checkout: make safe checkout the default

Make `GIT_CHECKOUT_SAFE` the default.  `NONE` is never what the user
wants _by default_; people expect checkout to, well, check things out.
Instead, it should be an opt-in "dry run" mode.

This removes some odd code in internal callers of `checkout` that takes
a `git_checkout_options` and updates the mode to `SAFE`.  This is now
unnecessary since everything has better defaults.

27 files changed, 95 insertions, 148 deletions

diff --git a/include/git2/checkout.h b/include/git2/checkout.h
index 9f834111a..1d145336b 100644
--- a/include/git2/checkout.h
+++ b/include/git2/checkout.h
@@ -31,17 +31,11 @@ GIT_BEGIN_DECL
  * check out, the "baseline" tree of what was checked out previously, the
  * working directory for actual files, and the index for staged changes.
  *
- * You give checkout one of three strategies for update:
+ * You give checkout one of two strategies for update:
  *
- * - `GIT_CHECKOUT_NONE` is a dry-run strategy that checks for conflicts,
- *   etc., but doesn't make any actual changes.
- *
- * - `GIT_CHECKOUT_FORCE` is at the opposite extreme, taking any action to
- *   make the working directory match the target (including potentially
- *   discarding modified files).
- *
- * - `GIT_CHECKOUT_SAFE` is between these two options, it will only make
- *   modifications that will not lose changes.
+ * - `GIT_CHECKOUT_SAFE` is the default, and similar to git's default,
+ *   which will make modifications that will not lose changes in the
+ *   working directory.
  *
  *                         |  target == baseline   |  target != baseline  |
  *    ---------------------|-----------------------|----------------------|
@@ -55,6 +49,10 @@ GIT_BEGIN_DECL
  *      baseline present   |                       |                      |
  *    ---------------------|-----------------------|----------------------|
  *
+ * - `GIT_CHECKOUT_FORCE` will take any action to make the working
+ *   directory match the target (including potentially discarding
+ *   modified files).
+ *
  * To emulate `git checkout`, use `GIT_CHECKOUT_SAFE` with a checkout
  * notification callback (see below) that displays information about dirty
  * files.  The default behavior will cancel checkout on conflicts.
@@ -69,6 +67,9 @@ GIT_BEGIN_DECL
  *
  * There are some additional flags to modify the behavior of checkout:
  *
+ * - `GIT_CHECKOUT_DRY_RUN` is a dry-run strategy that checks for conflicts,
+ *   etc., but doesn't make any actual changes.
+ *
  * - GIT_CHECKOUT_ALLOW_CONFLICTS makes SAFE mode apply safe file updates
  *   even if there are conflicts (instead of cancelling the checkout).
  *
@@ -104,27 +105,20 @@ GIT_BEGIN_DECL
  *   and write through existing symbolic links.
  */
 typedef enum {
-	GIT_CHECKOUT_NONE = 0, /**< default is a dry run, no actual updates */
-
 	/**
 	 * Allow safe updates that cannot overwrite uncommitted data.
-	 * If the uncommitted changes don't conflict with the checked out files,
-	 * the checkout will still proceed, leaving the changes intact.
-	 *
-	 * Mutually exclusive with GIT_CHECKOUT_FORCE.
-	 * GIT_CHECKOUT_FORCE takes precedence over GIT_CHECKOUT_SAFE.
+	 * If the uncommitted changes don't conflict with the checked
+	 * out files, the checkout will still proceed, leaving the
+	 * changes intact.
 	 */
-	GIT_CHECKOUT_SAFE = (1u << 0),
+	GIT_CHECKOUT_SAFE = 0,
 
 	/**
-	 * Allow all updates to force working directory to look like index.
-	 *
-	 * Mutually exclusive with GIT_CHECKOUT_SAFE.
-	 * GIT_CHECKOUT_FORCE takes precedence over GIT_CHECKOUT_SAFE.
+	 * Allow all updates to force working directory to look like
+	 * the index, potentially losing data in the process.
 	 */
 	GIT_CHECKOUT_FORCE = (1u << 1),
 
-
 	/** Allow checkout to recreate missing files */
 	GIT_CHECKOUT_RECREATE_MISSING = (1u << 2),
 
@@ -178,8 +172,9 @@ typedef enum {
 	GIT_CHECKOUT_DONT_WRITE_INDEX = (1u << 23),
 
 	/**
-	 * Show what would be done by a checkout.  Stop after sending
-	 * notifications; don't update the working directory or index.
+	 * Perform a "dry run", reporting what _would_ be done but
+	 * without actually making changes in the working directory
+	 * or the index.
 	 */
 	GIT_CHECKOUT_DRY_RUN = (1u << 24),
 
@@ -193,8 +188,15 @@ typedef enum {
 	/** Recursively checkout submodules with same options (NOT IMPLEMENTED) */
 	GIT_CHECKOUT_UPDATE_SUBMODULES = (1u << 16),
 	/** Recursively checkout submodules if HEAD moved in super repo (NOT IMPLEMENTED) */
-	GIT_CHECKOUT_UPDATE_SUBMODULES_IF_CHANGED = (1u << 17)
+	GIT_CHECKOUT_UPDATE_SUBMODULES_IF_CHANGED = (1u << 17),
 
+	/**
+	 * Do not do a checkout and do not fire callbacks; this is useful
+	 * for internal functions that will perform the checkout themselves
+	 * but need to pass checkout options into another function, for
+	 * example, `git_clone`.
+	*/
+	GIT_CHECKOUT_NONE = (1u << 30)
 } git_checkout_strategy_t;
 
 /**
@@ -345,7 +347,7 @@ typedef struct git_checkout_options {
 } git_checkout_options;
 
 #define GIT_CHECKOUT_OPTIONS_VERSION 1
-#define GIT_CHECKOUT_OPTIONS_INIT {GIT_CHECKOUT_OPTIONS_VERSION, GIT_CHECKOUT_SAFE}
+#define GIT_CHECKOUT_OPTIONS_INIT {GIT_CHECKOUT_OPTIONS_VERSION}
 
 /**
  * Initialize git_checkout_options structure
diff --git a/include/git2/clone.h b/include/git2/clone.h
index 3481f254c..ad11120bc 100644
--- a/include/git2/clone.h
+++ b/include/git2/clone.h
@@ -106,7 +106,7 @@ typedef struct git_clone_options {
 	/**
 	 * These options are passed to the checkout step. To disable
 	 * checkout, set the `checkout_strategy` to
-	 * `GIT_CHECKOUT_NONE`.
+	 * `GIT_CHECKOUT_DRY_RUN`.
 	 */
 	git_checkout_options checkout_opts;
 
@@ -164,9 +164,10 @@ typedef struct git_clone_options {
 } git_clone_options;
 
