Same repository requested with and without a trailing .git gets two mirrors, two fetches and two cache entries

[matt-edmondson]

What's wrong

GitBranchStateCache/Endpoints/BranchStateHandler.cs builds the mirror key as new MirrorKey(Canonicalize(route.Upstream), Canonicalize(route.RepositoryPath)) (~L410). Canonicalize (~L452) is only segment.ToLowerInvariant().

#24 and #37 made casing irrelevant, but a trailing .git still produces a different key. Remotes are routinely cloned both ways (https://github.com/studio/game and https://github.com/studio/game.git), and any allow-list entry with a wildcard admits both spellings.

Failure scenario

1. The service runs with --allow github=studio/*.
2. Client A posts to /v1/github/studio/game.git/state and client B posts to /v1/github/studio/game/state.
3. MirrorStore.TryResolve lays these out as two mirrors, studio/game.git/mirror.git and studio/game/mirror.git. Each has its own single-flight key, diff-cache key and admission key.
4. The result for a single repository is double the disk use, double the upstream fetches, and double the admission probes. That is the duplication Same repository gets mirrored, fetched and diffed twice when callers vary path casing #24 and Upstream key casing isn't canonicalized, duplicating mirrors like the already-fixed repository-path case bug #37 removed for casing.

A side effect is that the studio/game.git/… layout creates the mirror.git path-segment case that #42 had to special-case in the idle sweep.

Suggested fix / acceptance criteria

• In Canonicalize, or in the key built from the repository path, strip a single trailing .git (case-insensitively) for bookkeeping only. The URL sent to the forge keeps the caller's spelling.
• Test: requests for studio/game and studio/game.git resolve to the same MirrorKey and share a single fetch.
• Note in the changelog that existing *.git/ mirrors are re-cloned once under the new key. The idle sweep reaps the old ones.

[matt-edmondson]

Triage

• Category: Bug
• Priority: Medium. Nothing returns a wrong answer, but disk use, upstream fetches and admission probes double for any repository that is reached under both spellings, which is common with wildcard allow-lists. It's the same class of waste that Same repository gets mirrored, fetched and diffed twice when callers vary path casing #24 and Upstream key casing isn't canonicalized, duplicating mirrors like the already-fixed repository-path case bug #37 fixed for casing.
• Area / suggested assignment: mirror keying (Endpoints/BranchStateHandler.cs Canonicalize / MirrorKey)
• Related: Same repository gets mirrored, fetched and diffed twice when callers vary path casing #24 and Upstream key casing isn't canonicalized, duplicating mirrors like the already-fixed repository-path case bug #37 (case canonicalization), and Idle-mirror sweep deletes an actively used mirror when the repository is named mirror (path segment mirror.git) #42 (the idle-sweep special case for the mirror.git segment, which this change might let you simplify).
• Duplicates: none found
• In progress: no open PR covers this. Delegate git process invocation to ktsu.RunCommand [patch] #51 and the dependabot PRs are unrelated.

Note: keep the forge URL on the caller's spelling, as the issue says, and canonicalize only the bookkeeping key. The one-time re-clone of existing *.git/ mirrors belongs in the release notes.

---

Generated by Claude Code