Skip to content

fix(scripts): suppress git fetch stdout leak in multi-remote environments#1876

Open
seiya-koji wants to merge 1 commit intogithub:mainfrom
seiya-koji:fix/git-fetch-stdout-leak
Open

fix(scripts): suppress git fetch stdout leak in multi-remote environments#1876
seiya-koji wants to merge 1 commit intogithub:mainfrom
seiya-koji:fix/git-fetch-stdout-leak

Conversation

@seiya-koji
Copy link

Description

In multi-remote environments, git fetch --all outputs messages like Fetching origin to stdout. Since
check_existing_branches() only redirected stderr (2>/dev/null), the stdout output was captured by
$(check_existing_branches ...) command substitution, contaminating the branch number return value and
causing arithmetic errors like $((10#Fetching...)).

Fix: redirect both stdout and stderr to /dev/null (>/dev/null 2>&1).

Reproduction

  1. Clone a repository and add a second remote (e.g. a fork)
  2. Run create-new-feature.sh
  3. git fetch --all outputs Fetching origin\nFetching fork to stdout
  4. The output is captured into the variable that should contain only a branch number
  5. Script fails with a bash arithmetic error

Actual error output

Before fix (2>/dev/null — stderr only):

$ result="$(git fetch --all --prune 2>/dev/null; echo "10")"
$ echo "$result"
Fetching origin
Fetching fork
10

$ BRANCH_NUMBER="$result"
$ echo "$((10#$BRANCH_NUMBER))"
(eval):1: bad math expression: operator expected at `Fetching o...'

After fix (>/dev/null 2>&1 — stdout + stderr):

$ result="$(git fetch --all --prune >/dev/null 2>&1; echo "10")"
$ echo "$result"
10

$ BRANCH_NUMBER="$result"
$ echo "$((10#$BRANCH_NUMBER))"
10

Testing

  • Confirmed the bug in a multi-remote environment (repository with both origin and a fork remote)
  • Verified git fetch --all --prune >/dev/null 2>&1 suppresses stdout in multi-remote setup
  • Ran create-new-feature.sh after the fix and confirmed branch numbering works correctly

AI Disclosure

  • I did not use AI assistance for this contribution
  • I did use AI assistance (describe below)

The bug was discovered automatically when running Spec Kit's specify command via GitHub Copilot
(Claude Opus 4.6) in a downstream project with multiple git remotes. The fix was also generated by the
same agent.

In multi-remote environments, `git fetch --all` outputs messages like
"Fetching origin" to stdout. Since `check_existing_branches()` only
redirected stderr (`2>/dev/null`), the stdout output was captured by
the `$(...)` command substitution calling this function, contaminating
the branch number return value and causing arithmetic errors like
`$((10#Fetching...))`.

Fix: redirect both stdout and stderr to /dev/null (`>/dev/null 2>&1`).
@seiya-koji seiya-koji requested a review from mnriem as a code owner March 17, 2026 09:55
Copilot AI review requested due to automatic review settings March 17, 2026 09:55
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a bash scripting bug in create-new-feature.sh where git fetch --all --prune could emit remote “Fetching …” lines to stdout in multi-remote setups, contaminating command-substitution output used for numeric branch calculations.

Changes:

  • Redirect git fetch --all --prune stdout + stderr to /dev/null to keep check_existing_branches() output purely numeric.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a bash scripting bug where git fetch --all stdout could leak into command-substitution output in multi-remote repositories, corrupting the numeric branch-prefix value used for feature branch numbering.

Changes:

  • Redirect git fetch --all --prune stdout + stderr to /dev/null to prevent contaminating check_existing_branches() output.
  • Preserve existing behavior of tolerating fetch failures (|| true) while ensuring the function returns a clean numeric value.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants