Merge branch 'ps-replaceMustRunCommandWithGittestAlternative' into 'master'avar/24076ab9d1a10aa7555bdead49426b73c6d77dc8

Replace MustRunCommand with gittest.Exec|ExecStream in service directory

See merge request gitlab-org/gitaly!3434

71 files changed, 466 insertions, 448 deletions

diff --git a/internal/gitaly/service/blob/get_blobs_test.go b/internal/gitaly/service/blob/get_blobs_test.go
index a6543e877..b53b4b60f 100644
--- a/internal/gitaly/service/blob/get_blobs_test.go
+++ b/internal/gitaly/service/blob/get_blobs_test.go
@@ -7,13 +7,14 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"google.golang.org/grpc/codes"
 )
 
 func TestSuccessfulGetBlobsRequest(t *testing.T) {
-	_, repo, repoPath, client := setup(t)
+	cfg, repo, repoPath, client := setup(t)
 
 	expectedBlobs := []*gitalypb.GetBlobsResponse{
 		{
@@ -57,7 +58,7 @@ func TestSuccessfulGetBlobsRequest(t *testing.T) {
 	revision := "ef16b8d2b204706bd8dc211d4011a5bffb6fc0c2"
 	limits := []int{-1, 0, 10 * 1024 * 1024}
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "worktree", "add", "blobs-sandbox", revision)
+	gittest.Exec(t, cfg, "-C", repoPath, "worktree", "add", "blobs-sandbox", revision)
 
 	var revisionPaths []*gitalypb.GetBlobsRequest_RevisionPath
 	for _, blob := range expectedBlobs {
diff --git a/internal/gitaly/service/blob/lfs_pointers_test.go b/internal/gitaly/service/blob/lfs_pointers_test.go
index 5ef58616a..9e3e63d07 100644
--- a/internal/gitaly/service/blob/lfs_pointers_test.go
+++ b/internal/gitaly/service/blob/lfs_pointers_test.go
@@ -215,10 +215,10 @@ size 12345`
 	})
 
 	t.Run("dangling LFS pointer", func(t *testing.T) {
-		_, repo, repoPath, client := setup(t)
+		cfg, repo, repoPath, client := setup(t)
 
-		lfsPointerOID := text.ChompBytes(testhelper.MustRunCommand(t, strings.NewReader(lfsPointerContents),
-			"git", "-C", repoPath, "hash-object", "-w", "--stdin"))
+		hash := gittest.ExecStream(t, cfg, strings.NewReader(lfsPointerContents), "-C", repoPath, "hash-object", "-w", "--stdin")
+		lfsPointerOID := text.ChompBytes(hash)
 
 		stream, err := client.ListAllLFSPointers(ctx, &gitalypb.ListAllLFSPointersRequest{
 			Repository: repo,
@@ -511,7 +511,7 @@ func BenchmarkReadLFSPointers(b *testing.B) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	candidates := testhelper.MustRunCommand(b, nil, "git", "-C", path, "rev-list", "--in-commit-order", "--objects", "--no-object-names", "--filter=blob:limit=200", "--all")
+	candidates := gittest.Exec(b, cfg, "-C", path, "rev-list", "--in-commit-order", "--objects", "--no-object-names", "--filter=blob:limit=200", "--all")
 
 	b.Run("limitless", func(b *testing.B) {
 		_, err := readLFSPointers(ctx, repo, bytes.NewReader(candidates), 0)
diff --git a/internal/gitaly/service/cleanup/apply_bfg_object_map_stream_test.go b/internal/gitaly/service/cleanup/apply_bfg_object_map_stream_test.go
index 66abcefac..2a9335850 100644
--- a/internal/gitaly/service/cleanup/apply_bfg_object_map_stream_test.go
+++ b/internal/gitaly/service/cleanup/apply_bfg_object_map_stream_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/git/localrepo"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -40,7 +41,7 @@ func TestApplyBfgObjectMapStreamSuccess(t *testing.T) {
 		"refs/environments/1", "refs/keep-around/1", "refs/merge-requests/1", "refs/pipelines/1",
 		"refs/heads/_keep", "refs/tags/_keep", "refs/notes/_keep",
 	} {
-		testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", ref, headCommit.Id)
+		gittest.Exec(t, cfg, "-C", repoPath, "update-ref", ref, headCommit.Id)
 	}
 
 	// Create some refs pointing to ref/tags/v1.0.0, simulating an unmodified
@@ -48,7 +49,7 @@ func TestApplyBfgObjectMapStreamSuccess(t *testing.T) {
 	for _, ref := range []string{
 		"refs/environments/_keep", "refs/keep-around/_keep", "refs/merge-requests/_keep", "refs/pipelines/_keep",
 	} {
-		testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", ref, tagID)
+		gittest.Exec(t, cfg, "-C", repoPath, "update-ref", ref, tagID)
 	}
 
 	const filterRepoCommitMapHeader = "old                                      new\n"
diff --git a/internal/gitaly/service/commit/commit_signatures_test.go b/internal/gitaly/service/commit/commit_signatures_test.go
index 12690182d..260497ea7 100644
--- a/internal/gitaly/service/commit/commit_signatures_test.go
+++ b/internal/gitaly/service/commit/commit_signatures_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -14,10 +15,10 @@ import (
 )
 
 func TestSuccessfulGetCommitSignaturesRequest(t *testing.T) {
-	_, repo, repoPath, client := setupCommitServiceWithRepo(t, true)
+	cfg, repo, repoPath, client := setupCommitServiceWithRepo(t, true)
 
 	commitData := testhelper.MustReadFile(t, "testdata/dc00eb001f41dfac08192ead79c2377c588b82ee.commit")
-	commit := text.ChompBytes(testhelper.MustRunCommand(t, bytes.NewReader(commitData), "git", "-C", repoPath, "hash-object", "-w", "-t", "commit", "--stdin", "--literally"))
+	commit := text.ChompBytes(gittest.ExecStream(t, cfg, bytes.NewReader(commitData), "-C", repoPath, "hash-object", "-w", "-t", "commit", "--stdin", "--literally"))
 	require.Equal(t, "dc00eb001f41dfac08192ead79c2377c588b82ee", commit)
 
 	ctx, cancel := testhelper.Context()
diff --git a/internal/gitaly/service/commit/count_commits_test.go b/internal/gitaly/service/commit/count_commits_test.go
index 8b23acfc6..c0c3d2f1d 100644
--- a/internal/gitaly/service/commit/count_commits_test.go
+++ b/internal/gitaly/service/commit/count_commits_test.go
@@ -23,16 +23,16 @@ func TestSuccessfulCountCommitsRequest(t *testing.T) {
 	committerEmail := "scrooge@mcduck.com"
 
 	for i := 0; i < 5; i++ {
-		testhelper.MustRunCommand(t, nil, "git", "-C", repo2Path,
+		gittest.Exec(t, cfg, "-C", repo2Path,
 			"-c", fmt.Sprintf("user.name=%s", committerName),
 			"-c", fmt.Sprintf("user.email=%s", committerEmail),
 			"commit", "--allow-empty", "-m", "Empty commit")
 	}
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repo2Path, "checkout", "-b", "another-branch")
+	gittest.Exec(t, cfg, "-C", repo2Path, "checkout", "-b", "another-branch")
 
 	for i := 0; i < 3; i++ {
-		testhelper.MustRunCommand(t, nil, "git", "-C", repo2Path,
+		gittest.Exec(t, cfg, "-C", repo2Path,
 			"-c", fmt.Sprintf("user.name=%s", committerName),
 			"-c", fmt.Sprintf("user.email=%s", committerEmail),
 			"commit", "--allow-empty", "-m", "Empty commit")
diff --git a/internal/gitaly/service/commit/count_diverging_commits_test.go b/internal/gitaly/service/commit/count_diverging_commits_test.go
index 89a2b87fc..cf3d8b268 100644
--- a/internal/gitaly/service/commit/count_diverging_commits_test.go
+++ b/internal/gitaly/service/commit/count_diverging_commits_test.go
@@ -31,26 +31,26 @@ func createRepoWithDivergentBranches(t *testing.T, cfg config.Cfg, leftCommits,
 	committerEmail := "scrooge@mcduck.com"
 
 	for i := 0; i < 2; i++ {
-		testhelper.MustRunCommand(t, nil, "git", "-C", worktreePath,
+		gittest.Exec(t, cfg, "-C", worktreePath,
 			"-c", fmt.Sprintf("user.name=%s", committerName),
 			"-c", fmt.Sprintf("user.email=%s", committerEmail),
 			"commit", "--allow-empty", "-m", fmt.Sprintf("master branch Empty commit %d", i))
 	}
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", worktreePath, "checkout", "-b", leftBranchName)
+	gittest.Exec(t, cfg, "-C", worktreePath, "checkout", "-b", leftBranchName)
 
 	for i := 0; i < leftCommits; i++ {
-		testhelper.MustRunCommand(t, nil, "git", "-C", worktreePath,
+		gittest.Exec(t, cfg, "-C", worktreePath,
 			"-c", fmt.Sprintf("user.name=%s", committerName),
 			"-c", fmt.Sprintf("user.email=%s", committerEmail),
 			"commit", "--allow-empty", "-m", fmt.Sprintf("branch-1 Empty commit %d", i))
 	}
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", worktreePath, "checkout", "master")
-	testhelper.MustRunCommand(t, nil, "git", "-C", worktreePath, "checkout", "-b", rightBranchName)
+	gittest.Exec(t, cfg, "-C", worktreePath, "checkout", "master")
+	gittest.Exec(t, cfg, "-C", worktreePath, "checkout", "-b", rightBranchName)
 
 	for i := 0; i < rightCommits; i++ {
-		testhelper.MustRunCommand(t, nil, "git", "-C", worktreePath,
+		gittest.Exec(t, cfg, "-C", worktreePath,
 			"-c", fmt.Sprintf("user.name=%s", committerName),
 			"-c", fmt.Sprintf("user.email=%s", committerEmail),
 			"commit", "--allow-empty", "-m", fmt.Sprintf("branch-2 Empty commit %d", i))
diff --git a/internal/gitaly/service/commit/find_commits_test.go b/internal/gitaly/service/commit/find_commits_test.go
index 1ab4f293a..2458ba53c 100644
--- a/internal/gitaly/service/commit/find_commits_test.go
+++ b/internal/gitaly/service/commit/find_commits_test.go
@@ -486,7 +486,7 @@ func TestSuccessfulFindCommitsRequestWithAltGitObjectDirs(t *testing.T) {
 }
 
 func TestSuccessfulFindCommitsRequestWithAmbiguousRef(t *testing.T) {
-	_, repo, repoPath, client := setupCommitServiceWithRepo(t, false)
+	cfg, repo, repoPath, client := setupCommitServiceWithRepo(t, false)
 
 	// These are arbitrary SHAs in the repository. The important part is
 	// that we create a branch using one of them with a different SHA so
@@ -494,7 +494,7 @@ func TestSuccessfulFindCommitsRequestWithAmbiguousRef(t *testing.T) {
 	branchName := "1e292f8fedd741b75372e19097c76d327140c312"
 	commitSha := "6907208d755b60ebeacb2e9dfea74c92c3449a1f"
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "checkout", "-b", branchName, commitSha)
+	gittest.Exec(t, cfg, "-C", repoPath, "checkout", "-b", branchName, commitSha)
 
 	request := &gitalypb.FindCommitsRequest{
 		Repository: repo,
diff --git a/internal/gitaly/service/commit/isancestor_test.go b/internal/gitaly/service/commit/isancestor_test.go
index d1c4f63f9..27bcc08c9 100644
--- a/internal/gitaly/service/commit/isancestor_test.go
+++ b/internal/gitaly/service/commit/isancestor_test.go
@@ -164,7 +164,7 @@ func TestSuccessfulIsAncestorRequestWithAltGitObjectDirs(t *testing.T) {
 	committerName := "Scrooge McDuck"
 	committerEmail := "scrooge@mcduck.com"
 
-	previousHead := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "show", "--format=format:%H", "--no-patch", "HEAD")
+	previousHead := gittest.Exec(t, cfg, "-C", repoPath, "show", "--format=format:%H", "--no-patch", "HEAD")
 
 	cmd := exec.Command(cfg.Git.BinPath, "-C", repoPath,
 		"-c", fmt.Sprintf("user.name=%s", committerName),
diff --git a/internal/gitaly/service/commit/list_last_commits_for_tree_test.go b/internal/gitaly/service/commit/list_last_commits_for_tree_test.go
index b0c102191..9251b9385 100644
--- a/internal/gitaly/service/commit/list_last_commits_for_tree_test.go
+++ b/internal/gitaly/service/commit/list_last_commits_for_tree_test.go
@@ -351,17 +351,17 @@ func TestNonUtf8ListLastCommitsForTreeRequest(t *testing.T) {
 }
 
 func TestSuccessfulListLastCommitsForTreeRequestWithGlobCharacters(t *testing.T) {
-	_, repo, repoPath, client := setupCommitServiceWithRepo(t, false)
+	cfg, repo, repoPath, client := setupCommitServiceWithRepo(t, false)
 
 	path := ":wq"
 	err := os.Mkdir(filepath.Join(repoPath, path), 0755)
 	require.NoError(t, err)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "testhelper.TestUser.name", "test@example.com")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "testhelper.TestUser.email", "test@example.com")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "mv", "README.md", path)
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "commit", "-a", "-m", "renamed test file")
-	commitID := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "HEAD"))
+	gittest.Exec(t, cfg, "-C", repoPath, "config", "testhelper.TestUser.name", "test@example.com")
+	gittest.Exec(t, cfg, "-C", repoPath, "config", "testhelper.TestUser.email", "test@example.com")
+	gittest.Exec(t, cfg, "-C", repoPath, "mv", "README.md", path)
+	gittest.Exec(t, cfg, "-C", repoPath, "commit", "-a", "-m", "renamed test file")
+	commitID := text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "HEAD"))
 
 	request := &gitalypb.ListLastCommitsForTreeRequest{
 		Repository:    repo,
diff --git a/internal/gitaly/service/commit/tree_entries_test.go b/internal/gitaly/service/commit/tree_entries_test.go
index 47f4dddee..fb3db1e1f 100644
--- a/internal/gitaly/service/commit/tree_entries_test.go
+++ b/internal/gitaly/service/commit/tree_entries_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -16,7 +17,7 @@ import (
 )
 
 func TestSuccessfulGetTreeEntriesWithCurlyBraces(t *testing.T) {
-	_, repo, repoPath, client := setupCommitServiceWithRepo(t, false)
+	cfg, repo, repoPath, client := setupCommitServiceWithRepo(t, false)
 
 	normalFolderName := "issue-46261/folder"
 	curlyFolderName := "issue-46261/{{curly}}"
@@ -29,8 +30,8 @@ func TestSuccessfulGetTreeEntriesWithCurlyBraces(t *testing.T) {
 	testhelper.MustRunCommand(t, nil, "touch", filepath.Join(normalFolder, "/test1.txt"))
 	testhelper.MustRunCommand(t, nil, "touch", filepath.Join(curlyFolder, "/test2.txt"))
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "add", "--all")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "commit", "-m", "Test commit")
+	gittest.Exec(t, cfg, "-C", repoPath, "add", "--all")
+	gittest.Exec(t, cfg, "-C", repoPath, "commit", "-m", "Test commit")
 
 	testCases := []struct {
 		description string
@@ -394,7 +395,7 @@ func getTreeEntriesFromTreeEntryClient(t *testing.T, client gitalypb.CommitServi
 }
 
 func TestSuccessfulGetTreeEntries_FlatPathMaxDeep_SingleFoldersStructure(t *testing.T) {
-	_, repo, repoPath, client := setupCommitServiceWithRepo(t, false)
+	cfg, repo, repoPath, client := setupCommitServiceWithRepo(t, false)
 
 	folderName := "1/2/3/4/5/6/7/8/9/10/11/12"
 	require.GreaterOrEqual(t, strings.Count(strings.Trim(folderName, "/"), "/"), defaultFlatTreeRecursion, "sanity check: construct folder deeper than default recursion value")
@@ -403,11 +404,11 @@ func TestSuccessfulGetTreeEntries_FlatPathMaxDeep_SingleFoldersStructure(t *test
 	require.NoError(t, os.MkdirAll(nestedFolder, 0755))
 	// put single file into the deepest directory
 	testhelper.MustRunCommand(t, nil, "touch", filepath.Join(nestedFolder, ".gitkeep"))
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "add", "--all")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "commit", "-m", "Deep folder struct")
+	gittest.Exec(t, cfg, "-C", repoPath, "add", "--all")
+	gittest.Exec(t, cfg, "-C", repoPath, "commit", "-m", "Deep folder struct")
 
-	commitID := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "HEAD"))
-	rootOid := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "HEAD^{tree}"))
+	commitID := text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "HEAD"))
+	rootOid := text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "HEAD^{tree}"))
 
 	// make request to folder that contains nothing except one folder
 	request := &gitalypb.GetTreeEntriesRequest{
diff --git a/internal/gitaly/service/conflicts/list_conflict_files_test.go b/internal/gitaly/service/conflicts/list_conflict_files_test.go
index 6ca9ffe65..54c138850 100644
--- a/internal/gitaly/service/conflicts/list_conflict_files_test.go
+++ b/internal/gitaly/service/conflicts/list_conflict_files_test.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/git/localrepo"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
@@ -184,15 +185,15 @@ func buildCommit(t *testing.T, ctx context.Context, cfg config.Cfg, repo *gitaly
 	for file, contents := range files {
 		filePath := filepath.Join(repoPath, file)
 		require.NoError(t, ioutil.WriteFile(filePath, contents, 0666))
-		testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "add", filePath)
+		gittest.Exec(t, cfg, "-C", repoPath, "add", filePath)
 	}
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "commit", "-m", "message")
+	gittest.Exec(t, cfg, "-C", repoPath, "commit", "-m", "message")
 
 	oid, err := localrepo.NewTestRepo(t, cfg, repo).ResolveRevision(ctx, git.Revision("HEAD"))
 	require.NoError(t, err)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "reset", "--hard", "HEAD~")
+	gittest.Exec(t, cfg, "-C", repoPath, "reset", "--hard", "HEAD~")
 
 	return oid.String()
 }
diff --git a/internal/gitaly/service/conflicts/resolve_conflicts_test.go b/internal/gitaly/service/conflicts/resolve_conflicts_test.go
index 5144bc518..939a59d17 100644
--- a/internal/gitaly/service/conflicts/resolve_conflicts_test.go
+++ b/internal/gitaly/service/conflicts/resolve_conflicts_test.go
@@ -103,24 +103,19 @@ func TestSuccessfulResolveConflictsRequest(t *testing.T) {
 	commitConflict := func(parentCommitID, branch, blob string) string {
 		blobID, err := repo.WriteBlob(ctx, "", strings.NewReader(blob))
 		require.NoError(t, err)
-		testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "read-tree", branch)
-		testhelper.MustRunCommand(t, nil,
-			"git", "-C", repoPath,
+		gittest.Exec(t, cfg, "-C", repoPath, "read-tree", branch)
+		gittest.Exec(t, cfg, "-C", repoPath,
 			"update-index", "--add", "--cacheinfo", "100644", blobID.String(), missingAncestorPath,
 		)
 		treeID := bytes.TrimSpace(
-			testhelper.MustRunCommand(t, nil,
-				"git", "-C", repoPath, "write-tree",
-			),
+			gittest.Exec(t, cfg, "-C", repoPath, "write-tree"),
 		)
 		commitID := bytes.TrimSpace(
-			testhelper.MustRunCommand(t, nil,
-				"git", "-C", repoPath,
+			gittest.Exec(t, cfg, "-C", repoPath,
 				"commit-tree", string(treeID), "-p", parentCommitID,
 			),
 		)
-		testhelper.MustRunCommand(t, nil,
-			"git", "-C", repoPath, "update-ref", "refs/heads/"+branch, string(commitID))
+		gittest.Exec(t, cfg, "-C", repoPath, "update-ref", "refs/heads/"+branch, string(commitID))
 		return string(commitID)
 	}
 
@@ -190,7 +185,7 @@ func TestResolveConflictsWithRemoteRepo(t *testing.T) {
 			Path: "file.txt", OID: sourceBlobOID, Mode: "100644",
 		}),
 	)
-	testhelper.MustRunCommand(t, nil, "git", "-C", sourceRepoPath, "update-ref", "refs/heads/source", sourceCommitOID.String())
+	gittest.Exec(t, cfg, "-C", sourceRepoPath, "update-ref", "refs/heads/source", sourceCommitOID.String())
 
 	targetRepo, targetRepoPath, cleanup := gittest.CloneRepoAtStorage(t, cfg.Storages[0], "target")
 	t.Cleanup(cleanup)
@@ -200,7 +195,7 @@ func TestResolveConflictsWithRemoteRepo(t *testing.T) {
 			OID: targetBlobOID, Path: "file.txt", Mode: "100644",
 		}),
 	)
-	testhelper.MustRunCommand(t, nil, "git", "-C", targetRepoPath, "update-ref", "refs/heads/target", targetCommitOID.String())
+	gittest.Exec(t, cfg, "-C", targetRepoPath, "update-ref", "refs/heads/target", targetCommitOID.String())
 
 	ctx, cancel := testhelper.Context()
 	defer cancel()
@@ -244,7 +239,7 @@ func TestResolveConflictsWithRemoteRepo(t *testing.T) {
 	require.NoError(t, err)
 	require.Empty(t, response.GetResolutionError())
 
-	require.Equal(t, []byte("contents-2\n"), testhelper.MustRunCommand(t, nil, "git", "-C", sourceRepoPath, "cat-file", "-p", "refs/heads/source:file.txt"))
+	require.Equal(t, []byte("contents-2\n"), gittest.Exec(t, cfg, "-C", sourceRepoPath, "cat-file", "-p", "refs/heads/source:file.txt"))
 }
 
 func TestResolveConflictsLineEndings(t *testing.T) {
@@ -321,7 +316,7 @@ func TestResolveConflictsLineEndings(t *testing.T) {
 					OID: ourOID, Path: "file.txt", Mode: "100644",
 				}),
 			)
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", "refs/heads/ours", ourCommit.String())
+			gittest.Exec(t, cfg, "-C", repoPath, "update-ref", "refs/heads/ours", ourCommit.String())
 
 			theirOID := gittest.WriteBlob(t, cfg, repoPath, []byte(tc.theirContent))
 			theirCommit := gittest.WriteCommit(t, cfg, repoPath,
@@ -329,7 +324,7 @@ func TestResolveConflictsLineEndings(t *testing.T) {
 					OID: theirOID, Path: "file.txt", Mode: "100644",
 				}),
 			)
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", "refs/heads/theirs", theirCommit.String())
+			gittest.Exec(t, cfg, "-C", repoPath, "update-ref", "refs/heads/theirs", theirCommit.String())
 
 			stream, err := client.ResolveConflicts(ctx)
 			require.NoError(t, err)
@@ -361,8 +356,8 @@ func TestResolveConflictsLineEndings(t *testing.T) {
 			require.NoError(t, err)
 			require.Empty(t, response.GetResolutionError())
 
