From 772f365254391c35d9d830807f25aaf5c96a1210 Mon Sep 17 00:00:00 2001
From: wxiaoguang <wxiaoguang@gmail.com>
Date: Mon, 9 Nov 2026 17:59:52 +0000
Subject: [PATCH] refactor: use RunWithStderr for git commands (#40295)

If the stderr output is not handled, then it needs to use RunWithStderr
to make sure the git error message is included in the returned error.
Otherwise, when the git command fails, the error log won't show useful
information.

Ref:

* #39795 : no useful information in log messages
*
https://github.com/go-gitea/gitea/pull/40160#pullrequestreview-5752720866
---
 docs/guidelines-backend.md                |  2 ++
 modules/git/compare_test.go               |  2 +-
 modules/git/diff.go                       |  2 +-
 modules/git/fetch.go                      |  2 +-
 modules/git/fsck.go                       |  2 +-
 modules/git/gitcmd/command.go             |  3 +++
 modules/git/gitcmd/command_test.go        |  2 +-
 modules/git/merge_tree_test.go            |  4 ++--
 modules/git/receive_fsck_test.go          |  6 +++---
 modules/git/ref.go                        |  4 ++--
 modules/git/repo_commit_test.go           |  2 +-
 modules/git/repo_compare.go               |  6 +++---
 modules/git/repo_compare_test.go          |  3 +++
 modules/git/submodule.go                  |  2 +-
 routers/private/hook_verification.go      | 10 ++++++----
 routers/private/hook_verification_test.go |  3 +++
 services/gitdiff/gitdiff_test.go          |  2 +-
 services/gitproxy/server_test.go          |  2 +-
 services/pull/merge_prepare.go            |  8 +++-----
 services/pull/merge_rebase.go             |  2 +-
 services/pull/merge_tree.go               |  2 +-
 services/pull/temp_repo.go                |  3 +--
 tests/integration/git_general_test.go     | 16 ++++++++--------
 tests/integration/git_misc_test.go        | 10 +++++-----
 tests/integration/pull_create_test.go     |  2 +-
 tests/integration/pull_merge_test.go      |  2 +-
 26 files changed, 57 insertions(+), 47 deletions(-)

diff --git a/docs/guidelines-backend.md b/docs/guidelines-backend.md
index b3c3afd434f..cbaa401c59d 100644
--- a/docs/guidelines-backend.md
+++ b/docs/guidelines-backend.md
@@ -92,6 +92,8 @@ conditional `UPDATE` or a lock.
 
 - Pass already opened repositories down or use `git.RepositoryFromContextOrOpen`
   rather than reopening them or spawning extra `git` processes.
+- If git command stderr output is not handled by the caller, then it needs to use RunWithStderr
+  to make sure the git error message is included in the returned error and displayed in the logs.
 
 ## Dependencies
 
diff --git a/modules/git/compare_test.go b/modules/git/compare_test.go
index ac4fe894afa..a0825e74dc3 100644
--- a/modules/git/compare_test.go
+++ b/modules/git/compare_test.go
@@ -17,7 +17,7 @@ import (
 
