feat(sources): derive synthetic history from upstream-commit config

Add the lock-file-free source of synthetic dist-git history. Instead of
walking a component's lock file for input-fingerprint changes, the new
discovery path walks the generated upstream-commit TOML that pinned the
component and records the pin held at each commit that touched it,
including the pin carried by a commit that deletes the file.

Discovery is the only part that differs: the recorded change data is
identical, so interleaving and replay are shared with the default mode. No
fork point is persisted in this mode, so the upstream walk is bounded by
the repository's first-parent root rather than by an import commit.

Preparers select the source with the new WithoutLockfileHistory option,
which is rejected together with dirty detection because there is no
fingerprint to compare a working tree against. Component build, render, and
prepare-sources now assemble their git-repo preparer options through a
single mode-aware helper.

Refs: microsoft#323

Author: Copilot

internal/app/azldev/cmds/component/build.go

@@ -269,10 +269,7 @@ func buildComponent(
 
 	var preparerOpts []sources.PreparerOption
 	if !options.WithoutGitRepo {
-		preparerOpts = append(preparerOpts,
-			sources.WithGitRepo(env, env.LockReader(), distro.Version.ReleaseVer),
-			sources.WithDirtyDetection(),
-		)
+		preparerOpts = append(preparerOpts, gitRepoPreparerOptions(env, distro)...)
 	}
 
 	preparerOpts = append(preparerOpts,

internal/app/azldev/cmds/component/preparerctx.go

@@ -0,0 +1,33 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+package component
+
+import (
+	"github.com/microsoft/azure-linux-dev-tools/internal/app/azldev"
+	"github.com/microsoft/azure-linux-dev-tools/internal/app/azldev/core/sources"
+	"github.com/microsoft/azure-linux-dev-tools/internal/providers/sourceproviders"
+)
+
+// gitRepoPreparerOptions returns the [sources.PreparerOption] values that enable
+// synthetic dist-git history for the current mode.
+//
+// By default, history is derived from the component's lock file, and working-tree
+// changes are detected by comparing input fingerprints. In lock-file-free mode it
+// is derived from the component's generated upstream-commit TOML, which has no
+// fingerprint to compare against, so only committed changes are represented.
+func gitRepoPreparerOptions(
+	env *azldev.Env, distro sourceproviders.ResolvedDistro,
+) []sources.PreparerOption {
+	if env.WithoutLockfile() {
+		return []sources.PreparerOption{
+			sources.WithGitRepo(env, nil, ""),
+			sources.WithoutLockfileHistory(),
+		}
+	}
+
+	return []sources.PreparerOption{
+		sources.WithGitRepo(env, env.LockReader(), distro.Version.ReleaseVer),
+		sources.WithDirtyDetection(),
+	}
+}

internal/app/azldev/cmds/component/preparesources.go

@@ -155,10 +155,7 @@ func buildPreparerOptions(
 	var opts []sources.PreparerOption
 
 	if !options.WithoutGitRepo && !options.SkipOverlays {
-		opts = append(opts,
-			sources.WithGitRepo(env, env.LockReader(), distro.Version.ReleaseVer),
-			sources.WithDirtyDetection(),
-		)
+		opts = append(opts, gitRepoPreparerOptions(env, distro)...)
 	}
 
 	opts = append(opts,

internal/app/azldev/cmds/component/render.go

@@ -523,13 +523,11 @@ func prepareComponentSources(
 	// rpmautospec can expand %autorelease and %autochangelog correctly.
 	// WithSkipLookaside avoids expensive tarball downloads — only spec +
 	// sidecar files are needed for rendering.
-	preparerOpts := []sources.PreparerOption{
-		sources.WithGitRepo(env, env.LockReader(), distro.Version.ReleaseVer),
-		sources.WithDirtyDetection(),
+	preparerOpts := append(gitRepoPreparerOptions(env, distro),
 		sources.WithSkipLookaside(),
 		sources.WithUpstreamProvenance(sources.FedoraDistTag(distro.Ref.Name, distro.Version.ReleaseVer)),
 		sources.WithMockProcessor(mockProcessor),
-	}
+	)
 
 	preparer, err := sources.NewPreparer(sourceManager, env.FS(), env, env, preparerOpts...)
 	if err != nil {

internal/app/azldev/core/sources/sourceprep.go

@@ -98,6 +98,16 @@ func WithDirtyDetection() PreparerOption {
 	}
 }
 
+// WithoutLockfileHistory returns a [PreparerOption] that derives synthetic history
+// from the component's generated upstream-commit TOML instead of its lock file.
+// It selects the behavior of the global '--without-lockfile' flag; the lock reader
+// and release version passed to [WithGitRepo] are unused in that mode.
+func WithoutLockfileHistory() PreparerOption {
+	return func(p *sourcePreparerImpl) {
+		p.withoutLockfile = true
+	}
+}
+
 // WithSkipLookaside returns a [PreparerOption] that skips all lookaside cache
 // downloads during source preparation. This includes both explicit source file
 // downloads ([SourceManager.FetchFiles]) and lookaside extraction during
@@ -184,6 +194,11 @@ type sourcePreparerImpl struct {
 	// synthetic history generation. Set via [WithDirtyDetection].
 	dirtyDetection bool
 
+	// withoutLockfile, when true, derives synthetic history from the generated
+	// upstream-commit TOML rather than the lock file. Set via
+	// [WithoutLockfileHistory].
+	withoutLockfile bool
+
 	// releaseVer is the per-component resolved distro release version, not the
 	// project default. Set via [WithGitRepo].
 	releaseVer string
@@ -244,6 +259,11 @@ func NewPreparer(
 			"dirty detection compares fingerprints against committed lock files in the git history")
 	}
 
