen@users.noreply.github.com>
Date: Sat, 4 Jul 2026 16:57:52 +0200
Subject: [PATCH] Sync public tree to 9233b1e

---
 DISASMER_PUBLIC_TREE.json                     |  4 +-
 scripts/prepare-public-release-dryrun.js      | 40 ++++++++++++++----
 .../public-release-dryrun-contract-smoke.js   |  9 +++-
 scripts/public-release-dryrun-e2e.js          | 42 ++++++++++++++-----
 scripts/public-release-dryrun-preflight.js    |  3 ++
 5 files changed, 77 insertions(+), 21 deletions(-)

diff --git a/DISASMER_PUBLIC_TREE.json b/DISASMER_PUBLIC_TREE.json
index 8ca5e60..158c09d 100644
--- a/DISASMER_PUBLIC_TREE.json
+++ b/DISASMER_PUBLIC_TREE.json
@@ -1,7 +1,7 @@
 {
   "kind": "disasmer-filtered-public-tree",
-  "source_commit": "17dcc0b92ebee00867a5d6521d214d3ed52b0ece",
-  "release_name": "dryrun-17dcc0b92ebe",
+  "source_commit": "9233b1eb4743de23a6837eb0108d08feb1231676",
+  "release_name": "dryrun-9233b1eb4743",
   "filtered_out": [
     "private/**",
     "experiments/**",
diff --git a/scripts/prepare-public-release-dryrun.js b/scripts/prepare-public-release-dryrun.js
index 5532cb2..9c78133 100755
--- a/scripts/prepare-public-release-dryrun.js
+++ b/scripts/prepare-public-release-dryrun.js
@@ -32,13 +32,15 @@ const publicBinaries = [
 
 function commandOutput(command, args, options = {}) {
   try {
+    const execOptions = {
+      cwd: repo,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      ...options,
+    };
+    execOptions.env = commandEnv(command, options.env);
     return cp
-      .execFileSync(command, args, {
-        cwd: repo,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        ...options,
-      })
+      .execFileSync(command, args, execOptions)
       .trim();
   } catch (_) {
     return null;
@@ -46,11 +48,33 @@ function commandOutput(command, args, options = {}) {
 }
 
 function run(command, args, options = {}) {
-  cp.execFileSync(command, args, {
+  const execOptions = {
     cwd: repo,
     stdio: "inherit",
     ...options,
-  });
+  };
+  execOptions.env = commandEnv(command, options.env);
+  cp.execFileSync(command, args, execOptions);
+}
+
+function nonInteractiveGitEnv(extra = {}) {
+  return {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: process.env.GIT_ASKPASS || "/bin/false",
+    SSH_ASKPASS: process.env.SSH_ASKPASS || "/bin/false",
+    GIT_SSH_COMMAND:
+      process.env.GIT_SSH_COMMAND ||
+      "ssh -o BatchMode=yes -o NumberOfPasswordPrompts=0",
+    ...extra,
+  };
+}
+
+function commandEnv(command, env) {
+  if (command !== "git") {
+    return env;
+  }
+  return nonInteractiveGitEnv(env);
 }
 
 function ensureDir(dir) {
diff --git a/scripts/public-release-dryrun-contract-smoke.js b/scripts/public-release-dryrun-contract-smoke.js
index 00b160e..2e2aa98 100644
--- a/scripts/public-release-dryrun-contract-smoke.js
+++ b/scripts/public-release-dryrun-contract-smoke.js
@@ -146,7 +146,7 @@ for (const [name, pattern] of [
 