 func TestMergeBaseNoCommonHistory(t *testing.T) {
 	repoDir := filepath.Join(t.TempDir(), "repo.git")
-	require.NoError(t, gitcmd.NewCommand("init").AddDynamicArguments(repoDir).Run(t.Context()))
+	require.NoError(t, gitcmd.NewCommand("init").AddDynamicArguments(repoDir).RunWithStderr(t.Context()))
 	_, _, runErr := gitcmd.NewCommand("fast-import").WithDir(repoDir).WithStdinBytes([]byte(strings.TrimSpace(`
 commit refs/heads/branch1
 committer User <user@example.com> 1714310400 +0000
diff --git a/modules/git/diff.go b/modules/git/diff.go
index 6fe40c58f10..d04e1e53ba9 100644
--- a/modules/git/diff.go
+++ b/modules/git/diff.go
@@ -323,7 +323,7 @@ func GetAffectedFiles(ctx context.Context, repo *Repository, branchName, oldComm
 			}
 			return scanner.Err()
 		}).
-		Run(ctx)
+		RunWithStderr(ctx)
 	if err != nil {
 		log.Error("Unable to get affected files for commits from %s to %s in %s: %v", oldCommitID, newCommitID, repo.LogString(), err)
 	}
diff --git a/modules/git/fetch.go b/modules/git/fetch.go
index db4648279f6..c6cae127dca 100644
--- a/modules/git/fetch.go
+++ b/modules/git/fetch.go
@@ -18,7 +18,7 @@ import (
 // Ref: https://www.kernel.org/pub/software/scm/git/docs/git-gc.html
 func FetchRemoteTempCommit(ctx context.Context, repo, remoteRepo RepositoryFacade, commitID string) error {
 	// since it is for temporary use, we don't need to update any ref or lock anything or maintain anything
-	return fetchRemoteCommand(remoteRepo, commitID).WithRepo(repo).Run(ctx)
+	return fetchRemoteCommand(remoteRepo, commitID).WithRepo(repo).RunWithStderr(ctx)
 }
 
 // FetchRemoteCommitUpdateRef fetches a commit from a remote repository and points refName at it
diff --git a/modules/git/fsck.go b/modules/git/fsck.go
index 7bdccf35e0e..370953f78a8 100644
--- a/modules/git/fsck.go
+++ b/modules/git/fsck.go
@@ -12,5 +12,5 @@ import (
 
 // Fsck verifies the connectivity and validity of the objects in the database
 func Fsck(ctx context.Context, repo RepositoryFacade, timeout time.Duration, args gitcmd.TrustedCmdArgs) error {
-	return gitcmd.NewCommand("fsck").AddArguments(args...).WithTimeout(timeout).WithRepo(repo).Run(ctx)
+	return gitcmd.NewCommand("fsck").AddArguments(args...).WithTimeout(timeout).WithRepo(repo).RunWithStderr(ctx)
 }
diff --git a/modules/git/gitcmd/command.go b/modules/git/gitcmd/command.go
index 5167a5a748d..3e799852426 100644
--- a/modules/git/gitcmd/command.go
+++ b/modules/git/gitcmd/command.go
@@ -568,6 +568,9 @@ func (c *Command) RunWithStderr(ctx context.Context) RunStdError {
 	return c.WaitWithStderr()
 }
 
+// Run runs the command and leaves stderr handling to the caller, such as through [Command.MakeStderrPipe].
+// Without a stderr reader, Git's diagnostics are discarded and the error may only report an exit status.
+// Use [Command.RunWithStderr] to include Git's stderr in the returned error.
 func (c *Command) Run(ctx context.Context) (err error) {
 	if err = c.WithParentCallerInfo().Start(ctx); err != nil {
 		return err
diff --git a/modules/git/gitcmd/command_test.go b/modules/git/gitcmd/command_test.go
index 7b768274182..9d38ef6face 100644
--- a/modules/git/gitcmd/command_test.go
+++ b/modules/git/gitcmd/command_test.go
@@ -96,7 +96,7 @@ func TestRunWithContextStd(t *testing.T) {
 
 		cmd = NewCommand("grep")
 		cmd.AddOptionGrepExpr("-x")
-		assert.NoError(t, cmd.Run(t.Context()))
+		assert.NoError(t, cmd.RunWithStderr(t.Context()))
 		assert.Equal(t, []string{"grep", "-e", "-x"}, cmd.args)
 	}
 
diff --git a/modules/git/merge_tree_test.go b/modules/git/merge_tree_test.go
index 48a8266a50b..3f1fd312cbb 100644
--- a/modules/git/merge_tree_test.go
+++ b/modules/git/merge_tree_test.go
@@ -15,7 +15,7 @@ import (
 