+	if impl.dirtyDetection && impl.withoutLockfile {
+		return nil, errors.New("WithDirtyDetection is incompatible with WithoutLockfileHistory; " +
+			"there is no lock file to compare fingerprints against")
+	}
+
 	return impl, nil
 }
 
@@ -500,26 +520,9 @@ func (p *sourcePreparerImpl) trySyntheticHistory(
 	config := component.GetConfig()
 	componentName := component.GetName()
 
-	// Compute the current fingerprint for uncommitted-change detection.
-	// Only computed when dirty detection is enabled (e.g., build, render).
-	// An empty fingerprint skips dirty detection in buildSyntheticCommits.
-	var currentFingerprint string
-
-	if p.dirtyDetection {
-		var fpErr error
-
-		currentFingerprint, fpErr = computeCurrentFingerprint(p.fs, fingerprintConfig, p.releaseVer)
-		if fpErr != nil {
-			return fmt.Errorf("dirty detection failed for component %#q:\n%w", componentName, fpErr)
-		}
-	}
-
-	changes, importCommit, err := buildSyntheticCommits(
-		ctx, p.cmdFactory, config, componentName, p.lockReader.LockDir(),
-		currentFingerprint,
-	)
+	changes, importCommit, err := p.findSyntheticChanges(ctx, config, fingerprintConfig, componentName)
 	if err != nil {
-		return fmt.Errorf("failed to build synthetic commits:\n%w", err)
+		return err
 	}
 
 	if len(changes) == 0 {
@@ -570,6 +573,52 @@ func (p *sourcePreparerImpl) trySyntheticHistory(
 	return nil
 }
 
+// findSyntheticChanges discovers the component changes that synthetic history
+// should represent, using the source selected by the preparer's mode: the
+// component's lock file by default, or its generated upstream-commit TOML when
+// [WithoutLockfileHistory] is set. The returned import commit bounds the upstream
+// walk; it is always empty in lock-file-free mode, where no fork point is
+// persisted and the repository's first-parent root bounds the walk instead.
+func (p *sourcePreparerImpl) findSyntheticChanges(
+	ctx context.Context,
+	config *projectconfig.ComponentConfig,
+	fingerprintConfig *projectconfig.ComponentConfig,
+	componentName string,
+) (changes []FingerprintChange, importCommit string, err error) {
+	if p.withoutLockfile {
+		changes, err = buildUpstreamCommitSyntheticCommits(ctx, p.cmdFactory, config, componentName)
+		if err != nil {
+			return nil, "", fmt.Errorf("failed to build synthetic commits:\n%w", err)
+		}
+
+		return changes, "", nil
+	}
+
+	// Compute the current fingerprint for uncommitted-change detection.
+	// Only computed when dirty detection is enabled (e.g., build, render).
+	// An empty fingerprint skips dirty detection in buildSyntheticCommits.
+	var currentFingerprint string
+
+	if p.dirtyDetection {
+		var fpErr error
+
+		currentFingerprint, fpErr = computeCurrentFingerprint(p.fs, fingerprintConfig, p.releaseVer)
+		if fpErr != nil {
+			return nil, "", fmt.Errorf("dirty detection failed for component %#q:\n%w", componentName, fpErr)
+		}
+	}
+
+	changes, importCommit, err = buildSyntheticCommits(
+		ctx, p.cmdFactory, config, componentName, p.lockReader.LockDir(),
+		currentFingerprint,
+	)
+	if err != nil {
+		return nil, "", fmt.Errorf("failed to build synthetic commits:\n%w", err)
+	}
+
+	return changes, importCommit, nil
+}
+
 // computeCurrentFingerprint computes the current input fingerprint for a
 // component from its resolved config. Returns ("", nil) for local components
 // or when the source identity cannot be determined — dirty detection is

internal/app/azldev/core/sources/synthistory.go

@@ -42,6 +42,12 @@ type FingerprintChange struct {
 	UpstreamCommit string
 }
 
+// UpstreamCommitChange records a project commit that changed a component's
+// configured upstream commit. Lock-file-free mode discovers changes from the
+// generated upstream-commit TOML instead of a lock file's fingerprint, but the
+// recorded data and the replay that consumes it are identical.
+type UpstreamCommitChange = FingerprintChange
+
 // interleavedEntry represents a single commit in the rebuilt dist-git history.
 // Exactly one of upstreamCommit or syntheticChange is non-nil.
 type interleavedEntry struct {
@@ -585,15 +591,29 @@ func openProjectRepo(
 	config *projectconfig.ComponentConfig,
 	componentName string,
 ) (*gogit.Repository, string, error) {
-	if config.SourceConfigFile == nil || config.SourceConfigFile.SourcePath() == "" {
+	var configFilePath string
+	if config.SourceConfigFile != nil {
+		configFilePath = config.SourceConfigFile.SourcePath()
+	}
+
+	return openProjectRepoForConfigFile(configFilePath, componentName)
+}
+
+// openProjectRepoForConfigFile opens the git repository containing configFilePath
+// and returns both the [gogit.Repository] and the worktree root directory. Returns
+// (nil, "", nil) when the path is empty, indicating that synthetic commits should
+// be skipped.
+func openProjectRepoForConfigFile(
+	configFilePath string,
+	componentName string,
+) (*gogit.Repository, string, error) {
+	if configFilePath == "" {
 		slog.Debug("Cannot resolve config file for synthetic commits; skipping",
 			"component", componentName)
 
 		return nil, "", nil
 	}
 
-	configFilePath := config.SourceConfigFile.SourcePath()
-
 	repo, err := git.OpenProjectRepo(filepath.Dir(configFilePath))
 	if err != nil {
 		return nil, "", fmt.Errorf("failed to find project repository for config file %#q:\n%w",