chore: git cache cleanup

scripts/history-rewrite/tests/clean_history.dryrun.bats

@@ -0,0 +1,49 @@
+#!/usr/bin/env bats
+
+setup() {
+  TMPREPO=$(mktemp -d)
+  cd "$TMPREPO"
+  git init -q
+  # Set local git identity for test commits
+  git config user.email "test@example.com"
+  git config user.name "Test Runner"
+  # create a directory that matches the paths to be pruned
+  mkdir -p backend/codeql-db
+  # add a large fake blob file
+  dd if=/dev/zero of=backend/codeql-db/largefile.bin bs=1M count=2 >/dev/null 2>&1 || true
+  git add -A && git commit -m 'add large blob' -q
+  git checkout -b feature/test
+  # Create a local bare repo to act as origin and allow git push
+  TMPORIGIN=$(mktemp -d)
+  git init --bare "$TMPORIGIN" >/dev/null
+  git remote add origin "$TMPORIGIN"
+  git push -u origin feature/test >/dev/null 2>&1 || true
+  # Add a stub git-filter-repo to PATH to satisfy requirements without installing
+  STUBBIN=$(mktemp -d)
+  cat > "$STUBBIN/git-filter-repo" <<'SH'
+#!/usr/bin/env bash
+echo "stub git-filter-repo called: $@"
+exit 0
+SH
+  chmod +x "$STUBBIN/git-filter-repo"
+  PATH="$STUBBIN:$PATH"
+}
+
+teardown() {
+  rm -rf "$TMPREPO"
+}
+
+REPO_ROOT=$(cd "$BATS_TEST_DIRNAME/../../../" && pwd)
+SCRIPT="$REPO_ROOT/scripts/history-rewrite/clean_history.sh"
+
+@test "clean_history dry-run prints expected log and exits 0" {
+  run bash "$SCRIPT" --dry-run --paths 'backend/codeql-db' --strip-size 1
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Dry-run complete"* ]]
+}
+
+@test "preview_removals shows commits for the path" {
+  run bash "$REPO_ROOT/scripts/history-rewrite/preview_removals.sh" --paths 'backend/codeql-db' --strip-size 1
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Path: backend/codeql-db"* ]]
+}

scripts/history-rewrite/tests/clean_history.non_interactive.bats

@@ -0,0 +1,42 @@
+#!/usr/bin/env bats
+
+setup() {
+  TMPREPO=$(mktemp -d)
+  cd "$TMPREPO"
+  git init -q
+  # local git identity
+  git config user.email "test@example.com"
+  git config user.name "Test Runner"
+  # create a directory that matches the paths to be pruned
+  mkdir -p backend/codeql-db
+  echo "dummy" > backend/codeql-db/keep.txt
+  git add -A && git commit -m 'add test files' -q
+  git checkout -b feature/test
+  # Create a local bare repo to act as origin and allow git push
+  TMPORIGIN=$(mktemp -d)
+  git init --bare "$TMPORIGIN" >/dev/null
+  git remote add origin "$TMPORIGIN"
+  git push -u origin feature/test >/dev/null 2>&1 || true
+  # Add a stub git-filter-repo to PATH to satisfy requirements without installing
+  STUBBIN=$(mktemp -d)
+  cat > "$STUBBIN/git-filter-repo" <<'SH'
+#!/usr/bin/env bash
+echo "stub git-filter-repo called: $@"
+exit 0
+SH
+  chmod +x "$STUBBIN/git-filter-repo"
+  PATH="$STUBBIN:$PATH"
+}
+
+teardown() {
+  rm -rf "$TMPREPO"
+}
+
+REPO_ROOT=$(cd "$BATS_TEST_DIRNAME/../../../" && pwd)
+SCRIPT="$REPO_ROOT/scripts/history-rewrite/clean_history.sh"
+
+@test "clean_history non-interactive + force runs without prompting and invokes git-filter-repo" {
+  run bash "$SCRIPT" --force --non-interactive --paths 'backend/codeql-db' --strip-size 1
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"stub git-filter-repo called"* ]]
+}

scripts/history-rewrite/tests/tag_objects_excluded.bats

@@ -0,0 +1,29 @@
+#!/usr/bin/env bats
+
+setup() {
+  TMPREPO=$(mktemp -d)
+  cd "$TMPREPO"
+  git init -q
+  # Set local git identity so commits succeed in CI
+  git config user.email "test@example.com"
+  git config user.name "Test Runner"
+  # Create a commit in an unrelated path
+  mkdir -p other/dir
+  echo hello > other/dir/file.txt
+  git add other/dir/file.txt && git commit -m 'add unrelated file' -q
+  # Create an annotated tag
+  git tag -a v0.3.0 -m "annotated tag v0.3.0"
+}
+
+teardown() {
+  rm -rf "$TMPREPO"
+}
+
+REPO_ROOT=$(cd "$BATS_TEST_DIRNAME/../../../" && pwd)
+SCRIPT="$REPO_ROOT/scripts/ci/dry_run_history_rewrite.sh"
+
+@test "dry_run script ignores tag-only objects and passes" {
+  run bash "$SCRIPT" --paths 'backend/codeql-db' --strip-size 50
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"DRY-RUN OK"* ]]
+}

scripts/history-rewrite/tests/validate_after_rewrite.bats

@@ -0,0 +1,41 @@
+#!/usr/bin/env bats
+
+setup() {
+  # Create an isolated working repo
+  TMPREPO=$(mktemp -d)
+  cd "$TMPREPO"
+  git init -q
+  # Set local git identity for test commits
+  git config user.email "test@example.com"
+  git config user.name "Test Runner"
+  echo 'initial' > README.md
+  git add README.md && git commit -m 'init' -q
+  # Make a minimal .venv pre-commit stub
+  mkdir -p .venv/bin
+  cat > .venv/bin/pre-commit <<'SH'
+#!/usr/bin/env sh
+exit 0
+SH
+  chmod +x .venv/bin/pre-commit
+}
+
+teardown() {
+  rm -rf "$TMPREPO"
+}
+
+## Prefer deriving the script location from the test directory rather than hard-coding
+## repository root paths such as /projects/Charon. This is more portable across
+## environments and CI runners (e.g., forks where the repo path is different).
+SCRIPT_DIR=$(cd "$BATS_TEST_DIRNAME/.." && pwd -P)
+SCRIPT="$SCRIPT_DIR/validate_after_rewrite.sh"
+
+@test "validate_after_rewrite fails when backup branch is missing" {
+  run bash "$SCRIPT"
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"backup branch not provided"* ]]
+}
+
+@test "validate_after_rewrite passes with backup branch argument" {
+  run bash "$SCRIPT" --backup-branch backup/main
+  [ "$status" -eq 0 ]
+}