fix(tree): address partial cache review feedback

Review item #2274 (comment)
reports that "subsequent iteration or lookup silently accepts that truncated
tree" after an entry fails validation. Stored trees containing a `.git`
entry reproduce this on both backends: the first iteration rejects the name,
but the second accepts an empty tree or the valid prefix.

Build the entries in a local list and attach `_cache` only after every record
passes parsing and validation. Failed reads leave the lazy cache unset, so
later accesses retry and raise the same error instead of exposing partial data.
No backend behavior or tree validation policy changes. Git 2.54.0's `mktree`
and `ls-tree` accept and emit the fixture's `.git` entry; GitPython applies
its existing metadata-path guard while consuming that output.

Four regressions cover invalid entries first and last in SHA-1/SHA-256 trees.
All fail before the fix and pass afterwards on CLI and native Gix `ls_tree`.
All 97 tree tests pass on each backend. Ruff, ShellCheck and mypy pass.

Author: codex

git/objects/tree.py

@@ -219,7 +219,7 @@ def _set_cache_(self, attr: str) -> None:
             output = self.repo.git._call_process_safe(
                 "ls_tree", "-z", "--full-tree", self.hexsha, stdout_as_string=False
             )
-            self._cache: List[TreeCacheTup] = []
+            cache: List[TreeCacheTup] = []
             for record in output.split(b"\0"):
                 if not record:
                     continue
@@ -230,7 +230,8 @@ def _set_cache_(self, attr: str) -> None:
                 binsha = bytes.fromhex(oid.decode("ascii"))
                 if len(binsha) != self.repo._oid_size:
                     raise ValueError("Invalid tree object ID returned by Git")
-                self._cache.append((binsha, int(mode, 8), name))
+                cache.append((binsha, int(mode, 8), name))
+            self._cache = cache
         else:
             super()._set_cache_(attr)
         # END handle attribute

test/test_tree.py

@@ -41,6 +41,20 @@ def test_tree_cache_edits_do_not_update_object_ids_or_parents():
         assert repo.head.commit.tree["sub"].hexsha == original_oid
 
 
+@pytest.mark.parametrize("object_format", ["sha1", "sha256"])
+@pytest.mark.parametrize("invalid_position", ["first", "last"])
+def test_invalid_tree_does_not_retain_partial_cache(object_format, invalid_position):
+    with fixture_repo("tree-invalid.sh", object_format, invalid_position) as repo:
+        root = read_only_fixture("tree-invalid.sh", object_format, invalid_position)
+        oid = (root / "tree-id").read_text().strip()
+        names = [line.split("\t")[1] for line in (root / "entries").read_text().splitlines()]
+        assert names == ([".git", "valid"] if invalid_position == "first" else ["!valid", ".git"])
+        tree = Tree(repo, bytes.fromhex(oid), path="")
+        for _ in range(2):
+            with pytest.raises(ValueError, match="aliases Git metadata"):
+                list(tree)
+
+
 @ddt.ddt
 class TestTree(TestBase):
     @with_rw_repo("HEAD")

tests/fixtures/tree-invalid.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -eu
+git init --initial-branch=main --object-format="$1" repo
+cd repo
+blob=$(printf 'content\n' | git hash-object -w --stdin)
+if test "$2" = first; then
+    valid=valid
+else
+    valid='!valid'
+fi
+{
+    printf '100644 blob %s\t.git\n' "$blob"
+    printf '100644 blob %s\t%s\n' "$blob" "$valid"
+} | git mktree > ../tree-id
+git ls-tree "$(cat ../tree-id)" > ../entries