-			require.Equal(t, []byte(tc.expectedContents), testhelper.MustRunCommand(t, nil,
-				"git", "-C", repoPath, "cat-file", "-p", "refs/heads/ours:file.txt"))
+			oursFile := gittest.Exec(t, cfg, "-C", repoPath, "cat-file", "-p", "refs/heads/ours:file.txt")
+			require.Equal(t, []byte(tc.expectedContents), oursFile)
 		})
 	}
 }
@@ -428,7 +423,7 @@ func TestResolveConflictsIdenticalContent(t *testing.T) {
 		"6907208d755b60ebeacb2e9dfea74c92c3449a1f",
 		targetOID.String(),
 	} {
-		contents := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "cat-file", "-p", rev+":files/ruby/popen.rb")
+		contents := gittest.Exec(t, cfg, "-C", repoPath, "cat-file", "-p", rev+":files/ruby/popen.rb")
 		path := filepath.Join(tempDir, rev)
 		require.NoError(t, ioutil.WriteFile(path, contents, 0644))
 		conflictingPaths = append(conflictingPaths, path)
diff --git a/internal/gitaly/service/diff/commit_test.go b/internal/gitaly/service/diff/commit_test.go
index 6b9a4467a..484c2fac1 100644
--- a/internal/gitaly/service/diff/commit_test.go
+++ b/internal/gitaly/service/diff/commit_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/diff"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -15,7 +16,7 @@ import (
 )
 
 func TestSuccessfulCommitDiffRequest(t *testing.T) {
-	_, repo, repoPath, client := setupDiffService(t)
+	cfg, repo, repoPath, client := setupDiffService(t)
 
 	rightCommit := "ab2c9622c02288a2bbaaf35d96088cfdff31d9d9"
 	leftCommit := "8a0f2ee90d940bfb0ba1e14e8214b0649056e4ab"
@@ -169,7 +170,7 @@ func TestSuccessfulCommitDiffRequest(t *testing.T) {
 
 	for _, testCase := range testCases {
 		t.Run(testCase.desc, func(t *testing.T) {
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "diff.noprefix", testCase.noPrefixConfig)
+			gittest.Exec(t, cfg, "-C", repoPath, "config", "diff.noprefix", testCase.noPrefixConfig)
 			rpcRequest := &gitalypb.CommitDiffRequest{Repository: repo, RightCommitId: rightCommit, LeftCommitId: leftCommit, IgnoreWhitespaceChange: false}
 
 			ctx, cancel := testhelper.Context()
@@ -399,13 +400,13 @@ func TestSuccessfulCommitDiffRequestWithIgnoreWhitespaceChange(t *testing.T) {
 }
 
 func TestSuccessfulCommitDiffRequestWithWordDiff(t *testing.T) {
-	_, repo, repoPath, client := setupDiffService(t)
+	cfg, repo, repoPath, client := setupDiffService(t)
 
 	rightCommit := "ab2c9622c02288a2bbaaf35d96088cfdff31d9d9"
 	leftCommit := "8a0f2ee90d940bfb0ba1e14e8214b0649056e4ab"
 
 	var diffPatches [][]byte
-	output := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "diff", "--word-diff=porcelain", leftCommit, rightCommit)
+	output := gittest.Exec(t, cfg, "-C", repoPath, "diff", "--word-diff=porcelain", leftCommit, rightCommit)
 	diffPerFile := bytes.Split(output, []byte("diff --git"))
 
 	for _, s := range diffPerFile {
@@ -564,7 +565,7 @@ func TestSuccessfulCommitDiffRequestWithWordDiff(t *testing.T) {
 
 	for _, testCase := range testCases {
 		t.Run(testCase.desc, func(t *testing.T) {
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "diff.noprefix", testCase.noPrefixConfig)
+			gittest.Exec(t, cfg, "-C", repoPath, "config", "diff.noprefix", testCase.noPrefixConfig)
 			rpcRequest := &gitalypb.CommitDiffRequest{
 				Repository:             repo,
 				RightCommitId:          rightCommit,
diff --git a/internal/gitaly/service/diff/raw_test.go b/internal/gitaly/service/diff/raw_test.go
index 6c9214f37..9bbb8ea5d 100644
--- a/internal/gitaly/service/diff/raw_test.go
+++ b/internal/gitaly/service/diff/raw_test.go
@@ -15,7 +15,7 @@ import (
 )
 
 func TestSuccessfulRawDiffRequest(t *testing.T) {
-	_, repo, repoPath, client := setupDiffService(t)
+	cfg, repo, repoPath, client := setupDiffService(t)
 
 	ctx, cancel := testhelper.Context()
 	defer cancel()
@@ -37,17 +37,17 @@ func TestSuccessfulRawDiffRequest(t *testing.T) {
 
 	committerName := "Scrooge McDuck"
 	committerEmail := "scrooge@mcduck.com"
-	testhelper.MustRunCommand(t, nil, "git", "-C", sandboxRepoPath, "reset", "--hard", leftCommit)
+	gittest.Exec(t, cfg, "-C", sandboxRepoPath, "reset", "--hard", leftCommit)
 
-	testhelper.MustRunCommand(t, reader, "git", "-C", sandboxRepoPath, "apply")
-	testhelper.MustRunCommand(t, reader, "git", "-C", sandboxRepoPath, "add", ".")
-	testhelper.MustRunCommand(t, nil, "git", "-C", sandboxRepoPath,
+	gittest.ExecStream(t, cfg, reader, "-C", sandboxRepoPath, "apply")
+	gittest.ExecStream(t, cfg, reader, "-C", sandboxRepoPath, "add", ".")
+	gittest.Exec(t, cfg, "-C", sandboxRepoPath,
 		"-c", fmt.Sprintf("user.name=%s", committerName),
 		"-c", fmt.Sprintf("user.email=%s", committerEmail),
 		"commit", "-m", "Applying received raw diff")
 
-	expectedTreeStructure := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "ls-tree", "-r", rightCommit)
-	actualTreeStructure := testhelper.MustRunCommand(t, nil, "git", "-C", sandboxRepoPath, "ls-tree", "-r", "HEAD")
+	expectedTreeStructure := gittest.Exec(t, cfg, "-C", repoPath, "ls-tree", "-r", rightCommit)
+	actualTreeStructure := gittest.Exec(t, cfg, "-C", sandboxRepoPath, "ls-tree", "-r", "HEAD")
 	require.Equal(t, expectedTreeStructure, actualTreeStructure)
 }
 
@@ -100,7 +100,7 @@ func TestFailedRawDiffRequestDueToValidations(t *testing.T) {
 }
 
 func TestSuccessfulRawPatchRequest(t *testing.T) {
-	_, repo, repoPath, client := setupDiffService(t)
+	cfg, repo, repoPath, client := setupDiffService(t)
 
 	ctx, cancel := testhelper.Context()
 	defer cancel()
@@ -120,12 +120,12 @@ func TestSuccessfulRawPatchRequest(t *testing.T) {
 	_, sandboxRepoPath, cleanupFn := gittest.CloneRepoWithWorktree(t)
 	defer cleanupFn()
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", sandboxRepoPath, "reset", "--hard", leftCommit)
+	gittest.Exec(t, cfg, "-C", sandboxRepoPath, "reset", "--hard", leftCommit)
 
-	testhelper.MustRunCommand(t, reader, "git", "-C", sandboxRepoPath, "am")
+	gittest.ExecStream(t, cfg, reader, "-C", sandboxRepoPath, "am")
 
-	expectedTreeStructure := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "ls-tree", "-r", rightCommit)
-	actualTreeStructure := testhelper.MustRunCommand(t, nil, "git", "-C", sandboxRepoPath, "ls-tree", "-r", "HEAD")
+	expectedTreeStructure := gittest.Exec(t, cfg, "-C", repoPath, "ls-tree", "-r", rightCommit)
+	actualTreeStructure := gittest.Exec(t, cfg, "-C", sandboxRepoPath, "ls-tree", "-r", "HEAD")
 	require.Equal(t, expectedTreeStructure, actualTreeStructure)
 }
 
diff --git a/internal/gitaly/service/hook/pack_objects_test.go b/internal/gitaly/service/hook/pack_objects_test.go
index 3c51806b0..5e21cbfe9 100644
--- a/internal/gitaly/service/hook/pack_objects_test.go
+++ b/internal/gitaly/service/hook/pack_objects_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/streamcache"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
@@ -108,10 +109,11 @@ func TestServer_PackObjectsHook(t *testing.T) {
 			}
 			require.Equal(t, io.EOF, err)
 
-			testhelper.MustRunCommand(
+			gittest.ExecStream(
 				t,
+				cfg,
 				bytes.NewReader(stdout),
-				"git", "-C", repoPath, "index-pack", "--stdin", "--fix-thin",
+				"-C", repoPath, "index-pack", "--stdin", "--fix-thin",
 			)
 
 			for _, msg := range []string{"served bytes", "generated bytes"} {
@@ -215,10 +217,11 @@ func TestServer_PackObjectsHook_separateContext(t *testing.T) {
 	}
 	require.Equal(t, io.EOF, err)
 
-	testhelper.MustRunCommand(
+	gittest.ExecStream(
 		t,
+		cfg,
 		bytes.NewReader(stdout),
-		"git", "-C", repoPath, "index-pack", "--stdin", "--fix-thin",
+		"-C", repoPath, "index-pack", "--stdin", "--fix-thin",
 	)
 }
 
@@ -259,10 +262,11 @@ func TestServer_PackObjectsHook_usesCache(t *testing.T) {
 		}
 		require.Equal(t, io.EOF, err)
 
-		testhelper.MustRunCommand(
+		gittest.ExecStream(
 			t,
+			cfg,
 			bytes.NewReader(stdout),
-			"git", "-C", repoPath, "index-pack", "--stdin", "--fix-thin",
+			"-C", repoPath, "index-pack", "--stdin", "--fix-thin",
 		)
 	}
 
diff --git a/internal/gitaly/service/objectpool/alternates_test.go b/internal/gitaly/service/objectpool/alternates_test.go
index b32042513..be492b907 100644
--- a/internal/gitaly/service/objectpool/alternates_test.go
+++ b/internal/gitaly/service/objectpool/alternates_test.go
@@ -29,7 +29,7 @@ func TestDisconnectGitAlternates(t *testing.T) {
 
 	require.NoError(t, pool.Create(ctx, repo))
 	require.NoError(t, pool.Link(ctx, repo))
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "gc")
+	gittest.Exec(t, cfg, "-C", repoPath, "gc")
 
 	existingObjectID := "55bc176024cfa3baaceb71db584c7e5df900ea65"
 
@@ -56,11 +56,11 @@ func TestDisconnectGitAlternates(t *testing.T) {
 	// objects/info/alternates is gone. This is the purpose of
 	// DisconnectGitAlternates.
 	testhelper.AssertPathNotExists(t, altPath)
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "cat-file", "-e", existingObjectID)
+	gittest.Exec(t, cfg, "-C", repoPath, "cat-file", "-e", existingObjectID)
 }
 
 func TestDisconnectGitAlternatesNoAlternates(t *testing.T) {
-	_, repo, repoPath, locator, client := setup(t)
+	cfg, repo, repoPath, locator, client := setup(t)
 
 	ctx, cancel := testhelper.Context()
 	defer cancel()
@@ -72,7 +72,7 @@ func TestDisconnectGitAlternatesNoAlternates(t *testing.T) {
 	_, err = client.DisconnectGitAlternates(ctx, &gitalypb.DisconnectGitAlternatesRequest{Repository: repo})
 	require.NoError(t, err, "call DisconnectGitAlternates on repository without alternates")
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "fsck")
+	gittest.Exec(t, cfg, "-C", repoPath, "fsck")
 }
 
 func TestDisconnectGitAlternatesUnexpectedAlternates(t *testing.T) {
diff --git a/internal/gitaly/service/objectpool/create_test.go b/internal/gitaly/service/objectpool/create_test.go
index 52fa7ddca..82674ac4f 100644
--- a/internal/gitaly/service/objectpool/create_test.go
+++ b/internal/gitaly/service/objectpool/create_test.go
@@ -45,7 +45,7 @@ func TestCreate(t *testing.T) {
 	assert.True(t, os.IsNotExist(err))
 
 	// No problems
-	out := testhelper.MustRunCommand(t, nil, "git", "-C", pool.FullPath(), "cat-file", "-s", "55bc176024cfa3baaceb71db584c7e5df900ea65")
+	out := gittest.Exec(t, cfg, "-C", pool.FullPath(), "cat-file", "-s", "55bc176024cfa3baaceb71db584c7e5df900ea65")
 	assert.Equal(t, "282\n", string(out))
 
 	// Making the same request twice, should result in an error
diff --git a/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go b/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go
index 5cf5a65b4..252b633e7 100644
--- a/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go
+++ b/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go
@@ -55,13 +55,13 @@ func TestFetchIntoObjectPool_Success(t *testing.T) {
 	require.True(t, pool.IsValid(), "ensure underlying repository is valid")
 
 	// No problems
-	testhelper.MustRunCommand(t, nil, "git", "-C", pool.FullPath(), "fsck")
+	gittest.Exec(t, cfg, "-C", pool.FullPath(), "fsck")
 
 	packFiles, err := filepath.Glob(filepath.Join(pool.FullPath(), "objects", "pack", "pack-*.pack"))
 	require.NoError(t, err)
 	require.Len(t, packFiles, 1, "ensure commits got packed")
 
-	packContents := testhelper.MustRunCommand(t, nil, "git", "-C", pool.FullPath(), "verify-pack", "-v", packFiles[0])
+	packContents := gittest.Exec(t, cfg, "-C", pool.FullPath(), "verify-pack", "-v", packFiles[0])
 	require.Contains(t, string(packContents), repoCommit)
 
 	_, err = client.FetchIntoObjectPool(ctx, req)
diff --git a/internal/gitaly/service/objectpool/reduplicate_test.go b/internal/gitaly/service/objectpool/reduplicate_test.go
index 42abc62ea..abc928033 100644
--- a/internal/gitaly/service/objectpool/reduplicate_test.go
+++ b/internal/gitaly/service/objectpool/reduplicate_test.go
@@ -27,7 +27,7 @@ func TestReduplicate(t *testing.T) {
 	require.NoError(t, pool.Create(ctx, repo))
 	require.NoError(t, pool.Link(ctx, repo))
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "gc")
+	gittest.Exec(t, cfg, "-C", repoPath, "gc")
 
 	existingObjectID := "55bc176024cfa3baaceb71db584c7e5df900ea65"
 
@@ -47,5 +47,5 @@ func TestReduplicate(t *testing.T) {
 	require.NoError(t, err)
 
 	require.NoError(t, pool.Unlink(ctx, repo))
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "cat-file", "-e", existingObjectID)
+	gittest.Exec(t, cfg, "-C", repoPath, "cat-file", "-e", existingObjectID)
 }
diff --git a/internal/gitaly/service/operations/apply_patch_test.go b/internal/gitaly/service/operations/apply_patch_test.go
index 513fe989c..bb887b893 100644
--- a/internal/gitaly/service/operations/apply_patch_test.go
+++ b/internal/gitaly/service/operations/apply_patch_test.go
@@ -95,7 +95,7 @@ func testSuccessfulUserApplyPatch(t *testing.T, cfg config.Cfg, rubySrv *rubyser
 			response.GetBranchUpdate()
 			require.Equal(t, testCase.branchCreated, response.GetBranchUpdate().GetBranchCreated())
 
-			branches := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch")
+			branches := gittest.Exec(t, cfg, "-C", repoPath, "branch")
 			require.Contains(t, string(branches), testCase.branchName)
 
 			maxCount := fmt.Sprintf("--max-count=%d", len(testCase.commitMessages))
@@ -110,7 +110,7 @@ func testSuccessfulUserApplyPatch(t *testing.T, cfg config.Cfg, rubySrv *rubyser
 				"--reverse",
 			}
 
-			output := testhelper.MustRunCommand(t, nil, "git", gitArgs...)
+			output := gittest.Exec(t, cfg, gitArgs...)
 			shas := strings.Split(string(output), "\n")
 			// Throw away the last element, as that's going to be
 			// an empty string.
diff --git a/internal/gitaly/service/operations/branches_test.go b/internal/gitaly/service/operations/branches_test.go
index 9bcc0fba3..ec6b15056 100644
--- a/internal/gitaly/service/operations/branches_test.go
+++ b/internal/gitaly/service/operations/branches_test.go
@@ -102,14 +102,14 @@ func TestSuccessfulCreateBranchRequest(t *testing.T) {
 
 			response, err := client.UserCreateBranch(ctx, request)
 			if testCase.expectedBranch != nil {
-				defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "-D", branchName)
+				defer gittest.Exec(t, cfg, "-C", repoPath, "branch", "-D", branchName)
 			}
 
 			require.NoError(t, err)
 			require.Equal(t, testCase.expectedBranch, response.Branch)
 			require.Empty(t, response.PreReceiveError)
 
-			branches := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "for-each-ref", "--", "refs/heads/"+branchName)
+			branches := gittest.Exec(t, cfg, "-C", repoPath, "for-each-ref", "--", "refs/heads/"+branchName)
 			require.Contains(t, string(branches), "refs/heads/"+branchName)
 		})
 	}
@@ -174,7 +174,7 @@ func TestUserCreateBranchWithTransaction(t *testing.T) {
 
 	for _, tc := range testcases {
 		t.Run(tc.desc, func(t *testing.T) {
-			defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "-D", "new-branch")
+			defer gittest.Exec(t, cfg, "-C", repoPath, "branch", "-D", "new-branch")
 
 			ctx, cancel := testhelper.Context()
 			defer cancel()
@@ -219,7 +219,7 @@ func TestSuccessfulGitHooksForUserCreateBranchRequest(t *testing.T) {
 }
 
 func testSuccessfulGitHooksForUserCreateBranchRequest(t *testing.T, ctx context.Context) {
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	branchName := "new-branch"
 	request := &gitalypb.UserCreateBranchRequest{
@@ -231,7 +231,7 @@ func testSuccessfulGitHooksForUserCreateBranchRequest(t *testing.T, ctx context.
 
 	for _, hookName := range GitlabHooks {
 		t.Run(hookName, func(t *testing.T) {
-			defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "-D", branchName)
+			defer gittest.Exec(t, cfg, "-C", repoPath, "branch", "-D", branchName)
 
 			hookOutputTempPath := gittest.WriteEnvToCustomHook(t, repoPath, hookName)
 
@@ -283,7 +283,7 @@ func TestSuccessfulCreateBranchRequestWithStartPointRefPrefix(t *testing.T) {
 
 	for _, testCase := range testCases {
 		t.Run(testCase.desc, func(t *testing.T) {
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", "refs/heads/"+testCase.startPoint,
+			gittest.Exec(t, cfg, "-C", repoPath, "update-ref", "refs/heads/"+testCase.startPoint,
 				testCase.startPointCommit,
 				git.ZeroOID.String(),
 			)
@@ -312,7 +312,7 @@ func TestSuccessfulCreateBranchRequestWithStartPointRefPrefix(t *testing.T) {
 				},
 			}
 			require.Equal(t, responseOk, response)
-			branches := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "for-each-ref", "--", "refs/heads/"+testCase.branchName)
+			branches := gittest.Exec(t, cfg, "-C", repoPath, "for-each-ref", "--", "refs/heads/"+testCase.branchName)
 			require.Contains(t, string(branches), "refs/heads/"+testCase.branchName)
 		})
 	}
@@ -410,7 +410,7 @@ func TestSuccessfulUserDeleteBranchRequest(t *testing.T) {
 }
 
 func testSuccessfulUserDeleteBranchRequest(t *testing.T, ctx context.Context) {
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	testCases := []struct {
 		desc            string
@@ -445,7 +445,7 @@ func testSuccessfulUserDeleteBranchRequest(t *testing.T, ctx context.Context) {
 
 	for _, testCase := range testCases {
 		t.Run(testCase.desc, func(t *testing.T) {
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", testCase.branchNameInput, testCase.branchCommit)
+			gittest.Exec(t, cfg, "-C", repoPath, "branch", testCase.branchNameInput, testCase.branchCommit)
 
 			response, err := client.UserDeleteBranch(ctx, &gitalypb.UserDeleteBranchRequest{
 				Repository: repo,
@@ -455,7 +455,7 @@ func testSuccessfulUserDeleteBranchRequest(t *testing.T, ctx context.Context) {
 			require.NoError(t, err)
 			testhelper.ProtoEqual(t, testCase.response, response)
 
-			refs := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "for-each-ref", "--", "refs/heads/"+testCase.branchNameInput)
+			refs := gittest.Exec(t, cfg, "-C", repoPath, "for-each-ref", "--", "refs/heads/"+testCase.branchNameInput)
 			require.NotContains(t, string(refs), testCase.branchCommit, "branch deleted from refs")
 		})
 	}
@@ -465,7 +465,7 @@ func TestSuccessfulGitHooksForUserDeleteBranchRequest(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	branchNameInput := "to-be-deleted-soon-branch"
 
@@ -477,7 +477,7 @@ func TestSuccessfulGitHooksForUserDeleteBranchRequest(t *testing.T) {
 
 	for _, hookName := range GitlabHooks {
 		t.Run(hookName, func(t *testing.T) {
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", branchNameInput)
+			gittest.Exec(t, cfg, "-C", repoPath, "branch", branchNameInput)
 
 			hookOutputTempPath := gittest.WriteEnvToCustomHook(t, repoPath, hookName)
 
@@ -498,9 +498,9 @@ func TestUserDeleteBranch_transaction(t *testing.T) {
 	// delete the packed-refs reference, and one to delete the loose ref. But given that we want
 	// to be independent of how well-packed refs are, we expect to get a single transactional
 	// vote, only.
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", "refs/heads/delete-me", "master~")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "pack-refs", "--all")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", "refs/heads/delete-me", "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "update-ref", "refs/heads/delete-me", "master~")
+	gittest.Exec(t, cfg, "-C", repoPath, "pack-refs", "--all")
+	gittest.Exec(t, cfg, "-C", repoPath, "update-ref", "refs/heads/delete-me", "master")
 
 	transactionServer := &testTransactionServer{}
 
@@ -605,10 +605,10 @@ func TestFailedUserDeleteBranchDueToHooks(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	branchNameInput := "to-be-deleted-soon-branch"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", branchNameInput)
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", branchNameInput)
 
 	request := &gitalypb.UserDeleteBranchRequest{
 		Repository: repo,
@@ -626,7 +626,7 @@ func TestFailedUserDeleteBranchDueToHooks(t *testing.T) {
 			require.NoError(t, err)
 			require.Contains(t, response.PreReceiveError, "GL_ID="+testhelper.TestUser.GlId)
 
-			branches := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "for-each-ref", "--", "refs/heads/"+branchNameInput)
+			branches := gittest.Exec(t, cfg, "-C", repoPath, "for-each-ref", "--", "refs/heads/"+branchNameInput)
 			require.Contains(t, string(branches), branchNameInput, "branch name does not exist in branches list")
 		})
 	}
@@ -636,7 +636,7 @@ func TestBranchHookOutput(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	testCases := []struct {
 		desc        string
@@ -697,8 +697,8 @@ func TestBranchHookOutput(t *testing.T) {
 				require.NoError(t, err)
 				require.Equal(t, testCase.output, createResponse.PreReceiveError)
 
-				testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", branchNameInput)
-				defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "-d", branchNameInput)
+				gittest.Exec(t, cfg, "-C", repoPath, "branch", branchNameInput)
+				defer gittest.Exec(t, cfg, "-C", repoPath, "branch", "-d", branchNameInput)
 
 				deleteResponse, err := client.UserDeleteBranch(ctx, deleteRequest)
 				require.NoError(t, err)
diff --git a/internal/gitaly/service/operations/cherry_pick_test.go b/internal/gitaly/service/operations/cherry_pick_test.go
index 5c8fcbb3d..60292ebb1 100644
--- a/internal/gitaly/service/operations/cherry_pick_test.go
+++ b/internal/gitaly/service/operations/cherry_pick_test.go
@@ -23,7 +23,7 @@ func TestServer_UserCherryPick_successful(t *testing.T) {
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	destinationBranch := "cherry-picking-dst"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, "master")
 
 	masterHeadCommit, err := repo.ReadCommit(ctx, "master")
 	require.NoError(t, err)
@@ -34,7 +34,7 @@ func TestServer_UserCherryPick_successful(t *testing.T) {
 	testRepoCopy, testRepoCopyPath, cleanup := gittest.CloneRepoAtStorage(t, cfg.Storages[0], "read-only") // read-only repo
 	defer cleanup()
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", testRepoCopyPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", testRepoCopyPath, "branch", destinationBranch, "master")
 
 	testCases := []struct {
 		desc         string
@@ -178,7 +178,7 @@ func TestServer_UserCherryPick_successfulGitHooks(t *testing.T) {
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	destinationBranch := "cherry-picking-dst"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, "master")
 
 	cherryPickedCommit, err := repo.ReadCommit(ctx, "8a0f2ee90d940bfb0ba1e14e8214b0649056e4ab")
 	require.NoError(t, err)
@@ -216,7 +216,7 @@ func TestServer_UserCherryPick_stableID(t *testing.T) {
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	destinationBranch := "cherry-picking-dst"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, "master")
 
 	commitToPick, err := repo.ReadCommit(ctx, "8a0f2ee90d940bfb0ba1e14e8214b0649056e4ab")
 	require.NoError(t, err)
@@ -344,7 +344,7 @@ func TestServer_UserCherryPick_failedWithPreReceiveError(t *testing.T) {
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	destinationBranch := "cherry-picking-dst"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, "master")
 
 	cherryPickedCommit, err := repo.ReadCommit(ctx, "8a0f2ee90d940bfb0ba1e14e8214b0649056e4ab")
 	require.NoError(t, err)
@@ -379,7 +379,7 @@ func TestServer_UserCherryPick_failedWithCreateTreeError(t *testing.T) {
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	destinationBranch := "cherry-picking-dst"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, "master")
 