 func prepareRepoDirRenameConflict(t *testing.T) string {
 	repoDir := filepath.Join(t.TempDir(), "repo-dir-rename-conflict.git")
-	require.NoError(t, gitcmd.NewCommand("init", "--bare").AddDynamicArguments(repoDir).Run(t.Context()))
+	require.NoError(t, gitcmd.NewCommand("init", "--bare").AddDynamicArguments(repoDir).RunWithStderr(t.Context()))
 	stdin := `blob
 mark :1
 data 2
@@ -62,7 +62,7 @@ B
 from :3
 M 100644 :5 z/d
 `
-	require.NoError(t, gitcmd.NewCommand("fast-import").WithDir(repoDir).WithStdinBytes([]byte(stdin)).Run(t.Context()))
+	require.NoError(t, gitcmd.NewCommand("fast-import").WithDir(repoDir).WithStdinBytes([]byte(stdin)).RunWithStderr(t.Context()))
 	return repoDir
 }
 
diff --git a/modules/git/receive_fsck_test.go b/modules/git/receive_fsck_test.go
index 95af1a23e21..9970e6310d5 100644
--- a/modules/git/receive_fsck_test.go
+++ b/modules/git/receive_fsck_test.go
@@ -33,9 +33,9 @@ func TestReceivePushRejectsDuplicateTreeEntries(t *testing.T) {
 	ctx := t.Context()
 
 	sourceDir := filepath.Join(t.TempDir(), "source.git")
-	require.NoError(t, gitcmd.NewCommand("init", "--bare").AddDynamicArguments(sourceDir).Run(ctx))
+	require.NoError(t, gitcmd.NewCommand("init", "--bare").AddDynamicArguments(sourceDir).RunWithStderr(ctx))
 	targetDir := filepath.Join(t.TempDir(), "target.git")
-	require.NoError(t, gitcmd.NewCommand("init", "--bare").AddDynamicArguments(targetDir).Run(ctx))
+	require.NoError(t, gitcmd.NewCommand("init", "--bare").AddDynamicArguments(targetDir).RunWithStderr(ctx))
 
 	hashBlob := func(content string) string {
 		stdout, _, err := gitcmd.NewCommand("hash-object", "-w", "--stdin").WithDir(sourceDir).WithStdinBytes([]byte(content)).RunStdString(ctx)
@@ -54,7 +54,7 @@ func TestReceivePushRejectsDuplicateTreeEntries(t *testing.T) {
 	require.NoError(t, err)
 	commitID = strings.TrimSpace(commitID)
 
-	require.NoError(t, gitcmd.NewCommand("update-ref", "refs/heads/atk").AddDynamicArguments(commitID).WithDir(sourceDir).Run(ctx))
+	require.NoError(t, gitcmd.NewCommand("update-ref", "refs/heads/atk").AddDynamicArguments(commitID).WithDir(sourceDir).RunWithStderr(ctx))
 
 	_, _, err = gitcmd.NewCommand("push").AddDynamicArguments(targetDir, "refs/heads/atk:refs/heads/atk").WithDir(sourceDir).RunStdString(ctx)
 	require.Error(t, err, "push of a commit with duplicate tree entries must be rejected by the receiving repository's fsck")
diff --git a/modules/git/ref.go b/modules/git/ref.go
index 1b6162eec46..8900f7f91aa 100644
--- a/modules/git/ref.go
+++ b/modules/git/ref.go
@@ -260,9 +260,9 @@ func ParseRefSuffix(ref string) (refName, refSuffix string) {
 }
 
 func UpdateRef(ctx context.Context, repo RepositoryFacade, refName, newCommitID string) error {
-	return gitcmd.NewCommand("update-ref").AddDynamicArguments(refName, newCommitID).WithRepo(repo).Run(ctx)
+	return gitcmd.NewCommand("update-ref").AddDynamicArguments(refName, newCommitID).WithRepo(repo).RunWithStderr(ctx)
 }
 
