Load Git trees lazily on checkout

crates/uv-git/src/git.rs

@@ -375,6 +375,8 @@ impl GitCheckout {
         ProcessBuilder::new("git")
             .arg("clone")
             .arg("--local")
+            // Propagate the treeless clone.
+            .arg("--filter=tree:0")
             // Make sure to pass the local file path and not a file://... url. If given a url,
             // Git treats the repository as a remote origin and gets confused because we don't
             // have a HEAD checked out.
@@ -539,14 +541,14 @@ pub(crate) fn fetch(
 
     debug!("Performing a Git fetch for: {remote_url}");
     let result = match refspec_strategy {
-        RefspecStrategy::All => fetch_with_cli(repo, remote_url, refspecs.as_slice(), tags),
+        RefspecStrategy::All => fetch_refspecs(repo, remote_url, refspecs.as_slice(), tags),
         RefspecStrategy::First => {
             // Try each refspec
             let mut errors = refspecs
                 .iter()
                 .map_while(|refspec| {
                     let fetch_result =
-                        fetch_with_cli(repo, remote_url, std::slice::from_ref(refspec), tags);
+                        fetch_refspecs(repo, remote_url, std::slice::from_ref(refspec), tags);
 
                     // Stop after the first success and log failures
                     match fetch_result {
@@ -585,8 +587,8 @@ pub(crate) fn fetch(
     }
 }
 
-/// Attempts to use `git` CLI installed on the system to fetch a repository,.
-fn fetch_with_cli(
+/// Attempts to use `git` CLI installed on the system to fetch the given refspecs from a remote repository.
+fn fetch_refspecs(
     repo: &mut GitRepository,
     url: &str,
     refspecs: &[String],
@@ -599,6 +601,11 @@ fn fetch_with_cli(
     }
     cmd.arg("--force") // handle force pushes
         .arg("--update-head-ok") // see discussion in #2078
+        // Perform a treeless fetch, fetching trees and blobs on-demand.
+        // We cannot perform a shallow clone because build tools such as
+        // setuptools-scm may require access to git history, but we only
+        // need the contents of the specific commit we are fetching.
+        .arg("--filter=tree:0")
         .arg(url)
         .args(refspecs)
         // If cargo is run by git (for example, the `exec` command in `git

crates/uv/tests/it/pip_compile.rs

@@ -11421,7 +11421,7 @@ fn git_source_missing_tag() -> Result<()> {
       Caused by: Git operation failed
       Caused by: failed to clone into: [CACHE_DIR]/git-v0/db/8dab139913c4b566
       Caused by: failed to fetch tag `missing`
-      Caused by: process didn't exit successfully: `git fetch --force --update-head-ok 'https://github.com/astral-test/uv-public-pypackage' '+refs/tags/missing:refs/remotes/origin/tags/missing'` (exit status: 128)
+      Caused by: process didn't exit successfully: `git fetch --force --update-head-ok '--filter=tree:0' 'https://github.com/astral-test/uv-public-pypackage' '+refs/tags/missing:refs/remotes/origin/tags/missing'` (exit status: 128)
     --- stderr
     fatal: couldn't find remote ref refs/tags/missing
 

crates/uv/tests/it/pip_install.rs

@@ -1792,7 +1792,7 @@ fn install_git_private_https_pat_not_authorized() {
     error: Failed to download and build: `uv-private-pypackage @ git+https://git:***@github.com/astral-test/uv-private-pypackage`
       Caused by: Git operation failed
       Caused by: failed to clone into: [CACHE_DIR]/git-v0/db/8401f5508e3e612d
-      Caused by: process didn't exit successfully: `git fetch --force --update-head-ok 'https://git:***@github.com/astral-test/uv-private-pypackage' '+HEAD:refs/remotes/origin/HEAD'` (exit status: 128)
+      Caused by: process didn't exit successfully: `git fetch --force --update-head-ok '--filter=tree:0' 'https://git:***@github.com/astral-test/uv-private-pypackage' '+HEAD:refs/remotes/origin/HEAD'` (exit status: 128)
     --- stderr
     remote: Support for password authentication was removed on August 13, 2021.
     remote: Please see https://docs.github.com/get-started/getting-started-with-git/about-remote-repositories#cloning-with-https-urls for information on currently recommended modes of authentication.