 #define GIT_CLONE_OPTIONS_VERSION 1
-#define GIT_CLONE_OPTIONS_INIT { GIT_CLONE_OPTIONS_VERSION, \
-	{ GIT_CHECKOUT_OPTIONS_VERSION, GIT_CHECKOUT_SAFE }, \
-	GIT_FETCH_OPTIONS_INIT }
+#define GIT_CLONE_OPTIONS_INIT \
+	{ GIT_CLONE_OPTIONS_VERSION, \
+	  GIT_CHECKOUT_OPTIONS_INIT, \
+	  GIT_FETCH_OPTIONS_INIT }
 
 /**
  * Initialize git_clone_options structure
diff --git a/include/git2/rebase.h b/include/git2/rebase.h
index b1ac71f94..a53e68d9c 100644
--- a/include/git2/rebase.h
+++ b/include/git2/rebase.h
@@ -67,10 +67,9 @@ typedef struct {
 
 	/**
 	 * Options to control how files are written during `git_rebase_init`,
-	 * `git_rebase_next` and `git_rebase_abort`.  Note that a minimum
-	 * strategy of `GIT_CHECKOUT_SAFE` is defaulted in `init` and `next`,
-	 * and a minimum strategy of `GIT_CHECKOUT_FORCE` is defaulted in
-	 * `abort` to match git semantics.
+	 * `git_rebase_next` and `git_rebase_abort`.  Note that during
+	 * `abort`, these options will add an implied `GIT_CHECKOUT_FORCE`
+	 * to match git semantics.
 	 */
 	git_checkout_options checkout_options;
 
diff --git a/include/git2/stash.h b/include/git2/stash.h
index 32e6f9576..0aecaff91 100644
--- a/include/git2/stash.h
+++ b/include/git2/stash.h
@@ -171,8 +171,6 @@ GIT_EXTERN(int) git_stash_apply_options_init(
  * GIT_EMERGECONFLICT and both the working directory and index will be left
  * unmodified.
  *
- * Note that a minimum checkout strategy of `GIT_CHECKOUT_SAFE` is implied.
- *
  * @param repo The owning repository.
  * @param index The position within the stash list. 0 points to the
  *              most recent stashed state.
diff --git a/include/git2/submodule.h b/include/git2/submodule.h
index 2082966f6..7e554389a 100644
--- a/include/git2/submodule.h
+++ b/include/git2/submodule.h
@@ -131,9 +131,7 @@ typedef struct git_submodule_update_options {
 	/**
 	 * These options are passed to the checkout step. To disable
 	 * checkout, set the `checkout_strategy` to
-	 * `GIT_CHECKOUT_NONE`. Generally you will want the use
-	 * GIT_CHECKOUT_SAFE to update files in the working
-	 * directory.
+	 * `GIT_CHECKOUT_DRY_RUN`.
 	 */
 	git_checkout_options checkout_opts;
 
@@ -155,8 +153,9 @@ typedef struct git_submodule_update_options {
 #define GIT_SUBMODULE_UPDATE_OPTIONS_VERSION 1
 #define GIT_SUBMODULE_UPDATE_OPTIONS_INIT \
 	{ GIT_SUBMODULE_UPDATE_OPTIONS_VERSION, \
-		{ GIT_CHECKOUT_OPTIONS_VERSION, GIT_CHECKOUT_SAFE }, \
-	GIT_FETCH_OPTIONS_INIT, 1 }
+	  GIT_CHECKOUT_OPTIONS_INIT, \
+	  GIT_FETCH_OPTIONS_INIT, \
+	  1 }
 
 /**
  * Initialize git_submodule_update_options structure
diff --git a/src/libgit2/apply.c b/src/libgit2/apply.c
index 18304da4d..d73b11ee0 100644
--- a/src/libgit2/apply.c
+++ b/src/libgit2/apply.c
@@ -714,7 +714,6 @@ static int git_apply__to_workdir(
 			goto done;
 	}
 
-	checkout_opts.checkout_strategy |= GIT_CHECKOUT_SAFE;
 	checkout_opts.checkout_strategy |= GIT_CHECKOUT_DISABLE_PATHSPEC_MATCH;
 	checkout_opts.checkout_strategy |= GIT_CHECKOUT_DONT_WRITE_INDEX;
 
diff --git a/src/libgit2/checkout.c b/src/libgit2/checkout.c
index 6a4643196..c14f9d03f 100644
--- a/src/libgit2/checkout.c
+++ b/src/libgit2/checkout.c
@@ -302,17 +302,17 @@ static int checkout_action_no_wd(
 		*action = CHECKOUT_ACTION_IF(RECREATE_MISSING, UPDATE_BLOB, NONE);
 		break;
 	case GIT_DELTA_ADDED:    /* case 2 or 28 (and 5 but not really) */
-		*action = CHECKOUT_ACTION_IF(SAFE, UPDATE_BLOB, NONE);
+		*action = CHECKOUT_ACTION__UPDATE_BLOB;
 		break;
 	case GIT_DELTA_MODIFIED: /* case 13 (and 35 but not really) */
 		*action = CHECKOUT_ACTION_IF(RECREATE_MISSING, UPDATE_BLOB, CONFLICT);
 		break;
 	case GIT_DELTA_TYPECHANGE: /* case 21 (B->T) and 28 (T->B)*/
 		if (delta->new_file.mode == GIT_FILEMODE_TREE)
-			*action = CHECKOUT_ACTION_IF(SAFE, UPDATE_BLOB, NONE);
+			*action = CHECKOUT_ACTION__UPDATE_BLOB;
 		break;
 	case GIT_DELTA_DELETED: /* case 8 or 25 */
-		*action = CHECKOUT_ACTION_IF(SAFE, REMOVE, NONE);
+		*action = CHECKOUT_ACTION__REMOVE;
 		break;
 	default: /* impossible */
 		break;
@@ -512,14 +512,14 @@ static int checkout_action_with_wd(
 		if (checkout_is_workdir_modified(data, &delta->old_file, &delta->new_file, wd))
 			*action = CHECKOUT_ACTION_IF(FORCE, REMOVE, CONFLICT);
 		else
-			*action = CHECKOUT_ACTION_IF(SAFE, REMOVE, NONE);
+			*action = CHECKOUT_ACTION__REMOVE;
 		break;
 	case GIT_DELTA_MODIFIED: /* case 16, 17, 18 (or 36 but not really) */
 		if (wd->mode != GIT_FILEMODE_COMMIT &&
 			checkout_is_workdir_modified(data, &delta->old_file, &delta->new_file, wd))
 			*action = CHECKOUT_ACTION_IF(FORCE, UPDATE_BLOB, CONFLICT);
 		else
-			*action = CHECKOUT_ACTION_IF(SAFE, UPDATE_BLOB, NONE);
+			*action = CHECKOUT_ACTION__UPDATE_BLOB;
 		break;
 	case GIT_DELTA_TYPECHANGE: /* case 22, 23, 29, 30 */
 		if (delta->old_file.mode == GIT_FILEMODE_TREE) {
@@ -527,13 +527,13 @@ static int checkout_action_with_wd(
 				/* either deleting items in old tree will delete the wd dir,
 				 * or we'll get a conflict when we attempt blob update...
 				 */
-				*action = CHECKOUT_ACTION_IF(SAFE, UPDATE_BLOB, NONE);
+				*action = CHECKOUT_ACTION__UPDATE_BLOB;
 			else if (wd->mode == GIT_FILEMODE_COMMIT) {
 				/* workdir is possibly a "phantom" submodule - treat as a
 				 * tree if the only submodule info came from the config
 				 */
 				if (submodule_is_config_only(data, wd->path))
-					*action = CHECKOUT_ACTION_IF(SAFE, UPDATE_BLOB, NONE);
+					*action = CHECKOUT_ACTION__UPDATE_BLOB;
 				else
 					*action = CHECKOUT_ACTION_IF(FORCE, REMOVE_AND_UPDATE, CONFLICT);
 			} else
@@ -542,7 +542,7 @@ static int checkout_action_with_wd(
 		else if (checkout_is_workdir_modified(data, &delta->old_file, &delta->new_file, wd))
 			*action = CHECKOUT_ACTION_IF(FORCE, REMOVE_AND_UPDATE, CONFLICT);
 		else
-			*action = CHECKOUT_ACTION_IF(SAFE, REMOVE_AND_UPDATE, NONE);
+			*action = CHECKOUT_ACTION__REMOVE_AND_UPDATE;
 