 	// This commit already exists in master
 	cherryPickedCommit, err := repo.ReadCommit(ctx, "4a24d82dbca5c11c61556f3b35ca472b7463187e")
@@ -409,8 +409,8 @@ func TestServer_UserCherryPick_failedWithCommitError(t *testing.T) {
 
 	sourceBranch := "cherry-pick-src"
 	destinationBranch := "cherry-picking-dst"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, "master")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", sourceBranch, "8a0f2ee90d940bfb0ba1e14e8214b0649056e4ab")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", sourceBranch, "8a0f2ee90d940bfb0ba1e14e8214b0649056e4ab")
 
 	cherryPickedCommit, err := repo.ReadCommit(ctx, git.Revision(sourceBranch))
 	require.NoError(t, err)
@@ -438,7 +438,7 @@ func TestServer_UserCherryPick_failedWithConflict(t *testing.T) {
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	destinationBranch := "cherry-picking-dst"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, "conflict_branch_a")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, "conflict_branch_a")
 
 	// This commit cannot be applied to the destinationBranch above
 	cherryPickedCommit, err := repo.ReadCommit(ctx, git.Revision("f0f390655872bb2772c85a0128b2fbc2d88670cb"))
@@ -482,7 +482,7 @@ func TestServer_UserCherryPick_successfulWithGivenCommits(t *testing.T) {
 		t.Run(testCase.desc, func(t *testing.T) {
 			destinationBranch := fmt.Sprintf("cherry-picking-%d", i)
 
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, testCase.startRevision.String())
+			gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, testCase.startRevision.String())
 
 			commit, err := repo.ReadCommit(ctx, testCase.cherryRevision)
 			require.NoError(t, err)
diff --git a/internal/gitaly/service/operations/commit_files_test.go b/internal/gitaly/service/operations/commit_files_test.go
index 454644d5d..b8c50a6a2 100644
--- a/internal/gitaly/service/operations/commit_files_test.go
+++ b/internal/gitaly/service/operations/commit_files_test.go
@@ -880,7 +880,7 @@ func TestUserCommitFiles(t *testing.T) {
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
 			defer os.RemoveAll(repoPath)
-			testhelper.MustRunCommand(t, nil, "git", "init", "--bare", repoPath)
+			gittest.Exec(t, cfg, "init", "--bare", repoPath)
 
 			const branch = "master"
 
@@ -1081,10 +1081,10 @@ func TestSuccessfulUserCommitFilesRequest(t *testing.T) {
 			require.Equal(t, testhelper.TestUser.Email, headCommit.Committer.Email)
 			require.Equal(t, commitFilesMessage, headCommit.Subject)
 
-			fileContent := testhelper.MustRunCommand(t, nil, "git", "-C", tc.repoPath, "show", headCommit.GetId()+":"+filePath)
+			fileContent := gittest.Exec(t, cfg, "-C", tc.repoPath, "show", headCommit.GetId()+":"+filePath)
 			require.Equal(t, "My content", string(fileContent))
 
-			commitInfo := testhelper.MustRunCommand(t, nil, "git", "-C", tc.repoPath, "show", headCommit.GetId())
+			commitInfo := gittest.Exec(t, cfg, "-C", tc.repoPath, "show", headCommit.GetId())
 			expectedFilemode := "100644"
 			if tc.executeFilemode {
 				expectedFilemode = "100755"
@@ -1119,7 +1119,7 @@ func TestSuccessfulUserCommitFilesRequestMove(t *testing.T) {
 			testRepo, testRepoPath, cleanupFn := gittest.CloneRepoAtStorage(t, cfg.Storages[0], t.Name())
 			defer cleanupFn()
 
-			origFileContent := testhelper.MustRunCommand(t, nil, "git", "-C", testRepoPath, "show", branchName+":"+previousFilePath)
+			origFileContent := gittest.Exec(t, cfg, "-C", testRepoPath, "show", branchName+":"+previousFilePath)
 			headerRequest := headerRequest(testRepo, testhelper.TestUser, branchName, commitFilesMessage)
 			setAuthorAndEmail(headerRequest, authorName, authorEmail)
 			actionsRequest1 := moveFileHeaderRequest(previousFilePath, filePath, tc.infer)
@@ -1140,7 +1140,7 @@ func TestSuccessfulUserCommitFilesRequestMove(t *testing.T) {
 			update := resp.GetBranchUpdate()
 			require.NotNil(t, update)
 
-			fileContent := testhelper.MustRunCommand(t, nil, "git", "-C", testRepoPath, "show", update.CommitId+":"+filePath)
+			fileContent := gittest.Exec(t, cfg, "-C", testRepoPath, "show", update.CommitId+":"+filePath)
 
 			if tc.infer {
 				require.Equal(t, string(origFileContent), string(fileContent))
@@ -1170,7 +1170,7 @@ func TestSuccessfulUserCommitFilesRequestForceCommit(t *testing.T) {
 	targetBranchCommit, err := repo.ReadCommit(ctx, git.Revision(targetBranchName))
 	require.NoError(t, err)
 
-	mergeBaseOut := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "merge-base", targetBranchCommit.Id, startBranchCommit.Id)
+	mergeBaseOut := gittest.Exec(t, cfg, "-C", repoPath, "merge-base", targetBranchCommit.Id, startBranchCommit.Id)
 	mergeBaseID := text.ChompBytes(mergeBaseOut)
 	require.NotEqual(t, mergeBaseID, targetBranchCommit.Id, "expected %s not to be an ancestor of %s", targetBranchCommit.Id, startBranchCommit.Id)
 
diff --git a/internal/gitaly/service/operations/merge_test.go b/internal/gitaly/service/operations/merge_test.go
index 6ed8770be..13ac8916c 100644
--- a/internal/gitaly/service/operations/merge_test.go
+++ b/internal/gitaly/service/operations/merge_test.go
@@ -51,7 +51,7 @@ func TestSuccessfulMerge(t *testing.T) {
 	mergeBidi, err := client.UserMergeBranch(ctx)
 	require.NoError(t, err)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
 
 	hooks := GitlabHooks
 	hookTempfiles := make([]string, len(hooks))
@@ -133,7 +133,7 @@ func TestSuccessfulMerge_stableMergeIDs(t *testing.T) {
 	mergeBidi, err := client.UserMergeBranch(ctx)
 	require.NoError(t, err)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
 
 	firstRequest := &gitalypb.UserMergeBranchRequest{
 		Repository: repoProto,
@@ -199,7 +199,7 @@ func TestAbortedMerge(t *testing.T) {
 
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
 
 	firstRequest := &gitalypb.UserMergeBranchRequest{
 		Repository: repoProto,
@@ -265,7 +265,7 @@ func TestFailedMergeConcurrentUpdate(t *testing.T) {
 	mergeBidi, err := client.UserMergeBranch(ctx)
 	require.NoError(t, err)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
 
 	mergeCommitMessage := "Merged by Gitaly"
 	firstRequest := &gitalypb.UserMergeBranchRequest{
@@ -308,7 +308,7 @@ func TestUserMergeBranch_ambiguousReference(t *testing.T) {
 	merge, err := client.UserMergeBranch(ctx)
 	require.NoError(t, err)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
 
 	masterOID, err := repo.ResolveRevision(ctx, "refs/heads/master")
 	require.NoError(t, err)
@@ -364,9 +364,9 @@ func TestFailedMergeDueToHooks(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
 
 	hookContent := []byte("#!/bin/sh\necho 'failure'\nexit 1")
 
@@ -403,7 +403,7 @@ func TestFailedMergeDueToHooks(t *testing.T) {
 				return err
 			})
 
-			currentBranchHead := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", mergeBranchName)
+			currentBranchHead := gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", mergeBranchName)
 			require.Equal(t, mergeBranchHeadBefore, text.ChompBytes(currentBranchHead), "branch head updated")
 		})
 	}
@@ -413,7 +413,7 @@ func TestSuccessfulUserFFBranchRequest(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	commitID := "cfe32cf61b73a0d5e9f13e774abde7ff789b1660"
 	branchName := "test-ff-target-branch"
@@ -431,12 +431,12 @@ func TestSuccessfulUserFFBranchRequest(t *testing.T) {
 		},
 	}
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "-f", branchName, "6d394385cf567f80a8fd85055db1ab4c5295806f")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", "-f", branchName, "6d394385cf567f80a8fd85055db1ab4c5295806f")
 
 	resp, err := client.UserFFBranch(ctx, request)
 	require.NoError(t, err)
 	testhelper.ProtoEqual(t, expectedResponse, resp)
-	newBranchHead := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", branchName)
+	newBranchHead := gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", branchName)
 	require.Equal(t, commitID, text.ChompBytes(newBranchHead), "branch head not updated")
 }
 
@@ -444,12 +444,12 @@ func TestFailedUserFFBranchRequest(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	commitID := "cfe32cf61b73a0d5e9f13e774abde7ff789b1660"
 	branchName := "test-ff-target-branch"
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "-f", branchName, "6d394385cf567f80a8fd85055db1ab4c5295806f")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", "-f", branchName, "6d394385cf567f80a8fd85055db1ab4c5295806f")
 
 	testCases := []struct {
 		desc     string
@@ -531,7 +531,7 @@ func TestFailedUserFFBranchDueToHooks(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	commitID := "cfe32cf61b73a0d5e9f13e774abde7ff789b1660"
 	branchName := "test-ff-target-branch"
@@ -542,7 +542,7 @@ func TestFailedUserFFBranchDueToHooks(t *testing.T) {
 		User:       testhelper.TestUser,
 	}
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "-f", branchName, "6d394385cf567f80a8fd85055db1ab4c5295806f")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", "-f", branchName, "6d394385cf567f80a8fd85055db1ab4c5295806f")
 
 	hookContent := []byte("#!/bin/sh\necho 'failure'\nexit 1")
 
@@ -561,7 +561,7 @@ func TestUserFFBranch_ambiguousReference(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	branchName := "test-ff-target-branch"
 
@@ -574,10 +574,10 @@ func TestUserFFBranch_ambiguousReference(t *testing.T) {
 	// old revision when calling git-update-ref. As a result, the
 	// update would've failed as the branch's current revision
 	// didn't match the specified old revision.
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath,
+	gittest.Exec(t, cfg, "-C", repoPath,
 		"branch", branchName,
 		"6d394385cf567f80a8fd85055db1ab4c5295806f")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", branchName, "6d394385cf567f80a8fd85055db1ab4c5295806f~")
+	gittest.Exec(t, cfg, "-C", repoPath, "tag", branchName, "6d394385cf567f80a8fd85055db1ab4c5295806f~")
 
 	commitID := "cfe32cf61b73a0d5e9f13e774abde7ff789b1660"
 	request := &gitalypb.UserFFBranchRequest{
@@ -597,7 +597,7 @@ func TestUserFFBranch_ambiguousReference(t *testing.T) {
 	resp, err := client.UserFFBranch(ctx, request)
 	require.NoError(t, err)
 	testhelper.ProtoEqual(t, expectedResponse, resp)
-	newBranchHead := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "refs/heads/"+branchName)
+	newBranchHead := gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "refs/heads/"+branchName)
 	require.Equal(t, commitID, text.ChompBytes(newBranchHead), "branch head not updated")
 }
 
@@ -609,7 +609,7 @@ func TestSuccessfulUserMergeToRefRequest(t *testing.T) {
 
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
 
 	existingTargetRef := []byte("refs/merge-requests/x/written")
 	emptyTargetRef := []byte("refs/merge-requests/x/merge")
@@ -711,7 +711,7 @@ func TestConflictsOnUserMergeToRefRequest(t *testing.T) {
 
 	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", mergeBranchName, "824be604a34828eb682305f0d963056cfac87b2d")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", mergeBranchName, "824be604a34828eb682305f0d963056cfac87b2d")
 
 	request := &gitalypb.UserMergeToRefRequest{
 		Repository:     repo,
@@ -756,7 +756,7 @@ func TestUserMergeToRef_stableMergeID(t *testing.T) {
 
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
 
 	response, err := client.UserMergeToRef(ctx, &gitalypb.UserMergeToRefRequest{
 		Repository:     repoProto,
@@ -803,9 +803,9 @@ func TestFailedUserMergeToRefRequest(t *testing.T) {
 	ctx, cleanup := testhelper.Context()
 	defer cleanup()
 
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
 
 	validTargetRef := []byte("refs/merge-requests/x/merge")
 
@@ -898,9 +898,9 @@ func TestUserMergeToRefIgnoreHooksRequest(t *testing.T) {
 	ctx, cleanup := testhelper.Context()
 	defer cleanup()
 
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", mergeBranchName, mergeBranchHeadBefore)
 
 	targetRef := []byte("refs/merge-requests/x/merge")
 	mergeCommitMessage := "Merged by Gitaly"
diff --git a/internal/gitaly/service/operations/rebase_test.go b/internal/gitaly/service/operations/rebase_test.go
index 51c410a38..0989cec6c 100644
--- a/internal/gitaly/service/operations/rebase_test.go
+++ b/internal/gitaly/service/operations/rebase_test.go
@@ -47,7 +47,7 @@ func testSuccessfulUserRebaseConfirmableRequestFeatured(t *testing.T, ctx contex
 	repoCopyProto, _, cleanup := gittest.CloneRepoAtStorage(t, cfg.Storages[0], "copy")
 	defer cleanup()
 
-	branchSha := getBranchSha(t, repoPath, rebaseBranchName)
+	branchSha := getBranchSha(t, cfg, repoPath, rebaseBranchName)
 
 	rebaseStream, err := client.UserRebaseConfirmable(ctx)
 	require.NoError(t, err)
@@ -74,7 +74,7 @@ func testSuccessfulUserRebaseConfirmableRequestFeatured(t *testing.T, ctx contex
 	_, err = rebaseStream.Recv()
 	require.Equal(t, io.EOF, err)
 
-	newBranchSha := getBranchSha(t, repoPath, rebaseBranchName)
+	newBranchSha := getBranchSha(t, cfg, repoPath, rebaseBranchName)
 
 	require.NotEqual(t, newBranchSha, branchSha)
 	require.Equal(t, newBranchSha, firstResponse.GetRebaseSha())
@@ -203,7 +203,7 @@ func testUserRebaseConfirmableStableCommitIDsFeatured(t *testing.T, ctx context.
 	require.NoError(t, err)
 
 	committerDate := &timestamp.Timestamp{Seconds: 100000000}
-	parentSha := getBranchSha(t, repoPath, "master")
+	parentSha := getBranchSha(t, cfg, repoPath, "master")
 
 	require.NoError(t, rebaseStream.Send(&gitalypb.UserRebaseConfirmableRequest{
 		UserRebaseConfirmableRequestPayload: &gitalypb.UserRebaseConfirmableRequest_Header_{
@@ -212,7 +212,7 @@ func testUserRebaseConfirmableStableCommitIDsFeatured(t *testing.T, ctx context.
 				User:             testhelper.TestUser,
 				RebaseId:         "1",
 				Branch:           []byte(rebaseBranchName),
-				BranchSha:        getBranchSha(t, repoPath, rebaseBranchName),
+				BranchSha:        getBranchSha(t, cfg, repoPath, rebaseBranchName),
 				RemoteRepository: repoProto,
 				RemoteBranch:     []byte("master"),
 				Timestamp:        committerDate,
@@ -270,7 +270,7 @@ func testFailedRebaseUserRebaseConfirmableRequestDueToInvalidHeaderFeatured(t *t
 	repoCopy, _, cleanup := gittest.CloneRepoAtStorage(t, cfg.Storages[0], "copy")
 	defer cleanup()
 
-	branchSha := getBranchSha(t, repoPath, rebaseBranchName)
+	branchSha := getBranchSha(t, cfg, repoPath, rebaseBranchName)
 
 	testCases := []struct {
 		desc string
@@ -347,7 +347,7 @@ func testAbortedUserRebaseConfirmableFeatured(t *testing.T, ctx context.Context,
 			testRepoCopy, _, cleanup := gittest.CloneRepoAtStorage(t, cfg.Storages[0], "copy")
 			defer cleanup()
 
-			branchSha := getBranchSha(t, testRepoPath, rebaseBranchName)
+			branchSha := getBranchSha(t, cfg, testRepoPath, rebaseBranchName)
 
 			headerRequest := buildHeaderRequest(testRepo, testhelper.TestUser, fmt.Sprintf("%v", i), rebaseBranchName, branchSha, testRepoCopy, "master")
 
@@ -377,7 +377,7 @@ func testAbortedUserRebaseConfirmableFeatured(t *testing.T, ctx context.Context,
 			require.Error(t, err)
 			testhelper.RequireGrpcError(t, err, tc.code)
 
-			newBranchSha := getBranchSha(t, testRepoPath, rebaseBranchName)
+			newBranchSha := getBranchSha(t, cfg, testRepoPath, rebaseBranchName)
 			require.Equal(t, newBranchSha, branchSha, "branch should not change when the rebase is aborted")
 		})
 	}
@@ -395,7 +395,7 @@ func testFailedUserRebaseConfirmableDueToApplyBeingFalseFeatured(t *testing.T, c
 	testRepoCopy, _, cleanup := gittest.CloneRepoAtStorage(t, cfg.Storages[0], "copy")
 	defer cleanup()
 
-	branchSha := getBranchSha(t, repoPath, rebaseBranchName)
+	branchSha := getBranchSha(t, cfg, repoPath, rebaseBranchName)
 
 	rebaseStream, err := client.UserRebaseConfirmable(ctx)
 	require.NoError(t, err)
@@ -417,7 +417,7 @@ func testFailedUserRebaseConfirmableDueToApplyBeingFalseFeatured(t *testing.T, c
 	testhelper.RequireGrpcError(t, err, codes.FailedPrecondition)
 	require.False(t, secondResponse.GetRebaseApplied(), "the second rebase is not applied")
 
-	newBranchSha := getBranchSha(t, repoPath, rebaseBranchName)
+	newBranchSha := getBranchSha(t, cfg, repoPath, rebaseBranchName)
 	require.Equal(t, branchSha, newBranchSha, "branch should not change when the rebase is not applied")
 	require.NotEqual(t, newBranchSha, firstResponse.GetRebaseSha(), "branch should not be the sha returned when the rebase is not applied")
 }
@@ -433,7 +433,7 @@ func testFailedUserRebaseConfirmableRequestDueToPreReceiveErrorFeatured(t *testi
 	repoCopyProto, _, cleanup := gittest.CloneRepoAtStorage(t, cfg.Storages[0], "copy")
 	defer cleanup()
 
-	branchSha := getBranchSha(t, repoPath, rebaseBranchName)
+	branchSha := getBranchSha(t, cfg, repoPath, rebaseBranchName)
 
 	hookContent := []byte("#!/bin/sh\necho 'failure'\nexit 1")
 
@@ -464,7 +464,7 @@ func testFailedUserRebaseConfirmableRequestDueToPreReceiveErrorFeatured(t *testi
 			_, err = rebaseStream.Recv()
 			require.Equal(t, io.EOF, err)
 
-			newBranchSha := getBranchSha(t, repoPath, rebaseBranchName)
+			newBranchSha := getBranchSha(t, cfg, repoPath, rebaseBranchName)
 			require.Equal(t, branchSha, newBranchSha, "branch should not change when the rebase fails due to PreReceiveError")
 			require.NotEqual(t, newBranchSha, firstResponse.GetRebaseSha(), "branch should not be the sha returned when the rebase fails due to PreReceiveError")
 		})
@@ -482,7 +482,7 @@ func testFailedUserRebaseConfirmableDueToGitErrorFeatured(t *testing.T, ctx cont
 	defer cleanup()
 
 	failedBranchName := "rebase-encoding-failure-trigger"
-	branchSha := getBranchSha(t, repoPath, failedBranchName)
+	branchSha := getBranchSha(t, cfg, repoPath, failedBranchName)
 
 	rebaseStream, err := client.UserRebaseConfirmable(ctx)
 	require.NoError(t, err)
@@ -497,12 +497,12 @@ func testFailedUserRebaseConfirmableDueToGitErrorFeatured(t *testing.T, ctx cont
 	_, err = rebaseStream.Recv()
 	require.Equal(t, io.EOF, err)
 
-	newBranchSha := getBranchSha(t, repoPath, failedBranchName)
+	newBranchSha := getBranchSha(t, cfg, repoPath, failedBranchName)
 	require.Equal(t, branchSha, newBranchSha, "branch should not change when the rebase fails due to GitError")
 }
 
-func getBranchSha(t *testing.T, repoPath string, branchName string) string {
-	branchSha := string(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", branchName))
+func getBranchSha(t *testing.T, cfg config.Cfg, repoPath string, branchName string) string {
+	branchSha := string(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", branchName))
 	return strings.TrimSpace(branchSha)
 }
 
@@ -522,13 +522,13 @@ func testRebaseRequestWithDeletedFileFeatured(t *testing.T, ctx context.Context,
 
 	branch := "rebase-delete-test"
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "user.name", string(testhelper.TestUser.Name))
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "user.email", string(testhelper.TestUser.Email))
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "checkout", "-b", branch, "master~1")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rm", "README")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "commit", "-a", "-m", "delete file")
+	gittest.Exec(t, cfg, "-C", repoPath, "config", "user.name", string(testhelper.TestUser.Name))
+	gittest.Exec(t, cfg, "-C", repoPath, "config", "user.email", string(testhelper.TestUser.Email))
+	gittest.Exec(t, cfg, "-C", repoPath, "checkout", "-b", branch, "master~1")
+	gittest.Exec(t, cfg, "-C", repoPath, "rm", "README")
+	gittest.Exec(t, cfg, "-C", repoPath, "commit", "-a", "-m", "delete file")
 
-	branchSha := getBranchSha(t, repoPath, branch)
+	branchSha := getBranchSha(t, cfg, repoPath, branch)
 
 	rebaseStream, err := client.UserRebaseConfirmable(ctx)
 	require.NoError(t, err)
@@ -551,7 +551,7 @@ func testRebaseRequestWithDeletedFileFeatured(t *testing.T, ctx context.Context,
 	_, err = rebaseStream.Recv()
 	require.Equal(t, io.EOF, err)
 
-	newBranchSha := getBranchSha(t, repoPath, branch)
+	newBranchSha := getBranchSha(t, cfg, repoPath, branch)
 
 	require.NotEqual(t, newBranchSha, branchSha)
 	require.Equal(t, newBranchSha, firstResponse.GetRebaseSha())
@@ -572,15 +572,15 @@ func testRebaseOntoRemoteBranchFeatured(t *testing.T, ctx context.Context, cfg c
 	defer cleanup()
 
 	localBranch := "master"
-	localBranchHash := getBranchSha(t, repoPath, localBranch)
+	localBranchHash := getBranchSha(t, cfg, repoPath, localBranch)
 
 	remoteBranch := "remote-branch"
-	testhelper.MustRunCommand(t, nil, "git", "-C", remoteRepoPath, "config", "user.name", string(testhelper.TestUser.Name))
-	testhelper.MustRunCommand(t, nil, "git", "-C", remoteRepoPath, "config", "user.email", string(testhelper.TestUser.Email))
-	testhelper.MustRunCommand(t, nil, "git", "-C", remoteRepoPath, "checkout", "-b", remoteBranch, "master")
-	testhelper.MustRunCommand(t, nil, "git", "-C", remoteRepoPath, "rm", "README")
-	testhelper.MustRunCommand(t, nil, "git", "-C", remoteRepoPath, "commit", "-a", "-m", "remove README")
-	remoteBranchHash := getBranchSha(t, remoteRepoPath, remoteBranch)
+	gittest.Exec(t, cfg, "-C", remoteRepoPath, "config", "user.name", string(testhelper.TestUser.Name))
+	gittest.Exec(t, cfg, "-C", remoteRepoPath, "config", "user.email", string(testhelper.TestUser.Email))
+	gittest.Exec(t, cfg, "-C", remoteRepoPath, "checkout", "-b", remoteBranch, "master")
+	gittest.Exec(t, cfg, "-C", remoteRepoPath, "rm", "README")
+	gittest.Exec(t, cfg, "-C", remoteRepoPath, "commit", "-a", "-m", "remove README")
+	remoteBranchHash := getBranchSha(t, cfg, remoteRepoPath, remoteBranch)
 
 	rebaseStream, err := client.UserRebaseConfirmable(ctx)
 	require.NoError(t, err)
@@ -606,7 +606,7 @@ func testRebaseOntoRemoteBranchFeatured(t *testing.T, ctx context.Context, cfg c
 	_, err = rebaseStream.Recv()
 	require.Equal(t, io.EOF, err)
 
-	rebasedBranchHash := getBranchSha(t, repoPath, localBranch)
+	rebasedBranchHash := getBranchSha(t, cfg, repoPath, localBranch)
 
 	require.NotEqual(t, rebasedBranchHash, localBranchHash)
 	require.Equal(t, rebasedBranchHash, firstResponse.GetRebaseSha())
@@ -621,7 +621,7 @@ func testRebaseFailedWithCode(t *testing.T, cfg config.Cfg, rubySrv *rubyserver.
 func testRebaseFailedWithCodeFeatured(t *testing.T, ctx context.Context, cfg config.Cfg, rubySrv *rubyserver.Server) {
 	ctx, _, repoProto, repoPath, client := setupOperationsServiceWithRuby(t, ctx, cfg, rubySrv)
 