 func RemoveRef(ctx context.Context, repo RepositoryFacade, refName string) error {
-	return gitcmd.NewCommand("update-ref", "--no-deref", "-d").AddDynamicArguments(refName).WithRepo(repo).Run(ctx)
+	return gitcmd.NewCommand("update-ref", "--no-deref", "-d").AddDynamicArguments(refName).WithRepo(repo).RunWithStderr(ctx)
 }
diff --git a/modules/git/repo_commit_test.go b/modules/git/repo_commit_test.go
index 377d27f459a..df83eee8424 100644
--- a/modules/git/repo_commit_test.go
+++ b/modules/git/repo_commit_test.go
@@ -150,7 +150,7 @@ func TestCommitsByFileAndRange(t *testing.T) {
 	assert.False(t, hasMore)
 
 	repoFollowRenameDir := filepath.Join(t.TempDir(), "repo.git")
-	require.NoError(t, gitcmd.NewCommand("init").AddDynamicArguments(repoFollowRenameDir).Run(t.Context()))
+	require.NoError(t, gitcmd.NewCommand("init").AddDynamicArguments(repoFollowRenameDir).RunWithStderr(t.Context()))
 	_, _, runErr := gitcmd.NewCommand("fast-import").WithDir(repoFollowRenameDir).WithStdinBytes([]byte(strings.TrimSpace(`
 blob
 mark :1
diff --git a/modules/git/repo_compare.go b/modules/git/repo_compare.go
index 5a8734fc586..0a1af7eee63 100644
--- a/modules/git/repo_compare.go
+++ b/modules/git/repo_compare.go
@@ -55,7 +55,7 @@ func (repo *Repository) GetDiff(ctx context.Context, compareArg string, w io.Wri
 	return gitcmd.NewCommand("diff", "-p").AddDynamicArguments(compareArg).
 		WithRepo(repo).
 		WithStdoutCopy(w).
-		Run(ctx)
+		RunWithStderr(ctx)
 }
 
 // GetDiffBinary generates and returns patch data between given revisions, including binary diffs.
@@ -64,7 +64,7 @@ func (repo *Repository) GetDiffBinary(ctx context.Context, compareArg string, w
 		AddDynamicArguments(compareArg).
 		WithRepo(repo).
 		WithStdoutCopy(w).
-		Run(ctx)
+		RunWithStderr(ctx)
 }
 
 // GetPatch generates and returns format-patch data between given revisions, able to be used with `git apply`
@@ -72,7 +72,7 @@ func (repo *Repository) GetPatch(ctx context.Context, compareArg string, w io.Wr
 	return gitcmd.NewCommand("format-patch", "--binary", "--stdout").AddDynamicArguments(compareArg).
 		WithRepo(repo).
 		WithStdoutCopy(w).
-		Run(ctx)
+		RunWithStderr(ctx)
 }
 
 // GetFilesChangedBetween returns a list of all files that have been changed between the given commits
diff --git a/modules/git/repo_compare_test.go b/modules/git/repo_compare_test.go
index ad1d496871a..27757f98e36 100644
--- a/modules/git/repo_compare_test.go
+++ b/modules/git/repo_compare_test.go
@@ -45,6 +45,9 @@ func TestGetFormatPatch(t *testing.T) {
 	patch := string(patchb)
 	assert.Regexp(t, "^From 8d92fc95", patch)
 	assert.Contains(t, patch, "Subject: [PATCH] Add file2.txt")
+
+	err = repo.GetPatch(t.Context(), "gitea-missing-revision", io.Discard)
+	assert.ErrorContains(t, err, "fatal: ambiguous argument 'gitea-missing-revision'")
 }
 
