Read CI default-branch variables in the shared lookup

GitLab's CI_DEFAULT_BRANCH and Buildkite's BUILDKITE_PIPELINE_DEFAULT_BRANCH
only fed the final branch comparison. The commit-on-default check still
went to the remote, so single-branch checkouts on those CIs paid for a
git ls-remote call even when CI already knew the answer. Both variables
now come first in get_default_branch_name.

Also simplifies the remote lookup. start_new_session works on every
platform because Windows ignores it and taskkill walks the tree by PID.
The stalled-remote fixture is now a listener that never accepts, and the
test clears proxy variables so it really waits for the timeout.

Author: mtorp

CHANGELOG.md

@@ -9,6 +9,9 @@
   `actions/checkout`. The CLI reads the default branch from the GitHub event
   payload or asks the remote, before falling back to `main`/`master`. Scans on
   those branches become the branch head again.
+- GitLab's `CI_DEFAULT_BRANCH` and Buildkite's `BUILDKITE_PIPELINE_DEFAULT_BRANCH`
+  now apply to every default-branch check, including whether the commit is on
+  the default branch.
 
 ## 2.10.5
 

socketsecurity/core/git_interface.py

@@ -33,6 +33,7 @@ def __init__(self, path: str, base_commit_sha: str | None = None):
         self.path = path
         self.base_commit_sha = base_commit_sha
         self._fetched_ref_commits = {}
+        self._default_branch_name: str | None = None
         self.ensure_safe_directory(path)
         self.repo = Repo(path)
         assert self.repo
@@ -422,12 +423,10 @@ def _is_commit_and_branch_default(self) -> bool:
             github_ref = os.getenv('GITHUB_REF')  # e.g., 'refs/heads/main' or 'refs/pull/123/merge'
             gitlab_branch = os.getenv('CI_COMMIT_BRANCH')
             gitlab_mr_branch = os.getenv('CI_MERGE_REQUEST_SOURCE_BRANCH_NAME')
-            gitlab_default_branch = os.getenv('CI_DEFAULT_BRANCH', '')
             bitbucket_branch = os.getenv('BITBUCKET_BRANCH')
             buildkite_branch = os.getenv('BUILDKITE_BRANCH')
             buildkite_pr = os.getenv('BUILDKITE_PULL_REQUEST')
-            buildkite_default_branch = os.getenv('BUILDKITE_PIPELINE_DEFAULT_BRANCH')
-            
+
             # Handle Buildkite before GitHub because some Buildkite pipelines
             # intentionally provide GitHub-compatible environment variables.
             if buildkite_branch:
@@ -437,7 +436,7 @@ def _is_commit_and_branch_default(self) -> bool:
                         "not default branch"
                     )
                     return False
-                default_branch_name = buildkite_default_branch or self.get_default_branch_name()
+                default_branch_name = self.get_default_branch_name()
                 is_default = buildkite_branch == default_branch_name
                 log.debug(
                     f"Buildkite branch: {buildkite_branch}, Default: {default_branch_name}, "
@@ -470,7 +469,7 @@ def _is_commit_and_branch_default(self) -> bool:
             elif gitlab_branch or gitlab_mr_branch:
                 # If this is a merge request, use the source branch
                 current_branch = gitlab_mr_branch or gitlab_branch
-                default_branch_name = gitlab_default_branch or self.get_default_branch_name()
+                default_branch_name = self.get_default_branch_name()
 
                 # For merge requests, they're typically not considered "default branch"
                 if gitlab_mr_branch:
@@ -644,13 +643,17 @@ def get_default_branch_name(self) -> str:
         Returns:
             Default branch name (e.g., 'main', 'master')
         """
-        cached = getattr(self, "_default_branch_name", None)
-        if cached:
-            return cached
-        self._default_branch_name = self._detect_default_branch_name()
+        if self._default_branch_name is None:
+            self._default_branch_name = self._detect_default_branch_name()
         return self._default_branch_name
 
     def _detect_default_branch_name(self) -> str:
+        for variable in ('CI_DEFAULT_BRANCH', 'BUILDKITE_PIPELINE_DEFAULT_BRANCH'):
+            default_branch = os.getenv(variable)
+            if default_branch:
+                log.debug(f"Default branch detected from {variable}: {default_branch}")
+                return default_branch
+
         try:
             default_branch = self.repo.remotes.origin.refs.HEAD.reference.remote_head
             log.debug(f"Default branch detected from origin/HEAD: {default_branch}")
@@ -666,13 +669,14 @@ def _detect_default_branch_name(self) -> str:
         if default_branch:
             return default_branch
 