-	branchSha := getBranchSha(t, repoPath, rebaseBranchName)
+	branchSha := getBranchSha(t, cfg, repoPath, rebaseBranchName)
 
 	testCases := []struct {
 		desc               string
diff --git a/internal/gitaly/service/operations/revert_test.go b/internal/gitaly/service/operations/revert_test.go
index d43e29f50..9a2b54cb9 100644
--- a/internal/gitaly/service/operations/revert_test.go
+++ b/internal/gitaly/service/operations/revert_test.go
@@ -27,7 +27,7 @@ func testServerUserRevertSuccessfulFeatured(t *testing.T, ctx context.Context, c
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	destinationBranch := "revert-dst"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, "master")
 
 	masterHeadCommit, err := repo.ReadCommit(ctx, "master")
 	require.NoError(t, err)
@@ -38,7 +38,7 @@ func testServerUserRevertSuccessfulFeatured(t *testing.T, ctx context.Context, c
 	testRepoCopy, testRepoCopyPath, cleanup := gittest.CloneRepoAtStorage(t, cfg.Storages[0], "read-only") // read-only repo
 	defer cleanup()
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", testRepoCopyPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", testRepoCopyPath, "branch", destinationBranch, "master")
 
 	testCases := []struct {
 		desc         string
@@ -287,7 +287,7 @@ func testServerUserRevertSuccessfulGitHooksFeatured(t *testing.T, ctx context.Co
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	destinationBranch := "revert-dst"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, "master")
 
 	revertedCommit, err := repo.ReadCommit(ctx, "d59c60028b053793cecfb4022de34602e1a9218e")
 	require.NoError(t, err)
@@ -399,7 +399,7 @@ func testServerUserRevertFailedDueToPreReceiveErrorFeatured(t *testing.T, ctx co
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	destinationBranch := "revert-dst"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, "master")
 
 	revertedCommit, err := repo.ReadCommit(ctx, "d59c60028b053793cecfb4022de34602e1a9218e")
 	require.NoError(t, err)
@@ -435,7 +435,7 @@ func testServerUserRevertFailedDueToCreateTreeErrorConflictFeatured(t *testing.T
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	destinationBranch := "revert-dst"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, "master")
 
 	// This revert patch of the following commit cannot be applied to the destinationBranch above
 	revertedCommit, err := repo.ReadCommit(ctx, "372ab6950519549b14d220271ee2322caa44d4eb")
@@ -465,7 +465,7 @@ func testServerUserRevertFailedDueToCreateTreeErrorEmptyFeatured(t *testing.T, c
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	destinationBranch := "revert-dst"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, "master")
 
 	revertedCommit, err := repo.ReadCommit(ctx, "d59c60028b053793cecfb4022de34602e1a9218e")
 	require.NoError(t, err)
@@ -500,8 +500,8 @@ func testServerUserRevertFailedDueToCommitErrorFeatured(t *testing.T, ctx contex
 
 	sourceBranch := "revert-src"
 	destinationBranch := "revert-dst"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", destinationBranch, "master")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", sourceBranch, "a5391128b0ef5d21df5dd23d98557f4ef12fae20")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", destinationBranch, "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", sourceBranch, "a5391128b0ef5d21df5dd23d98557f4ef12fae20")
 
 	revertedCommit, err := repo.ReadCommit(ctx, git.Revision(sourceBranch))
 	require.NoError(t, err)
diff --git a/internal/gitaly/service/operations/squash_test.go b/internal/gitaly/service/operations/squash_test.go
index 69783b729..dce5c478c 100644
--- a/internal/gitaly/service/operations/squash_test.go
+++ b/internal/gitaly/service/operations/squash_test.go
@@ -14,6 +14,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/git/localrepo"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -74,7 +75,7 @@ func testSuccessfulUserSquashRequest(t *testing.T, ctx context.Context, start, e
 	require.Equal(t, testhelper.TestUser.Email, commit.Committer.Email)
 	require.Equal(t, commitMessage, commit.Subject)
 
-	treeData := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "ls-tree", "--name-only", response.SquashSha)
+	treeData := gittest.Exec(t, cfg, "-C", repoPath, "ls-tree", "--name-only", response.SquashSha)
 	files := strings.Fields(text.ChompBytes(treeData))
 	require.Subset(t, files, []string{"VERSION", "README", "files", ".gitattributes"}, "ensure the files remain on their places")
 }
@@ -126,8 +127,8 @@ func TestUserSquash_stableID(t *testing.T) {
 	}, commit)
 }
 
-func ensureSplitIndexExists(t *testing.T, repoDir string) bool {
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoDir, "update-index", "--add")
+func ensureSplitIndexExists(t *testing.T, cfg config.Cfg, repoDir string) bool {
+	gittest.Exec(t, cfg, "-C", repoDir, "update-index", "--add")
 
 	fis, err := ioutil.ReadDir(repoDir)
 	require.NoError(t, err)
@@ -176,7 +177,7 @@ func TestSuccessfulUserSquashRequestWith3wayMerge(t *testing.T) {
 	require.NoError(t, err)
 
 	// Ensure Git metadata is cleaned up
-	worktreeList := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "worktree", "list", "--porcelain"))
+	worktreeList := text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "worktree", "list", "--porcelain"))
 	expectedOut := fmt.Sprintf("worktree %s\nbare\n", repoPath)
 	require.Equal(t, expectedOut, worktreeList)
 
@@ -190,9 +191,9 @@ func TestSplitIndex(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
-	require.False(t, ensureSplitIndexExists(t, repoPath))
+	require.False(t, ensureSplitIndexExists(t, cfg, repoPath))
 
 	request := &gitalypb.UserSquashRequest{
 		Repository:    repo,
@@ -207,7 +208,7 @@ func TestSplitIndex(t *testing.T) {
 	response, err := client.UserSquash(ctx, request)
 	require.NoError(t, err)
 	require.Empty(t, response.GetGitError())
-	require.False(t, ensureSplitIndexExists(t, repoPath))
+	require.False(t, ensureSplitIndexExists(t, cfg, repoPath))
 }
 
 func TestSquashRequestWithRenamedFiles(t *testing.T) {
@@ -224,27 +225,27 @@ func TestSquashRequestWithRenamedFiles(t *testing.T) {
 	originalFilename := "original-file.txt"
 	renamedFilename := "renamed-file.txt"
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "testhelper.TestUser.name", string(author.Name))
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "testhelper.TestUser.email", string(author.Email))
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "checkout", "-b", "squash-rename-test", "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "config", "testhelper.TestUser.name", string(author.Name))
+	gittest.Exec(t, cfg, "-C", repoPath, "config", "testhelper.TestUser.email", string(author.Email))
+	gittest.Exec(t, cfg, "-C", repoPath, "checkout", "-b", "squash-rename-test", "master")
 	require.NoError(t, ioutil.WriteFile(filepath.Join(repoPath, originalFilename), []byte("This is a test"), 0644))
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "add", ".")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "commit", "-m", "test file")
+	gittest.Exec(t, cfg, "-C", repoPath, "add", ".")
+	gittest.Exec(t, cfg, "-C", repoPath, "commit", "-m", "test file")
 
-	startCommitID := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "HEAD"))
+	startCommitID := text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "HEAD"))
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "mv", originalFilename, renamedFilename)
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "commit", "-a", "-m", "renamed test file")
+	gittest.Exec(t, cfg, "-C", repoPath, "mv", originalFilename, renamedFilename)
+	gittest.Exec(t, cfg, "-C", repoPath, "commit", "-a", "-m", "renamed test file")
 
 	// Modify the original file in another branch
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "checkout", "-b", "squash-rename-branch", startCommitID)
+	gittest.Exec(t, cfg, "-C", repoPath, "checkout", "-b", "squash-rename-branch", startCommitID)
 	require.NoError(t, ioutil.WriteFile(filepath.Join(repoPath, originalFilename), []byte("This is a change"), 0644))
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "commit", "-a", "-m", "test")
+	gittest.Exec(t, cfg, "-C", repoPath, "commit", "-a", "-m", "test")
 
 	require.NoError(t, ioutil.WriteFile(filepath.Join(repoPath, originalFilename), []byte("This is another change"), 0644))
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "commit", "-a", "-m", "test")
+	gittest.Exec(t, cfg, "-C", repoPath, "commit", "-a", "-m", "test")
 
-	endCommitID := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "HEAD"))
+	endCommitID := text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "HEAD"))
 
 	request := &gitalypb.UserSquashRequest{
 		Repository:    repoProto,
diff --git a/internal/gitaly/service/operations/submodules_test.go b/internal/gitaly/service/operations/submodules_test.go
index 70f75dcf5..454c40f46 100644
--- a/internal/gitaly/service/operations/submodules_test.go
+++ b/internal/gitaly/service/operations/submodules_test.go
@@ -96,7 +96,7 @@ func testSuccessfulUserUpdateSubmoduleRequestFeatured(t *testing.T, ctx context.
 			require.Equal(t, commit.Committer.Email, testhelper.TestUser.Email)
 			require.Equal(t, commit.Subject, commitMessage)
 
-			entry := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "ls-tree", "-z", fmt.Sprintf("%s^{tree}:", response.BranchUpdate.CommitId), testCase.submodule)
+			entry := gittest.Exec(t, cfg, "-C", repoPath, "ls-tree", "-z", fmt.Sprintf("%s^{tree}:", response.BranchUpdate.CommitId), testCase.submodule)
 			parser := lstree.NewParser(bytes.NewReader(entry))
 			parsedEntry, err := parser.NextEntry()
 			require.NoError(t, err)
diff --git a/internal/gitaly/service/operations/tags_test.go b/internal/gitaly/service/operations/tags_test.go
index 676d7faf5..20d663e63 100644
--- a/internal/gitaly/service/operations/tags_test.go
+++ b/internal/gitaly/service/operations/tags_test.go
@@ -37,11 +37,11 @@ func TestSuccessfulUserDeleteTagRequest(t *testing.T) {
 }
 
 func testSuccessfulUserDeleteTagRequest(t *testing.T, ctx context.Context) {
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	tagNameInput := "to-be-deleted-soon-tag"
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", tagNameInput)
+	gittest.Exec(t, cfg, "-C", repoPath, "tag", tagNameInput)
 
 	request := &gitalypb.UserDeleteTagRequest{
 		Repository: repo,
@@ -52,7 +52,7 @@ func testSuccessfulUserDeleteTagRequest(t *testing.T, ctx context.Context) {
 	_, err := client.UserDeleteTag(ctx, request)
 	require.NoError(t, err)
 
-	tags := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag")
+	tags := gittest.Exec(t, cfg, "-C", repoPath, "tag")
 	require.NotContains(t, string(tags), tagNameInput, "tag name still exists in tags list")
 }
 
@@ -60,7 +60,7 @@ func TestSuccessfulGitHooksForUserDeleteTagRequest(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	tagNameInput := "to-be-déleted-soon-tag"
 
@@ -72,7 +72,7 @@ func TestSuccessfulGitHooksForUserDeleteTagRequest(t *testing.T) {
 
 	for _, hookName := range GitlabHooks {
 		t.Run(hookName, func(t *testing.T) {
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", tagNameInput)
+			gittest.Exec(t, cfg, "-C", repoPath, "tag", tagNameInput)
 
 			hookOutputTempPath := gittest.WriteEnvToCustomHook(t, repoPath, hookName)
 
@@ -232,20 +232,20 @@ func testSuccessfulUserCreateTagRequest(t *testing.T, ctx context.Context) {
 			require.NoError(t, err, "error from calling RPC")
 			require.Empty(t, response.PreReceiveError, "PreReceiveError must be empty, signalling the push was accepted")
 
-			defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", "-d", inputTagName)
+			defer gittest.Exec(t, cfg, "-C", repoPath, "tag", "-d", inputTagName)
 
 			responseOk := &gitalypb.UserCreateTagResponse{
 				Tag: testCase.expectedTag,
 			}
 			// Fake up *.Id for annotated tags
 			if len(testCase.expectedTag.Id) == 0 {
-				id := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", inputTagName)
+				id := gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", inputTagName)
 				responseOk.Tag.Id = text.ChompBytes(id)
 			}
 
 			require.Equal(t, responseOk, response)
 
-			tag := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag")
+			tag := gittest.Exec(t, cfg, "-C", repoPath, "tag")
 			require.Contains(t, string(tag), inputTagName)
 		})
 	}
@@ -369,8 +369,8 @@ func TestUserCreateTagWithTransaction(t *testing.T) {
 			response, err := client.UserCreateTag(ctx, request)
 			require.NoError(t, err)
 
-			targetOID := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "refs/tags/"+tagName))
-			peeledOID := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", targetOID+"^{commit}"))
+			targetOID := text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "refs/tags/"+tagName))
+			peeledOID := text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", targetOID+"^{commit}"))
 			targetOIDOK := targetOID
 			if len(testCase.message) > 0 {
 				targetOIDOK = peeledOID
@@ -485,7 +485,7 @@ func testSuccessfulUserCreateTagRequestAnnotatedLightweightDisambiguation(t *tes
 			if testCase.err != nil {
 				require.Equal(t, testCase.err, err)
 			} else {
-				defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", "-d", tagName)
+				defer gittest.Exec(t, cfg, "-C", repoPath, "tag", "-d", tagName)
 				require.NoError(t, err)
 				require.Empty(t, response.PreReceiveError)
 			}
@@ -500,12 +500,12 @@ func TestSuccessfulUserCreateTagRequestWithParsedTargetRevision(t *testing.T) {
 }
 
 func testSuccessfulUserCreateTagRequestWithParsedTargetRevision(t *testing.T, ctx context.Context) {
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "heads/master", "master~1")
-	defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "-d", "heads/master")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "refs/heads/master", "master~2")
-	defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "-d", "refs/heads/master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", "heads/master", "master~1")
+	defer gittest.Exec(t, cfg, "-C", repoPath, "branch", "-d", "heads/master")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", "refs/heads/master", "master~2")
+	defer gittest.Exec(t, cfg, "-C", repoPath, "branch", "-d", "refs/heads/master")
 
 	testCases := []struct {
 		desc             string
@@ -565,11 +565,11 @@ func testSuccessfulUserCreateTagRequestWithParsedTargetRevision(t *testing.T, ct
 			}
 
 			response, err := client.UserCreateTag(ctx, request)
-			defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", "-d", tagName)
+			defer gittest.Exec(t, cfg, "-C", repoPath, "tag", "-d", tagName)
 			require.NoError(t, err)
 			require.Empty(t, response.PreReceiveError)
 
-			parsedID := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", tagName)
+			parsedID := gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", tagName)
 			require.Equal(t, text.ChompBytes(parsedID), response.Tag.TargetCommit.Id)
 		})
 	}
@@ -668,19 +668,19 @@ func TestSuccessfulUserCreateTagRequestToNonCommit(t *testing.T) {
 			response, err := client.UserCreateTag(ctx, request)
 			require.NoError(t, err)
 			require.Empty(t, response.PreReceiveError)
-			defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", "-d", inputTagName)
+			defer gittest.Exec(t, cfg, "-C", repoPath, "tag", "-d", inputTagName)
 
 			// Fake up *.Id for annotated tags
 			if len(testCase.expectedTag.Id) == 0 {
-				tagID := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", inputTagName)
+				tagID := gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", inputTagName)
 				responseOk.Tag.Id = text.ChompBytes(tagID)
 			}
 			require.Equal(t, responseOk, response)
 
-			peeledID := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", inputTagName+"^{}")
+			peeledID := gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", inputTagName+"^{}")
 			require.Equal(t, testCase.targetRevision, text.ChompBytes(peeledID))
 
-			objectType := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "cat-file", "-t", inputTagName)
+			objectType := gittest.Exec(t, cfg, "-C", repoPath, "cat-file", "-t", inputTagName)
 			require.Equal(t, testCase.expectedObjectType, text.ChompBytes(objectType))
 		})
 	}
@@ -748,9 +748,9 @@ func TestSuccessfulUserCreateTagNestedTags(t *testing.T) {
 				response, err := client.UserCreateTag(ctx, request)
 				require.NoError(t, err)
 				require.Empty(t, response.PreReceiveError)
-				defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", "-d", tagName)
+				defer gittest.Exec(t, cfg, "-C", repoPath, "tag", "-d", tagName)
 
-				createdID := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", tagName)
+				createdID := gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", tagName)
 				createdIDStr := text.ChompBytes(createdID)
 				responseOk := &gitalypb.UserCreateTagResponse{
 					Tag: &gitalypb.Tag{
@@ -769,7 +769,7 @@ func TestSuccessfulUserCreateTagNestedTags(t *testing.T) {
 				}
 				require.Equal(t, responseOk, response)
 
-				peeledID := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", tagName+"^{}")
+				peeledID := gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", tagName+"^{}")
 				peeledIDStr := text.ChompBytes(peeledID)
 				require.Equal(t, testCase.targetObject, peeledIDStr)
 
@@ -789,7 +789,7 @@ func TestSuccessfulUserCreateTagNestedTags(t *testing.T) {
 					User:           testhelper.TestUser,
 				}
 				response, err = client.UserCreateTag(ctx, request)
-				defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", "-d", tagNameLight)
+				defer gittest.Exec(t, cfg, "-C", repoPath, "tag", "-d", tagNameLight)
 				require.NoError(t, err)
 				require.Empty(t, response.PreReceiveError)
 
@@ -804,7 +804,7 @@ func TestSuccessfulUserCreateTagNestedTags(t *testing.T) {
 				}
 				require.Equal(t, responseOk, response)
 
-				createdIDLight := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", tagNameLight)
+				createdIDLight := gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", tagNameLight)
 				createdIDLightStr := text.ChompBytes(createdIDLight)
 				require.Equal(t, testCase.targetObject, createdIDLightStr)
 			}
@@ -846,7 +846,7 @@ func TestUserDeleteTagsuccessfulDeletionOfPrefixedTag(t *testing.T) {
 }
 
 func testUserDeleteTagsuccessfulDeletionOfPrefixedTag(t *testing.T, ctx context.Context) {
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	testCases := []struct {
 		desc         string
@@ -868,7 +868,7 @@ func testUserDeleteTagsuccessfulDeletionOfPrefixedTag(t *testing.T, ctx context.
 
 	for _, testCase := range testCases {
 		t.Run(testCase.desc, func(t *testing.T) {
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", testCase.tagNameInput, testCase.tagCommit)
+			gittest.Exec(t, cfg, "-C", repoPath, "tag", testCase.tagNameInput, testCase.tagCommit)
 
 			request := &gitalypb.UserDeleteTagRequest{
 				Repository: repo,
@@ -880,7 +880,7 @@ func testUserDeleteTagsuccessfulDeletionOfPrefixedTag(t *testing.T, ctx context.
 			require.Equal(t, testCase.err, err)
 			require.Equal(t, testCase.response, response)
 
-			refs := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "for-each-ref", "--", "refs/tags/"+testCase.tagNameInput)
+			refs := gittest.Exec(t, cfg, "-C", repoPath, "for-each-ref", "--", "refs/tags/"+testCase.tagNameInput)
 			require.NotContains(t, string(refs), testCase.tagCommit, "tag kept because we stripped off refs/tags/*")
 		})
 	}
@@ -912,7 +912,7 @@ func TestUserCreateTagsuccessfulCreationOfPrefixedTag(t *testing.T) {
 
 	for _, testCase := range testCases {
 		t.Run(testCase.desc, func(t *testing.T) {
-			defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", "-d", testCase.tagNameInput)
+			defer gittest.Exec(t, cfg, "-C", repoPath, "tag", "-d", testCase.tagNameInput)
 
 			request := &gitalypb.UserCreateTagRequest{
 				Repository:     repoProto,
@@ -936,7 +936,7 @@ func TestUserCreateTagsuccessfulCreationOfPrefixedTag(t *testing.T) {
 
 			require.Equal(t, responseOk, response)
 
-			refs := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "for-each-ref", "--", "refs/tags/"+testCase.tagNameInput)
+			refs := gittest.Exec(t, cfg, "-C", repoPath, "for-each-ref", "--", "refs/tags/"+testCase.tagNameInput)
 			require.Contains(t, string(refs), testCase.tagTargetRevisionInput, "tag created, we did not strip off refs/tags/*")
 		})
 	}
@@ -946,7 +946,7 @@ func TestSuccessfulGitHooksForUserCreateTagRequest(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	projectPath := "project/path"
 	repo.GlProjectPath = projectPath
@@ -962,7 +962,7 @@ func TestSuccessfulGitHooksForUserCreateTagRequest(t *testing.T) {
 
 	for _, hookName := range GitlabHooks {
 		t.Run(hookName, func(t *testing.T) {
-			defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", "-d", tagName)
+			defer gittest.Exec(t, cfg, "-C", repoPath, "tag", "-d", tagName)
 
 			hookOutputTempPath := gittest.WriteEnvToCustomHook(t, repoPath, hookName)
 
@@ -1055,11 +1055,11 @@ func TestFailedUserDeleteTagDueToHooks(t *testing.T) {
 }
 
 func testFailedUserDeleteTagDueToHooks(t *testing.T, ctx context.Context) {
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	tagNameInput := "to-be-deleted-soon-tag"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", tagNameInput)
-	defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", "-d", tagNameInput)
+	gittest.Exec(t, cfg, "-C", repoPath, "tag", tagNameInput)
+	defer gittest.Exec(t, cfg, "-C", repoPath, "tag", "-d", tagNameInput)
 
 	request := &gitalypb.UserDeleteTagRequest{
 		Repository: repo,
@@ -1077,7 +1077,7 @@ func testFailedUserDeleteTagDueToHooks(t *testing.T, ctx context.Context) {
 			require.Nil(t, err)
 			require.Contains(t, response.PreReceiveError, "GL_ID="+testhelper.TestUser.GlId)
 
-			tags := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag")
+			tags := gittest.Exec(t, cfg, "-C", repoPath, "tag")
 			require.Contains(t, string(tags), tagNameInput, "tag name does not exist in tags list")
 		})
 	}
@@ -1283,7 +1283,7 @@ func TestTagHookOutput(t *testing.T) {
 }
 
 func testTagHookOutput(t *testing.T, ctx context.Context) {
-	ctx, _, repo, repoPath, client := setupOperationsService(t, ctx)
+	ctx, cfg, repo, repoPath, client := setupOperationsService(t, ctx)
 
 	testCases := []struct {
 		desc        string
@@ -1350,8 +1350,8 @@ func testTagHookOutput(t *testing.T, ctx context.Context) {
 				}
 				require.Equal(t, createResponseOk, createResponse)
 
-				defer testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", "-d", tagNameInput)
-				testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag", tagNameInput)
+				defer gittest.Exec(t, cfg, "-C", repoPath, "tag", "-d", tagNameInput)
+				gittest.Exec(t, cfg, "-C", repoPath, "tag", tagNameInput)
 
 				deleteResponse, err := client.UserDeleteTag(ctx, deleteRequest)
 				require.NoError(t, err)
diff --git a/internal/gitaly/service/operations/update_branches_test.go b/internal/gitaly/service/operations/update_branches_test.go
index 894e2a1c8..6a5317210 100644
--- a/internal/gitaly/service/operations/update_branches_test.go
+++ b/internal/gitaly/service/operations/update_branches_test.go
@@ -100,7 +100,7 @@ func testSuccessfulUserUpdateBranchRequestFeatured(t *testing.T, ctx context.Con
 			require.NoError(t, err)
 			require.Equal(t, string(testCase.newRev), branchCommit.Id)
 
-			branches := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "for-each-ref", "--", "refs/heads/"+branchName)
+			branches := gittest.Exec(t, cfg, "-C", repoPath, "for-each-ref", "--", "refs/heads/"+branchName)
 			require.Contains(t, string(branches), "refs/heads/"+branchName)
 		})
 	}
@@ -152,7 +152,7 @@ func testSuccessfulUserUpdateBranchRequestToDeleteFeatured(t *testing.T, ctx con
 	for _, testCase := range testCases {
 		t.Run(testCase.desc, func(t *testing.T) {
 			if testCase.createBranch {
-				testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "--", testCase.updateBranchName, string(testCase.oldRev))
+				gittest.Exec(t, cfg, "-C", repoPath, "branch", "--", testCase.updateBranchName, string(testCase.oldRev))
 			}
 
 			responseOk := &gitalypb.UserUpdateBranchResponse{}
@@ -170,7 +170,7 @@ func testSuccessfulUserUpdateBranchRequestToDeleteFeatured(t *testing.T, ctx con
 			_, err = repo.ReadCommit(ctx, git.Revision(testCase.updateBranchName))
 			require.Equal(t, localrepo.ErrObjectNotFound, err, "expected 'not found' error got %v", err)
 
-			refs := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "for-each-ref", "--", "refs/heads/"+testCase.updateBranchName)
+			refs := gittest.Exec(t, cfg, "-C", repoPath, "for-each-ref", "--", "refs/heads/"+testCase.updateBranchName)
 			require.NotContains(t, string(refs), testCase.oldRev, "branch deleted from refs")
 		})
 	}
diff --git a/internal/gitaly/service/operations/update_with_hooks_test.go b/internal/gitaly/service/operations/update_with_hooks_test.go
index f4e6cc4db..b93438e93 100644
--- a/internal/gitaly/service/operations/update_with_hooks_test.go
+++ b/internal/gitaly/service/operations/update_with_hooks_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/git/localrepo"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/hook"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/service"
@@ -277,7 +278,7 @@ func TestUpdateReferenceWithHooks(t *testing.T) {
 				contained, err := localrepo.NewTestRepo(t, cfg, repo).HasRevision(ctx, git.Revision("refs/heads/master"))
 				require.NoError(t, err)
 				require.False(t, contained, "branch should have been deleted")
-				testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "master", oldRev)
+				gittest.Exec(t, cfg, "-C", repoPath, "branch", "master", oldRev)
 			} else {
 				ref, err := localrepo.NewTestRepo(t, cfg, repo).GetReference(ctx, "refs/heads/master")
 				require.NoError(t, err)
diff --git a/internal/gitaly/service/ref/delete_refs_test.go b/internal/gitaly/service/ref/delete_refs_test.go
index 966a9faa1..b9f27f28c 100644
--- a/internal/gitaly/service/ref/delete_refs_test.go
+++ b/internal/gitaly/service/ref/delete_refs_test.go
@@ -48,10 +48,10 @@ func TestSuccessfulDeleteRefs(t *testing.T) {
 			repo, repoPath, cleanupFn := gittest.CloneRepoAtStorage(t, cfg.Storages[0], testCase.desc)
 			defer cleanupFn()
 
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", "refs/delete/a", "b83d6e391c22777fca1ed3012fce84f633d7fed0")
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", "refs/also-delete/b", "1b12f15a11fc6e62177bef08f47bc7b5ce50b141")
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", "refs/keep/c", "498214de67004b1da3d820901307bed2a68a8ef6")
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", "refs/also-keep/d", "b83d6e391c22777fca1ed3012fce84f633d7fed0")
+			gittest.Exec(t, cfg, "-C", repoPath, "update-ref", "refs/delete/a", "b83d6e391c22777fca1ed3012fce84f633d7fed0")
+			gittest.Exec(t, cfg, "-C", repoPath, "update-ref", "refs/also-delete/b", "1b12f15a11fc6e62177bef08f47bc7b5ce50b141")
+			gittest.Exec(t, cfg, "-C", repoPath, "update-ref", "refs/keep/c", "498214de67004b1da3d820901307bed2a68a8ef6")
+			gittest.Exec(t, cfg, "-C", repoPath, "update-ref", "refs/also-keep/d", "b83d6e391c22777fca1ed3012fce84f633d7fed0")
 
 			ctx, cancel := testhelper.Context()
 			defer cancel()
diff --git a/internal/gitaly/service/ref/list_new_blobs_test.go b/internal/gitaly/service/ref/list_new_blobs_test.go
index 8093ee9da..3dc6d7c27 100644
--- a/internal/gitaly/service/ref/list_new_blobs_test.go
+++ b/internal/gitaly/service/ref/list_new_blobs_test.go
@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"google.golang.org/grpc/codes"
@@ -15,10 +16,10 @@ func TestListNewBlobs(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	_, repo, repoPath, client := setupRefService(t)
+	cfg, repo, repoPath, client := setupRefService(t)
 
 	oid := "ab2c9622c02288a2bbaaf35d96088cfdff31d9d9"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "-D", "gitaly-diff-stuff")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", "-D", "gitaly-diff-stuff")
 
 	testCases := []struct {
 		revision     string
diff --git a/internal/gitaly/service/ref/list_new_commits_test.go b/internal/gitaly/service/ref/list_new_commits_test.go
index ccddf4afc..09aedfa0a 100644
--- a/internal/gitaly/service/ref/list_new_commits_test.go
+++ b/internal/gitaly/service/ref/list_new_commits_test.go
@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"google.golang.org/grpc/codes"
@@ -15,10 +16,10 @@ func TestListNewCommits(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	_, repo, repoPath, client := setupRefService(t)
+	cfg, repo, repoPath, client := setupRefService(t)
 
 	oid := "0031876facac3f2b2702a0e53a26e89939a42209"
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "-D", "few-commits")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", "-D", "few-commits")
 
 	testCases := []struct {
 		revision      string
diff --git a/internal/gitaly/service/ref/pack_refs_test.go b/internal/gitaly/service/ref/pack_refs_test.go
index 5cd668fd9..f45ab5000 100644
--- a/internal/gitaly/service/ref/pack_refs_test.go
+++ b/internal/gitaly/service/ref/pack_refs_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/git/localrepo"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -44,7 +45,7 @@ func TestPackRefsSuccessfulRequest(t *testing.T) {
 
 	// ensure all refs are reachable
 	for i := 0; i < newBranches; i++ {
-		testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "show-ref", fmt.Sprintf("refs/heads/new-ref-%d", i))
+		gittest.Exec(t, cfg, "-C", repoPath, "show-ref", fmt.Sprintf("refs/heads/new-ref-%d", i))
 	}
 }
 
diff --git a/internal/gitaly/service/ref/refs_test.go b/internal/gitaly/service/ref/refs_test.go
index b8cef0429..61b38b8d0 100644
--- a/internal/gitaly/service/ref/refs_test.go
+++ b/internal/gitaly/service/ref/refs_test.go
@@ -414,9 +414,9 @@ func TestSuccessfulFindAllTagsRequest(t *testing.T) {
 	truncatedPGPTagMsg, err := ioutil.ReadFile("testdata/truncated_pgp_msg.patch")
 	require.NoError(t, err)
 
-	truncatedPGPTagID := string(testhelper.MustRunCommand(t, bytes.NewBuffer(truncatedPGPTagMsg), "git", "-C", repoPath, "mktag"))
+	truncatedPGPTagID := string(gittest.ExecStream(t, cfg, bytes.NewBuffer(truncatedPGPTagMsg), "-C", repoPath, "mktag"))
 	truncatedPGPTagID = strings.TrimSpace(truncatedPGPTagID) // remove trailing newline
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", "refs/tags/pgp-long-tag-message", truncatedPGPTagID)
+	gittest.Exec(t, cfg, "-C", repoPath, "update-ref", "refs/tags/pgp-long-tag-message", truncatedPGPTagID)
 
 	blobID := "faaf198af3a36dbf41961466703cc1d47c61d051"
 	commitID := "6f6d7e7ed97bb5f0054f2b1df789b39ca89b6ff9"
@@ -642,7 +642,7 @@ func TestFindAllTagNestedTags(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.description, func(t *testing.T) {
-			tags := bytes.NewReader(testhelper.MustRunCommand(t, nil, "git", "-C", testRepoCopyPath, "tag"))
+			tags := bytes.NewReader(gittest.Exec(t, cfg, "-C", testRepoCopyPath, "tag"))
 			testhelper.MustRunCommand(t, tags, "xargs", cfg.Git.BinPath, "-C", testRepoCopyPath, "tag", "-d")
 
 			catfileCache := catfile.NewCache(git.NewExecCommandFactory(cfg), cfg)
@@ -990,13 +990,13 @@ func TestSuccessfulFindAllBranchesRequestWithMergedBranches(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	localRefs := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "for-each-ref", "--format=%(refname:strip=2)", "refs/heads")
+	localRefs := gittest.Exec(t, cfg, "-C", repoPath, "for-each-ref", "--format=%(refname:strip=2)", "refs/heads")
 	for _, ref := range strings.Split(string(localRefs), "\n") {
 		ref = strings.TrimSpace(ref)
 		if _, ok := localBranches["refs/heads/"+ref]; ok || ref == "master" || ref == "" {
 			continue
 		}
-		testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "-D", ref)
+		gittest.Exec(t, cfg, "-C", repoPath, "branch", "-D", ref)
 	}
 
 	expectedRefs := []string{"refs/heads/100%branch", "refs/heads/improve/awesome", "refs/heads/'test'"}
@@ -1487,7 +1487,7 @@ func TestFindTagNestedTag(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.description, func(t *testing.T) {
-			tags := bytes.NewReader(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag"))
+			tags := bytes.NewReader(gittest.Exec(t, cfg, "-C", repoPath, "tag"))
 			testhelper.MustRunCommand(t, tags, "xargs", cfg.Git.BinPath, "-C", repoPath, "tag", "-d")
 
 			catfileCache := catfile.NewCache(git.NewExecCommandFactory(cfg), cfg)
diff --git a/internal/gitaly/service/remote/fetch_internal_remote_test.go b/internal/gitaly/service/remote/fetch_internal_remote_test.go
index f6848f36d..09871c334 100644
--- a/internal/gitaly/service/remote/fetch_internal_remote_test.go
+++ b/internal/gitaly/service/remote/fetch_internal_remote_test.go
@@ -192,7 +192,7 @@ func TestSuccessfulFetchInternalRemote(t *testing.T) {
 	}, testserver.WithHookManager(hookManager), testserver.WithDisablePraefect())
 
 	localRepoPath := filepath.Join(localCfg.Storages[0].Path, localRepo.GetRelativePath())
-	testhelper.MustRunCommand(t, nil, "git", "-C", localRepoPath, "symbolic-ref", "HEAD", "refs/heads/feature")
+	gittest.Exec(t, remoteCfg, "-C", localRepoPath, "symbolic-ref", "HEAD", "refs/heads/feature")
 
 	client, conn := newRemoteClient(t, localAddr)
 	t.Cleanup(func() { conn.Close() })
@@ -211,8 +211,8 @@ func TestSuccessfulFetchInternalRemote(t *testing.T) {
 	require.True(t, c.GetResult())
 
 	require.Equal(t,
-		string(testhelper.MustRunCommand(t, nil, "git", "-C", remoteRepoPath, "show-ref", "--head")),
-		string(testhelper.MustRunCommand(t, nil, "git", "-C", localRepoPath, "show-ref", "--head")),
+		string(gittest.Exec(t, remoteCfg, "-C", remoteRepoPath, "show-ref", "--head")),
+		string(gittest.Exec(t, remoteCfg, "-C", localRepoPath, "show-ref", "--head")),
 	)
 
 	gitalySSHInvocationParams := getGitalySSHInvocationParams()
diff --git a/internal/gitaly/service/remote/find_remote_root_ref_test.go b/internal/gitaly/service/remote/find_remote_root_ref_test.go
index e9bd8aec2..0ffe0a09a 100644
--- a/internal/gitaly/service/remote/find_remote_root_ref_test.go
+++ b/internal/gitaly/service/remote/find_remote_root_ref_test.go
@@ -13,10 +13,9 @@ import (
 )
 
 func TestFindRemoteRootRefSuccess(t *testing.T) {
-	_, repo, repoPath, client := setupRemoteService(t)
+	cfg, repo, repoPath, client := setupRemoteService(t)
 
-	originURL := text.ChompBytes(testhelper.MustRunCommand(t, nil,
-		"git", "-C", repoPath, "remote", "get-url", "origin"))
+	originURL := text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "remote", "get-url", "origin"))
 
 	for _, tc := range []struct {
 		desc    string
@@ -60,7 +59,7 @@ func TestFindRemoteRootRefWithUnbornRemoteHead(t *testing.T) {
 	// point to an unborn branch because the default branch hasn't yet been created.
 	_, clientRepoPath, cleanup := gittest.InitBareRepoAt(t, cfg, cfg.Storages[0])
 	defer cleanup()
-	testhelper.MustRunCommand(t, nil, "git", "-C", remoteRepoPath, "remote", "add",
+	gittest.Exec(t, cfg, "-C", remoteRepoPath, "remote", "add",
 		"foo", "file://"+clientRepoPath)
 
 	ctx, cancel := testhelper.Context()
diff --git a/internal/gitaly/service/remote/remotes_test.go b/internal/gitaly/service/remote/remotes_test.go
index 189d494d4..c1e7ae7b4 100644
--- a/internal/gitaly/service/remote/remotes_test.go
+++ b/internal/gitaly/service/remote/remotes_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/rubyserver"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
@@ -73,13 +74,13 @@ func testSuccessfulAddRemote(t *testing.T, cfg config.Cfg, rubySrv *rubyserver.S
 			_, err := client.AddRemote(ctx, request)
 			require.NoError(t, err)
 
-			remotes := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "remote", "-v")
+			remotes := gittest.Exec(t, cfg, "-C", repoPath, "remote", "-v")
 
 			require.Contains(t, string(remotes), fmt.Sprintf("%s\t%s (fetch)", tc.remoteName, tc.url))
 			require.Contains(t, string(remotes), fmt.Sprintf("%s\t%s (push)", tc.remoteName, tc.url))
 
 			mirrorConfigRegexp := fmt.Sprintf("remote.%s", tc.remoteName)
-			mirrorConfig := string(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "--get-regexp", mirrorConfigRegexp))
+			mirrorConfig := string(gittest.Exec(t, cfg, "-C", repoPath, "config", "--get-regexp", mirrorConfigRegexp))
 			if len(tc.resolvedMirrorRefmaps) > 0 {
 				for _, resolvedMirrorRefmap := range tc.resolvedMirrorRefmaps {
 					require.Contains(t, mirrorConfig, resolvedMirrorRefmap)
@@ -134,12 +135,12 @@ func TestFailedAddRemoteDueToValidation(t *testing.T) {
 }
 
 func TestSuccessfulRemoveRemote(t *testing.T) {
-	_, repo, repoPath, client := setupRemoteService(t)
+	cfg, repo, repoPath, client := setupRemoteService(t)
 
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "remote", "add", "my-remote", "http://my-repo.git")
+	gittest.Exec(t, cfg, "-C", repoPath, "remote", "add", "my-remote", "http://my-repo.git")
 
 	testCases := []struct {
 		description string
@@ -169,7 +170,7 @@ func TestSuccessfulRemoveRemote(t *testing.T) {
 			require.NoError(t, err)
 			require.Equal(t, tc.result, r.GetResult())
 
-			remotes := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "remote")
+			remotes := gittest.Exec(t, cfg, "-C", repoPath, "remote")
 
 			require.NotContains(t, string(remotes), tc.remoteName)
 		})
diff --git a/internal/gitaly/service/remote/update_remote_mirror_test.go b/internal/gitaly/service/remote/update_remote_mirror_test.go
index c4b4c4481..f5d959069 100644
--- a/internal/gitaly/service/remote/update_remote_mirror_test.go
+++ b/internal/gitaly/service/remote/update_remote_mirror_test.go
@@ -357,7 +357,7 @@ func testUpdateRemoteMirrorFeatured(t *testing.T, ctx context.Context, cfg confi
 			defer cleanSourceRepo()
 
 			// configure the mirror repository as a remote in the source
-			testhelper.MustRunCommand(t, nil, "git", "-C", sourceRepoPath, "remote", "add", "mirror", mirrorRepoPath)
+			gittest.Exec(t, cfg, "-C", sourceRepoPath, "remote", "add", "mirror", mirrorRepoPath)
 
 			// create identical commits in both repositories so we can use them for
 			// the references
@@ -383,7 +383,7 @@ func testUpdateRemoteMirrorFeatured(t *testing.T, ctx context.Context, cfg confi
 						require.NoError(t, err)
 					}
 
-					testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", reference, commitOID.String())
+					gittest.Exec(t, cfg, "-C", repoPath, "update-ref", reference, commitOID.String())
 				}
 			}
 			for repoPath, symRefs := range map[string]map[string]string{
@@ -391,7 +391,7 @@ func testUpdateRemoteMirrorFeatured(t *testing.T, ctx context.Context, cfg confi
 				mirrorRepoPath: tc.mirrorSymRefs,
 			} {
 				for symRef, targetRef := range symRefs {
-					testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "symbolic-ref", symRef, targetRef)
+					gittest.Exec(t, cfg, "-C", repoPath, "symbolic-ref", symRef, targetRef)
 				}
 			}
 
@@ -425,7 +425,7 @@ func testUpdateRemoteMirrorFeatured(t *testing.T, ctx context.Context, cfg confi
 			// the same.
 			actualMirrorRefs := map[string]string{}
 
-			refLines := strings.Split(text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", mirrorRepoPath, "for-each-ref", "--format=%(refname)%00%(contents:subject)")), "\n")
+			refLines := strings.Split(text.ChompBytes(gittest.Exec(t, cfg, "-C", mirrorRepoPath, "for-each-ref", "--format=%(refname)%00%(contents:subject)")), "\n")
 			for _, line := range refLines {
 				if line == "" {
 					continue
@@ -499,10 +499,10 @@ func testSuccessfulUpdateRemoteMirrorRequestFeatured(t *testing.T, ctx context.C
 	for _, args := range setupCommands {
 		gitArgs := []string{"-C", testRepoPath}
 		gitArgs = append(gitArgs, args...)
-		testhelper.MustRunCommand(t, nil, "git", gitArgs...)
+		gittest.Exec(t, cfg, gitArgs...)
 	}
 
-	newTagOid := string(testhelper.MustRunCommand(t, nil, "git", "-C", testRepoPath, "rev-parse", "v1.0.0"))
+	newTagOid := string(gittest.Exec(t, cfg, "-C", testRepoPath, "rev-parse", "v1.0.0"))
 	newTagOid = strings.TrimSpace(newTagOid)
 	require.NotEqual(t, newTagOid, "f4e6814c3e4e7a0de82a9e7cd20c626cc963a2f8") // Sanity check that the tag did in fact change
 
@@ -529,10 +529,10 @@ func testSuccessfulUpdateRemoteMirrorRequestFeatured(t *testing.T, ctx context.C
 	require.Empty(t, response.DivergentRefs)
 
 	// Ensure the local repository still has no reference to the mirror-only commit
-	localRefs := string(testhelper.MustRunCommand(t, nil, "git", "-C", testRepoPath, "for-each-ref"))
+	localRefs := string(gittest.Exec(t, cfg, "-C", testRepoPath, "for-each-ref"))
 	require.NotContains(t, localRefs, mirrorOnlyCommitOid)
 
-	mirrorRefs := string(testhelper.MustRunCommand(t, nil, "git", "-C", mirrorPath, "for-each-ref"))
+	mirrorRefs := string(gittest.Exec(t, cfg, "-C", mirrorPath, "for-each-ref"))
 
 	require.Contains(t, mirrorRefs, mirrorOnlyCommitOid)
 	require.Contains(t, mirrorRefs, "60ecb67744cb56576c30214ff52294f8ce2def98 commit\trefs/heads/new-branch")
@@ -598,14 +598,14 @@ func testSuccessfulUpdateRemoteMirrorRequestWithWildcardsFeatured(t *testing.T,
 	for _, args := range setupCommands {
 		gitArgs := []string{"-C", testRepoPath}
 		gitArgs = append(gitArgs, args...)
-		testhelper.MustRunCommand(t, nil, "git", gitArgs...)
+		gittest.Exec(t, cfg, gitArgs...)
 	}
 
 	// Workaround for https://gitlab.com/gitlab-org/gitaly/issues/1439
 	// Create a tag on the remote to ensure it gets deleted later
 	gittest.CreateTag(t, cfg, mirrorPath, "v1.2.0", "master", nil)
 
-	newTagOid := string(testhelper.MustRunCommand(t, nil, "git", "-C", testRepoPath, "rev-parse", "v1.0.0"))
+	newTagOid := string(gittest.Exec(t, cfg, "-C", testRepoPath, "rev-parse", "v1.0.0"))
 	newTagOid = strings.TrimSpace(newTagOid)
 	require.NotEqual(t, newTagOid, "f4e6814c3e4e7a0de82a9e7cd20c626cc963a2f8") // Sanity check that the tag did in fact change
 	firstRequest := &gitalypb.UpdateRemoteMirrorRequest{
@@ -622,7 +622,7 @@ func testSuccessfulUpdateRemoteMirrorRequestWithWildcardsFeatured(t *testing.T,
 	require.NoError(t, err)
 	require.Empty(t, response.DivergentRefs)
 
-	mirrorRefs := string(testhelper.MustRunCommand(t, nil, "git", "-C", mirrorPath, "for-each-ref"))
+	mirrorRefs := string(gittest.Exec(t, cfg, "-C", mirrorPath, "for-each-ref"))
 	require.Contains(t, mirrorRefs, "60ecb67744cb56576c30214ff52294f8ce2def98 commit\trefs/heads/11-0-stable")
 	require.Contains(t, mirrorRefs, "60ecb67744cb56576c30214ff52294f8ce2def98 commit\trefs/heads/11-1-stable")
 	require.Contains(t, mirrorRefs, "0b4bc9a49b562e85de7cc9e834518ea6828729b9 commit\trefs/heads/feature")
@@ -684,7 +684,7 @@ func testSuccessfulUpdateRemoteMirrorRequestWithKeepDivergentRefsFeatured(t *tes
 	for _, args := range setupCommands {
 		gitArgs := []string{"-C", testRepoPath}
 		gitArgs = append(gitArgs, args...)
-		testhelper.MustRunCommand(t, nil, "git", gitArgs...)
+		gittest.Exec(t, cfg, gitArgs...)
 	}
 	firstRequest := &gitalypb.UpdateRemoteMirrorRequest{
 		Repository:        testRepo,
@@ -700,7 +700,7 @@ func testSuccessfulUpdateRemoteMirrorRequestWithKeepDivergentRefsFeatured(t *tes
 	require.NoError(t, err)
 	require.ElementsMatch(t, response.DivergentRefs, [][]byte{[]byte("refs/heads/master")})
 
-	mirrorRefs := string(testhelper.MustRunCommand(t, nil, "git", "-C", mirrorPath, "for-each-ref"))
+	mirrorRefs := string(gittest.Exec(t, cfg, "-C", mirrorPath, "for-each-ref"))
 
 	// Verify `master` didn't get updated, since its HEAD is no longer an ancestor of remote's version
 	require.Contains(t, mirrorRefs, "1e292f8fedd741b75372e19097c76d327140c312 commit\trefs/heads/master")
@@ -719,7 +719,7 @@ func testSuccessfulUpdateRemoteMirrorRequestWithKeepDivergentRefsFeatured(t *tes
 	_, err = stream.CloseAndRecv()
 	require.NoError(t, err)
 
-	mirrorRefs = string(testhelper.MustRunCommand(t, nil, "git", "-C", mirrorPath, "for-each-ref"))
+	mirrorRefs = string(gittest.Exec(t, cfg, "-C", mirrorPath, "for-each-ref"))
 
 	// Verify `master` gets overwritten with the value from the source
 	require.Contains(t, mirrorRefs, "ba3faa7dbecdb555c748b36e8bc0f427e69de5e7 commit\trefs/heads/master")
diff --git a/internal/gitaly/service/repository/archive_test.go b/internal/gitaly/service/repository/archive_test.go
index d56fdc7c5..b5688e59b 100644
--- a/internal/gitaly/service/repository/archive_test.go
+++ b/internal/gitaly/service/repository/archive_test.go
@@ -405,7 +405,7 @@ func TestGetArchiveFailure(t *testing.T) {
 }
 
 func TestGetArchivePathInjection(t *testing.T) {
-	_, repo, repoPath, client := setupRepositoryServiceWithWorktree(t)
+	cfg, repo, repoPath, client := setupRepositoryServiceWithWorktree(t)
 
 	ctx, cancel := testhelper.Context()
 	defer cancel()
@@ -436,9 +436,9 @@ func TestGetArchivePathInjection(t *testing.T) {
 	require.NoError(t, f.Close())
 
 	// Add the directory to the repository
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "add", ".")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "commit", "-m", "adding fake key file")
-	commitID := strings.TrimRight(string(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "HEAD")), "\n")
+	gittest.Exec(t, cfg, "-C", repoPath, "add", ".")
+	gittest.Exec(t, cfg, "-C", repoPath, "commit", "-m", "adding fake key file")
+	commitID := strings.TrimRight(string(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "HEAD")), "\n")
 
 	injectionPath := fmt.Sprintf("--output=%s", authorizedKeysPath)
 
diff --git a/internal/gitaly/service/repository/clone_from_pool_internal_test.go b/internal/gitaly/service/repository/clone_from_pool_internal_test.go
index 6103a0dee..2f3d8251a 100644
--- a/internal/gitaly/service/repository/clone_from_pool_internal_test.go
+++ b/internal/gitaly/service/repository/clone_from_pool_internal_test.go
@@ -66,7 +66,7 @@ func TestCloneFromPoolInternal(t *testing.T) {
 	require.NoError(t, pool.Create(ctx, repo))
 	require.NoError(t, pool.Link(ctx, repo))
 
-	fullRepack(t, repoPath)
+	fullRepack(t, cfg, repoPath)
 
 	gittest.WriteCommit(t, cfg, repoPath, gittest.WithBranch("branch"))
 
@@ -92,11 +92,11 @@ func TestCloneFromPoolInternal(t *testing.T) {
 
 	// feature is a branch known to exist in the source repository. By looking it up in the target
 	// we establish that the target has branches, even though (as we saw above) it has no objects.
-	testhelper.MustRunCommand(t, nil, "git", "-C", forkRepoPath, "show-ref", "--verify", "refs/heads/feature")
-	testhelper.MustRunCommand(t, nil, "git", "-C", forkRepoPath, "show-ref", "--verify", "refs/heads/branch")
+	gittest.Exec(t, cfg, "-C", forkRepoPath, "show-ref", "--verify", "refs/heads/feature")
+	gittest.Exec(t, cfg, "-C", forkRepoPath, "show-ref", "--verify", "refs/heads/branch")
 }
 
 // fullRepack does a full repack on the repository, which means if it has a pool repository linked, it will get rid of redundant objects that are reachable in the pool
-func fullRepack(t *testing.T, repoPath string) {
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "repack", "-A", "-l", "-d")
+func fullRepack(t *testing.T, cfg config.Cfg, repoPath string) {
+	gittest.Exec(t, cfg, "-C", repoPath, "repack", "-A", "-l", "-d")
 }
diff --git a/internal/gitaly/service/repository/clone_from_pool_test.go b/internal/gitaly/service/repository/clone_from_pool_test.go
index e47b26ad7..e49c8f8f5 100644
--- a/internal/gitaly/service/repository/clone_from_pool_test.go
+++ b/internal/gitaly/service/repository/clone_from_pool_test.go
@@ -30,7 +30,7 @@ func testCloneFromPoolHTTP(t *testing.T, cfg config.Cfg, rubySrv *rubyserver.Ser
 	require.NoError(t, pool.Create(ctx, repo))
 	require.NoError(t, pool.Link(ctx, repo))
 
-	fullRepack(t, repoPath)
+	fullRepack(t, cfg, repoPath)
 
 	gittest.WriteCommit(t, cfg, repoPath, gittest.WithBranch("branch"))
 
@@ -63,6 +63,6 @@ func testCloneFromPoolHTTP(t *testing.T, cfg config.Cfg, rubySrv *rubyserver.Ser
 
 	// feature is a branch known to exist in the source repository. By looking it up in the target
 	// we establish that the target has branches, even though (as we saw above) it has no objects.
-	testhelper.MustRunCommand(t, nil, "git", "-C", forkRepoPath, "show-ref", "--verify", "refs/heads/feature")
-	testhelper.MustRunCommand(t, nil, "git", "-C", forkRepoPath, "show-ref", "--verify", "refs/heads/branch")
+	gittest.Exec(t, cfg, "-C", forkRepoPath, "show-ref", "--verify", "refs/heads/feature")
+	gittest.Exec(t, cfg, "-C", forkRepoPath, "show-ref", "--verify", "refs/heads/branch")
 }
diff --git a/internal/gitaly/service/repository/config_test.go b/internal/gitaly/service/repository/config_test.go
index c8f108075..f3307f926 100644
--- a/internal/gitaly/service/repository/config_test.go
+++ b/internal/gitaly/service/repository/config_test.go
@@ -48,7 +48,7 @@ func TestDeleteConfig(t *testing.T) {
 			t.Cleanup(cleanupFn)
 
 			for _, k := range tc.addKeys {
-				testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", k, "blabla")
+				gittest.Exec(t, cfg, "-C", repoPath, "config", k, "blabla")
 			}
 
 			_, err := client.DeleteConfig(ctx, &gitalypb.DeleteConfigRequest{Repository: repo, Keys: tc.reqKeys})
@@ -59,7 +59,7 @@ func TestDeleteConfig(t *testing.T) {
 				return
 			}
 
-			actualConfig := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "-l")
+			actualConfig := gittest.Exec(t, cfg, "-C", repoPath, "config", "-l")
 			scanner := bufio.NewScanner(bytes.NewReader(actualConfig))
 			for scanner.Scan() {
 				for _, k := range tc.reqKeys {
@@ -115,7 +115,7 @@ func testSetConfig(t *testing.T, cfg config.Cfg, rubySrv *rubyserver.Server) {
 				return
 			}
 
-			actualConfigBytes := testhelper.MustRunCommand(t, nil, "git", "-C", testRepoPath, "config", "--local", "-l")
+			actualConfigBytes := gittest.Exec(t, cfg, "-C", testRepoPath, "config", "--local", "-l")
 			scanner := bufio.NewScanner(bytes.NewReader(actualConfigBytes))
 
 			var actualConfig []string
diff --git a/internal/gitaly/service/repository/create_bundle_test.go b/internal/gitaly/service/repository/create_bundle_test.go
index c6b29818d..d5a77a33a 100644
--- a/internal/gitaly/service/repository/create_bundle_test.go
+++ b/internal/gitaly/service/repository/create_bundle_test.go
@@ -30,10 +30,10 @@ func TestSuccessfulCreateBundleRequest(t *testing.T) {
 
 	require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "gitlab-worktree"), 0755))
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "worktree", "add", "gitlab-worktree/worktree1", sha.String())
+	gittest.Exec(t, cfg, "-C", repoPath, "worktree", "add", "gitlab-worktree/worktree1", sha.String())
 	require.NoError(t, os.Chtimes(filepath.Join(repoPath, "gitlab-worktree", "worktree1"), time.Now().Add(-7*time.Hour), time.Now().Add(-7*time.Hour)))
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "-D", "branch")
+	gittest.Exec(t, cfg, "-C", repoPath, "branch", "-D", "branch")
 	require.NoError(t, os.Remove(filepath.Join(repoPath, "objects", sha.String()[0:2], sha.String()[2:])))
 
 	request := &gitalypb.CreateBundleRequest{Repository: repo}
@@ -56,7 +56,7 @@ func TestSuccessfulCreateBundleRequest(t *testing.T) {
 	_, err = io.Copy(dstFile, reader)
 	require.NoError(t, err)
 
-	output := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "bundle", "verify", dstFile.Name())
+	output := gittest.Exec(t, cfg, "-C", repoPath, "bundle", "verify", dstFile.Name())
 	// Extra sanity; running verify should fail on bad bundles
 	require.Contains(t, string(output), "The bundle records a complete history")
 }
diff --git a/internal/gitaly/service/repository/create_from_bundle_test.go b/internal/gitaly/service/repository/create_from_bundle_test.go
index c8e547376..c1cb14348 100644
--- a/internal/gitaly/service/repository/create_from_bundle_test.go
+++ b/internal/gitaly/service/repository/create_from_bundle_test.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/git/localrepo"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/tempdir"
@@ -29,9 +30,9 @@ func TestServer_CreateRepositoryFromBundle_successful(t *testing.T) {
 	require.NoError(t, err)
 	bundlePath := filepath.Join(tmpdir, "original.bundle")
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", "refs/custom-refs/ref1", "HEAD")
+	gittest.Exec(t, cfg, "-C", repoPath, "update-ref", "refs/custom-refs/ref1", "HEAD")
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "bundle", "create", bundlePath, "--all")
+	gittest.Exec(t, cfg, "-C", repoPath, "bundle", "create", bundlePath, "--all")
 	defer os.RemoveAll(bundlePath)
 
 	stream, err := client.CreateRepositoryFromBundle(ctx)
@@ -69,7 +70,7 @@ func TestServer_CreateRepositoryFromBundle_successful(t *testing.T) {
 	_, err = stream.CloseAndRecv()
 	require.NoError(t, err)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", importedRepoPath, "fsck")
+	gittest.Exec(t, cfg, "-C", importedRepoPath, "fsck")
 
 	info, err := os.Lstat(filepath.Join(importedRepoPath, "hooks"))
 	require.NoError(t, err)
diff --git a/internal/gitaly/service/repository/create_from_url_test.go b/internal/gitaly/service/repository/create_from_url_test.go
index e543d01f7..58e7fba91 100644
--- a/internal/gitaly/service/repository/create_from_url_test.go
+++ b/internal/gitaly/service/repository/create_from_url_test.go
@@ -48,9 +48,9 @@ func TestSuccessfulCreateRepositoryFromURLRequest(t *testing.T) {
 	_, err := client.CreateRepositoryFromURL(ctx, req)
 	require.NoError(t, err)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", importedRepoPath, "fsck")
+	gittest.Exec(t, cfg, "-C", importedRepoPath, "fsck")
 
-	remotes := testhelper.MustRunCommand(t, nil, "git", "-C", importedRepoPath, "remote")
+	remotes := gittest.Exec(t, cfg, "-C", importedRepoPath, "remote")
 	require.NotContains(t, string(remotes), "origin")
 
 	info, err := os.Lstat(filepath.Join(importedRepoPath, "hooks"))
diff --git a/internal/gitaly/service/repository/create_test.go b/internal/gitaly/service/repository/create_test.go
index 4ebe3aba6..4d290803c 100644
--- a/internal/gitaly/service/repository/create_test.go
+++ b/internal/gitaly/service/repository/create_test.go
@@ -177,18 +177,18 @@ func TestCreateRepositoryTransactional(t *testing.T) {
 }
 
 func TestCreateRepositoryIdempotent(t *testing.T) {
-	_, repo, repoPath, client := setupRepositoryService(t)
+	cfg, repo, repoPath, client := setupRepositoryService(t)
 
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	refsBefore := strings.Split(string(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "for-each-ref")), "\n")
+	refsBefore := strings.Split(string(gittest.Exec(t, cfg, "-C", repoPath, "for-each-ref")), "\n")
 
 	req := &gitalypb.CreateRepositoryRequest{Repository: repo}
 	_, err := client.CreateRepository(ctx, req)
 	require.NoError(t, err)
 
-	refsAfter := strings.Split(string(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "for-each-ref")), "\n")
+	refsAfter := strings.Split(string(gittest.Exec(t, cfg, "-C", repoPath, "for-each-ref")), "\n")
 
 	assert.Equal(t, refsBefore, refsAfter)
 }
diff --git a/internal/gitaly/service/repository/fetch_remote_test.go b/internal/gitaly/service/repository/fetch_remote_test.go
index 6e652502a..f0ac0951b 100644
--- a/internal/gitaly/service/repository/fetch_remote_test.go
+++ b/internal/gitaly/service/repository/fetch_remote_test.go
@@ -34,15 +34,15 @@ import (
 	"google.golang.org/grpc/status"
 )
 
-func copyRepoWithNewRemote(t *testing.T, repo *gitalypb.Repository, repoPath string, remote string) (*gitalypb.Repository, string) {
+func copyRepoWithNewRemote(t *testing.T, cfg config.Cfg, repo *gitalypb.Repository, repoPath string, remote string) (*gitalypb.Repository, string) {
 	cloneRepo := &gitalypb.Repository{StorageName: repo.GetStorageName(), RelativePath: "fetch-remote-clone.git"}
 
 	clonePath := filepath.Join(filepath.Dir(repoPath), "fetch-remote-clone.git")
 	require.NoError(t, os.RemoveAll(clonePath))
 
-	testhelper.MustRunCommand(t, nil, "git", "clone", "--bare", repoPath, clonePath)
+	gittest.Exec(t, cfg, "clone", "--bare", repoPath, clonePath)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", clonePath, "remote", "add", remote, repoPath)
+	gittest.Exec(t, cfg, "-C", clonePath, "remote", "add", remote, repoPath)
 
 	return cloneRepo, clonePath
 }
@@ -53,7 +53,7 @@ func TestFetchRemoteSuccess(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	cloneRepo, cloneRepoPath := copyRepoWithNewRemote(t, repo, repoPath, "my-remote")
+	cloneRepo, cloneRepoPath := copyRepoWithNewRemote(t, cfg, repo, repoPath, "my-remote")
 	defer func() {
 		require.NoError(t, os.RemoveAll(cloneRepoPath))
 	}()
@@ -171,7 +171,7 @@ func TestFetchRemote_withDefaultRefmaps(t *testing.T) {
 
 	sourceRepo := localrepo.NewTestRepo(t, cfg, sourceRepoProto)
 
-	targetRepoProto, targetRepoPath := copyRepoWithNewRemote(t, sourceRepoProto, sourceRepoPath, "my-remote")
+	targetRepoProto, targetRepoPath := copyRepoWithNewRemote(t, cfg, sourceRepoProto, sourceRepoPath, "my-remote")
 	defer func() {
 		require.NoError(t, os.RemoveAll(targetRepoPath))
 	}()
@@ -335,7 +335,7 @@ func TestFetchRemote_prune(t *testing.T) {
 		},
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
-			targetRepoProto, targetRepoPath := copyRepoWithNewRemote(t, sourceRepo, sourceRepoPath, "my-remote")
+			targetRepoProto, targetRepoPath := copyRepoWithNewRemote(t, cfg, sourceRepo, sourceRepoPath, "my-remote")
 			defer func() {
 				require.NoError(t, os.RemoveAll(targetRepoPath))
 			}()
@@ -490,7 +490,7 @@ func TestFetchRemote_force(t *testing.T) {
 		},
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
-			targetRepoProto, targetRepoPath := copyRepoWithNewRemote(t, sourceRepoProto, sourceRepoPath, "my-remote")
+			targetRepoProto, targetRepoPath := copyRepoWithNewRemote(t, cfg, sourceRepoProto, sourceRepoPath, "my-remote")
 			defer func() {
 				require.NoError(t, os.RemoveAll(targetRepoPath))
 			}()
@@ -661,8 +661,8 @@ func remoteHTTPServer(t *testing.T, repoName, httpToken string) (*httptest.Serve
 	return s, fmt.Sprintf("%s/%s.git", s.URL, repoName)
 }
 
-func getRefnames(t *testing.T, repoPath string) []string {
-	result := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "for-each-ref", "--format", "%(refname:lstrip=2)")
+func getRefnames(t *testing.T, cfg config.Cfg, repoPath string) []string {
+	result := gittest.Exec(t, cfg, "-C", repoPath, "for-each-ref", "--format", "%(refname:lstrip=2)")
 	return strings.Split(text.ChompBytes(result), "\n")
 }
 
@@ -708,13 +708,13 @@ func testFetchRemoteOverHTTP(t *testing.T, cfg config.Cfg, rubySrv *rubyserver.S
 				req.RemoteParams.Url = s.URL + tc.remoteURL
 			}
 
-			refs := getRefnames(t, forkedRepoPath)
+			refs := getRefnames(t, cfg, forkedRepoPath)
 			require.True(t, len(refs) > 1, "the advertisement.txt should have deleted all refs except for master")
 
 			_, err := client.FetchRemote(ctx, req)
 			require.NoError(t, err)
 
-			refs = getRefnames(t, forkedRepoPath)
+			refs = getRefnames(t, cfg, forkedRepoPath)
 
 			require.Len(t, refs, 1)
 			assert.Equal(t, "master", refs[0])
diff --git a/internal/gitaly/service/repository/fork_test.go b/internal/gitaly/service/repository/fork_test.go
index 8d0911834..9b71ca3c9 100644
--- a/internal/gitaly/service/repository/fork_test.go
+++ b/internal/gitaly/service/repository/fork_test.go
@@ -14,6 +14,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/backchannel"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/catfile"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/hook"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/rubyserver"
@@ -104,9 +105,9 @@ func TestSuccessfulCreateForkRequest(t *testing.T) {
 			require.NoError(t, err)
 			defer func() { require.NoError(t, os.RemoveAll(forkedRepoPath)) }()
 
-			testhelper.MustRunCommand(t, nil, "git", "-C", forkedRepoPath, "fsck")
+			gittest.Exec(t, cfg, "-C", forkedRepoPath, "fsck")
 
-			remotes := testhelper.MustRunCommand(t, nil, "git", "-C", forkedRepoPath, "remote")
+			remotes := gittest.Exec(t, cfg, "-C", forkedRepoPath, "remote")
 			require.NotContains(t, string(remotes), "origin")
 
 			info, err := os.Lstat(filepath.Join(forkedRepoPath, "hooks"))
diff --git a/internal/gitaly/service/repository/gc_test.go b/internal/gitaly/service/repository/gc_test.go
index 99283d3f9..c54dc521c 100644
--- a/internal/gitaly/service/repository/gc_test.go
+++ b/internal/gitaly/service/repository/gc_test.go
@@ -227,7 +227,7 @@ func TestGarbageCollectFailure(t *testing.T) {
 }
 
 func TestCleanupInvalidKeepAroundRefs(t *testing.T) {
-	_, repo, repoPath, client := setupRepositoryService(t)
+	cfg, repo, repoPath, client := setupRepositoryService(t)
 
 	// Make the directory, so we can create random reflike things in it
 	require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "refs", "keep-around"), 0755))
@@ -275,7 +275,7 @@ func TestCleanupInvalidKeepAroundRefs(t *testing.T) {
 			// Create a proper keep-around loose ref
 			existingSha := "1e292f8fedd741b75372e19097c76d327140c312"
 			existingRefName := fmt.Sprintf("refs/keep-around/%s", existingSha)
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "update-ref", existingRefName, existingSha)
+			gittest.Exec(t, cfg, "-C", repoPath, "update-ref", existingRefName, existingSha)
 
 			// Create an invalid ref that should should be removed with the testcase
 			bogusSha := "b3f5e4adf6277b571b7943a4f0405a6dd7ee7e15"
@@ -292,7 +292,7 @@ func TestCleanupInvalidKeepAroundRefs(t *testing.T) {
 			require.NoError(t, err)
 
 			// The existing keeparound still exists
-			commitSha := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", existingRefName)
+			commitSha := gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", existingRefName)
 			require.Equal(t, existingSha, text.ChompBytes(commitSha))
 
 			//The invalid one was removed
@@ -301,7 +301,7 @@ func TestCleanupInvalidKeepAroundRefs(t *testing.T) {
 
 			if testcase.shouldExist {
 				keepAroundName := fmt.Sprintf("refs/keep-around/%s", testcase.refName)
-				commitSha := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", keepAroundName)
+				commitSha := gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", keepAroundName)
 				require.Equal(t, testcase.refName, text.ChompBytes(commitSha))
 			} else {
 				_, err := os.Stat(refPath)
diff --git a/internal/gitaly/service/repository/optimize_test.go b/internal/gitaly/service/repository/optimize_test.go
index c114ef6e3..51f25425e 100644
--- a/internal/gitaly/service/repository/optimize_test.go
+++ b/internal/gitaly/service/repository/optimize_test.go
@@ -42,7 +42,7 @@ func getNewestPackfileModtime(t *testing.T, repoPath string) time.Time {
 func TestOptimizeRepository(t *testing.T) {
 	cfg, repo, repoPath, client := setupRepositoryService(t)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "repack", "-A", "-b")
+	gittest.Exec(t, cfg, "-C", repoPath, "repack", "-A", "-b")
 
 	ctx, cancel := testhelper.Context()
 	defer cancel()
@@ -56,13 +56,13 @@ func TestOptimizeRepository(t *testing.T) {
 
 	gittest.WriteCommit(t, cfg, repoPath, gittest.WithBranch("master"))
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "http.http://localhost:51744/60631c8695bf041a808759a05de53e36a73316aacb502824fabbb0c6055637c1.git.extraHeader", "Authorization: Basic secret-password")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "http.http://localhost:51744/60631c8695bf041a808759a05de53e36a73316aacb502824fabbb0c6055637c2.git.extraHeader", "Authorization: Basic secret-password")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "randomStart-http.http://localhost:51744/60631c8695bf041a808759a05de53e36a73316aacb502824fabbb0c6055637c3.git.extraHeader", "Authorization: Basic secret-password")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "http.http://localhost:51744/60631c8695bf041a808759a05de53e36a73316aacb502824fabbb0c6055637c4.git.extraHeader-randomEnd", "Authorization: Basic secret-password")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "hTTp.http://localhost:51744/60631c8695bf041a808759a05de53e36a73316aacb502824fabbb0c6055637c5.git.ExtrAheaDeR", "Authorization: Basic secret-password")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "http.http://extraHeader/extraheader/EXTRAHEADER.git.extraHeader", "Authorization: Basic secret-password")
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "config", "https.https://localhost:51744/60631c8695bf041a808759a05de53e36a73316aacb502824fabbb0c6055637c5.git.extraHeader", "Authorization: Basic secret-password")
+	gittest.Exec(t, cfg, "-C", repoPath, "config", "http.http://localhost:51744/60631c8695bf041a808759a05de53e36a73316aacb502824fabbb0c6055637c1.git.extraHeader", "Authorization: Basic secret-password")
+	gittest.Exec(t, cfg, "-C", repoPath, "config", "http.http://localhost:51744/60631c8695bf041a808759a05de53e36a73316aacb502824fabbb0c6055637c2.git.extraHeader", "Authorization: Basic secret-password")
+	gittest.Exec(t, cfg, "-C", repoPath, "config", "randomStart-http.http://localhost:51744/60631c8695bf041a808759a05de53e36a73316aacb502824fabbb0c6055637c3.git.extraHeader", "Authorization: Basic secret-password")
+	gittest.Exec(t, cfg, "-C", repoPath, "config", "http.http://localhost:51744/60631c8695bf041a808759a05de53e36a73316aacb502824fabbb0c6055637c4.git.extraHeader-randomEnd", "Authorization: Basic secret-password")
+	gittest.Exec(t, cfg, "-C", repoPath, "config", "hTTp.http://localhost:51744/60631c8695bf041a808759a05de53e36a73316aacb502824fabbb0c6055637c5.git.ExtrAheaDeR", "Authorization: Basic secret-password")
+	gittest.Exec(t, cfg, "-C", repoPath, "config", "http.http://extraHeader/extraheader/EXTRAHEADER.git.extraHeader", "Authorization: Basic secret-password")
+	gittest.Exec(t, cfg, "-C", repoPath, "config", "https.https://localhost:51744/60631c8695bf041a808759a05de53e36a73316aacb502824fabbb0c6055637c5.git.extraHeader", "Authorization: Basic secret-password")
 	confFileData, err := ioutil.ReadFile(filepath.Join(repoPath, "config"))
 	require.NoError(t, err)
 	require.True(t, bytes.Contains(confFileData, []byte("http://localhost:51744/60631c8695bf041a808759a05de53e36a73316aacb502824fabbb0c6055637c1.git")))
diff --git a/internal/gitaly/service/repository/rebase_in_progress_test.go b/internal/gitaly/service/repository/rebase_in_progress_test.go
index d168de7f5..c552392c2 100644
--- a/internal/gitaly/service/repository/rebase_in_progress_test.go
+++ b/internal/gitaly/service/repository/rebase_in_progress_test.go
@@ -17,15 +17,15 @@ import (
 func TestSuccessfulIsRebaseInProgressRequest(t *testing.T) {
 	cfg, repo1, repoPath1, client := setupRepositoryService(t)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath1, "worktree", "add", "--detach", filepath.Join(repoPath1, worktreePrefix, fmt.Sprintf("%s-1", rebaseWorktreePrefix)), "master")
+	gittest.Exec(t, cfg, "-C", repoPath1, "worktree", "add", "--detach", filepath.Join(repoPath1, worktreePrefix, fmt.Sprintf("%s-1", rebaseWorktreePrefix)), "master")
 
 	brokenPath := filepath.Join(repoPath1, worktreePrefix, fmt.Sprintf("%s-2", rebaseWorktreePrefix))
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath1, "worktree", "add", "--detach", brokenPath, "master")
+	gittest.Exec(t, cfg, "-C", repoPath1, "worktree", "add", "--detach", brokenPath, "master")
 	require.NoError(t, os.Chmod(brokenPath, 0))
 	require.NoError(t, os.Chtimes(brokenPath, time.Now(), time.Now().Add(-16*time.Minute)))
 
 	oldPath := filepath.Join(repoPath1, worktreePrefix, fmt.Sprintf("%s-3", rebaseWorktreePrefix))
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath1, "worktree", "add", "--detach", oldPath, "master")
+	gittest.Exec(t, cfg, "-C", repoPath1, "worktree", "add", "--detach", oldPath, "master")
 	require.NoError(t, os.Chtimes(oldPath, time.Now(), time.Now().Add(-16*time.Minute)))
 
 	repo2, _, cleanupFn := gittest.CloneRepoAtStorage(t, cfg.Storages[0], "second")
diff --git a/internal/gitaly/service/repository/repack_test.go b/internal/gitaly/service/repository/repack_test.go
index 7f2fa4a78..3c496d8ae 100644
--- a/internal/gitaly/service/repository/repack_test.go
+++ b/internal/gitaly/service/repository/repack_test.go
@@ -81,7 +81,7 @@ func TestRepackLocal(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, packFiles, 1)
 
