Fetch repositories to /tmp, not in-memory.

go.mod

@@ -4,6 +4,7 @@ go 1.25.0
 
 require (
 	github.com/KimMachineGun/automemlimit v0.7.4
+	github.com/go-git/go-billy/v6 v6.0.0-20250627091229-31e2a16eef30
 	github.com/go-git/go-git/v6 v6.0.0-20250910120214-3a68d0404116
 	github.com/maypok86/otter/v2 v2.2.1
 	github.com/minio/minio-go/v7 v7.0.95
@@ -20,7 +21,6 @@ require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/go-git/gcfg/v2 v2.0.2 // indirect
-	github.com/go-git/go-billy/v6 v6.0.0-20250627091229-31e2a16eef30 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect

src/fetch.go

@@ -4,17 +4,32 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"os"
 
+	"github.com/go-git/go-billy/v6/osfs"
 	"github.com/go-git/go-git/v6"
 	"github.com/go-git/go-git/v6/plumbing"
+	"github.com/go-git/go-git/v6/plumbing/cache"
 	"github.com/go-git/go-git/v6/plumbing/filemode"
 	"github.com/go-git/go-git/v6/plumbing/object"
-	"github.com/go-git/go-git/v6/storage/memory"
+	"github.com/go-git/go-git/v6/storage/filesystem"
 )
 
-func FetchRepository(ctx context.Context, repoURL string, branch string) (*Manifest, error) {
-	storer := memory.NewStorage()
+const largeObjectThreshold int64 = 1048576
 
+func FetchRepository(ctx context.Context, repoURL string, branch string) (*Manifest, error) {
+	baseDir, err := os.MkdirTemp("", "fetchRepo")
+	if err != nil {
+		return nil, fmt.Errorf("mkdtemp: %w", err)
+	}
+	defer os.RemoveAll(baseDir)
+
+	fs := osfs.New(baseDir, osfs.WithBoundOS())
+	cache := cache.NewObjectLRUDefault()
+	storer := filesystem.NewStorageWithOptions(fs, cache, filesystem.Options{
+		ExclusiveAccess:      true,
+		LargeObjectThreshold: largeObjectThreshold,
+	})
 	repo, err := git.CloneContext(ctx, storer, nil, &git.CloneOptions{
 		Bare:          true,
 		URL:           repoURL,