Fix repository discovery precedence

Properly wait instead of hardcoding a short sleep.

Fixes #1676

fix: wait for git daemon to listen before connecting

<!-- agent -->
GitPython 3.1.60 removed the Actor.name_email_regex class attribute while
replacing internal actor parsing, which broke downstream consumers such as
python-semantic-release.

Bring back the historical compiled pattern for downstream compatibility,
but emit DeprecationWarning whenever the class member is accessed. The warning
explains its quadratic behavior on long malformed strings and points callers to
the public Actor(name, email) constructor when fields are separate, or direct
string parsing when they are not.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

# 252a84ac Add public Actor.from_string constructor (#2220)

Add public Actor.from_string constructor (#2220)

Promote the existing actor identity parser to Actor.from_string while retaining _from_string as a compatibility alias. Point the name_email_regex deprecation warning to the new public constructor or Actor(name, email).

Validation:
- actor-related test/test_actor.py and test/test_util.py cases: 12 passed
- ruff check and format checks passed
- basedpyright git/util.py: no errors

Co-authored-by: Codex GPT-5 <codex@openai.com>

# dd2181d8 Address review feedback about Actor subclasses

Address review feedback about Actor subclasses

Review feedback: Actor.from_string() should preserve the class on which the public classmethod is called instead of always returning a base Actor.

Construct through cls on both parsing paths and cover subclass construction directly.

Validation:
- actor-related test/test_actor.py and test/test_util.py cases: 13 passed
- ruff check and format checks passed
- basedpyright git/util.py: no errors

# fcf1ecb1 Address review feedback about constructor typing

Address review feedback about constructor typing

Review feedback: Actor.from_string() constructs subclasses at runtime but its Actor return annotation prevents type checkers from preserving subclass-specific members.

Use the project existing Python 3.7-compatible bound TypeVar pattern so the declared return type follows cls.

Validation:
- actor-related test/test_actor.py and test/test_util.py cases: 13 passed
- ruff check and format checks passed
- basedpyright git/util.py: no errors

Co-authored-by: Codex GPT-5 <codex@openai.com>

fix: restore Actor.name_email_regex

prepare next release

<!-- agent -->
Opening a linked worktree created from a bare repository read `core.bare` from the
common repository and discarded the worktree path.

Keep a discovered linked worktree non-bare when its administrative directory has
a `commondir` marker. The regression compares Git rev-parse behavior and verifies
Repo.bare and working_tree_dir.

Git baseline: 0bd5a6920d7c4238e0d90ddc0e7e08866e84a0f1;
environment.c:is_bare_repository() and setup.c:check_repository_format_gently().
Git 2.50.1 reports the linked checkout as non-bare.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

<!-- agent -->
Cygwin patches ensurepip to load setuptools and pip wheels from
`/usr/share/python-wheels`. The rolling python-pip-wheel package advanced to pip
26.2.1, which requires Python 3.10 or newer, so every Python 3.9 venv creation
failed—including the installation test's nested virtual environment.

Keep the single Cygwin lane on Python 3.9 because the regular matrix already
covers Python 3.12 and newer. Install Cygwin's setuptools wheel, download pip
26.0.1 from its immutable PyPI URL into ensurepip's shared wheel directory,
verify its SHA-256 digest, and avoid upgrading pip. This fixes all venv creation
without relying on a version that may disappear from rolling Cygwin mirrors.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

Keep bare-repository worktrees non-bare

GHSA-59cr-6r3x-644w identifies that submodule update paths could reach
filesystem operations without the containment check already used by add and
move.

Add a regression that proves update rejects a parent-directory checkout
path before cloning, and override Submodule.abspath to apply the shared
_to_relative_path guard for every filesystem consumer.

Git baseline: git.git read-cache.c verify_path_internal() rejects invalid index
paths, covered for parent traversal by t/t9300-fast-import.sh.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

…dening

Reject unsafe submodule checkout paths

Bumps the pre-commit group with 1 update: [https://github.com/astral-sh/ruff-pre-commit](https://github.com/astral-sh/ruff-pre-commit).


Updates `https://github.com/astral-sh/ruff-pre-commit` from v0.16.0 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff-pre-commit/releases)
- [Commits](astral-sh/ruff-pre-commit@v0.16.0...v0.16.5)

---
updated-dependencies:
- dependency-name: https://github.com/astral-sh/ruff-pre-commit
  dependency-version: 0.16.5
  dependency-type: direct:production
  dependency-group: pre-commit
...

Signed-off-by: dependabot[bot] <support@github.com>

…mit/pre-commit-d501b75439

build(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.0 to 0.16.5 in the pre-commit group