 		/* don't update if the typechange is to a tree */
 		if (delta->new_file.mode == GIT_FILEMODE_TREE)
@@ -627,7 +627,7 @@ static int checkout_action_with_wd_dir(
 			 * directory if is it left empty, so we can defer removing the
 			 * dir and it will succeed if no children are left.
 			 */
-			*action = CHECKOUT_ACTION_IF(SAFE, UPDATE_BLOB, NONE);
+			*action = CHECKOUT_ACTION__UPDATE_BLOB;
 		}
 		else if (delta->new_file.mode != GIT_FILEMODE_TREE)
 			/* For typechange to dir, dir is already created so no action */
@@ -2432,14 +2432,12 @@ static int checkout_data_init(
 
 	/* if you are forcing, allow all safe updates, plus recreate missing */
 	if ((data->opts.checkout_strategy & GIT_CHECKOUT_FORCE) != 0)
-		data->opts.checkout_strategy |= GIT_CHECKOUT_SAFE |
-			GIT_CHECKOUT_RECREATE_MISSING;
+		data->opts.checkout_strategy |= GIT_CHECKOUT_RECREATE_MISSING;
 
 	/* if the repository does not actually have an index file, then this
 	 * is an initial checkout (perhaps from clone), so we allow safe updates
 	 */
-	if (!data->index->on_disk &&
-		(data->opts.checkout_strategy & GIT_CHECKOUT_SAFE) != 0)
+	if (!data->index->on_disk)
 		data->opts.checkout_strategy |= GIT_CHECKOUT_RECREATE_MISSING;
 
 	data->strategy = data->opts.checkout_strategy;
diff --git a/src/libgit2/checkout.h b/src/libgit2/checkout.h
index 517fbf3b1..e613325c7 100644
--- a/src/libgit2/checkout.h
+++ b/src/libgit2/checkout.h
@@ -12,8 +12,6 @@
 #include "git2/checkout.h"
 #include "iterator.h"
 
-#define GIT_CHECKOUT__NOTIFY_CONFLICT_TREE (1u << 12)
-
 /**
  * Update the working directory to match the target iterator.  The
  * expected baseline value can be passed in via the checkout options
diff --git a/src/libgit2/cherrypick.c b/src/libgit2/cherrypick.c
index 9ec4962b9..acf46dd6b 100644
--- a/src/libgit2/cherrypick.c
+++ b/src/libgit2/cherrypick.c
@@ -73,8 +73,7 @@ static int cherrypick_normalize_opts(
 	const char *their_label)
 {
 	int error = 0;
-	unsigned int default_checkout_strategy = GIT_CHECKOUT_SAFE |
-		GIT_CHECKOUT_ALLOW_CONFLICTS;
+	unsigned int default_checkout_strategy = GIT_CHECKOUT_ALLOW_CONFLICTS;
 
 	GIT_UNUSED(repo);
 
diff --git a/src/libgit2/clone.c b/src/libgit2/clone.c
index 1843875f8..93ff7d802 100644
--- a/src/libgit2/clone.c
+++ b/src/libgit2/clone.c
@@ -16,6 +16,7 @@
 #include "git2/commit.h"
 #include "git2/tree.h"
 
+#include "checkout.h"
 #include "remote.h"
 #include "futils.h"
 #include "refs.h"
diff --git a/src/libgit2/merge.c b/src/libgit2/merge.c
index 641b32632..3b06824e6 100644
--- a/src/libgit2/merge.c
+++ b/src/libgit2/merge.c
@@ -3341,8 +3341,7 @@ int git_merge(
 		goto done;
 
 	checkout_strategy = given_checkout_opts ?
-		given_checkout_opts->checkout_strategy :
-		GIT_CHECKOUT_SAFE;
+		given_checkout_opts->checkout_strategy : 0;
 
 	if ((error = git_indexwriter_init_for_operation(&indexwriter, repo,
 		&checkout_strategy)) < 0)
diff --git a/src/libgit2/revert.c b/src/libgit2/revert.c
index d6ab6ae3c..c661e028f 100644
--- a/src/libgit2/revert.c
+++ b/src/libgit2/revert.c
@@ -74,8 +74,7 @@ static int revert_normalize_opts(
 	const char *their_label)
 {
 	int error = 0;
-	unsigned int default_checkout_strategy = GIT_CHECKOUT_SAFE |
-		GIT_CHECKOUT_ALLOW_CONFLICTS;
+	unsigned int default_checkout_strategy = GIT_CHECKOUT_ALLOW_CONFLICTS;
 
 	GIT_UNUSED(repo);
 
diff --git a/tests/libgit2/checkout/binaryunicode.c b/tests/libgit2/checkout/binaryunicode.c
index edb5cfaf5..20040bc30 100644
--- a/tests/libgit2/checkout/binaryunicode.c
+++ b/tests/libgit2/checkout/binaryunicode.c
@@ -27,8 +27,6 @@ static void execute_test(void)
 	cl_git_pass(git_commit_lookup(&commit, g_repo, &oid));
 	cl_git_pass(git_commit_tree(&tree, commit));
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE;
-
 	cl_git_pass(git_checkout_tree(g_repo, (git_object *)tree, &opts));
 
 	git_tree_free(tree);
diff --git a/tests/libgit2/checkout/conflict.c b/tests/libgit2/checkout/conflict.c
index 4a9e4b9fa..a90f5165c 100644
--- a/tests/libgit2/checkout/conflict.c
+++ b/tests/libgit2/checkout/conflict.c
@@ -308,8 +308,6 @@ void test_checkout_conflict__directory_file(void)
 		{ 0100644, CONFLICTING_THEIRS_OID, 3, "df-4/file" },
 	};
 