+        try:
+            remote_refs = {str(ref) for ref in self.repo.remotes.origin.refs}
+        except Exception:
+            remote_refs = set()
         for branch_name in ['main', 'master']:
-            try:
-                if f'origin/{branch_name}' in [str(ref) for ref in self.repo.remotes.origin.refs]:
-                    log.debug(f"Using fallback default branch: {branch_name}")
-                    return branch_name
-            except Exception:
-                continue
+            if f'origin/{branch_name}' in remote_refs:
+                log.debug(f"Using fallback default branch: {branch_name}")
+                return branch_name
 
         log.debug("Using final fallback default branch: main")
         return 'main'
@@ -693,12 +697,8 @@ def _default_branch_from_github_event() -> str | None:
         return default_branch or None
 
     def _default_branch_from_remote(self) -> str | None:
-        # A new process group lets a timeout also kill the remote helpers, which
-        # otherwise hold stdout open and keep communicate() blocked.
-        if IS_WINDOWS:
-            group_kwargs = {"creationflags": subprocess.CREATE_NEW_PROCESS_GROUP}
-        else:
-            group_kwargs = {"start_new_session": True}
+        # A new session lets a timeout also kill the remote helpers, which otherwise
+        # hold stdout open and keep communicate() blocked. Windows ignores it.
         try:
             process = subprocess.Popen(
                 ["git", "ls-remote", "--symref", "origin", "HEAD"],
@@ -708,7 +708,7 @@ def _default_branch_from_remote(self) -> str | None:
                 stdout=subprocess.PIPE,
                 stderr=subprocess.DEVNULL,
                 text=True,
-                **group_kwargs,
+                start_new_session=True,
             )
         except Exception as error:
             log.debug(f"Could not query origin for its default branch: {error}")

tests/unit/test_git_interface.py

@@ -1,7 +1,6 @@
 import logging
 import socket
 import subprocess
-import threading
 import time
 from types import SimpleNamespace
 from unittest.mock import MagicMock
@@ -434,6 +433,20 @@ def test_github_event_payload_supplies_default_branch(
     remote_lookup.assert_not_called()
 
 
+def test_ci_default_branch_variable_skips_remote_lookup(
+        single_branch_checkout, monkeypatch, mocker
+):
+    monkeypatch.setenv("CI_COMMIT_BRANCH", "dev")
+    monkeypatch.setenv("CI_DEFAULT_BRANCH", "dev")
+    mocker.patch.object(Git, "ensure_safe_directory")
+    remote_lookup = mocker.patch.object(Git, "_default_branch_from_remote")
+
+    repository = Git(str(single_branch_checkout))
+
+    assert repository.is_default_branch is True
+    remote_lookup.assert_not_called()
+
+
 def test_origin_head_wins_without_remote_lookup(single_branch_checkout, monkeypatch, mocker):
     _git(single_branch_checkout, "symbolic-ref", "refs/remotes/origin/HEAD", "refs/remotes/origin/dev")
     monkeypatch.setenv("GITHUB_REF", "refs/heads/dev")
@@ -459,28 +472,11 @@ def test_feature_branch_in_single_branch_checkout_is_not_default(
 
 @pytest.fixture
 def stalled_http_remote():
-    """An HTTP server that accepts connections and never responds."""
+    """An HTTP remote that completes the TCP handshake and never responds."""
     server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     server.bind(("127.0.0.1", 0))
     server.listen()
-    connections = []
-    stop = threading.Event()
-
-    def accept():
-        server.settimeout(0.2)
-        while not stop.is_set():
-            try:
-                connections.append(server.accept()[0])
-            except OSError:
-                continue
-
-    thread = threading.Thread(target=accept, daemon=True)
-    thread.start()
     yield f"http://127.0.0.1:{server.getsockname()[1]}/repo.git"
-    stop.set()
-    thread.join()
-    for connection in connections:
-        connection.close()
     server.close()
 
 
@@ -489,28 +485,26 @@ def test_stalled_remote_lookup_stops_at_timeout(
 ):
     _git(single_branch_checkout, "remote", "set-url", "origin", stalled_http_remote)
     monkeypatch.setattr(git_interface, "REMOTE_HEAD_TIMEOUT_SECONDS", 1)
+    for variable in ("HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "http_proxy", "https_proxy", "all_proxy"):
+        monkeypatch.delenv(variable, raising=False)
     repository = Git.__new__(Git)
     repository.repo = Repo(str(single_branch_checkout))
 
     started = time.monotonic()
     result = repository._default_branch_from_remote()
 
     assert result is None
-    assert time.monotonic() - started < 10
+    assert 1 <= time.monotonic() - started < 10
 
 
-def test_windows_remote_lookup_uses_new_process_group(monkeypatch, mocker):
-    monkeypatch.setattr(git_interface, "IS_WINDOWS", True)
-    monkeypatch.setattr(subprocess, "CREATE_NEW_PROCESS_GROUP", 0x200, raising=False)
+def test_remote_lookup_parses_branch_with_slash(mocker):
     process = MagicMock(returncode=0)
     process.communicate.return_value = ("ref: refs/heads/release/stable\tHEAD\n", "")
-    popen = mocker.patch.object(git_interface.subprocess, "Popen", return_value=process)
+    mocker.patch.object(git_interface.subprocess, "Popen", return_value=process)
     repository = Git.__new__(Git)
     repository.repo = MagicMock(working_dir="/repo")
 
     assert repository._default_branch_from_remote() == "release/stable"
-    assert popen.call_args.kwargs["creationflags"] == 0x200
-    assert "start_new_session" not in popen.call_args.kwargs
 
 
 def test_windows_timeout_kills_the_whole_process_tree(monkeypatch, mocker):