Retry transient Git config reads - #2130

Problem and Context

Concurrent Git processes can replace .git\config while VFS for Git reads it. On Windows, a reader can then get a short Permission denied or sharing error. This happens, for example, when several worktree mounts read the shared config while one mount writes it.

VFS for Git reads configuration through git.exe and through libgit2. A retry in only one of them would leave the other config readers exposed to the same race.

RetryConfig also started git.exe three times on every load, once each for gvfs.max-retries, gvfs.timeout-seconds, and gvfs.read-timeout-seconds. Mount, clone, prefetch, and dehydrate load it.

Changes

Transient config read retry

• Add one bounded retry policy, GitConfigReadRetry, for git.exe and libgit2 config reads. It makes five attempts, with exponential delays from 20 to 160 milliseconds.
• Retry only transient file access failures. The classifier tests only the failure reason after the quoted path, so a path that contains "Permission denied" does not match.
• Preserve missing-key results. Do not retry non-transient failures. Do not change config writes.
• Retry the libgit2 repository open, because it parses .git\config.
• Retry the hook's Git alias lookup. Hooks allow at most one retry, because they run on the Git command path.
• Trace each retry and the final exhausted attempt. Do not trace a config name that contains URL credentials.
• Buffer libgit2 multivalue results before callbacks, so that a retry cannot run a callback twice.
• Use the same policy for git credential fill. Credential fill keeps its stricter check: it retries only an empty-output failure in which git reports a transient file access warning and its config read failure. Each attempt gets only the time that remains of the caller's timeout. Credential fill now reports retries with the shared retry traces, not with a separate CredentialConfigReadFailure event.
• Add Enlistment.CreateGitProcess(ITracer), so that the mount's config readers report retries to the mount trace.

RetryConfig reads with libgit2

• Read gvfs.max-retries, gvfs.timeout-seconds, and gvfs.read-timeout-seconds in process with libgit2. An invalid or unreadable setting still uses its default with a warning. Open a transient repository without its object store. Before clone creates the repository, read the global, XDG, system, and ProgramData config, as the git.exe path does.
• Read with git.exe when libgit2 cannot give the value that git.exe gives:
  • when the environment sets GIT_CONFIG_PARAMETERS, GIT_CONFIG_COUNT, GIT_CONFIG_GLOBAL, GIT_CONFIG_SYSTEM, GIT_CONFIG_NOSYSTEM, or GIT_CONFIG. libgit2 also ignores GIT_DIR, but the reader does not fall back for it: Git exports GIT_DIR to hooks in linked worktrees, GVFS reads repositories through an explicit path, and before clone creates the repository an inherited GIT_DIR names an unrelated repository;
  • when the config has an include that libgit2 evaluates differently from git.exe: an includeIf condition other than gitdir: or gitdir/i: (libgit2 skips hasconfig:remote.*.url without an error, and can apply onbranch: on a detached HEAD), a gitdir: pattern that starts with a slash, or a path that uses %(prefix);
  • when libgit2 selects a different global or XDG config file than Git for Windows. Git reads .gitconfig from one home directory (HOME, else HOMEDRIVE and HOMEPATH, else USERPROFILE). libgit2 uses the first of these directories that contains the file. It also searches APPDATA and LOCALAPPDATA for the XDG file;
  • when libgit2 fails to read the setting, for example because it rejects the repository's ownership. The reader traces RetryConfig_ReadWithGit in this case.
• After a transient failure, do not read again with git.exe, because libgit2 already used the retry budget.
• Move integer setting parsing to GitConfigHelper, so that both readers report the same default, minimum, and parse errors.
• When the LibGit2Repo constructor fails, suppress finalization. The constructor already released its libgit2 reference, and the finalizer released it a second time.

Tests

• Add unit tests for retry recovery, missing keys, persistent and non-transient failures, the reason classifier, exhaustion traces, credential redaction, libgit2 retries, multivalue callbacks, and the repository open retry.
• Update the credential fill unit tests to assert the shared retry traces. Add a unit test for the retry policy's time budget check and its callback before each retry.
• Add unit tests that read RetryConfig with libgit2 from a test repository and from an isolated global config. The tests use a non-ASCII repository path.
• Add unit tests that compare the libgit2 reader with the installed git.exe. The tests check that a hasconfig: include, an onbranch: include on a branch and on a detached HEAD, and a gitdir: pattern without a drive are read through git.exe with the value that git.exe reads. Other tests check that %(prefix) include paths are read through git.exe.
• Add a unit test that sets HOME to an empty directory and USERPROFILE to a directory with a .gitconfig. The test checks that the libgit2 reader fails, that the installed git.exe reads no value, and that RetryConfig uses the default.
• Add unit tests for the environment variables that route reads to git.exe, and for the fallback.

Known gaps and deliberate decisions

• No feature flag for the RetryConfig reader — the reader change affects the success path. Every known difference between libgit2 and git.exe routes the read to git.exe. A gvfs.* flag would itself need a config read.
• A future Git config feature could diverge — the reader knows the includeIf conditions that libgit2 evaluates today. A new Git config mechanism that libgit2 skips without an error would not be detected.
• No unit test for the constructor finalization fix — the finalizer calls the real libgit2 shutdown, which all tests in the process share.
• No functional test for the new reader — unit tests compare libgit2 with the installed git.exe.
• The fallback event is not telemetry — its error text can contain user paths.
• An exhausted --file or --global read can look unset — git config --file exits 1 with only warning: lines, which ConfigResult treats as "not configured".
• GetConfigString cannot observe a locked config — libgit2 serves its parsed snapshot, so its retry helps GetConfigBool and repository open.
• Config writes are not retried — Keep worktree ids and status cache path out of the shared git config #2129 moves the mount's worktree ids out of the shared config.
• No retry jitter — mounts that fail together retry at the same offsets.
• Some readers have no tracer — the enlistment constructor, HttpRequestor, and the static global and system readers do not report retries.