 func TestReadPatch(t *testing.T) {
diff --git a/modules/git/submodule.go b/modules/git/submodule.go
index 9cf81e5ee5a..57e795efc76 100644
--- a/modules/git/submodule.go
+++ b/modules/git/submodule.go
@@ -37,7 +37,7 @@ func GetTemplateSubmoduleCommits(ctx context.Context, repo RepositoryFacade) (su
 			}
 			return scanner.Err()
 		}).
-		Run(ctx)
+		RunWithStderr(ctx)
 	if err != nil {
 		return nil, fmt.Errorf("GetTemplateSubmoduleCommits: error running git ls-tree: %v", err)
 	}
diff --git a/routers/private/hook_verification.go b/routers/private/hook_verification.go
index 5e826758520..655e5b484c2 100644
--- a/routers/private/hook_verification.go
+++ b/routers/private/hook_verification.go
@@ -34,10 +34,12 @@ func verifyCommits(ctx context.Context, oldCommitID, newCommitID string, repo *g
 	err := command.WithEnv(env).
 		WithRepo(repo).
 		WithPipelineFunc(func(gitCtx gitcmd.Context) error {
-			err := readAndVerifyCommitsFromShaReader(ctx, stdoutReader, repo, env)
-			return gitCtx.CancelPipeline(err)
+			if err := readAndVerifyCommitsFromShaReader(ctx, stdoutReader, repo, env); err != nil {
+				return gitCtx.CancelPipeline(err)
+			}
+			return nil
 		}).
-		Run(ctx)
+		RunWithStderr(ctx)
 	if err != nil && !isErrUnverifiedCommit(err) {
 		log.Error("Unable to check commits from %s to %s in %s: %v", oldCommitID, newCommitID, repo.LogString(), err)
 	}
@@ -75,7 +77,7 @@ func readAndVerifyCommit(ctx context.Context, sha string, repo *git.Repository,
 			}
 			return nil
 		}).
-		Run(ctx)
+		RunWithStderr(ctx)
 }
 
 type errUnverifiedCommit struct {
diff --git a/routers/private/hook_verification_test.go b/routers/private/hook_verification_test.go
index f71dd58b8c4..5a2b1b52776 100644
--- a/routers/private/hook_verification_test.go
+++ b/routers/private/hook_verification_test.go
@@ -41,4 +41,7 @@ func TestVerifyCommits(t *testing.T) {
 			assert.Error(t, err)
 		}
 	}
+
+	err = verifyCommits(t.Context(), objectFormat.EmptyObjectID().String(), "gitea-missing-revision", gitRepo, nil)
+	assert.ErrorContains(t, err, "fatal: ambiguous argument 'gitea-missing-revision'")
 }
diff --git a/services/gitdiff/gitdiff_test.go b/services/gitdiff/gitdiff_test.go
index 382dc2f28ab..cb752095537 100644
--- a/services/gitdiff/gitdiff_test.go
+++ b/services/gitdiff/gitdiff_test.go
@@ -1049,7 +1049,7 @@ revert
 from :2
 D test2.txt
 D test10.txt`
-	require.NoError(t, gitcmd.NewCommand("fast-import").WithRepo(pull.BaseRepo).WithStdinBytes([]byte(stdin)).Run(t.Context()))
+	require.NoError(t, gitcmd.NewCommand("fast-import").WithRepo(pull.BaseRepo).WithStdinBytes([]byte(stdin)).RunWithStderr(t.Context()))
 
 	gitRepo, err := git.OpenRepository(t.Context(), pull.BaseRepo)
 	assert.NoError(t, err)
diff --git a/services/gitproxy/server_test.go b/services/gitproxy/server_test.go
index 1c367147fe5..15099d08d45 100644
--- a/services/gitproxy/server_test.go
+++ b/services/gitproxy/server_test.go
@@ -437,7 +437,7 @@ func TestRun(t *testing.T) {
 		_ = daemon.Run()
 	}))
 	require.NoError(t, err)
-	require.NoError(t, gitcmd.NewCommand("clone", "-q", "--bare").AddDynamicArguments("git://127.0.0.1:"+port+"/repo1_bare", filepath.Join(base, "allowed")).Run(t.Context()))
+	require.NoError(t, gitcmd.NewCommand("clone", "-q", "--bare").AddDynamicArguments("git://127.0.0.1:"+port+"/repo1_bare", filepath.Join(base, "allowed")).RunWithStderr(t.Context()))
 	_, stderr, runErr := gitcmd.NewCommand("clone", "-q", "--bare").AddDynamicArguments("git://127.0.0.2:"+port+"/repo1_bare", filepath.Join(base, "denied")).RunStdString(t.Context())
 	require.Error(t, runErr)
 	assert.Contains(t, stderr, "target denied by policy")
diff --git a/services/pull/merge_prepare.go b/services/pull/merge_prepare.go
index 9e0453e6534..f85c01c2c0f 100644
--- a/services/pull/merge_prepare.go
+++ b/services/pull/merge_prepare.go
@@ -33,8 +33,7 @@ type mergeContext struct {
 }
 
