Fix git.Export(sha1)

`git clone -b ...` does not accept a revision -- it must be a branch
or tag -- so we can't use that to export a repo at a revision, as we'd
like to do for the helm operator's sync loop.

Instead we'll have to clone without an argument, and checkout the
desired revision.

git/export.go

@@ -21,9 +21,12 @@ func (e *Export) Clean() {
 
 // Export creates a minimal clone of the repo, at the ref given.
 func (r *Repo) Export(ctx context.Context, ref string) (*Export, error) {
-	dir, err := r.workingClone(ctx, ref)
+	dir, err := r.workingClone(ctx, "")
 	if err != nil {
 		return nil, err
 	}
+	if err = checkout(ctx, dir, ref); err != nil {
+		return nil, err
+	}
 	return &Export{dir}, nil
 }

git/export_test.go

@@ -0,0 +1,44 @@
+package git
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/weaveworks/flux/cluster/kubernetes/testfiles"
+)
+
+func TestExportAtRevision(t *testing.T) {
+	newDir, cleanup := testfiles.TempDir(t)
+	defer cleanup()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	err := createRepo(newDir, []string{"config"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	repo := NewRepo(Remote{URL: newDir}, ReadOnly)
+	if err := repo.Ready(ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	headMinusOne, err := repo.Revision(ctx, "HEAD^1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	export, err := repo.Export(ctx, headMinusOne)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	exportHead, err := refRevision(ctx, export.dir, "HEAD")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if headMinusOne != exportHead {
+		t.Errorf("exported %s, but head in export dir %s is %s", headMinusOne, export.dir, exportHead)
+	}
+}

git/operations.go

@@ -53,6 +53,10 @@ func mirror(ctx context.Context, workingDir, repoURL string) (path string, err e
 	return repoPath, nil
 }
 
+func checkout(ctx context.Context, workingDir, ref string) error {
+	return execGitCmd(ctx, workingDir, nil, "checkout", ref)
+}
+
 // checkPush sanity-checks that we can write to the upstream repo
 // (being able to `clone` is an adequate check that we can read the
 // upstream).