fix(nix): support git worktree checkouts

[boxcee-interview]

Closes #425

nix.sh bind-mounts only $(pwd) at /crossplane-cli. In a git worktree checkout, .git is a file pointing at the main clone's .git/worktrees/<name> — a path the container never sees. The container's first git command (git config --global --add safe.directory) therefore fails with fatal: not a git repository (exit 128) and set -e aborts the script before Nix starts.

Following the fix suggested in the issue: when .git is a file (worktree), also bind-mount the main clone's git dir and the worktree itself at their host paths — that is what Nix (libgit2) resolves the worktree path from — and add both host paths to safe.directory inside the container. Regular-clone runs are unaffected (no extra mounts, no extra safe.directory entries).

How to Test

git -C crossplane-cli worktree add --detach ../cli-wt origin/main
cd ../cli-wt
./nix.sh flake metadata   # previously: fatal: not a git repository (exit 128)

Verified in a container reproducing the mount layout: with the common git dir and worktree mounted at their host paths and both added to safe.directory, git status/git rev-parse succeed in the worktree directory (exit 0); with the original single mount they fail exactly as reported (exit 128).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: crossplane/cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8002550d-1765-4191-8caa-e47a1474b0ee

📥 Commits

Reviewing files that changed from the base of the PR and between 833d6e0 and 51ba841.

📒 Files selected for processing: 1

• nix.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

When nix.sh runs from a Git worktree, it mounts the worktree and common Git directory into the container. The script passes their host paths to the container and adds nonempty paths to Git's global safe.directory configuration.

Changes: Git worktree support

Layer / File(s)	Summary
Resolve, mount, and trust worktree paths nix.sh	When .git is a file, the script resolves the common Git directory, makes a relative path absolute, and mounts it and the worktree into the container. It passes both host paths as environment variables. Inside the container, it adds each nonempty path to Git's global safe.directory configuration.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 51ba8

The worktree path handling matches the documented root-based invocation, with no material merge blocker established.

Pre-merge checks: 6

Passed checks: 6 passed

Check name	Status	Explanation
Title check		The title is 40 characters, stays under the 72-character limit, and clearly describes support for Git worktree checkouts in nix.sh.
Description check		The description directly explains the Git worktree failure, the mounting and safe.directory changes, expected behavior, and test results.
Linked Issues check		Issue #425 requires nix.sh to work from Git worktrees and preserve full-clone behavior. nix.sh detects a .git file, resolves git rev-parse --git-common-dir, mounts the common Git directory and…
Out of Scope Changes check		The diff changes only nix.sh. Each change supports issue #425 by mounting Git worktree metadata or configuring the required safe.directory entries. No unrelated change is present.
Breaking Changes		The pull request changes only nix.sh. The authoritative diff contains no files under apis/** or cmd/**, so it does not remove or rename public fields or flags, add required public fields or flag…
Feature Gate Requirement		PASS. The pull request changes only nix.sh and adds Git worktree handling for the existing Nix wrapper. It does not add an experimental application feature or change apis/**. The existing Nix `exp…

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}