fix(crafter): handle invalid merge branch config during repo open

Gracefully handle "branch config: invalid merge" errors from go-git
when opening a repository, similar to the existing protection for
remote listing. This prevents the crafter from crashing when the
local git config has an invalid merge reference.

Closes #3031

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

pkg/attestation/crafter/crafter.go

@@ -310,7 +310,12 @@ var errBranchInvalidMerge = errors.New("branch config: invalid merge")
 
 // Returns the current directory git commit hash if possible
 // If we are not in a git repo it will return an empty string
-func gracefulGitRepoHead(path string) (*HeadCommit, error) {
+func gracefulGitRepoHead(path string, logger *zerolog.Logger) (*HeadCommit, error) {
+	if logger == nil {
+		l := zerolog.Nop()
+		logger = &l
+	}
+
 	repo, err := git.PlainOpenWithOptions(path, &git.PlainOpenOptions{
 		// walk up the directory tree until we find a git repo
 		DetectDotGit: true,
@@ -329,6 +334,12 @@ func gracefulGitRepoHead(path string) (*HeadCommit, error) {
 			return nil, nil
 		}
 
+		// This error is not exposed by go-git so we do a string comparison
+		if isBranchInvalidMergeError(err) {
+			logger.Warn().Err(err).Msg("branch is invalid merge, skipping commit")
+			return nil, nil
+		}
+
 		return nil, fmt.Errorf("opening repository: %w", err)
 	}
 
@@ -361,8 +372,9 @@ func gracefulGitRepoHead(path string) (*HeadCommit, error) {
 		// we do not care about that use-case, so we ignore the error
 		// we compare by error string because go-git does not expose the error type
 		// and errors.Is require the same instance of the error
-		if err.Error() == errBranchInvalidMerge.Error() {
-			return c, nil
+		if isBranchInvalidMergeError(err) {
+			logger.Warn().Err(err).Msg("branch is invalid merge, skipping remotes")
+			return nil, nil
 		}
 
 		return nil, fmt.Errorf("getting remotes: %w", err)
@@ -387,6 +399,10 @@ func gracefulGitRepoHead(path string) (*HeadCommit, error) {
 	return c, nil
 }
 
+func isBranchInvalidMergeError(err error) bool {
+	return err.Error() == errBranchInvalidMerge.Error()
+}
+
 // Clear any basic auth credentials from the remote URL
 func sanitizeRemoteURL(remoteURL string) (string, error) {
 	uri, err := url.Parse(remoteURL)
@@ -409,7 +425,7 @@ func initialCraftingState(cwd string, opts *InitOpts) (*api.CraftingState, error
 		return nil, errors.New("required init options not provided")
 	}
 	// Get git commit hash
-	headCommit, err := gracefulGitRepoHead(cwd)
+	headCommit, err := gracefulGitRepoHead(cwd, opts.Logger)
 	if err != nil {
 		return nil, fmt.Errorf("getting git commit hash: %w", err)
 	}

pkg/attestation/crafter/crafter_unit_test.go

@@ -27,6 +27,7 @@ import (
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing/object"
+	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
@@ -190,7 +191,8 @@ func (s *crafterUnitSuite) TestGitRepoHead() {
 				require.NoError(s.T(), err)
 			}
 
-			got, err := gracefulGitRepoHead(path)
+			l := zerolog.Nop()
+			got, err := gracefulGitRepoHead(path, &l)
 			if tc.wantErr {
 				assert.Error(s.T(), err)
 				return
@@ -358,7 +360,8 @@ func (s *crafterUnitSuite) TestGitRepoHeadWorktree() {
 	out, err := cmd.CombinedOutput()
 	require.NoError(s.T(), err, "git worktree add: %s", out)
 
-	got, err := gracefulGitRepoHead(worktreePath)
+	l := zerolog.Nop()
+	got, err := gracefulGitRepoHead(worktreePath, &l)
 	require.NoError(s.T(), err)
 	require.NotNil(s.T(), got)