DEVX-166: create_dependency_pr must clone the target repo

Problem

create_dependency_pr resolves the pinned-version file and runs all git operations in the current working directory. Producer post-merge workflows (grm, sso-bridge) invoke it from the producer checkout, so it searches/modifies the wrong repository: find_pinned_version reads files that do not exist there, and the git fetch/checkout/commit/push sequence runs in the producer clone. The failure is silent — producer workflows append || echo warning, so a no-op looks like success.

Approach

REQ-1: Clone the target repo (--repo) into a temporary directory with an authenticated http.extraHeader, then run every file lookup and git operation (fetch, checkout, add, commit, push) inside that clone. The push uses the same auth header config.

REQ-2: Tests mock subprocess.run so no real clone happens in the unit suite (test-isolation gate).

Files Affected

src/devx/ci/create_dependency_pr.py
tests/unit/test_create_dependency_pr.py

Test Plan

Existing CLI tests keep passing with the subprocess mock in place.
Verify the clone command targets the --repo URL and that git ops run with cwd=<clone> (asserted via the mock's call list).

Deploy Plan

Merge via auto-merge after green CI. The fix takes effect the next time a producer post-merge workflow invokes create_dependency_pr.

Rollback Plan

Revert the squash-merge commit on master; the previous (broken) CWD behavior returns, which is strictly worse — no state is created.

Acceptance Criteria

REQ-1: target repo cloned to tempdir; all file/git ops run in the clone
REQ-2: unit tests never spawn a real git subprocess

1.7 KiB Raw Blame History