Remove LocalGitConfigSource in favor of RemoteGitConfigSource with file URL support

[Copilot]

LocalGitConfigSource provided redundant functionality since git clone natively supports both remote and local file URLs. This PR consolidates both implementations into RemoteGitConfigSource.

Changes

• Modified ConfigSource.__init_subclass__: Support multiple schemes per class (string or list of strings)
• Extended RemoteGitConfigSource: Changed scheme from "git+https" to ["git+https", "git+file"]
• Removed LocalGitConfigSource: 28 lines removed, functionality absorbed by RemoteGitConfigSource
• Updated exports: Removed LocalGitConfigSource from public API

Example

# Both now use the same implementation
config_remote = ConfigSource.create_from_url("git+https://github.com/org/repo.git")
config_local = ConfigSource.create_from_url("git+file:///path/to/repo")

assert isinstance(config_remote, RemoteGitConfigSource)
assert isinstance(config_local, RemoteGitConfigSource)  # Previously LocalGitConfigSource

Both cases clone to a temporary directory and use git pull for updates, leveraging git's native file:// URL support.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/DIRACGrid/diracx/discussions/700
  • Triggering command: curl -s REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Remove LocalGitConfigSource</issue_title>
<issue_description>LocalGitConfigSource can be removed in favour of using the RemoteGitConfigSource with a file URL. See below for more details.

I'll give a couple of AIs a chance out of curiosity of how they manage.

Discussed in #700

^{Originally posted by sfayer November 7, 2025}
Hi,

We're working on the non-k8s diracx container deployment recipe and have run into some issues with loading the CS store... We've exported our existing CS into the diracx format and have it in a local git repo directory which we're initially bind mounting in as a read-only mount at /cs_store and setting DIRACX_CONFIG_BACKEND_URL="git+file:///cs_store?branch=master".

This doesn't work: The git+file handler runs into a number of issues:

• The bind mount point files are owned by "root", whereas the diracx container uses "mambauser" which trips out git's insecure file permissions check for the rev-parse command:

  diracx/diracx-core/src/diracx/core/config/sources.py

  Lines 251 to 252 in c265a47

  	sh.git(
  	"rev-parse",

• If we bypass the security checks, the checkout fails because we made it a bare repo.
• If we convert it to a normal repo, the checkout fails because the volume is read-only.
• If we make the volume read-write, the checkout fails because of the different file ownership.

We modified the code, to use the git+https "RemoteGitConfigSource" handler for the git+file case too and this works (and I suspect would also work better if this directory was shared across multiple hosts).

Our questions for discussion are:

• Is there actually a good use case for the LocalGitConfigSource class? It seems to me that in the majority of deployments RemoteGitConfigSource would work the same or better, even if the source is actually a local directory.
• If removing LocalGitConfigSource isn't an option, perhaps we could make using it optional instead? (For example offering 3 protocol types, say git+https and git+file using RemoteGitConfigSource and a new git+local option if you really want the LocalGitConfigSource behavior)?

We're not really sure how this is all going to work out if it needs to start pushing commits back: Getting the permissions all correct for writing a bind-mount on any platform seems to be its own challenge (but perhaps that isn't planned for a while and we can worry about that later?).

Regards,
Simon

Mentioning @marianne013

</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Remove LocalGitConfigSource #706

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.