 // PrepareGitCmd prepares a git command with the correct directory, environment, and output buffers
-// This function can only be called with gitcmd.Run()
-// Do NOT use it with gitcmd.RunStd*() functions, otherwise it will panic
+// Use RunWithStderr because this already configures a stdout buffer.
 func (ctx *mergeContext) PrepareGitCmd(cmd *gitcmd.Command) *gitcmd.Command {
 	ctx.outbuf.Reset()
 	return cmd.WithEnv(ctx.env).
@@ -211,7 +210,7 @@ func getDiffTree(ctx context.Context, repo git.RepositoryFacade, baseBranch, hea
 	cmd := gitcmd.NewCommand("diff-tree", "--no-commit-id", "--name-only", "-r", "-r", "-z", "--root")
 	diffOutReader, diffOutReaderClose := cmd.MakeStdoutPipe()
 	defer diffOutReaderClose()
-	err := cmd.AddDynamicArguments(baseBranch, headBranch).
+	return cmd.AddDynamicArguments(baseBranch, headBranch).
 		WithRepo(repo).
 		WithPipelineFunc(func(ctx gitcmd.Context) error {
 			// Now scan the output from the command
@@ -228,8 +227,7 @@ func getDiffTree(ctx context.Context, repo git.RepositoryFacade, baseBranch, hea
 			}
 			return scanner.Err()
 		}).
-		Run(ctx)
-	return err
+		RunWithStderr(ctx)
 }
 
 // ErrRebaseConflicts represents an error if rebase fails with a conflict
diff --git a/services/pull/merge_rebase.go b/services/pull/merge_rebase.go
index 1de4683440a..75b87f0a77b 100644
--- a/services/pull/merge_rebase.go
+++ b/services/pull/merge_rebase.go
@@ -78,7 +78,7 @@ func doMergeRebaseFastForward(ctx *mergeContext) error {
 			return err
 		}
 		addCommitSigningOptions(cmdCommit, ctx.signKey)
-		if err := cmdCommit.WithRepo(ctx.tmpRepo).Run(ctx); err != nil {
+		if err := cmdCommit.WithRepo(ctx.tmpRepo).RunWithStderr(ctx); err != nil {
 			log.Error("Unable to amend commit message: %v", err)
 			return err
 		}
diff --git a/services/pull/merge_tree.go b/services/pull/merge_tree.go
index e6839c29553..b24fd67950a 100644
--- a/services/pull/merge_tree.go
+++ b/services/pull/merge_tree.go
@@ -41,7 +41,7 @@ func checkConflictsMergeTree(ctx context.Context, pr *issues_model.PullRequest,
 	// against the current base commit (baseCommitID) using `git diff-tree`. The command returns exit code 0
 	// if there is no diff between these trees (empty patch) and exit code 1 if there is a diff.
 	gitErr := gitcmd.NewCommand("diff-tree", "-r", "--quiet").
-		AddDynamicArguments(treeHash, baseCommitID).WithRepo(pr.BaseRepo).Run(ctx)
+		AddDynamicArguments(treeHash, baseCommitID).WithRepo(pr.BaseRepo).RunWithStderr(ctx)
 	switch {
 	case gitErr == nil:
 		log.Debug("PullRequest[%d]: Patch is empty - ignoring", pr.ID)
diff --git a/services/pull/temp_repo.go b/services/pull/temp_repo.go
index 6484eb38788..13148cf41c5 100644
--- a/services/pull/temp_repo.go
+++ b/services/pull/temp_repo.go
@@ -38,8 +38,7 @@ type prTmpRepoContext struct {
 }
 