-	packContents := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "verify-pack", "-v", packFiles[0])
+	packContents := gittest.Exec(t, cfg, "-C", repoPath, "verify-pack", "-v", packFiles[0])
 	require.NotContains(t, string(packContents), string(altDirsCommit))
 	require.Contains(t, string(packContents), repoCommit)
 }
diff --git a/internal/gitaly/service/repository/replicate_test.go b/internal/gitaly/service/repository/replicate_test.go
index 3b2c46df4..b984e0122 100644
--- a/internal/gitaly/service/repository/replicate_test.go
+++ b/internal/gitaly/service/repository/replicate_test.go
@@ -40,7 +40,7 @@ func TestReplicateRepository(t *testing.T) {
 	// create a loose object to ensure snapshot replication is used
 	blobData, err := text.RandomHex(10)
 	require.NoError(t, err)
-	blobID := text.ChompBytes(testhelper.MustRunCommand(t, bytes.NewBuffer([]byte(blobData)), "git", "-C", repoPath, "hash-object", "-w", "--stdin"))
+	blobID := text.ChompBytes(gittest.ExecStream(t, cfg, bytes.NewBuffer([]byte(blobData)), "-C", repoPath, "hash-object", "-w", "--stdin"))
 
 	// write info attributes
 	attrFilePath := filepath.Join(repoPath, "info", "attributes")
@@ -62,7 +62,7 @@ func TestReplicateRepository(t *testing.T) {
 	require.NoError(t, err)
 
 	targetRepoPath := filepath.Join(cfg.Storages[1].Path, targetRepo.GetRelativePath())
-	testhelper.MustRunCommand(t, nil, "git", "-C", targetRepoPath, "fsck")
+	gittest.Exec(t, cfg, "-C", targetRepoPath, "fsck")
 
 	replicatedAttrFilePath := filepath.Join(targetRepoPath, "info", "attributes")
 	replicatedAttrData, err := ioutil.ReadFile(replicatedAttrFilePath)
@@ -77,12 +77,12 @@ func TestReplicateRepository(t *testing.T) {
 	})
 	require.NoError(t, err)
 	require.Equal(t,
-		testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "show-ref", "--hash", "--verify", "refs/heads/branch"),
-		testhelper.MustRunCommand(t, nil, "git", "-C", targetRepoPath, "show-ref", "--hash", "--verify", "refs/heads/branch"),
+		gittest.Exec(t, cfg, "-C", repoPath, "show-ref", "--hash", "--verify", "refs/heads/branch"),
+		gittest.Exec(t, cfg, "-C", targetRepoPath, "show-ref", "--hash", "--verify", "refs/heads/branch"),
 	)
 
 	// if an unreachable object has been replicated, that means snapshot replication was used
-	testhelper.MustRunCommand(t, nil, "git", "-C", targetRepoPath, "cat-file", "-p", blobID)
+	gittest.Exec(t, cfg, "-C", targetRepoPath, "cat-file", "-p", blobID)
 }
 
 func TestReplicateRepositoryInvalidArguments(t *testing.T) {
@@ -251,7 +251,7 @@ func TestReplicateRepository_BadRepository(t *testing.T) {
 			}
 
 			require.NoError(t, err)
-			testhelper.MustRunCommand(t, nil, "git", "-C", targetRepoPath, "fsck")
+			gittest.Exec(t, cfg, "-C", targetRepoPath, "fsck")
 		})
 	}
 }
diff --git a/internal/gitaly/service/repository/repository_test.go b/internal/gitaly/service/repository/repository_test.go
index e68bda64b..b415f259b 100644
--- a/internal/gitaly/service/repository/repository_test.go
+++ b/internal/gitaly/service/repository/repository_test.go
@@ -116,7 +116,7 @@ func TestSuccessfulHasLocalBranches(t *testing.T) {
 
 	emptyRepoName := "empty-repo.git"
 	emptyRepoPath := filepath.Join(cfg.Storages[0].Path, emptyRepoName)
-	testhelper.MustRunCommand(t, nil, "git", "init", "--bare", emptyRepoPath)
+	gittest.Exec(t, cfg, "init", "--bare", emptyRepoPath)
 	defer os.RemoveAll(emptyRepoPath)
 
 	testCases := []struct {
diff --git a/internal/gitaly/service/repository/search_files_test.go b/internal/gitaly/service/repository/search_files_test.go
index cfaf90dc5..32da79044 100644
--- a/internal/gitaly/service/repository/search_files_test.go
+++ b/internal/gitaly/service/repository/search_files_test.go
@@ -13,6 +13,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/backchannel"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/catfile"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/transaction"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
@@ -151,7 +152,7 @@ func TestSearchFilesByContentLargeFile(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	_, repo, repoPath, client := setupRepositoryServiceWithWorktree(t)
+	cfg, repo, repoPath, client := setupRepositoryServiceWithWorktree(t)
 
 	committerName := "Scrooge McDuck"
 	committerEmail := "scrooge@mcduck.com"
@@ -179,8 +180,8 @@ func TestSearchFilesByContentLargeFile(t *testing.T) {
 	for _, largeFile := range largeFiles {
 		t.Run(largeFile.filename, func(t *testing.T) {
 			require.NoError(t, ioutil.WriteFile(filepath.Join(repoPath, largeFile.filename), bytes.Repeat([]byte(largeFile.line), largeFile.repeated), 0644))
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "add", ".")
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoPath,
+			gittest.Exec(t, cfg, "-C", repoPath, "add", ".")
+			gittest.Exec(t, cfg, "-C", repoPath,
 				"-c", fmt.Sprintf("user.name=%s", committerName),
 				"-c", fmt.Sprintf("user.email=%s", committerEmail), "commit", "-m", "large file commit", "--", largeFile.filename)
 
diff --git a/internal/gitaly/service/repository/snapshot_test.go b/internal/gitaly/service/repository/snapshot_test.go
index c7281c923..86ba8a765 100644
--- a/internal/gitaly/service/repository/snapshot_test.go
+++ b/internal/gitaly/service/repository/snapshot_test.go
@@ -158,8 +158,8 @@ func TestGetSnapshotWithDedupe(t *testing.T) {
 			defer cleanupCopy()
 
 			// ensure the sha committed to the alternates directory can be accessed
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoCopyPath, "cat-file", "-p", originalAlternatesCommit)
-			testhelper.MustRunCommand(t, nil, "git", "-C", repoCopyPath, "fsck")
+			gittest.Exec(t, cfg, "-C", repoCopyPath, "cat-file", "-p", originalAlternatesCommit)
+			gittest.Exec(t, cfg, "-C", repoCopyPath, "fsck")
 		})
 	}
 }
@@ -217,8 +217,8 @@ func TestGetSnapshotWithDedupeSoftFailures(t *testing.T) {
 	defer cleanupCopy()
 
 	// ensure the sha committed to the alternates directory can be accessed
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoCopyPath, "cat-file", "-p", originalAlternatesCommit)
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoCopyPath, "fsck")
+	gittest.Exec(t, cfg, "-C", repoCopyPath, "cat-file", "-p", originalAlternatesCommit)
+	gittest.Exec(t, cfg, "-C", repoCopyPath, "fsck")
 }
 
 // copyRepoUsingSnapshot creates a tarball snapshot, then creates a new repository from that snapshot
diff --git a/internal/gitaly/service/repository/squash_in_progress_test.go b/internal/gitaly/service/repository/squash_in_progress_test.go
index 28f3ed2ce..e75079046 100644
--- a/internal/gitaly/service/repository/squash_in_progress_test.go
+++ b/internal/gitaly/service/repository/squash_in_progress_test.go
@@ -14,7 +14,7 @@ import (
 func TestSuccessfulIsSquashInProgressRequest(t *testing.T) {
 	cfg, repo, repoPath, client := setupRepositoryService(t)
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "worktree", "add", "--detach", filepath.Join(repoPath, worktreePrefix, "squash-1"), "master")
+	gittest.Exec(t, cfg, "-C", repoPath, "worktree", "add", "--detach", filepath.Join(repoPath, worktreePrefix, "squash-1"), "master")
 
 	repoCopy, _, cleanupFn := gittest.CloneRepoAtStorage(t, cfg.Storages[0], "copy")
 	defer cleanupFn()
diff --git a/internal/gitaly/service/repository/write_ref_test.go b/internal/gitaly/service/repository/write_ref_test.go
index ddfbf0ac7..e538a29f0 100644
--- a/internal/gitaly/service/repository/write_ref_test.go
+++ b/internal/gitaly/service/repository/write_ref_test.go
@@ -6,13 +6,14 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"google.golang.org/grpc/codes"
 )
 
 func TestWriteRefSuccessful(t *testing.T) {
-	_, repo, repoPath, client := setupRepositoryService(t)
+	cfg, repo, repoPath, client := setupRepositoryService(t)
 
 	testCases := []struct {
 		desc string
@@ -61,7 +62,7 @@ func TestWriteRefSuccessful(t *testing.T) {
 				require.EqualValues(t, content, refRevision)
 				return
 			}
-			rev := testhelper.MustRunCommand(t, nil, "git", "--git-dir", repoPath, "log", "--pretty=%H", "-1", string(tc.req.Ref))
+			rev := gittest.Exec(t, cfg, "--git-dir", repoPath, "log", "--pretty=%H", "-1", string(tc.req.Ref))
 
 			rev = bytes.Replace(rev, []byte("\n"), nil, 1)
 
diff --git a/internal/gitaly/service/smarthttp/receive_pack_test.go b/internal/gitaly/service/smarthttp/receive_pack_test.go
index ab109ffc3..0727c0350 100644
--- a/internal/gitaly/service/smarthttp/receive_pack_test.go
+++ b/internal/gitaly/service/smarthttp/receive_pack_test.go
@@ -70,7 +70,7 @@ func TestSuccessfulReceivePackRequest(t *testing.T) {
 	require.Equal(t, expectedResponse, string(response), "Expected response to be %q, got %q", expectedResponse, response)
 
 	// The fact that this command succeeds means that we got the commit correctly, no further checks should be needed.
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "show", push.newHead)
+	gittest.Exec(t, cfg, "-C", repoPath, "show", push.newHead)
 
 	envData, err := ioutil.ReadFile(hookOutputFile)
 	require.NoError(t, err, "get git env data")
@@ -138,7 +138,7 @@ func TestReceivePackHiddenRefs(t *testing.T) {
 
 			// The options passed are the same ones used when doing an actual push.
 			revisions := strings.NewReader(fmt.Sprintf("^%s\n%s\n", oldHead, newHead))
-			pack := testhelper.MustRunCommand(t, revisions, "git", "-C", repoPath, "pack-objects", "--stdout", "--revs", "--thin", "--delta-base-offset", "-q")
+			pack := gittest.ExecStream(t, cfg, revisions, "-C", repoPath, "pack-objects", "--stdout", "--revs", "--thin", "--delta-base-offset", "-q")
 			request.Write(pack)
 
 			stream, err := client.PostReceivePack(ctx)
@@ -179,7 +179,7 @@ func TestSuccessfulReceivePackRequestWithGitProtocol(t *testing.T) {
 	require.Equal(t, fmt.Sprintf("GIT_PROTOCOL=%s\n", git.ProtocolV2), envData)
 
 	// The fact that this command succeeds means that we got the commit correctly, no further checks should be needed.
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "show", push.newHead)
+	gittest.Exec(t, cfg, "-C", repoPath, "show", push.newHead)
 }
 
 func TestFailedReceivePackRequestWithGitOpts(t *testing.T) {
@@ -269,7 +269,7 @@ func newTestPush(t *testing.T, cfg config.Cfg, fileContents []byte) *pushData {
 	_, repoPath, localCleanup := gittest.CloneRepoWithWorktreeAtStorage(t, cfg, cfg.Storages[0])
 	defer localCleanup()
 
-	oldHead, newHead := createCommit(t, repoPath, fileContents)
+	oldHead, newHead := createCommit(t, cfg, repoPath, fileContents)
 
 	// ReceivePack request is a packet line followed by a packet flush, then the pack file of the objects we want to push.
 	// This is explained a bit in https://git-scm.com/book/en/v2/Git-Internals-Transfer-Protocols#_uploading_data
@@ -291,7 +291,7 @@ func newTestPush(t *testing.T, cfg config.Cfg, fileContents []byte) *pushData {
 	stdin := strings.NewReader(fmt.Sprintf("^%s\n%s\n", oldHead, newHead))
 
 	// The options passed are the same ones used when doing an actual push.
-	pack := testhelper.MustRunCommand(t, stdin, "git", "-C", repoPath, "pack-objects", "--stdout", "--revs", "--thin", "--delta-base-offset", "-q")
+	pack := gittest.ExecStream(t, cfg, stdin, "-C", repoPath, "pack-objects", "--stdout", "--revs", "--thin", "--delta-base-offset", "-q")
 	requestBuffer.Write(pack)
 
 	return &pushData{newHead: newHead, body: requestBuffer}
@@ -299,25 +299,25 @@ func newTestPush(t *testing.T, cfg config.Cfg, fileContents []byte) *pushData {
 
 // createCommit creates a commit on HEAD with a file containing the
 // specified contents.
-func createCommit(t *testing.T, repoPath string, fileContents []byte) (oldHead string, newHead string) {
+func createCommit(t *testing.T, cfg config.Cfg, repoPath string, fileContents []byte) (oldHead string, newHead string) {
 	commitMsg := fmt.Sprintf("Testing ReceivePack RPC around %d", time.Now().Unix())
 	committerName := "Scrooge McDuck"
 	committerEmail := "scrooge@mcduck.com"
 
 	// The latest commit ID on the remote repo
-	oldHead = text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "master"))
+	oldHead = text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "master"))
 
 	changedFile := "README.md"
 	require.NoError(t, ioutil.WriteFile(filepath.Join(repoPath, changedFile), fileContents, 0644))
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "add", changedFile)
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath,
+	gittest.Exec(t, cfg, "-C", repoPath, "add", changedFile)
+	gittest.Exec(t, cfg, "-C", repoPath,
 		"-c", fmt.Sprintf("user.name=%s", committerName),
 		"-c", fmt.Sprintf("user.email=%s", committerEmail),
 		"commit", "-m", commitMsg)
 
 	// The commit ID we want to push to the remote repo
-	newHead = text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "master"))
+	newHead = text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "master"))
 
 	return oldHead, newHead
 }
@@ -359,8 +359,8 @@ func TestInvalidTimezone(t *testing.T) {
 	_, localRepoPath, localCleanup := gittest.CloneRepoWithWorktreeAtStorage(t, cfg, cfg.Storages[0])
 	defer localCleanup()
 
-	head := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", localRepoPath, "rev-parse", "HEAD"))
-	tree := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", localRepoPath, "rev-parse", "HEAD^{tree}"))
+	head := text.ChompBytes(gittest.Exec(t, cfg, "-C", localRepoPath, "rev-parse", "HEAD"))
+	tree := text.ChompBytes(gittest.Exec(t, cfg, "-C", localRepoPath, "rev-parse", "HEAD^{tree}"))
 
 	buf := new(bytes.Buffer)
 	buf.WriteString("tree " + tree + "\n")
@@ -369,10 +369,10 @@ func TestInvalidTimezone(t *testing.T) {
 	buf.WriteString("committer Au Thor <author@example.com> 1313584730 +051800\n")
 	buf.WriteString("\n")
 	buf.WriteString("Commit message\n")
-	commit := text.ChompBytes(testhelper.MustRunCommand(t, buf, "git", "-C", localRepoPath, "hash-object", "-t", "commit", "--stdin", "-w"))
+	commit := text.ChompBytes(gittest.ExecStream(t, cfg, buf, "-C", localRepoPath, "hash-object", "-t", "commit", "--stdin", "-w"))
 
 	stdin := strings.NewReader(fmt.Sprintf("^%s\n%s\n", head, commit))
-	pack := testhelper.MustRunCommand(t, stdin, "git", "-C", localRepoPath, "pack-objects", "--stdout", "--revs", "--thin", "--delta-base-offset", "-q")
+	pack := gittest.ExecStream(t, cfg, stdin, "-C", localRepoPath, "pack-objects", "--stdout", "--revs", "--thin", "--delta-base-offset", "-q")
 
 	pkt := fmt.Sprintf("%s %s refs/heads/master\x00 %s", head, commit, "report-status side-band-64k agent=git/2.12.0")
 	body := &bytes.Buffer{}
@@ -402,7 +402,7 @@ func TestInvalidTimezone(t *testing.T) {
 
 	expectedResponse := "0030\x01000eunpack ok\n0019ok refs/heads/master\n00000000"
 	require.Equal(t, expectedResponse, string(response), "Expected response to be %q, got %q", expectedResponse, response)
-	testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "show", commit)
+	gittest.Exec(t, cfg, "-C", repoPath, "show", commit)
 }
 
 func TestReceivePackFsck(t *testing.T) {
@@ -475,7 +475,7 @@ func TestPostReceivePackToHooks(t *testing.T) {
 
 	push := newTestPush(t, cfg, nil)
 	testRepoPath := filepath.Join(cfg.Storages[0].Path, repo.RelativePath)
-	oldHead := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", testRepoPath, "rev-parse", "HEAD"))
+	oldHead := text.ChompBytes(gittest.Exec(t, cfg, "-C", testRepoPath, "rev-parse", "HEAD"))
 
 	changes := fmt.Sprintf("%s %s refs/heads/master\n", oldHead, push.newHead)
 
@@ -646,9 +646,9 @@ func TestPostReceiveWithReferenceTransactionHook(t *testing.T) {
 		// this used to generate two transactions: one for the packed-refs file and one for
 		// the loose ref. We only expect a single transaction though, given that the
 		// packed-refs transaction should get filtered out.
-		testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "branch", "delete-me")
-		testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "pack-refs", "--all")
-		branchOID := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "refs/heads/delete-me"))
+		gittest.Exec(t, cfg, "-C", repoPath, "branch", "delete-me")
+		gittest.Exec(t, cfg, "-C", repoPath, "pack-refs", "--all")
+		branchOID := text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "refs/heads/delete-me"))
 
 		uploadPackData := &bytes.Buffer{}
 		gittest.WritePktlineString(t, uploadPackData, fmt.Sprintf("%s %s refs/heads/delete-me\x00 %s", branchOID, git.ZeroOID.String(), uploadPackCapabilities))
diff --git a/internal/gitaly/service/smarthttp/upload_pack_test.go b/internal/gitaly/service/smarthttp/upload_pack_test.go
index d79a49704..b9c6d73ed 100644
--- a/internal/gitaly/service/smarthttp/upload_pack_test.go
+++ b/internal/gitaly/service/smarthttp/upload_pack_test.go
@@ -47,9 +47,9 @@ func TestSuccessfulUploadPackRequest(t *testing.T) {
 	localRepoPath := filepath.Join(storagePath, localRepoRelativePath)
 	testRepoPath := filepath.Join(storagePath, repo.RelativePath)
 	// Make a non-bare clone of the test repo to act as a remote one
-	testhelper.MustRunCommand(t, nil, "git", "clone", testRepoPath, remoteRepoPath)
+	gittest.Exec(t, cfg, "clone", testRepoPath, remoteRepoPath)
 	// Make a bare clone of the test repo to act as a local one and to leave the original repo intact for other tests
-	testhelper.MustRunCommand(t, nil, "git", "clone", "--bare", testRepoPath, localRepoPath)
+	gittest.Exec(t, cfg, "clone", "--bare", testRepoPath, localRepoPath)
 	defer os.RemoveAll(localRepoPath)
 	defer os.RemoveAll(remoteRepoPath)
 
@@ -58,15 +58,15 @@ func TestSuccessfulUploadPackRequest(t *testing.T) {
 	committerEmail := "scrooge@mcduck.com"
 
 	// The latest commit ID on the local repo
-	oldHead := bytes.TrimSpace(testhelper.MustRunCommand(t, nil, "git", "-C", remoteRepoPath, "rev-parse", "master"))
+	oldHead := bytes.TrimSpace(gittest.Exec(t, cfg, "-C", remoteRepoPath, "rev-parse", "master"))
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", remoteRepoPath,
+	gittest.Exec(t, cfg, "-C", remoteRepoPath,
 		"-c", fmt.Sprintf("user.name=%s", committerName),
 		"-c", fmt.Sprintf("user.email=%s", committerEmail),
 		"commit", "--allow-empty", "-m", commitMsg)
 
 	// The commit ID we want to pull from the remote repo
-	newHead := bytes.TrimSpace(testhelper.MustRunCommand(t, nil, "git", "-C", remoteRepoPath, "rev-parse", "master"))
+	newHead := bytes.TrimSpace(gittest.Exec(t, cfg, "-C", remoteRepoPath, "rev-parse", "master"))
 
 	// UploadPack request is a "want" packet line followed by a packet flush, then many "have" packets followed by a packet flush.
 	// This is explained a bit in https://git-scm.com/book/en/v2/Git-Internals-Transfer-Protocols#_downloading_data
@@ -90,10 +90,10 @@ func TestSuccessfulUploadPackRequest(t *testing.T) {
 	pack, version, entries := extractPackDataFromResponse(t, responseBuffer)
 	require.NotNil(t, pack, "Expected to find a pack file in response, found none")
 
-	testhelper.MustRunCommand(t, bytes.NewReader(pack), "git", "-C", localRepoPath, "unpack-objects", fmt.Sprintf("--pack_header=%d,%d", version, entries))
+	gittest.ExecStream(t, cfg, bytes.NewReader(pack), "-C", localRepoPath, "unpack-objects", fmt.Sprintf("--pack_header=%d,%d", version, entries))
 
 	// The fact that this command succeeds means that we got the commit correctly, no further checks should be needed.
-	testhelper.MustRunCommand(t, nil, "git", "-C", localRepoPath, "show", string(newHead))
+	gittest.Exec(t, cfg, "-C", localRepoPath, "show", string(newHead))
 
 	metric, err := negotiationMetrics.GetMetricWithLabelValues("have")
 	require.NoError(t, err)
@@ -115,18 +115,18 @@ func TestUploadPackRequestWithGitConfigOptions(t *testing.T) {
 	testRepoPath := filepath.Join(storagePath, repo.RelativePath)
 
 	// Make a clone of the test repo to modify
-	testhelper.MustRunCommand(t, nil, "git", "clone", "--bare", testRepoPath, ourRepoPath)
+	gittest.Exec(t, cfg, "clone", "--bare", testRepoPath, ourRepoPath)
 	defer os.RemoveAll(ourRepoPath)
 
 	// Remove remote-tracking branches that get in the way for this test
-	testhelper.MustRunCommand(t, nil, "git", "-C", ourRepoPath, "remote", "remove", "origin")
+	gittest.Exec(t, cfg, "-C", ourRepoPath, "remote", "remove", "origin")
 
 	// Turn the csv branch into a hidden ref
-	want := string(bytes.TrimSpace(testhelper.MustRunCommand(t, nil, "git", "-C", ourRepoPath, "rev-parse", "refs/heads/csv")))
-	testhelper.MustRunCommand(t, nil, "git", "-C", ourRepoPath, "update-ref", "refs/hidden/csv", want)
-	testhelper.MustRunCommand(t, nil, "git", "-C", ourRepoPath, "update-ref", "-d", "refs/heads/csv")
+	want := string(bytes.TrimSpace(gittest.Exec(t, cfg, "-C", ourRepoPath, "rev-parse", "refs/heads/csv")))
+	gittest.Exec(t, cfg, "-C", ourRepoPath, "update-ref", "refs/hidden/csv", want)
+	gittest.Exec(t, cfg, "-C", ourRepoPath, "update-ref", "-d", "refs/heads/csv")
 
-	have := string(bytes.TrimSpace(testhelper.MustRunCommand(t, nil, "git", "-C", ourRepoPath, "rev-parse", want+"~1")))
+	have := string(bytes.TrimSpace(gittest.Exec(t, cfg, "-C", ourRepoPath, "rev-parse", want+"~1")))
 
 	requestBody := &bytes.Buffer{}
 	requestBodyCopy := &bytes.Buffer{}
@@ -244,8 +244,8 @@ func TestUploadPackWithPackObjectsHook(t *testing.T) {
 
 	serverSocketPath := runSmartHTTPServer(t, cfg)
 
