Fix dubious-ownership git failure in rocq-image container jobs#58
Merged
Conversation
When run-experiment.yml runs inside a `rocq-image` container it runs as root while the checked-out workspace (and every nested submodule working dir) is owned by the host-runner uid, so the "Re-init submodules over HTTPS" step dies with `fatal: detected dubious ownership in repository` (exit 128) and skips the whole experiment. actions/checkout whitelists its own operations, but the explicit re-init step doesn't. Add `git config --global --add safe.directory '*'` at the top of that step, before any git runs. Global so it also covers git the experiment run shells out to later; a no-op on the host runner, which owns its own workspace. Reproduced and verified against the toolchain image locally: as root on a uid-1001-owned repo, `git submodule sync/update` fails 128 without the line and succeeds 0 with it. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Follow-up to #57. With the prebuilt
rocq-imagenow in place, the experiment job runs inside the container as root, while the checked-out workspace (and every nested submodule working dir) is owned by the host-runner uid. git refuses to operate on a repo it doesn't "own", so the Re-init submodules over HTTPS step fails:…and every subsequent step (
Install etna-cli,Register experiment,Run experiment) is skipped. This never happened on the host runner, which owns its workspace.actions/checkoutwhitelists its own git operations, but the explicit re-init step doesn't inherit that.Fix
Add
git config --global --add safe.directory '*'at the top of the re-init step, before any git command. Setting it globally means it also covers any git the experiment run shells out to later. No-op on the host path (the runner owns its workspace), so the non-container path is unaffected.Validation
bst-proplang-rocq(run): the image pulled andactions/checkout(incl. all submodules) succeeded inside it — confirming Add prebuilt Rocq toolchain image for run-experiment's rocq-image #57 works — then this step was the next failure.git 2.43.0, as root, repo owned by uid 1001):🤖 Generated with Claude Code