 // PrepareGitCmd prepares a git command with the correct directory, environment, and output buffers
-// This function can only be called with gitcmd.Run()
-// Do NOT use it with gitcmd.RunStd*() functions, otherwise it will panic
+// Use RunWithStderr because this already configures a stdout buffer.
 func (ctx *prTmpRepoContext) PrepareGitCmd(cmd *gitcmd.Command) *gitcmd.Command {
 	ctx.outbuf.Reset()
 	return cmd.WithRepo(ctx.tmpRepo).WithStdoutBuffer(ctx.outbuf)
diff --git a/tests/integration/git_general_test.go b/tests/integration/git_general_test.go
index d8439c0a3fa..93959b6c7ec 100644
--- a/tests/integration/git_general_test.go
+++ b/tests/integration/git_general_test.go
@@ -195,7 +195,7 @@ func lfsCommitAndPushTest(t *testing.T, dstPath string, sizes ...int) (pushedFil
 	t.Run("CommitAndPushLFS", func(t *testing.T) {
 		defer tests.PrintCurrentTest(t)()
 		prefix := "lfs-data-file-"
-		err := gitcmd.NewCommand("lfs").AddArguments("install").WithDir(dstPath).Run(t.Context())
+		var err error = gitcmd.NewCommand("lfs").AddArguments("install").WithDir(dstPath).RunWithStderr(t.Context())
 		assert.NoError(t, err)
 		_, _, err = gitcmd.NewCommand("lfs").AddArguments("track").AddDynamicArguments(prefix + "*").
 			WithDir(dstPath).RunStdString(t.Context())
@@ -427,7 +427,7 @@ func doBranchProtectPRMerge(baseCtx *APITestContext, dstPath string) func(t *tes
 		// Try to force push without force push permissions, which should fail
 		t.Run("ForcePushWithoutForcePermissions", func(t *testing.T) {
 			t.Run("CreateDivergentHistory", func(t *testing.T) {
-				gitcmd.NewCommand("reset", "--hard", "HEAD~1").WithDir(dstPath).Run(t.Context())
+				require.NoError(t, gitcmd.NewCommand("reset", "--hard", "HEAD~1").WithDir(dstPath).RunWithStderr(t.Context()))
 				_, err := generateCommitWithNewData(t.Context(), testFileSizeSmall, dstPath, "user2@example.com", "User Two", "branch-data-file-new")
 				assert.NoError(t, err)
 			})
@@ -873,11 +873,11 @@ func doCreateAgitFlowPull(dstPath string, ctx *APITestContext, headBranch string
 		})
 
 		t.Run("Push", func(t *testing.T) {
-			err := gitcmd.NewCommand("push", "origin", "HEAD:refs/for/master", "-o").
+			runErr := gitcmd.NewCommand("push", "origin", "HEAD:refs/for/master", "-o").
 				AddDynamicArguments("topic=" + headBranch).
 				WithDir(dstPath).
-				Run(t.Context())
-			require.NoError(t, err)
+				RunWithStderr(t.Context())
+			require.NoError(t, runErr)
 
 			unittest.AssertCount(t, &issues_model.PullRequest{}, pullNum+1)
 			pr1 = unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{
@@ -945,11 +945,11 @@ func doCreateAgitFlowPull(dstPath string, ctx *APITestContext, headBranch string
 		})
 
 		t.Run("Push2", func(t *testing.T) {
-			err := gitcmd.NewCommand("push", "origin", "HEAD:refs/for/master", "-o").
+			runErr := gitcmd.NewCommand("push", "origin", "HEAD:refs/for/master", "-o").
 				AddDynamicArguments("topic=" + headBranch).
 				WithDir(dstPath).
-				Run(t.Context())
-			require.NoError(t, err)
+				RunWithStderr(t.Context())
+			require.NoError(t, runErr)
 
 			unittest.AssertCount(t, &issues_model.PullRequest{}, pullNum+2)
 			prMsg, err := doAPIGetPullRequest(*ctx, ctx.Username, ctx.Reponame, pr1.Index)(t)
diff --git a/tests/integration/git_misc_test.go b/tests/integration/git_misc_test.go
index 27614a299fd..c5b64a7cc67 100644
--- a/tests/integration/git_misc_test.go
+++ b/tests/integration/git_misc_test.go
@@ -113,7 +113,7 @@ func TestAgitPullPush(t *testing.T) {
 				assert.NoError(t, err)
 
