uv run test/downstream/run.py bandit

uv run test/downstream/run.py bandit --backend gix

uv run test/downstream/run.py bandit --version 1.9.4

for backend in gix cli; do

for project in langchain mlflow bandit swebench datahub; do

uv run test/downstream/run.py "$project" --backend "$backend"

done

The default resolves the latest release from PyPI each time. `--version` reproduces

a release; `--python` selects the test interpreter (default: 3.12), including an

existing interpreter's path. `--backend` selects `cli` (the default) or `gix`.

The runner creates a fresh environment and installs this editable checkout,

adding the official GixPython release through `.[gix]` for Gix runs. It verifies

both the imported checkout and the selected backend before testing, and records

the backend in `result.json` and the default work-directory name. Starting the

runner from a Gix environment alone does not select Gix in the isolated test

environment. Upstream test files are not modified.

Source, the environment, frozen requirements, JUnit results, and release provenance

are retained under `.cache/downstream/`. `--work-dir PATH` uses a new directory

| Project | Distribution downloads | Last tested release | Selected coverage |

| --- | ---: | --- | --- |

| LangChain Community | 27,882,881 | 0.4.2 | 2 upstream GitLoader tests: real clones, commits, checkout, tree traversal, ignored paths, and remote validation |

| MLflow (`mlflow-skinny`) | 25,850,354 | 3.17.0 | 47 upstream tests: 31 repository/project/model-versioning cases plus 16 Git context and credential-redaction contract cases |

| Bandit | 24,935,372 | 1.9.4 | 12 upstream baseline CLI tests: real repository creation, commits, branches, resets, discovery, and dirty state |

| SWE-bench | 22,942,741 | 5.0.2 | 4 supplemental integration cases for `AutoContextManager`; no upstream tests cover its GitPython callers |

| DataHub (`acryl-datahub`) | 5,019,402 | 1.7.0.14 | 7 upstream tests passed, 1 credential-dependent skip: public clone/checkout, SSH timeout, exception/redaction contracts, and configuration |

credential variable and needs no private credentials. `ssh`, public GitLab

access, and local TCP sockets are needed for the selected tests.

CI runs all five projects against the latest release with both CLI and Gix

backends, for ten independent jobs. A backend mismatch or a run in which no

test passes fails the job, including when all selected tests are skipped.

Test dependency ranges only supply the upstream test harness; they do not pin

the dependent's release.

profiles = json.loads((HERE / "projects.json").read_text())

parser = argparse.ArgumentParser(description=__doc__)

parser.add_argument("project", choices=profiles)

parser.add_argument("--backend", choices=("cli", "gix"), default="cli", help="Backend to install and verify")

parser.add_argument("--version", help="Release to reproduce; defaults to PyPI's latest release")

parser.add_argument("--python", default="3.12", help="Python used by the isolated test environment")

parser.add_argument("--work-dir", type=Path, help="New directory for retained source, environment, and results")

else:

cache = CHECKOUT / ".cache" / "downstream"

cache.mkdir(parents=True, exist_ok=True)

work = Path(tempfile.mkdtemp(prefix=f"{args.project}-{version}-{args.backend}-", dir=cache))

print(f"Testing {args.project} {version} with {args.backend}; retained work directory: {work}", flush=True)

config = work / "gitconfig"

config.write_text(

if profile.get("no_deps"):

run(install + ["--no-deps"] + list(map(expand, profile["no_deps"])), env=env)

# Replace the released dependency even if the downstream pins another version.

requirement = str(CHECKOUT) + ("[gix]" if args.backend == "gix" else "")

run(install + ["--reinstall-package", "gitpython", "-e", requirement], env=env)

# Check the import used by tests and by downstream Python subprocesses.

run(

[

str(python),

"-c",

"import os, pathlib, sys, git; from git import _backend; "

"expected = pathlib.Path(os.environ['GITPYTHON_CHECKOUT']) / 'git' / '__init__.py'; "

"assert pathlib.Path(git.__file__).resolve() == expected.resolve(), git.__file__; "

"print('GitPython backend:', _backend.name); "

"assert _backend.name == sys.argv[1], f'Expected {sys.argv[1]} backend, got {_backend.name}'; "

"print('GitPython:', git.__file__); print(git.Git().version()); "

"assert git.Git().version_info >= (2, 52), 'Git 2.52 or newer is required'",

args.backend,

],

cwd=source,

env=env,

)

with (work / "requirements-frozen.txt").open("w") as output:

run(["uv", "pip", "freeze", "--python", str(python)], env=env, stdout=output)

result = {

"project": args.project,

"version": version,

"backend": args.backend,

"source": provenance,

"gitpython": str(CHECKOUT),

}

result_path = work / "result.json"

result_path.write_text(json.dumps(result, indent=2) + "\n")

report = work / "junit.xml"