-	opts.checkout_strategy |= GIT_CHECKOUT_SAFE;
-
 	create_index(checkout_index_entries, 12);
 	cl_git_pass(git_index_write(g_index));
 
@@ -347,7 +345,6 @@ void test_checkout_conflict__directory_file_with_custom_labels(void)
 		{ 0100644, CONFLICTING_THEIRS_OID, 3, "df-4/file" },
 	};
 
-	opts.checkout_strategy |= GIT_CHECKOUT_SAFE;
 	opts.our_label = "HEAD";
 	opts.their_label = "branch";
 
@@ -388,8 +385,6 @@ void test_checkout_conflict__link_file(void)
 		{ 0100644, CONFLICTING_THEIRS_OID, 3, "link-4" },
 	};
 
-	opts.checkout_strategy |= GIT_CHECKOUT_SAFE;
-
 	create_index(checkout_index_entries, 12);
 	cl_git_pass(git_index_write(g_index));
 
@@ -415,8 +410,6 @@ void test_checkout_conflict__links(void)
 		{ 0120000, LINK_THEIRS_OID, 3, "link-2" },
 	};
 
-	opts.checkout_strategy |= GIT_CHECKOUT_SAFE;
-
 	create_index(checkout_index_entries, 5);
 	cl_git_pass(git_index_write(g_index));
 
@@ -436,8 +429,6 @@ void test_checkout_conflict__add_add(void)
 		{ 0100644, CONFLICTING_THEIRS_OID, 3, "conflicting.txt" },
 	};
 
-	opts.checkout_strategy |= GIT_CHECKOUT_SAFE;
-
 	create_index(checkout_index_entries, 2);
 	cl_git_pass(git_index_write(g_index));
 
@@ -477,8 +468,6 @@ void test_checkout_conflict__mode_change(void)
 		{ 0100755, CONFLICTING_THEIRS_OID, 3, "executable-6" },
 	};
 
-	opts.checkout_strategy |= GIT_CHECKOUT_SAFE;
-
 	create_index(checkout_index_entries, 18);
 	cl_git_pass(git_index_write(g_index));
 
@@ -608,8 +597,6 @@ void test_checkout_conflict__renames(void)
 		}
 	};
 
-	opts.checkout_strategy |= GIT_CHECKOUT_SAFE;
-
 	create_index(checkout_index_entries, 41);
 	create_index_names(checkout_name_entries, 9);
 	cl_git_pass(git_index_write(g_index));
@@ -793,7 +780,7 @@ void test_checkout_conflict__rename_keep_ours(void)
 		}
 	};
 
-	opts.checkout_strategy |= GIT_CHECKOUT_SAFE | GIT_CHECKOUT_USE_OURS;
+	opts.checkout_strategy |= GIT_CHECKOUT_USE_OURS;
 
 	create_index(checkout_index_entries, 41);
 	create_index_names(checkout_name_entries, 9);
@@ -926,8 +913,6 @@ void test_checkout_conflict__name_mangled_file_exists_in_workdir(void)
 		}
 	};
 
-	opts.checkout_strategy |= GIT_CHECKOUT_SAFE;
-
 	create_index(checkout_index_entries, 24);
 	create_index_names(checkout_name_entries, 6);
 	cl_git_pass(git_index_write(g_index));
diff --git a/tests/libgit2/checkout/head.c b/tests/libgit2/checkout/head.c
index 3b0bf4729..f67770e1f 100644
--- a/tests/libgit2/checkout/head.c
+++ b/tests/libgit2/checkout/head.c
@@ -228,7 +228,6 @@ void test_checkout_head__workdir_filemode_is_simplified(void)
 	cl_git_pass(git_revparse_single(&branch, g_repo, "099fabac3a9ea935598528c27f866e34089c2eff"));
 
 	opts.checkout_strategy &= ~GIT_CHECKOUT_FORCE;
-	opts.checkout_strategy |=  GIT_CHECKOUT_SAFE;
 	cl_git_pass(git_checkout_tree(g_repo, branch, NULL));
 
 	git_object_free(branch);
@@ -256,7 +255,6 @@ void test_checkout_head__obeys_filemode_true(void)
 	cl_git_pass(git_revparse_single(&branch, g_repo, "099fabac3a9ea935598528c27f866e34089c2eff"));
 
 	opts.checkout_strategy &= ~GIT_CHECKOUT_FORCE;
-	opts.checkout_strategy |=  GIT_CHECKOUT_SAFE;
 	cl_git_fail_with(GIT_ECONFLICT, git_checkout_tree(g_repo, branch, NULL));
 
 	git_object_free(branch);
@@ -284,7 +282,6 @@ void test_checkout_head__obeys_filemode_false(void)
 	cl_git_pass(git_revparse_single(&branch, g_repo, "099fabac3a9ea935598528c27f866e34089c2eff"));
 
 	opts.checkout_strategy &= ~GIT_CHECKOUT_FORCE;
-	opts.checkout_strategy |=  GIT_CHECKOUT_SAFE;
 	cl_git_pass(git_checkout_tree(g_repo, branch, NULL));
 
 	git_object_free(branch);
diff --git a/tests/libgit2/checkout/icase.c b/tests/libgit2/checkout/icase.c
index d77c7abd5..fee60b24e 100644
--- a/tests/libgit2/checkout/icase.c
+++ b/tests/libgit2/checkout/icase.c
@@ -34,7 +34,6 @@ void test_checkout_icase__initialize(void)
 	cl_git_pass(git_object_lookup(&obj, repo, &id, GIT_OBJECT_ANY));
 
 	git_checkout_options_init(&checkout_opts, GIT_CHECKOUT_OPTIONS_VERSION);
-	checkout_opts.checkout_strategy = GIT_CHECKOUT_NONE;
 }
 
 void test_checkout_icase__cleanup(void)
@@ -106,7 +105,7 @@ static int symlink_or_fake(git_repository *repo, const char *a, const char *b)
 
 void test_checkout_icase__refuses_to_overwrite_files_for_files(void)
 {
-	checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE|GIT_CHECKOUT_RECREATE_MISSING;
+	checkout_opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	cl_git_write2file("testrepo/BRANCH_FILE.txt", "neue file\n", 10, \
 		O_WRONLY | O_CREAT | O_TRUNC, 0644);
@@ -128,7 +127,7 @@ void test_checkout_icase__overwrites_files_for_files_when_forced(void)
 
 void test_checkout_icase__refuses_to_overwrite_links_for_files(void)
 {
-	checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE|GIT_CHECKOUT_RECREATE_MISSING;
+	checkout_opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	cl_must_pass(symlink_or_fake(repo, "../tmp", "testrepo/BRANCH_FILE.txt"));
 
