chore(deps): bump git2 from 0.20.4 to 0.21.0

crates/houndr-repo/Cargo.toml

@@ -10,7 +10,7 @@ categories = ["development-tools"]
 
 [dependencies]
 houndr-index.workspace = true
-git2 = "0.20"
+git2 = { version = "0.21", features = ["ssh", "https"] }
 serde.workspace = true
 toml = "1.1"
 glob = "0.3"

crates/houndr-repo/src/vcs.rs

@@ -156,7 +156,7 @@ impl GitRepo {
     /// Detect the default branch from the bare repo's HEAD reference.
     fn detect_default_branch(repo: &Repository) -> Option<String> {
         let head = repo.head().ok()?;
-        head.shorthand().map(|s| s.to_string())
+        head.shorthand().ok().map(|s| s.to_string())
     }
 
     /// Detect the default branch by querying the remote (for fresh clones with no local HEAD).
@@ -168,7 +168,7 @@ impl GitRepo {
             .connect_auth(git2::Direction::Fetch, Some(callbacks), None)
             .ok()?;
         let default_branch = remote.default_branch().ok()?;
-        let name = default_branch.as_str()?;
+        let name = default_branch.as_str().ok()?;
         // Strip "refs/heads/" prefix
         let short = name.strip_prefix("refs/heads/").unwrap_or(name);
         let result = short.to_string();
@@ -301,8 +301,8 @@ impl GitRepo {
             }
 
             let name = match entry.name() {
-                Some(n) => n,
-                None => return git2::TreeWalkResult::Ok,
+                Ok(n) => n,
+                Err(_) => return git2::TreeWalkResult::Ok,
             };
 
             let path = if dir.is_empty() {
@@ -378,8 +378,8 @@ impl GitRepo {
             }
 
             let name = match entry.name() {
-                Some(n) => n,
-                None => return git2::TreeWalkResult::Ok,
+                Ok(n) => n,
+                Err(_) => return git2::TreeWalkResult::Ok,
             };
 
             let path = if dir.is_empty() {

crates/houndr-repo/tests/auth_smoke.rs

@@ -0,0 +1,65 @@
+// Network + auth smoke tests for git2 transport features.
+//
+// Marked `#[ignore]` because they require network access (and SSH needs a
+// github-registered key in ssh-agent). CI doesn't run them.
+//
+// Run locally with:
+//   cargo test -p houndr-repo --test auth_smoke -- --ignored --nocapture
+//
+// These exist to catch regressions like the git2 0.21 default-feature change,
+// where the Rust API for Cred::* stays compilable but libgit2-sys is built
+// without GIT_SSH / GIT_HTTPS — meaning real fetches silently fail.
+
+use git2::{FetchOptions, RemoteCallbacks, Repository};
+use std::path::PathBuf;
+
+fn temp_path(tag: &str) -> PathBuf {
+    let mut p = std::env::temp_dir();
+    p.push(format!("houndr-auth-smoke-{}-{}", tag, std::process::id()));
+    let _ = std::fs::remove_dir_all(&p);
+    p
+}
+
+fn fetch_master(url: &str, callbacks: RemoteCallbacks<'_>, tag: &str) {
+    let path = temp_path(tag);
+    let repo = Repository::init_bare(&path).expect("init bare");
+    let mut remote = repo.remote("origin", url).expect("add remote");
+
+    let mut fo = FetchOptions::new();
+    fo.remote_callbacks(callbacks);
+
+    let result = remote.fetch(&["master"], Some(&mut fo), None);
+    let _ = std::fs::remove_dir_all(&path);
+    result.unwrap_or_else(|e| panic!("{tag} fetch failed: {e}"));
+}
+
+#[test]
+#[ignore = "network: HTTPS clone smoke test"]
+fn https_clone_works() {
+    let mut callbacks = RemoteCallbacks::new();
+    callbacks.certificate_check(|_, _| Ok(git2::CertificateCheckStatus::CertificatePassthrough));
+
+    fetch_master(
+        "https://github.com/octocat/Hello-World.git",
+        callbacks,
+        "https",
+    );
+}
+
+#[test]
+#[ignore = "network + ssh-agent: SSH clone smoke test"]
+fn ssh_clone_works() {
+    let mut callbacks = RemoteCallbacks::new();
+    callbacks.certificate_check(|cert, _host| {
+        if cert.as_hostkey().is_some() {
+            Ok(git2::CertificateCheckStatus::CertificateOk)
+        } else {
+            Ok(git2::CertificateCheckStatus::CertificatePassthrough)
+        }
+    });
+    callbacks.credentials(|_url, username, _allowed| {
+        git2::Cred::ssh_key_from_agent(username.unwrap_or("git"))
+    });
+
+    fetch_master("git@github.com:octocat/Hello-World.git", callbacks, "ssh");
+}