feat(git): provide git to apt through a virtual package

[viceice]

Changes

After install-tool git, containerbase registers a containerbase-git deb that provides git (= 1:<version>):

• packages depending on git (e.g. git-lfs, tig) install without pulling Ubuntu's git into /usr/bin
• an explicit apt install git and git add-ons like git-svn still install Ubuntu's git, as before
• each install-tool git updates the virtual package to the installed version
• docs for custom images

Blocking Ubuntu's git (apt pin) is breaking and follows in the next major (#7779).

Context

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

Part of #7779.

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Code, tests and docs written with Claude Code (Claude Opus 5.5).

Use of AI in replying to PR comments

Who answers review comments:

• @viceice will read and reply directly. Name the account.
• An agent will draft replies and @username will read them before they are posted. Name the account.
• An agent will draft replies and reply autonomously. This is heavily discouraged, and we prefer that there are humans in the loop
• Nobody has explicitly committed to replying.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified tests

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 7 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: containerbase/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2983c956-af02-40de-96d8-193e92dc4fe6

📥 Commits

Reviewing files that changed from the base of the PR and between 1dd74d8 and 96e8f28.

📒 Files selected for processing: 4

• docs/custom-base-image.md
• src/cli/tools/git/index.spec.ts
• src/cli/tools/git/index.ts
• test/Dockerfile.distro

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Provide prebuilt git to apt through a virtual Debian package

✨ Enhancement 🧪 Tests 📝 Documentation 🕐 20-40 Minutes

AI Description

• Register the installed prebuilt git version as an apt-provided package after each installation.
• Let git-dependent packages install without pulling in Ubuntu's git; preserve explicit git
 installs.
• Document the behavior and test package registration and apt dependency resolution.

Diagram

graph TD
  A["install-tool git"] --> B["GitInstallService"] --> C["Versioned deb"] --> D[("dpkg status")] --> E["apt resolver"] --> F["git-lfs and tig"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin Ubuntu's git in apt

• ➕ Could prevent apt from selecting Ubuntu's git without building a Debian package.
• ➖ Would also change explicit git installation behavior, which this PR preserves for the current major release.

Recommendation: Use the versioned provider package for this release: it satisfies add-on dependencies while retaining explicit Ubuntu git installs. Defer the breaking apt pin to the planned major release.

Files changed (4) +111 / -5

Enhancement (1) +48 / -3

index.tsRegister installed git as a versioned apt provider +48/-3

Register installed git as a versioned apt provider

• After git installation, builds and installs an empty containerbase-git deb that provides git at the installed version with Ubuntu's git epoch. Uses a temporary build directory that is removed afterward.

src/cli/tools/git/index.ts

Tests (2) +58 / -2

index.spec.tsVerify virtual package creation during git post-install +38/-2

Verify virtual package creation during git post-install

• Checks Debian control metadata, directory permissions, build and installation commands, and temporary-directory cleanup alongside the existing safe-directory behavior.

src/cli/tools/git/index.spec.ts

Dockerfile.distroExercise git-dependent apt packages in an image test +20/-0

Exercise git-dependent apt packages in an image test

• Adds a Docker stage that installs git-lfs and tig, confirms Ubuntu's git was not installed, and checks that the prebuilt git remains active. Includes the stage in the final test image.

test/Dockerfile.distro

Documentation (1) +5 / -0

custom-base-image.mdExplain git's apt provider and compatibility limits +5/-0

Explain git's apt provider and compatibility limits

• Documents how containerbase-git satisfies git dependencies, while explicit git installs and git add-ons can still install Ubuntu's package. Notes that blocking Ubuntu's git is deferred to the next major release.

docs/custom-base-image.md

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1)

1. Failed installs leave a false Git provider 🐞 Bug

Description

postInstall installs containerbase-git before writing the apt pin and before the install
lifecycle tests the Git executable, but the failure handler does not undo that package installation.
If writing the pin or the later Git test fails, the handler deletes the tool version while dpkg
still reports a package providing that version of Git; a successfully written pin also continues to
block Ubuntu's Git.

Code

src/cli/tools/git/index.ts[178]

+      await this._spawn('dpkg', ['--install', deb]);

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A failed Git install can leave `containerbase-git` registered for a tool version that the install lifecycle has removed.
## Fix Focus Areas
- src/cli/tools/git/index.ts[123-135]
- src/cli/tools/git/index.ts[171-179]
- src/cli/install-tool/install-tool.service.ts[160-165]
## Recommended Fix
Add failure cleanup for the Git provider and pin, preserving the previous provider and pin when an attempted version update fails. Ensure cleanup also runs when a later install-lifecycle step, including the tool test, fails.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

---

Resolved findings

1. Git tests break after version bumps ✓ Resolved

Description

test-git-apt requires containerbase-git to report exactly 2.56.0 instead of deriving the
expected version from the installer input. When Renovate updates install-tool git, this
independent assertion can fail even though installation and apt provisioning still work.

Code

test/Dockerfile.distro[55]

+  dpkg -s containerbase-git | grep '^Version: 2\.56\.0$'; \

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The apt smoke test hard-codes the complete `containerbase-git` version separately from the installer command, so a Renovate version bump can make the test fail despite a successful installation.

## Fix Focus Areas
- test/Dockerfile.distro[54-56]

## Recommended Fix
Replace the exact `2.56.0` assertion with a stable-prefix or major/minor assertion, or otherwise derive the expected value from the version used by `install-tool git` so the smoke test remains valid after compatible version updates.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can import rules and skills only from the repositories your team follows

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[viceice]

Qodo findings:

• "Failed installs leave a false Git provider": not fixed. The apt pin is gone, and a failed install-tool git already fails the image build.
• The hardcoded 2.56.0 in test-git-apt gets fixed.

(Claude, for @viceice)

[github-actions]

🎉 This PR is included in version 14.43.0 🎉

The release is available on:

• GitHub release
• 14.43.0

Your semantic-release bot 📦🚀