@@ -152,7 +151,7 @@ void test_checkout_icase__overwrites_links_for_files_when_forced(void)
 
 void test_checkout_icase__overwrites_empty_folders_for_files(void)
 {
-	checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE|GIT_CHECKOUT_RECREATE_MISSING;
+	checkout_opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	cl_must_pass(p_mkdir("testrepo/NEW.txt", 0777));
 
@@ -164,7 +163,7 @@ void test_checkout_icase__overwrites_empty_folders_for_files(void)
 
 void test_checkout_icase__refuses_to_overwrite_populated_folders_for_files(void)
 {
-	checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE|GIT_CHECKOUT_RECREATE_MISSING;
+	checkout_opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	cl_must_pass(p_mkdir("testrepo/BRANCH_FILE.txt", 0777));
 	cl_git_write2file("testrepo/BRANCH_FILE.txt/foobar", "neue file\n", 10, \
@@ -192,7 +191,7 @@ void test_checkout_icase__overwrites_folders_for_files_when_forced(void)
 
 void test_checkout_icase__refuses_to_overwrite_files_for_folders(void)
 {
-	checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE|GIT_CHECKOUT_RECREATE_MISSING;
+	checkout_opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	cl_git_write2file("testrepo/A", "neue file\n", 10, \
 		O_WRONLY | O_CREAT | O_TRUNC, 0644);
@@ -216,7 +215,7 @@ void test_checkout_icase__overwrites_files_for_folders_when_forced(void)
 
 void test_checkout_icase__refuses_to_overwrite_links_for_folders(void)
 {
-	checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE|GIT_CHECKOUT_RECREATE_MISSING;
+	checkout_opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	cl_must_pass(symlink_or_fake(repo, "..", "testrepo/A"));
 
@@ -244,8 +243,6 @@ void test_checkout_icase__ignores_unstaged_casechange(void)
 	git_commit *orig, *br2;
 	git_checkout_options checkout_opts = GIT_CHECKOUT_OPTIONS_INIT;
 
-	checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE;
-
 	cl_git_pass(git_reference_lookup_resolved(&orig_ref, repo, "HEAD", 100));
 	cl_git_pass(git_commit_lookup(&orig, repo, git_reference_target(orig_ref)));
 	cl_git_pass(git_reset(repo, (git_object *)orig, GIT_RESET_HARD, NULL));
@@ -270,8 +267,6 @@ void test_checkout_icase__conflicts_with_casechanged_subtrees(void)
 	git_oid oid;
 	git_checkout_options checkout_opts = GIT_CHECKOUT_OPTIONS_INIT;
 
-	checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE;
-
 	cl_git_pass(git_reference_lookup_resolved(&orig_ref, repo, "HEAD", 100));
 	cl_git_pass(git_object_lookup(&orig, repo, git_reference_target(orig_ref), GIT_OBJECT_COMMIT));
 	cl_git_pass(git_reset(repo, (git_object *)orig, GIT_RESET_HARD, NULL));
diff --git a/tests/libgit2/checkout/index.c b/tests/libgit2/checkout/index.c
index 6a80d22c5..db77b06f8 100644
--- a/tests/libgit2/checkout/index.c
+++ b/tests/libgit2/checkout/index.c
@@ -60,7 +60,7 @@ void test_checkout_index__can_create_missing_files(void)
 	cl_assert_equal_i(false, git_fs_path_isfile("./testrepo/branch_file.txt"));
 	cl_assert_equal_i(false, git_fs_path_isfile("./testrepo/new.txt"));
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_RECREATE_MISSING;
+	opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	cl_git_pass(git_checkout_index(g_repo, NULL, &opts));
 
@@ -80,7 +80,6 @@ void test_checkout_index__can_remove_untracked_files(void)
 	cl_assert_equal_i(true, git_fs_path_isdir("./testrepo/dir/subdir/subsubdir"));
 
 	opts.checkout_strategy =
-		GIT_CHECKOUT_SAFE |
 		GIT_CHECKOUT_RECREATE_MISSING |
 		GIT_CHECKOUT_REMOVE_UNTRACKED;
 
@@ -156,7 +155,7 @@ void test_checkout_index__honor_the_specified_pathspecs(void)
 	cl_assert_equal_i(false, git_fs_path_isfile("./testrepo/branch_file.txt"));
 	cl_assert_equal_i(false, git_fs_path_isfile("./testrepo/new.txt"));
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_RECREATE_MISSING;
+	opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	cl_git_pass(git_checkout_index(g_repo, NULL, &opts));
 
@@ -175,7 +174,7 @@ void test_checkout_index__honor_the_gitattributes_directives(void)
 	cl_git_mkfile("./testrepo/.gitattributes", attributes);
 	cl_repo_set_bool(g_repo, "core.autocrlf", false);
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_RECREATE_MISSING;
+	opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	cl_git_pass(git_checkout_index(g_repo, NULL, &opts));
 
@@ -193,7 +192,7 @@ void test_checkout_index__honor_coreautocrlf_setting_set_to_true(void)
 	cl_git_pass(p_unlink("./testrepo/.gitattributes"));
 	cl_repo_set_bool(g_repo, "core.autocrlf", true);
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_RECREATE_MISSING;
+	opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	cl_git_pass(git_checkout_index(g_repo, NULL, &opts));
 
@@ -287,7 +286,7 @@ void test_checkout_index__coresymlinks_set_to_true_fails_when_unsupported(void)
 
 	cl_repo_set_bool(g_repo, "core.symlinks", true);
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_RECREATE_MISSING;
+	opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 	cl_git_fail(git_checkout_index(g_repo, NULL, &opts));
 }
 
@@ -303,7 +302,7 @@ void test_checkout_index__honor_coresymlinks_setting_set_to_true(void)
 
 	cl_repo_set_bool(g_repo, "core.symlinks", true);
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_RECREATE_MISSING;
+	opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	cl_git_pass(git_checkout_index(g_repo, NULL, &opts));
 
@@ -320,7 +319,7 @@ void test_checkout_index__honor_coresymlinks_setting_set_to_false(void)
 
 	cl_repo_set_bool(g_repo, "core.symlinks", false);
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_RECREATE_MISSING;
+	opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	cl_git_pass(git_checkout_index(g_repo, NULL, &opts));
 
