Enable Git long paths for clone and fetch

[andrew]

Pass -c core.longpaths=true to clone and fetch commands so Git for Windows can write paths past MAX_PATH without requiring global configuration. Apply the same override when unshallowing cached repositories.

Closes #18

[Copilot]

🟢 Approval recommended

The change is small, localized to Git argument construction, and includes focused tests covering the new behavior paths.

Pull request overview

This PR addresses Windows MAX_PATH failures during repository operations by injecting a per-invocation Git config override (-c core.longpaths=true) into clone/fetch-related commands, including the cached-repo unshallow path, avoiding the need for global Git configuration.

Changes:

• Introduce a longPathArgs helper to prefix Git invocations with -c core.longpaths=true.
• Apply the override to Ensure’s clone and fetch flows.
• Apply the override to cached repository unshallow fetch, and add targeted tests asserting the argument prefix.

File summaries

File	Description
run.go	Adds longPathArgs helper to prefix Git argv with the long-path config override.
ensure.go	Uses longPathArgs(...) for clone and fetch invocations in Ensure.
ensure_test.go	Adds a test verifying clone/fetch commands are invoked with the long-path config prefix.
cache.go	Uses longPathArgs(...) for the cached unshallow fetch invocation.
cache_test.go	Adds a test verifying the unshallow fetch command is invoked with the long-path config prefix.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[andrew]

updateSubmodules at ensure.go:106,115 (submodule sync --recursive and submodule update --init --recursive --depth 1) does not go through longPathArgs, so a submodule whose .git/objects/pack path exceeds 260 still fails. Hit this after bumping scrutineer to 67c4b52: the top-level clone now works but the submodule step does not.

Separately, Submodules() on Windows reports checked out commit X does not match gitlink Y for a fixture that works on Linux/macOS (same run, https://github.com/alpha-omega-security/scrutineer/actions/runs/33872943042), which looks unrelated to longpaths.