 				// create PR via agit
-				err = gitcmd.NewCommand(testCase.pushArgs...).WithDir(dstPath).Run(t.Context())
+				err = gitcmd.NewCommand(testCase.pushArgs...).WithDir(dstPath).RunWithStderr(t.Context())
 				assert.NoError(t, err)
 
 				// check pull request exist
@@ -132,14 +132,14 @@ func TestAgitPullPush(t *testing.T) {
 					// push 2
 					err = gitcmd.NewCommand("push", "origin", "HEAD:refs/for/master/test-agit-push").
 						WithDir(dstPath).
-						Run(t.Context())
+						RunWithStderr(t.Context())
 					assert.NoError(t, err)
 					pr = unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{BaseRepoID: 1, Flow: issues_model.PullRequestFlowAGit, HeadBranch: "user2/test-agit-push"})
 					assert.Equal(t, 0, pr.CommitsBehind)
 					assert.Equal(t, 2, pr.CommitsAhead)
 
 					// reset to first commit
-					err = gitcmd.NewCommand("reset", "--hard", "HEAD~1").WithDir(dstPath).Run(t.Context())
+					err = gitcmd.NewCommand("reset", "--hard", "HEAD~1").WithDir(dstPath).RunWithStderr(t.Context())
 					assert.NoError(t, err)
 
 					// test force push without confirm
@@ -153,7 +153,7 @@ func TestAgitPullPush(t *testing.T) {
 					// test force push with confirm
 					err = gitcmd.NewCommand("push", "origin", "HEAD:refs/for/master/test-agit-push", "-o", "force-push").
 						WithDir(dstPath).
-						Run(t.Context())
+						RunWithStderr(t.Context())
 					assert.NoError(t, err)
 
 					_, stderr, _ = gitcmd.NewCommand("push", "origin", "HEAD:refs/for/no-such-branch/test-agit-push").
@@ -193,7 +193,7 @@ func TestAgitPullPush(t *testing.T) {
 
 					err = gitcmd.NewCommand("push", "origin", "HEAD:refs/for/master/test-agit-review").
 						WithDir(dstPath).
-						Run(t.Context())
+						RunWithStderr(t.Context())
 					assert.NoError(t, err)
 
 					// Reload PR to get updated commit ID
diff --git a/tests/integration/pull_create_test.go b/tests/integration/pull_create_test.go
index 2ac677145b9..4f298493734 100644
--- a/tests/integration/pull_create_test.go
+++ b/tests/integration/pull_create_test.go
@@ -402,7 +402,7 @@ func TestCreateAgitPullWithReadPermission(t *testing.T) {
 		err := gitcmd.NewCommand("push", "origin", "HEAD:refs/for/master", "-o").
 			AddDynamicArguments("topic=test-topic").
 			WithDir(dstPath).
-			Run(t.Context())
+			RunWithStderr(t.Context())
 		assert.NoError(t, err)
 
 		repo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{OwnerName: "user2", Name: "repo1"})
diff --git a/tests/integration/pull_merge_test.go b/tests/integration/pull_merge_test.go
index 12253eff299..a5c498c3d00 100644
--- a/tests/integration/pull_merge_test.go
+++ b/tests/integration/pull_merge_test.go
@@ -407,7 +407,7 @@ func TestCantMergeUnrelated(t *testing.T) {
 			Name:    "repo1",
 		})
 
-		err := gitcmd.NewCommand("read-tree", "--empty").WithRepo(repo1).Run(t.Context())
+		var err error = gitcmd.NewCommand("read-tree", "--empty").WithRepo(repo1).RunWithStderr(t.Context())
 		assert.NoError(t, err)
 
 		stdout, _, err := gitcmd.NewCommand("hash-object", "-w", "--stdin").