Respect git global ignore files (core.excludesFile) in source scanner

[Lukecele]

When scanning for source candidates, Oxide previously disabled git global ignore files via builder.git_global(false).

As noted in #15941, the intention was to prevent .gitignore files in parent directories outside of a git repository from taking effect, while keeping global ignore files configured in git working. However, calling git_global(false) on the walker had the unintended side effect of ignoring core.excludesFile (and $XDG_CONFIG_HOME/git/ignore) entirely.

This change enables builder.git_global(true) so that ignore patterns configured in Git's global configuration are respected during source scanning.

Fixes #20509

Test plan

• Added unit test respects_git_core_excludes_file in crates/oxide/tests/scanner.rs verifying that files matched by Git's core.excludesFile are skipped.
• Verified that all existing unit and scanner tests continue to pass.

[ci-all]

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Changes which files the scanner ignores during source scanning.

The PR appears safe to merge; no new actionable issues were found.

_{Reviews (3) · Last reviewed commit: "ci: retrigger pull request checks"}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 467dad97-5759-4870-bd3c-ade3ce5180d2

📥 Commits

Reviewing files that changed from the base of the PR and between 4f875f5 and 8e1e925.

📒 Files selected for processing (2)

• crates/ignore/src/gitignore.rs
• crates/oxide/tests/scanner.rs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

Walkthrough

The excludes-file parser now accepts quoted core.excludesFile paths that contain spaces. The scanner now respects Git global ignore files. New tests check quoted-path parsing and verify that a globally excluded HTML file is omitted from scan results.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: 🔵 Low · up to 39cbd

The global-ignore change is mergeable with awareness of the test's shared configuration mutation. Isolating that fixture remains a bounded follow-up; no existing test failure or production defect was established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 8e1e9

Global Git ignore settings now affect which files are scanned. The change remains within existing filesystem permissions and source-selection behavior, with no demonstrated privilege escalation. The remaining uncertainty is who controls these settings in shared or automated build environments.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A party controlling a consumed global configuration or excludes file can influence file selection in scanner processes reading that policy. Shared environment, home, or system configuration can affect multiple scans. The evidence does not establish attacker access, privileges gained, or tenant, service, and deployment scope.

Trust Boundaries and Controls

• observed — The newly consumed configuration is opened and parsed as data under the scanner process's existing filesystem authority. Explicit source rules, source-pattern filtering, and conditional repository-boundary handling remain in place. These controls do not establish the provenance or trustworthiness of global policy.

Resilience and Maintainability Implications

• observed — Global ignore loading is best-effort: missing excludes files produce an empty matcher, matcher errors can produce empty or partial rules, and errors are debug-logged rather than enforced as scan failures. This existing ignore-crate behavior now applies to the scanner and should not be interpreted as fail-closed security enforcement.

Hardening Proposals

• proposed — For shared or automated builds, explicitly control ownership of the process environment and global Git configuration so file-selection policy is intentional and reproducible. Treat this as deployment hardening, not remediation of a verified vulnerability.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: enabling Git global ignore files in the source scanner.
Description check	✅ Passed	The description directly explains the previous behavior, the change to builder.git_global(true), the related issue, and the added test.
Linked Issues check	✅ Passed	Issue [#20509] requires source scanning to skip files matched by Git core.excludesFile. create_walker now calls builder.git_global(true). The scanner test configures GIT_CONFIG_GLOBAL with an …
Out of Scope Changes check	✅ Passed	The changes stay within issue [#20509]. The scanner setting implements global Git ignore support. The parser update supports valid quoted core.excludesFile paths needed by that behavior. The tests p…

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

crates/oxide/tests/scanner.rs (1)

2961-2961: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Synchronize the process-wide GIT_CONFIG_GLOBAL mutation.

GIT_CONFIG_GLOBAL is process-wide, and global Git-ignore handling reads it during Scanner::new. The configured pattern matches only ignored-by-global.html. The inspected concurrent scanner fixtures do not contain that basename, and their Git commands are only git init calls with ignored output. The race therefore does not currently change an asserted result or cause a command failure. It can affect a future scan that contains this basename. Isolate this test in a separate process or protect the mutation with a shared lock.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 7f764ba3-4601-4e02-b611-e93f5ae31d2d

📥 Commits

Reviewing files that changed from the base of the PR and between fa81d69 and 4f875f5.

📒 Files selected for processing (2)

• crates/oxide/src/scanner/mod.rs
• crates/oxide/tests/scanner.rs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[Lukecele]

#20524 (review)