-	oldHead := bytes.TrimSpace(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "master~"))
-	newHead := bytes.TrimSpace(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "master"))
+	oldHead := bytes.TrimSpace(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "master~"))
+	newHead := bytes.TrimSpace(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "master"))
 
 	requestBuffer := &bytes.Buffer{}
 	gittest.WritePktlineString(t, requestBuffer, fmt.Sprintf("want %s %s\n", newHead, clientCapabilities))
@@ -371,9 +371,9 @@ func TestUploadPackRequestForPartialCloneSuccess(t *testing.T) {
 	remoteRepoPath := filepath.Join(storagePath, remoteRepoRelativePath)
 	localRepoPath := filepath.Join(storagePath, localRepoRelativePath)
 	// Make a non-bare clone of the test repo to act as a remote one
-	testhelper.MustRunCommand(t, nil, "git", "clone", repoPath, remoteRepoPath)
+	gittest.Exec(t, cfg, "clone", repoPath, remoteRepoPath)
 	// Make a bare clone of the test repo to act as a local one and to leave the original repo intact for other tests
-	testhelper.MustRunCommand(t, nil, "git", "init", "--bare", localRepoPath)
+	gittest.Exec(t, cfg, "init", "--bare", localRepoPath)
 
 	defer os.RemoveAll(localRepoPath)
 	defer os.RemoveAll(remoteRepoPath)
@@ -382,13 +382,13 @@ func TestUploadPackRequestForPartialCloneSuccess(t *testing.T) {
 	committerName := "Scrooge McDuck"
 	committerEmail := "scrooge@mcduck.com"
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", remoteRepoPath,
+	gittest.Exec(t, cfg, "-C", remoteRepoPath,
 		"-c", fmt.Sprintf("user.name=%s", committerName),
 		"-c", fmt.Sprintf("user.email=%s", committerEmail),
 		"commit", "--allow-empty", "-m", commitMsg)
 
 	// The commit ID we want to pull from the remote repo
-	newHead := bytes.TrimSpace(testhelper.MustRunCommand(t, nil, "git", "-C", remoteRepoPath, "rev-parse", "master"))
+	newHead := bytes.TrimSpace(gittest.Exec(t, cfg, "-C", remoteRepoPath, "rev-parse", "master"))
 	// The commit ID we want to pull from the remote repo
 
 	// UploadPack request is a "want" packet line followed by a packet flush, then many "have" packets followed by a packet flush.
@@ -414,7 +414,7 @@ func TestUploadPackRequestForPartialCloneSuccess(t *testing.T) {
 	pack, version, entries := extractPackDataFromResponse(t, responseBuffer)
 	require.NotNil(t, pack, "Expected to find a pack file in response, found none")
 
-	testhelper.MustRunCommand(t, bytes.NewReader(pack), "git", "-C", localRepoPath, "unpack-objects", fmt.Sprintf("--pack_header=%d,%d", version, entries))
+	gittest.ExecStream(t, cfg, bytes.NewReader(pack), "-C", localRepoPath, "unpack-objects", fmt.Sprintf("--pack_header=%d,%d", version, entries))
 
 	// a4a132b1b0d6720ca9254440a7ba8a6b9bbd69ec is README.md, which is a small file
 	blobLessThanLimit := "a4a132b1b0d6720ca9254440a7ba8a6b9bbd69ec"
@@ -430,7 +430,7 @@ func TestUploadPackRequestForPartialCloneSuccess(t *testing.T) {
 	newHead = []byte(gittest.WriteCommit(t, cfg, remoteRepoPath, gittest.WithBranch(newBranch)))
 
 	// after we delete the branch, we have a dangling commit
-	testhelper.MustRunCommand(t, nil, "git", "-C", remoteRepoPath, "branch", "-D", newBranch)
+	gittest.Exec(t, cfg, "-C", remoteRepoPath, "branch", "-D", newBranch)
 
 	requestBuffer.Reset()
 	gittest.WritePktlineString(t, &requestBuffer, fmt.Sprintf("want %s %s\n", string(newHead), clientCapabilities))
diff --git a/internal/gitaly/service/ssh/receive_pack_test.go b/internal/gitaly/service/ssh/receive_pack_test.go
index 550c9c923..3e75b239e 100644
--- a/internal/gitaly/service/ssh/receive_pack_test.go
+++ b/internal/gitaly/service/ssh/receive_pack_test.go
@@ -490,7 +490,7 @@ func TestSSHReceivePackToHooks(t *testing.T) {
 
 	cfg.GitlabShell.Dir = tempGitlabShellDir
 
-	cloneDetails, cleanup := setupSSHClone(t, cfg.Storages[0].Path, repo)
+	cloneDetails, cleanup := setupSSHClone(t, cfg, cfg.Storages[0].Path, repo)
 	defer cleanup()
 
 	serverURL, cleanup := testhelper.NewGitlabTestServer(t, testhelper.GitlabTestServerOptions{
@@ -535,7 +535,7 @@ type SSHCloneDetails struct {
 }
 
 // setupSSHClone sets up a test clone
-func setupSSHClone(t *testing.T, storagePath string, testRepo *gitalypb.Repository) (SSHCloneDetails, func()) {
+func setupSSHClone(t *testing.T, cfg config.Cfg, storagePath string, testRepo *gitalypb.Repository) (SSHCloneDetails, func()) {
 	tempRepo := "gitlab-test-ssh-receive-pack.git"
 	testRepoPath := filepath.Join(storagePath, testRepo.GetRelativePath())
 	remoteRepoPath := filepath.Join(storagePath, tempRepo)
@@ -544,15 +544,15 @@ func setupSSHClone(t *testing.T, storagePath string, testRepo *gitalypb.Reposito
 	if err := os.RemoveAll(remoteRepoPath); err != nil && !os.IsNotExist(err) {
 		t.Fatal(err)
 	}
-	testhelper.MustRunCommand(t, nil, "git", "clone", "--bare", testRepoPath, remoteRepoPath)
+	gittest.Exec(t, cfg, "clone", "--bare", testRepoPath, remoteRepoPath)
 	// Make a non-bare clone of the test repo to act as a local one
 	if err := os.RemoveAll(localRepoPath); err != nil && !os.IsNotExist(err) {
 		t.Fatal(err)
 	}
-	testhelper.MustRunCommand(t, nil, "git", "clone", remoteRepoPath, localRepoPath)
+	gittest.Exec(t, cfg, "clone", remoteRepoPath, localRepoPath)
 
 	// We need git thinking we're pushing over SSH...
-	oldHead, newHead, success := makeCommit(t, localRepoPath)
+	oldHead, newHead, success := makeCommit(t, cfg, localRepoPath)
 	require.True(t, success)
 
 	return SSHCloneDetails{
@@ -601,21 +601,21 @@ func sshPush(t *testing.T, cfg config.Cfg, cloneDetails SSHCloneDetails, serverS
 		return "", "", fmt.Errorf("failed to run `git push`: %q", out)
 	}
 
-	localHead := bytes.TrimSpace(testhelper.MustRunCommand(t, nil, "git", "-C", cloneDetails.LocalRepoPath, "rev-parse", "master"))
-	remoteHead := bytes.TrimSpace(testhelper.MustRunCommand(t, nil, "git", "-C", cloneDetails.RemoteRepoPath, "rev-parse", "master"))
+	localHead := bytes.TrimSpace(gittest.Exec(t, cfg, "-C", cloneDetails.LocalRepoPath, "rev-parse", "master"))
+	remoteHead := bytes.TrimSpace(gittest.Exec(t, cfg, "-C", cloneDetails.RemoteRepoPath, "rev-parse", "master"))
 
 	return string(localHead), string(remoteHead), nil
 }
 
 func testCloneAndPush(t *testing.T, cfg config.Cfg, storagePath, serverSocketPath string, testRepo *gitalypb.Repository, params pushParams) (string, string, error) {
-	cloneDetails, cleanup := setupSSHClone(t, storagePath, testRepo)
+	cloneDetails, cleanup := setupSSHClone(t, cfg, storagePath, testRepo)
 	defer cleanup()
 
 	return sshPush(t, cfg, cloneDetails, serverSocketPath, params)
 }
 
 // makeCommit creates a new commit and returns oldHead, newHead, success
-func makeCommit(t *testing.T, localRepoPath string) ([]byte, []byte, bool) {
+func makeCommit(t *testing.T, cfg config.Cfg, localRepoPath string) ([]byte, []byte, bool) {
 	commitMsg := fmt.Sprintf("Testing ReceivePack RPC around %d", time.Now().Unix())
 	committerName := "Scrooge McDuck"
 	committerEmail := "scrooge@mcduck.com"
@@ -623,12 +623,12 @@ func makeCommit(t *testing.T, localRepoPath string) ([]byte, []byte, bool) {
 
 	// Create a tiny file and add it to the index
 	require.NoError(t, ioutil.WriteFile(newFilePath, []byte("foo bar"), 0644))
-	testhelper.MustRunCommand(t, nil, "git", "-C", localRepoPath, "add", ".")
+	gittest.Exec(t, cfg, "-C", localRepoPath, "add", ".")
 
 	// The latest commit ID on the remote repo
-	oldHead := bytes.TrimSpace(testhelper.MustRunCommand(t, nil, "git", "-C", localRepoPath, "rev-parse", "master"))
+	oldHead := bytes.TrimSpace(gittest.Exec(t, cfg, "-C", localRepoPath, "rev-parse", "master"))
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", localRepoPath,
+	gittest.Exec(t, cfg, "-C", localRepoPath,
 		"-c", fmt.Sprintf("user.name=%s", committerName),
 		"-c", fmt.Sprintf("user.email=%s", committerEmail),
 		"commit", "-m", commitMsg)
@@ -637,7 +637,7 @@ func makeCommit(t *testing.T, localRepoPath string) ([]byte, []byte, bool) {
 	}
 
 	// The commit ID we want to push to the remote repo
-	newHead := bytes.TrimSpace(testhelper.MustRunCommand(t, nil, "git", "-C", localRepoPath, "rev-parse", "master"))
+	newHead := bytes.TrimSpace(gittest.Exec(t, cfg, "-C", localRepoPath, "rev-parse", "master"))
 
 	return oldHead, newHead, true
 }
diff --git a/internal/gitaly/service/ssh/upload_pack_test.go b/internal/gitaly/service/ssh/upload_pack_test.go
index a9b2012a2..60d46a3d3 100644
--- a/internal/gitaly/service/ssh/upload_pack_test.go
+++ b/internal/gitaly/service/ssh/upload_pack_test.go
@@ -73,7 +73,7 @@ func (cmd cloneCommand) execute(t *testing.T) error {
 	return nil
 }
 
-func (cmd cloneCommand) test(t *testing.T, repoPath string, localRepoPath string) (string, string, string, string) {
+func (cmd cloneCommand) test(t *testing.T, cfg config.Cfg, repoPath string, localRepoPath string) (string, string, string, string) {
 	t.Helper()
 
 	defer os.RemoveAll(localRepoPath)
@@ -81,11 +81,11 @@ func (cmd cloneCommand) test(t *testing.T, repoPath string, localRepoPath string
 	err := cmd.execute(t)
 	require.NoError(t, err)
 
-	remoteHead := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "rev-parse", "master"))
-	localHead := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", localRepoPath, "rev-parse", "master"))
+	remoteHead := text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "rev-parse", "master"))
+	localHead := text.ChompBytes(gittest.Exec(t, cfg, "-C", localRepoPath, "rev-parse", "master"))
 
-	remoteTags := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "tag"))
-	localTags := text.ChompBytes(testhelper.MustRunCommand(t, nil, "git", "-C", localRepoPath, "tag"))
+	remoteTags := text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "tag"))
+	localTags := text.ChompBytes(gittest.Exec(t, cfg, "-C", localRepoPath, "tag"))
 
 	return localHead, remoteHead, localTags, remoteTags
 }
@@ -237,7 +237,7 @@ func TestUploadPackCloneSuccess(t *testing.T) {
 				server:       serverSocketPath,
 				cfg:          cfg,
 			}
-			lHead, rHead, _, _ := cmd.test(t, repoPath, localRepoPath)
+			lHead, rHead, _, _ := cmd.test(t, cfg, repoPath, localRepoPath)
 			require.Equal(t, lHead, rHead, "local and remote head not equal")
 
 			metric, err := negotiationMetrics.GetMetricWithLabelValues("deepen")
@@ -424,7 +424,7 @@ func TestUploadPackCloneSuccessWithGitProtocol(t *testing.T) {
 				cfg:         cfg,
 			}
 
-			lHead, rHead, _, _ := cmd.test(t, repoPath, localRepoPath)
+			lHead, rHead, _, _ := cmd.test(t, cfg, repoPath, localRepoPath)
 			require.Equal(t, lHead, rHead, "local and remote head not equal")
 
 			envData := readProto()
@@ -453,7 +453,7 @@ func TestUploadPackCloneHideTags(t *testing.T) {
 		gitConfig:  "transfer.hideRefs=refs/tags",
 		cfg:        cfg,
 	}
-	_, _, lTags, rTags := cloneCmd.test(t, repoPath, localRepoPath)
+	_, _, lTags, rTags := cloneCmd.test(t, cfg, repoPath, localRepoPath)
 
 	if lTags == rTags {
 		t.Fatalf("local and remote tags are equal. clone failed: %q != %q", lTags, rTags)
diff --git a/internal/gitaly/service/wiki/delete_page_test.go b/internal/gitaly/service/wiki/delete_page_test.go
index 9b242a7fe..3518e9690 100644
--- a/internal/gitaly/service/wiki/delete_page_test.go
+++ b/internal/gitaly/service/wiki/delete_page_test.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/git/localrepo"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/rubyserver"
@@ -71,7 +72,7 @@ func testSuccessfulWikiDeletePageRequest(t *testing.T, cfg config.Cfg, rubySrv *
 			_, err := client.WikiDeletePage(ctx, tc.req)
 			require.NoError(t, err)
 
-			headID := testhelper.MustRunCommand(t, nil, "git", "-C", wikiRepoPath, "show", "--format=format:%H", "--no-patch", "HEAD")
+			headID := gittest.Exec(t, cfg, "-C", wikiRepoPath, "show", "--format=format:%H", "--no-patch", "HEAD")
 			commit, err := wikiRepo.ReadCommit(ctx, git.Revision(headID))
 			require.NoError(t, err, "look up git commit after deleting a wiki page")
 
diff --git a/internal/gitaly/service/wiki/find_file_test.go b/internal/gitaly/service/wiki/find_file_test.go
index effa48ab4..371c39f75 100644
--- a/internal/gitaly/service/wiki/find_file_test.go
+++ b/internal/gitaly/service/wiki/find_file_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/rubyserver"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
@@ -26,7 +27,7 @@ func testSuccessfulWikiFindFileRequest(t *testing.T, cfg config.Cfg, rubySrv *ru
 	committerEmail := "scrooge@mcduck.com"
 	sandboxWikiPath := filepath.Join(cfg.Storages[0].Path, "find-file-sandbox")
 
-	testhelper.MustRunCommand(t, nil, "git", "clone", wikiRepoPath, sandboxWikiPath)
+	gittest.Exec(t, cfg, "clone", wikiRepoPath, sandboxWikiPath)
 	defer os.RemoveAll(sandboxWikiPath)
 
 	sandboxWiki := &gitalypb.Repository{
@@ -44,19 +45,19 @@ func testSuccessfulWikiFindFileRequest(t *testing.T, cfg config.Cfg, rubySrv *ru
 	require.NoError(t, err)
 
 	// Sandbox wiki is empty, so we create a commit to be used later
-	testhelper.MustRunCommand(t, nil, "git", "-C", sandboxWikiPath,
+	gittest.Exec(t, cfg, "-C", sandboxWikiPath,
 		"-c", fmt.Sprintf("user.name=%s", committerName),
 		"-c", fmt.Sprintf("user.email=%s", committerEmail),
 		"commit", "--allow-empty", "-m", "Adding an empty commit")
-	oldHeadID := testhelper.MustRunCommand(t, nil, "git", "-C", sandboxWikiPath, "show", "--format=format:%H", "--no-patch", "HEAD")
+	oldHeadID := gittest.Exec(t, cfg, "-C", sandboxWikiPath, "show", "--format=format:%H", "--no-patch", "HEAD")
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", sandboxWikiPath, "add", ".")
-	testhelper.MustRunCommand(t, nil, "git", "-C", sandboxWikiPath,
+	gittest.Exec(t, cfg, "-C", sandboxWikiPath, "add", ".")
+	gittest.Exec(t, cfg, "-C", sandboxWikiPath,
 		"-c", fmt.Sprintf("user.name=%s", committerName),
 		"-c", fmt.Sprintf("user.email=%s", committerEmail),
 		"commit", "-m", "Adding an image")
 
-	newHeadID := testhelper.MustRunCommand(t, nil, "git", "-C", sandboxWikiPath, "show", "--format=format:%H", "--no-patch", "HEAD")
+	newHeadID := gittest.Exec(t, cfg, "-C", sandboxWikiPath, "show", "--format=format:%H", "--no-patch", "HEAD")
 
 	response := &gitalypb.WikiFindFileResponse{
 		Name:     []byte("cloúds.png"),
diff --git a/internal/gitaly/service/wiki/find_page_test.go b/internal/gitaly/service/wiki/find_page_test.go
index 6780fa3f3..efd089ef2 100644
--- a/internal/gitaly/service/wiki/find_page_test.go
+++ b/internal/gitaly/service/wiki/find_page_test.go
@@ -461,7 +461,7 @@ func testSuccessfulWikiFindPageRequestWithTrailers(t *testing.T, cfg config.Cfg,
 	committerName := "Scróoge McDuck" // Include UTF-8 to ensure encoding is handled
 	committerEmail := "scrooge@mcduck.com"
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", worktreePath,
+	gittest.Exec(t, cfg, "-C", worktreePath,
 		"-c", fmt.Sprintf("user.name=%s", committerName),
 		"-c", fmt.Sprintf("user.email=%s", committerEmail),
 		"commit", "--allow-empty", "-m", "master branch, empty commit")
@@ -471,7 +471,7 @@ func testSuccessfulWikiFindPageRequestWithTrailers(t *testing.T, cfg config.Cfg,
 	page1Name := "Home Pagé"
 	createTestWikiPage(t, cfg, client, wikiRepo, worktreePath, createWikiPageOpts{title: page1Name})
 
-	testhelper.MustRunCommand(t, nil, "git", "-C", worktreePath,
+	gittest.Exec(t, cfg, "-C", worktreePath,
 		"-c", fmt.Sprintf("user.name=%s", committerName),
 		"-c", fmt.Sprintf("user.email=%s", committerEmail),
 		"commit", "--amend", "-m", "Empty commit", "-s")
diff --git a/internal/gitaly/service/wiki/get_page_versions_test.go b/internal/gitaly/service/wiki/get_page_versions_test.go
index c283a67a7..6b6235974 100644
--- a/internal/gitaly/service/wiki/get_page_versions_test.go
+++ b/internal/gitaly/service/wiki/get_page_versions_test.go
@@ -29,9 +29,9 @@ func testWikiGetPageVersionsRequest(t *testing.T, cfg config.Cfg, rubySrv *rubys
 
 	content := bytes.Repeat([]byte("Mock wiki page content"), 10000)
 	writeWikiPage(t, client, wikiRepo, createWikiPageOpts{title: pageTitle, content: content})
-	v1cid := testhelper.MustRunCommand(t, nil, "git", "-C", wikiRepoPath, "log", "-1", "--format=%H")
+	v1cid := gittest.Exec(t, cfg, "-C", wikiRepoPath, "log", "-1", "--format=%H")
 	updateWikiPage(t, client, wikiRepo, pageTitle, []byte("New content"))
-	v2cid := testhelper.MustRunCommand(t, nil, "git", "-C", wikiRepoPath, "log", "-1", "--format=%H")
+	v2cid := gittest.Exec(t, cfg, "-C", wikiRepoPath, "log", "-1", "--format=%H")
 
 	gitAuthor := &gitalypb.CommitAuthor{
 		Name:  []byte("Ahmad Sherif"),
diff --git a/internal/gitaly/service/wiki/testhelper_test.go b/internal/gitaly/service/wiki/testhelper_test.go
index f89f0e532..8c31d7e8d 100644
--- a/internal/gitaly/service/wiki/testhelper_test.go
+++ b/internal/gitaly/service/wiki/testhelper_test.go
@@ -211,7 +211,7 @@ func createTestWikiPage(t *testing.T, cfg config.Cfg, client gitalypb.WikiServic
 	defer cancel()
 
 	writeWikiPage(t, client, wikiRepoProto, opts)
-	head1ID := testhelper.MustRunCommand(t, nil, "git", "-C", wikiRepoPath, "show", "--format=format:%H", "--no-patch", "HEAD")
+	head1ID := gittest.Exec(t, cfg, "-C", wikiRepoPath, "show", "--format=format:%H", "--no-patch", "HEAD")
 
 	wikiRepo := localrepo.NewTestRepo(t, cfg, wikiRepoProto)
 	pageCommit, err := wikiRepo.ReadCommit(ctx, git.Revision(head1ID))
diff --git a/internal/gitaly/service/wiki/update_page_test.go b/internal/gitaly/service/wiki/update_page_test.go
index 49c154f1d..60f04e78e 100644
--- a/internal/gitaly/service/wiki/update_page_test.go
+++ b/internal/gitaly/service/wiki/update_page_test.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/git/localrepo"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/rubyserver"
@@ -96,7 +97,7 @@ func testSuccessfulWikiUpdatePageRequest(t *testing.T, cfg config.Cfg, rubySrv *
 			_, err = stream.CloseAndRecv()
 			require.NoError(t, err)
 
-			headID := testhelper.MustRunCommand(t, nil, "git", "-C", wikiRepoPath, "show", "--format=format:%H", "--no-patch", "HEAD")
+			headID := gittest.Exec(t, cfg, "-C", wikiRepoPath, "show", "--format=format:%H", "--no-patch", "HEAD")
 			commit, err := wikiRepo.ReadCommit(ctx, git.Revision(headID))
 			require.NoError(t, err, "look up git commit before merge is applied")
 
@@ -104,7 +105,7 @@ func testSuccessfulWikiUpdatePageRequest(t *testing.T, cfg config.Cfg, rubySrv *
 			require.Equal(t, authorEmail, commit.Author.Email, "author email mismatched")
 			require.Equal(t, message, commit.Subject, "message mismatched")
 
-			pageContent := testhelper.MustRunCommand(t, nil, "git", "-C", wikiRepoPath, "cat-file", "blob", "HEAD:Instálling-Gitaly.md")
+			pageContent := gittest.Exec(t, cfg, "-C", wikiRepoPath, "cat-file", "blob", "HEAD:Instálling-Gitaly.md")
 			require.Equal(t, tc.content, pageContent, "mismatched content")
 		})
 	}
diff --git a/internal/gitaly/service/wiki/write_page_test.go b/internal/gitaly/service/wiki/write_page_test.go
index 1e5a94ee5..b4969e9f6 100644
--- a/internal/gitaly/service/wiki/write_page_test.go
+++ b/internal/gitaly/service/wiki/write_page_test.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/internal/git/localrepo"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/rubyserver"
@@ -100,7 +101,7 @@ func testSuccessfulWikiWritePageRequest(t *testing.T, cfg config.Cfg, rubySrv *r
 
 			require.Empty(t, resp.DuplicateError, "DuplicateError must be empty")
 
-			headID := testhelper.MustRunCommand(t, nil, "git", "-C", wikiRepoPath, "show", "--format=format:%H", "--no-patch", "HEAD")
+			headID := gittest.Exec(t, cfg, "-C", wikiRepoPath, "show", "--format=format:%H", "--no-patch", "HEAD")
 			commit, err := wikiRepo.ReadCommit(ctx, git.Revision(headID))
 			require.NoError(t, err, "look up git commit after writing a wiki page")
 
@@ -108,7 +109,7 @@ func testSuccessfulWikiWritePageRequest(t *testing.T, cfg config.Cfg, rubySrv *r
 			require.Equal(t, authorEmail, commit.Author.Email, "author email mismatched")
 			require.Equal(t, message, commit.Subject, "message mismatched")
 
-			pageContent := testhelper.MustRunCommand(t, nil, "git", "-C", wikiRepoPath, "cat-file", "blob", "HEAD:"+tc.gollumPath)
+			pageContent := gittest.Exec(t, cfg, "-C", wikiRepoPath, "cat-file", "blob", "HEAD:"+tc.gollumPath)
 			require.Equal(t, tc.content, pageContent, "mismatched content")
 		})
 	}