 for (const [name, pattern] of [
   ["preflight rejects stale release manifests", /manifest\.source_commit[\s\S]*currentSourceCommit/],
-  ["preflight disables interactive remote prompts", /function nonInteractiveEnv[\s\S]*GIT_TERMINAL_PROMPT[\s\S]*GIT_ASKPASS[\s\S]*SSH_ASKPASS[\s\S]*git", \["ls-remote"[\s\S]*timeout/],
+  ["preflight disables interactive remote prompts", /function nonInteractiveEnv[\s\S]*GIT_TERMINAL_PROMPT[\s\S]*GIT_ASKPASS[\s\S]*SSH_ASKPASS[\s\S]*GIT_SSH_COMMAND[\s\S]*BatchMode=yes[\s\S]*NumberOfPasswordPrompts=0[\s\S]*git", \["ls-remote"[\s\S]*timeout/],
   ["preflight accepts external public tree push", /function publicTreeAlreadyPushed\(manifest\)[\s\S]*DISASMER_PUBLIC_TREE_ALREADY_PUSHED/],
   ["preflight verifies public branch commit", /remoteMain[\s\S]*publicTreeCommit/],
   ["preflight verifies local asset checksums", /parseSha256Sums[\s\S]*checksum mismatch/],
@@ -160,6 +160,7 @@ for (const [name, pattern] of [
 for (const [name, pattern] of [
   ["e2e runner requires explicit opt-in", /DISASMER_PUBLIC_RELEASE_DRYRUN_E2E=1/],
   ["e2e runner rejects stale release manifests", /manifest\.source_commit[\s\S]*expectedSourceCommit\(\)/],
+  ["e2e runner disables interactive git prompts", /function nonInteractiveGitEnv[\s\S]*GIT_TERMINAL_PROMPT[\s\S]*GIT_ASKPASS[\s\S]*SSH_ASKPASS[\s\S]*GIT_SSH_COMMAND[\s\S]*BatchMode=yes[\s\S]*NumberOfPasswordPrompts=0[\s\S]*function commandEnv/],
   ["e2e runner accepts external public tree push", /function publicTreeAlreadyPushed\(manifest\)[\s\S]*DISASMER_PUBLIC_TREE_ALREADY_PUSHED/],
   ["e2e runner downloads Forgejo Release assets", /downloadReleaseAssets/],
   ["e2e runner verifies SHA256SUMS", /verifyChecksums/],
@@ -237,6 +238,12 @@ if (workflow) {
   }
 }
 
+expect(
+  prepScript,
+  "public tree prep disables interactive git prompts",
+  /function nonInteractiveGitEnv[\s\S]*GIT_TERMINAL_PROMPT[\s\S]*GIT_ASKPASS[\s\S]*SSH_ASKPASS[\s\S]*GIT_SSH_COMMAND[\s\S]*BatchMode=yes[\s\S]*NumberOfPasswordPrompts=0[\s\S]*function commandEnv/
+);
+
 for (const [scriptName, script] of [
   ["public acceptance", publicAcceptance],
   ["public split", publicSplit],
diff --git a/scripts/public-release-dryrun-e2e.js b/scripts/public-release-dryrun-e2e.js
index 9a94871..5dd218f 100755
--- a/scripts/public-release-dryrun-e2e.js
+++ b/scripts/public-release-dryrun-e2e.js
@@ -64,13 +64,15 @@ function ensureDir(dir) {
 function run(command, args, options = {}) {
   const commandLine = [command, ...args].join(" ");
   commands.push(commandLine);
-  return cp.execFileSync(command, args, {
+  const execOptions = {
     cwd: repo,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
     timeout: 15 * 60 * 1000,
     ...options,
-  });
+  };
+  execOptions.env = commandEnv(command, options.env);
+  return cp.execFileSync(command, args, execOptions);
 }
 
 function runJson(command, args, options = {}) {
@@ -89,19 +91,39 @@ function runJson(command, args, options = {}) {
 
 function commandOutput(command, args, options = {}) {
   try {
-    return cp
-      .execFileSync(command, args, {
-        cwd: repo,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        ...options,
-      })
-      .trim();
+    const execOptions = {
+      cwd: repo,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      ...options,
+    };
+    execOptions.env = commandEnv(command, options.env);
+    return cp.execFileSync(command, args, execOptions).trim();
   } catch (_) {
     return null;
   }
 }
 
+function nonInteractiveGitEnv(extra = {}) {
+  return {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: process.env.GIT_ASKPASS || "/bin/false",
+    SSH_ASKPASS: process.env.SSH_ASKPASS || "/bin/false",
+    GIT_SSH_COMMAND:
+      process.env.GIT_SSH_COMMAND ||
+      "ssh -o BatchMode=yes -o NumberOfPasswordPrompts=0",
+    ...extra,
+  };
+}
+
+function commandEnv(command, env) {
+  if (command !== "git") {
+    return env;
+  }
+  return nonInteractiveGitEnv(env);
+}
+
 function expectedSourceCommit() {
   return (
     process.env.DISASMER_ACCEPTANCE_COMMIT ||
diff --git a/scripts/public-release-dryrun-preflight.js b/scripts/public-release-dryrun-preflight.js
index cb483d8..24a97b2 100755
--- a/scripts/public-release-dryrun-preflight.js
+++ b/scripts/public-release-dryrun-preflight.js
@@ -40,6 +40,9 @@ function nonInteractiveEnv(extra = {}) {
     GIT_TERMINAL_PROMPT: "0",
     GIT_ASKPASS: process.env.GIT_ASKPASS || "/bin/false",
     SSH_ASKPASS: process.env.SSH_ASKPASS || "/bin/false",
+    GIT_SSH_COMMAND:
+      process.env.GIT_SSH_COMMAND ||
+      "ssh -o BatchMode=yes -o NumberOfPasswordPrompts=0",
     ...extra,
   };
 }