Implement Git and GitHub StorageRoot backends with access control

[Copilot]

Adds Git and GitHub repository backends to the storage system, enabling version-controlled data storage with optional access control through GitHub's collaborator API.

Implementation

Git StorageRoot (storage/git.nw)

• Inherits from base StorageRoot, handles local and remote repositories
• Clones remotes to ~/.cache/nytid/git-repos/, uses local paths in-place
• Auto-commits on commit_changes(), skips push when no remote configured
• Raises NotImplementedError for access control (directs users to GitHub backend)

GitHub StorageRoot (storage/github.nw)

• Extends git.StorageRoot with collaborator management via GitHub REST API
• grant_access(user, permission) adds collaborators with pull/push/admin permissions
• revoke_access(user) removes collaborators
• Supports github.com and GitHub Enterprise (auto-detects from URL)
• Requires GITHUB_TOKEN environment variable or constructor parameter

Integration (storage/init.nw)

• open_root() detects GitHub URLs via @github, ://github, /github patterns
• Falls back to generic Git for .git URLs, local filesystem otherwise

Usage

from nytid import storage

# Auto-detects backend from URL
root = storage.open_root("git@github.com:user/course-data.git")
root.grant_access("ta-username", "push")

with root.open("assignments.csv", "w") as f:
    f.write(data)

root.commit_changes("Update assignments")

Testing

• 4 Git tests (local repos, commit/push, URL parsing)
• 8 GitHub tests (API endpoint detection, access control, mocked API calls)
• All tests passing, security scan clean

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• esm.ubuntu.com
  • Triggering command: /usr/lib/apt/methods/https /usr/lib/apt/methods/https (dns block)
• mygithubproject.com
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin REDACTED cp /tmp�� py git.nw > git.py && noroots git.nw && black git.py kpsewhich tualenvs/nytid-8X3FfPdf-py3.12/bin/pytest (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Implement StorageRoot for Git</issue_title>
<issue_description>We have a StorageRoot implementation for AFS. But we want one for Git.

This should be done in two stages:

1. One StorageRoot for Git. This one can't do access control (as the AFS one can).
2. Another StorageRoot for GitHub (inherits from Git), which can also do the access control by adding access to the repo on GitHub. Maybe this will work the same for both global GitHub and self-hosted GitHub-enterprise.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Implement StorageRoot for Git #244

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.