@@ -336,7 +335,7 @@ void test_checkout_index__donot_overwrite_modified_file_by_default(void)
 	/* set this up to not return an error code on conflicts, but it
 	 * still will not have permission to overwrite anything...
 	 */
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_ALLOW_CONFLICTS;
+	opts.checkout_strategy = GIT_CHECKOUT_ALLOW_CONFLICTS;
 
 	cl_git_pass(git_checkout_index(g_repo, NULL, &opts));
 
@@ -362,7 +361,7 @@ void test_checkout_index__options_disable_filters(void)
 
 	cl_git_mkfile("./testrepo/.gitattributes", "*.txt text eol=crlf\n");
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_RECREATE_MISSING;
+	opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 	opts.disable_filters = false;
 
 	cl_git_pass(git_checkout_index(g_repo, NULL, &opts));
@@ -393,7 +392,7 @@ void test_checkout_index__options_dir_modes(void)
 
 	reset_index_to_treeish((git_object *)commit);
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_RECREATE_MISSING;
+	opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 	opts.dir_mode = 0701;
 
 	cl_git_pass(git_checkout_index(g_repo, NULL, &opts));
@@ -420,7 +419,7 @@ void test_checkout_index__options_override_file_modes(void)
 	if (!cl_is_chmod_supported())
 		return;
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_RECREATE_MISSING;
+	opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 	opts.file_mode = 0700;
 
 	cl_git_pass(git_checkout_index(g_repo, NULL, &opts));
@@ -485,7 +484,7 @@ void test_checkout_index__can_notify_of_skipped_files(void)
 	data.file = "new.txt";
 	data.sha = "a71586c1dfe8a71c6cbf6c129f404c5642ff31bd";
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE |
+	opts.checkout_strategy =
 		GIT_CHECKOUT_RECREATE_MISSING |
 		GIT_CHECKOUT_ALLOW_CONFLICTS;
 	opts.notify_flags = GIT_CHECKOUT_NOTIFY_CONFLICT;
@@ -525,7 +524,6 @@ void test_checkout_index__wont_notify_of_expected_line_ending_changes(void)
 	cl_git_mkfile("./testrepo/new.txt", "my new file\r\n");
 
 	opts.checkout_strategy =
-		GIT_CHECKOUT_SAFE |
 		GIT_CHECKOUT_RECREATE_MISSING |
 		GIT_CHECKOUT_ALLOW_CONFLICTS;
 	opts.notify_flags = GIT_CHECKOUT_NOTIFY_CONFLICT;
@@ -547,7 +545,7 @@ void test_checkout_index__calls_progress_callback(void)
 	git_checkout_options opts = GIT_CHECKOUT_OPTIONS_INIT;
 	int calls = 0;
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_RECREATE_MISSING;
+	opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 	opts.progress_cb = checkout_progress_counter;
 	opts.progress_payload = &calls;
 
@@ -582,7 +580,6 @@ void test_checkout_index__can_overcome_name_clashes(void)
 	cl_assert(git_fs_path_isfile("./testrepo/path0/file0"));
 
 	opts.checkout_strategy =
-		GIT_CHECKOUT_SAFE |
 		GIT_CHECKOUT_RECREATE_MISSING |
 		GIT_CHECKOUT_ALLOW_CONFLICTS;
 	cl_git_pass(git_checkout_index(g_repo, index, &opts));
@@ -634,7 +631,6 @@ void test_checkout_index__can_update_prefixed_files(void)
 	cl_git_pass(p_mkdir("./testrepo/branch_file.txt.after", 0777));
 
 	opts.checkout_strategy =
-		GIT_CHECKOUT_SAFE |
 		GIT_CHECKOUT_RECREATE_MISSING |
 		GIT_CHECKOUT_REMOVE_UNTRACKED;
 
@@ -685,7 +681,7 @@ void test_checkout_index__target_directory(void)
 	checkout_counts cts;
 	memset(&cts, 0, sizeof(cts));
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE |
+	opts.checkout_strategy =
 		GIT_CHECKOUT_RECREATE_MISSING;
 	opts.target_directory = "alternative";
 	cl_assert(!git_fs_path_isdir("alternative"));
@@ -730,7 +726,7 @@ void test_checkout_index__target_directory_from_bare(void)
 	cl_git_pass(git_index_write(index));
 	git_index_free(index);
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE |
+	opts.checkout_strategy =
 		GIT_CHECKOUT_RECREATE_MISSING;
 
 	opts.notify_flags = GIT_CHECKOUT_NOTIFY_ALL;
@@ -769,7 +765,7 @@ void test_checkout_index__can_get_repo_from_index(void)
 	cl_assert_equal_i(false, git_fs_path_isfile("./testrepo/branch_file.txt"));
 	cl_assert_equal_i(false, git_fs_path_isfile("./testrepo/new.txt"));
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_RECREATE_MISSING;
+	opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	cl_git_pass(git_repository_index(&index, g_repo));
 
diff --git a/tests/libgit2/checkout/tree.c b/tests/libgit2/checkout/tree.c
index d4b57f5d1..d8b9e4fc5 100644
--- a/tests/libgit2/checkout/tree.c
+++ b/tests/libgit2/checkout/tree.c
@@ -147,7 +147,7 @@ void test_checkout_tree__doesnt_write_unrequested_files_to_worktree(void)
 	/* GIT_CHECKOUT_NONE should not add any file to the working tree from the
 	 * index as it is supposed to be a dry run.
 	 */
-	opts.checkout_strategy = GIT_CHECKOUT_NONE;
+	opts.checkout_strategy = GIT_CHECKOUT_DRY_RUN;
 	git_checkout_tree(g_repo, (git_object*)p_chomped_commit, &opts);
 	cl_assert_equal_i(false, git_fs_path_isfile("testrepo/readme.txt"));
 
@@ -186,8 +186,6 @@ void test_checkout_tree__can_switch_branches(void)
 	git_object_free(obj);
 
 	/* do second checkout safe because we should be clean after first */
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE;
-
 	cl_git_pass(git_reference_name_to_id(&oid, g_repo, "refs/heads/subtrees"));
 	cl_git_pass(git_object_lookup(&obj, g_repo, &oid, GIT_OBJECT_ANY));
 
@@ -213,7 +211,7 @@ void test_checkout_tree__can_remove_untracked(void)
 {
 	git_checkout_options opts = GIT_CHECKOUT_OPTIONS_INIT;
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_REMOVE_UNTRACKED;
+	opts.checkout_strategy = GIT_CHECKOUT_REMOVE_UNTRACKED;
 
 	cl_git_mkfile("testrepo/untracked_file", "as you wish");
 	cl_assert(git_fs_path_isfile("testrepo/untracked_file"));
@@ -228,7 +226,7 @@ void test_checkout_tree__can_remove_ignored(void)
 	git_checkout_options opts = GIT_CHECKOUT_OPTIONS_INIT;
 	int ignored = 0;
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_REMOVE_IGNORED;
+	opts.checkout_strategy = GIT_CHECKOUT_REMOVE_IGNORED;
 
 	cl_git_mkfile("testrepo/ignored_file", "as you wish");
 
