Require Git 2.38+ for app security checks

[jek]

WHY are these changes introduced?

shopify app security check runs Git while inspecting untrusted repositories. Its protections rely on safe.bareRepository, which was introduced in Git 2.38. Older versions can't enforce the complete protection set.

WHAT is this pull request doing?

Require Git 2.38 or later before every Git command app security runs. A version manager can select a different Git for each working directory, so the version is checked in the directory where each command runs. The check runs Git the same way the scan does, so it also refuses a git executable in the scanned directory.

A scan that doesn't use Git, such as --no-git-ignore with no Git-dependent secret candidate, still runs without it.

When Git is missing, can't run, reports an unrecognized version, or is too old, the command stops with an actionable error. The version guard lives in CLI Kit for reuse, but only app security enforces it today. Other Git-using commands are unchanged.

Git versions before 2.45 can't turn off lazy fetching, and their empty transport allow-list still allows a helper with an empty name, which a remote gets from an empty vcs or a URL that starts with ::. Git runs that helper through the repository's remote- alias, so every Git command now also replaces that alias.

This also fixes CLI Kit's check that refuses a program found in the working directory, which never worked on Windows: it joined the directory to PATH with :, and Windows splits PATH on ;. It now looks up a bare command name as a file in the working directory, so either path separator works. A command given as a path, such as ./build.sh, runs the file the caller named and isn't checked. This applies to every command the CLI runs.

How to manually test your changes?

1. Create a temporary app and a Git executable that reports an unsupported version:

   real_git="$(command -v git)"
   app="$(mktemp -d)"
   fake_git="$(mktemp -d)"
   cp packages/e2e/data/valid-app/shopify.app.toml "$app/shopify.app.toml"
   printf 'export const answer = 42\n' > "$app/index.ts"
   printf '#!/bin/sh\necho "git version 2.37.6"\n' > "$fake_git/git"
   chmod +x "$fake_git/git"

2. Run file listing with default Git filtering:

   PATH="$fake_git:$PATH" node packages/cli/bin/dev.js app security check \
     --path "$app" \
     --list-files

   Confirm that it exits before gathering and reports that Git 2.38 or later is required.

3. Turn off Git filtering:

   PATH="$fake_git:$PATH" node packages/cli/bin/dev.js app security check \
     --path "$app" \
     --no-git-ignore \
     --list-files

   Confirm that it lists the app files and exits successfully because this scan doesn't use Git.

4. Replace the fake Git with one that, like a version manager, selects an old Git only in a nested repository:

   mkdir "$app/nested"
   "$real_git" -C "$app/nested" init -q
   touch "$app/nested/.old-git"
   cat > "$fake_git/git" <<EOF
   #!/bin/sh
   if [ "\$1" = "--version" ]; then
     if [ -f .old-git ]; then echo "git version 2.37.6"; else echo "git version 2.55.0"; fi
     exit 0
   fi
   exec "$real_git" "\$@"
   EOF
   PATH="$fake_git:$PATH" node packages/cli/bin/dev.js app security check \
     --path "$app" \
     --list-files

   Confirm that it reports Git 2.37.6 is installed, even though the app directory selects Git 2.55.0.

5. Remove the temporary directories:

   rm -rf "$app" "$fake_git"

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[dmerand]

LGTM with the exception of this issue, which we discussed async.

[dmerand]

This new Windows-only regression fails in Windows Node 26 CI: it expects /Skipped run of unsecure binary/, but receives Couldn't determine the installed Git version. The macOS smoke run skips this test.

Could we fix the Windows refusal/test behavior and get the Windows job plus required Unit tests green before landing? Please keep the planted-script regression. Since execa is mocked here, this failure alone does not prove that git.cmd ran.

[jek]

Pushed as an additional commit

[lopez-mar]

approved pending what we discussed async

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/public/node/git.d.ts

@@ -102,6 +102,17 @@ export declare function getHeadSymbolicRef(directory?: string): Promise<string>;
  * an abort error.
  */
 export declare function ensureGitIsPresentOrAbort(): Promise<void>;
+export interface GitVersionCheckOptions {
+    /** The directory to run Git in. A version manager can select a different Git for each working directory. */
+    cwd?: string;
+}
+/**
+ * Aborts when Git isn't installed, can't run, reports an unrecognized version, or is older than the required minimum.
+ *
+ * @param minimumVersion - The oldest supported Git version, in semantic version format.
+ * @param options - Where to run Git.
+ */
+export declare function ensureGitVersionIsAtLeast(minimumVersion: string, options?: GitVersionCheckOptions): Promise<void>;
 export declare class OutsideGitDirectoryError extends AbortError {
 }
 /**