@@ -313,7 +311,7 @@ void test_checkout_tree__conflict_on_ignored_when_not_overwriting(void)
 	int error;
 
 	cl_git_fail(error = checkout_tree_with_blob_ignored_in_workdir(
-		GIT_CHECKOUT_SAFE | GIT_CHECKOUT_DONT_OVERWRITE_IGNORED, false));
+		GIT_CHECKOUT_DONT_OVERWRITE_IGNORED, false));
 
 	cl_assert_equal_i(GIT_ECONFLICT, error);
 }
@@ -334,7 +332,7 @@ void test_checkout_tree__conflict_on_ignored_folder_when_not_overwriting(void)
 	int error;
 
 	cl_git_fail(error = checkout_tree_with_blob_ignored_in_workdir(
-		GIT_CHECKOUT_SAFE | GIT_CHECKOUT_DONT_OVERWRITE_IGNORED, true));
+		GIT_CHECKOUT_DONT_OVERWRITE_IGNORED, true));
 
 	cl_assert_equal_i(GIT_ECONFLICT, error);
 }
@@ -370,7 +368,7 @@ void test_checkout_tree__can_update_only(void)
 
 	/* now checkout branch but with update only */
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_UPDATE_ONLY;
+	opts.checkout_strategy = GIT_CHECKOUT_UPDATE_ONLY;
 
 	cl_git_pass(git_reference_name_to_id(&oid, g_repo, "refs/heads/dir"));
 	cl_git_pass(git_object_lookup(&obj, g_repo, &oid, GIT_OBJECT_ANY));
@@ -417,7 +415,6 @@ void test_checkout_tree__can_checkout_with_pattern(void)
 
 	/* now to a narrow patterned checkout */
 
-	g_opts.checkout_strategy = GIT_CHECKOUT_SAFE;
 	g_opts.paths.strings = entries;
 	g_opts.paths.count = 1;
 
@@ -489,7 +486,6 @@ void test_checkout_tree__can_disable_pattern_match(void)
 	/* now to a narrow patterned checkout, but disable pattern */
 
 	g_opts.checkout_strategy =
-		GIT_CHECKOUT_SAFE |
 		GIT_CHECKOUT_DISABLE_PATHSPEC_MATCH;
 	g_opts.paths.strings = entries;
 	g_opts.paths.count = 1;
@@ -606,8 +602,6 @@ void test_checkout_tree__donot_update_deleted_file_by_default(void)
 	git_index *index = NULL;
 	checkout_counts ct;
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE;
-
 	memset(&ct, 0, sizeof(ct));
 	opts.notify_flags = GIT_CHECKOUT_NOTIFY_ALL;
 	opts.notify_cb = checkout_count_callback;
@@ -883,8 +877,7 @@ void test_checkout_tree__target_directory_from_bare(void)
 	g_repo = cl_git_sandbox_init("testrepo.git");
 	cl_assert(git_repository_is_bare(g_repo));
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE |
-		GIT_CHECKOUT_RECREATE_MISSING;
+	opts.checkout_strategy = GIT_CHECKOUT_RECREATE_MISSING;
 
 	opts.notify_flags = GIT_CHECKOUT_NOTIFY_ALL;
 	opts.notify_cb = checkout_count_callback;
@@ -963,8 +956,6 @@ void test_checkout_tree__fails_when_conflicts_exist_in_index(void)
 	git_oid oid;
 	git_object *obj = NULL;
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE;
-
 	cl_git_pass(git_reference_name_to_id(&oid, g_repo, "HEAD"));
 	cl_git_pass(git_object_lookup(&obj, g_repo, &oid, GIT_OBJECT_ANY));
 
@@ -1622,8 +1613,6 @@ void test_checkout_tree__retains_external_index_changes(void)
 {
 	git_checkout_options opts = GIT_CHECKOUT_OPTIONS_INIT;
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE;
-
 	modify_index_and_checkout_tree(&opts);
 	assert_status_entrycount(g_repo, 1);
 }
@@ -1632,7 +1621,7 @@ void test_checkout_tree__no_index_refresh(void)
 {
 	git_checkout_options opts = GIT_CHECKOUT_OPTIONS_INIT;
 
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_NO_REFRESH;
+	opts.checkout_strategy = GIT_CHECKOUT_NO_REFRESH;
 
 	modify_index_and_checkout_tree(&opts);
 	assert_status_entrycount(g_repo, 0);
@@ -1659,7 +1648,7 @@ void test_checkout_tree__dry_run(void)
 	/* now checkout branch but with dry run enabled */
 
 	memset(&ct, 0, sizeof(ct));
-	opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_DRY_RUN;
+	opts.checkout_strategy = GIT_CHECKOUT_DRY_RUN;
 	opts.notify_flags = GIT_CHECKOUT_NOTIFY_ALL;
 	opts.notify_cb = checkout_count_callback;
 	opts.notify_payload = &ct;
diff --git a/tests/libgit2/cherrypick/workdir.c b/tests/libgit2/cherrypick/workdir.c
index 8fd1ecbdf..f0296bd41 100644
--- a/tests/libgit2/cherrypick/workdir.c
+++ b/tests/libgit2/cherrypick/workdir.c
@@ -257,7 +257,7 @@ void test_cherrypick_workdir__conflict_use_ours(void)
 	};
 
 	/* leave the index in a conflicted state, but checkout "ours" to the workdir */
-	opts.checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_USE_OURS;
+	opts.checkout_opts.checkout_strategy = GIT_CHECKOUT_USE_OURS;
 
 	git_oid_fromstr(&head_oid, "bafbf6912c09505ac60575cd43d3f2aba3bd84d8");
 
diff --git a/tests/libgit2/clone/nonetwork.c b/tests/libgit2/clone/nonetwork.c
index eab633635..5b88395c8 100644
--- a/tests/libgit2/clone/nonetwork.c
+++ b/tests/libgit2/clone/nonetwork.c
@@ -23,7 +23,6 @@ void test_clone_nonetwork__initialize(void)
 	memset(&g_options, 0, sizeof(git_clone_options));
 	g_options.version = GIT_CLONE_OPTIONS_VERSION;
 	g_options.checkout_opts = dummy_opts;
-	g_options.checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE;
 	g_options.fetch_opts = dummy_fetch;
 }
 
diff --git a/tests/libgit2/merge/workdir/dirty.c b/tests/libgit2/merge/workdir/dirty.c
index b9c2ad033..be22700a8 100644
--- a/tests/libgit2/merge/workdir/dirty.c
+++ b/tests/libgit2/merge/workdir/dirty.c
@@ -97,7 +97,6 @@ static int merge_branch(void)
 	cl_git_pass(git_oid_fromstr(&their_oids[0], MERGE_BRANCH_OID));
 	cl_git_pass(git_annotated_commit_lookup(&their_head, repo, &their_oids[0]));
 
-	checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE;
 	error = git_merge(repo, (const git_annotated_commit **)&their_head, 1, &merge_opts, &checkout_opts);
 
 	git_annotated_commit_free(their_head);
diff --git a/tests/libgit2/merge/workdir/renames.c b/tests/libgit2/merge/workdir/renames.c
index 1b5128cf1..90f4b6910 100644
--- a/tests/libgit2/merge/workdir/renames.c
+++ b/tests/libgit2/merge/workdir/renames.c
@@ -100,7 +100,7 @@ void test_merge_workdir_renames__ours(void)
 
 	merge_opts.flags |= GIT_MERGE_FIND_RENAMES;
 	merge_opts.rename_threshold = 50;
-	checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_USE_OURS;
+	checkout_opts.checkout_strategy = GIT_CHECKOUT_USE_OURS;
 
 	cl_git_pass(merge_branches(repo, GIT_REFS_HEADS_DIR BRANCH_RENAME_OURS, GIT_REFS_HEADS_DIR BRANCH_RENAME_THEIRS, &merge_opts, &checkout_opts));
 	cl_git_pass(git_repository_index(&index, repo));
diff --git a/tests/libgit2/merge/workdir/simple.c b/tests/libgit2/merge/workdir/simple.c
index b9d3fc24c..0cbf728eb 100644
--- a/tests/libgit2/merge/workdir/simple.c
+++ b/tests/libgit2/merge/workdir/simple.c
@@ -103,7 +103,7 @@ static void merge_simple_branch(int merge_file_favor, int addl_checkout_strategy
 	cl_git_pass(git_annotated_commit_lookup(&their_heads[0], repo, &their_oids[0]));
 
 	merge_opts.file_favor = merge_file_favor;
-	checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_ALLOW_CONFLICTS |
+	checkout_opts.checkout_strategy = GIT_CHECKOUT_ALLOW_CONFLICTS |
 		addl_checkout_strategy;
 
 	cl_git_pass(git_merge(repo, (const git_annotated_commit **)their_heads, 1, &merge_opts, &checkout_opts));
@@ -577,7 +577,7 @@ void test_merge_workdir_simple__checkout_ours(void)
 		REMOVED_IN_MASTER_REUC_ENTRY
 	};
 
-	merge_simple_branch(0, GIT_CHECKOUT_SAFE | GIT_CHECKOUT_USE_OURS);
+	merge_simple_branch(0, GIT_CHECKOUT_USE_OURS);
 
 	cl_assert(merge_test_index(repo_index, merge_index_entries, 8));
 	cl_assert(merge_test_reuc(repo_index, merge_reuc_entries, 3));
diff --git a/tests/libgit2/online/clone.c b/tests/libgit2/online/clone.c
index dfaee0e85..1b85e622a 100644
--- a/tests/libgit2/online/clone.c
+++ b/tests/libgit2/online/clone.c
@@ -62,7 +62,6 @@ void test_online_clone__initialize(void)
 	memset(&g_options, 0, sizeof(git_clone_options));
 	g_options.version = GIT_CLONE_OPTIONS_VERSION;
 	g_options.checkout_opts = dummy_opts;
-	g_options.checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE;
 	g_options.fetch_opts = dummy_fetch;
 	g_options.fetch_opts.callbacks.certificate_check = ssl_cert;
 
@@ -193,7 +192,6 @@ void test_online_clone__can_checkout_a_cloned_repo(void)
 	bool checkout_progress_cb_was_called = false,
 		  fetch_progress_cb_was_called = false;
 
-	g_options.checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE;
 	g_options.checkout_opts.progress_cb = &checkout_progress;
 	g_options.checkout_opts.progress_payload = &checkout_progress_cb_was_called;
 	g_options.fetch_opts.callbacks.transfer_progress = &fetch_progress;
diff --git a/tests/libgit2/perf/helper__perf__do_merge.c b/tests/libgit2/perf/helper__perf__do_merge.c
index c77b46a1f..70cc84a83 100644
--- a/tests/libgit2/perf/helper__perf__do_merge.c
+++ b/tests/libgit2/perf/helper__perf__do_merge.c
@@ -26,13 +26,12 @@ void perf__do_merge(const char *fixture,
 
 	perf__timer__start(&t_total);
 
-	checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE;
 	clone_opts.checkout_opts = checkout_opts;
 
 	perf__timer__start(&t_clone);
 	cl_git_pass(git_clone(&g_repo, fixture, test_name, &clone_opts));
 	perf__timer__stop(&t_clone);
-	
+
 	git_oid_fromstr(&oid_a, id_a);
 	cl_git_pass(git_commit_lookup(&commit_a, g_repo, &oid_a));
 	cl_git_pass(git_branch_create(&ref_branch_a, g_repo,
diff --git a/tests/libgit2/revert/workdir.c b/tests/libgit2/revert/workdir.c
index 3f54280ca..a69613a4a 100644
--- a/tests/libgit2/revert/workdir.c
+++ b/tests/libgit2/revert/workdir.c
@@ -374,7 +374,7 @@ void test_revert_workdir__conflict_use_ours(void)
 		{ 0100644, "0f5bfcf58c558d865da6be0281d7795993646cee", 0, "file6.txt" },
 	};
 
-	opts.checkout_opts.checkout_strategy = GIT_CHECKOUT_SAFE | GIT_CHECKOUT_USE_OURS;
+	opts.checkout_opts.checkout_strategy = GIT_CHECKOUT_USE_OURS;
 
 	git_oid_fromstr(&head_oid, "72333f47d4e83616630ff3b0ffe4c0faebcc3c45");
 	cl_git_pass(git_commit_lookup(&head, repo, &head_oid));
diff --git a/tests/libgit2/worktree/worktree.c b/tests/libgit2/worktree/worktree.c
index 66273d1cb..74cc277c2 100644
--- a/tests/libgit2/worktree/worktree.c
+++ b/tests/libgit2/worktree/worktree.c
@@ -300,7 +300,7 @@ void test_worktree_worktree__add_no_checkout(void)
 	git_str path = GIT_STR_INIT;
 	git_worktree_add_options opts = GIT_WORKTREE_ADD_OPTIONS_INIT;
 
-	opts.checkout_options.checkout_strategy = GIT_CHECKOUT_NONE;
+	opts.checkout_options.checkout_strategy = GIT_CHECKOUT_DRY_RUN;
 
 	cl_git_pass(git_str_joinpath(&path, fixture.repo->workdir, "../worktree-no-checkout"));
 	cl_git_pass(git_worktree_add(&wt, fixture.repo, "worktree-no-checkout", path.ptr, &opts));