`fatal: unsafe repository (REPO is owned by someone else)` with ubuntu 20.04 container

[wez]

Hello!

This started happening recently; I see it both with v2.4.0 and v.3.0.0:

Syncing repository: wez/wezterm
Getting Git version info
Deleting the contents of '/__w/wezterm/wezterm'
Initializing the repository
  /usr/bin/git init /__w/wezterm/wezterm
  Initialized empty Git repository in /__w/wezterm/wezterm/.git/
  /usr/bin/git remote add origin https://github.com/wez/wezterm
  Error: fatal: unsafe repository ('/__w/wezterm/wezterm' is owned by someone else)
  To add an exception for this directory, call:
  
  	git config --global --add safe.directory /__w/wezterm/wezterm
  Error: The process '/usr/bin/git' failed with exit code 128

Is there a way to configure/advise the action how to handle this?
Is this really a problem elsewhere in the GH actions environment?

[wez]

https://github.com/wez/wezterm/runs/6000077214?check_suite_focus=true is this failing on v2.4.0
https://github.com/wez/wezterm/runs/5999826001?check_suite_focus=true is on 3.0.0

[Elsie19]

I'm getting the same issue with https://github.com/pacstall/pacstall-programs/runs/6000224485?check_suite_focus=true

[cbalioglu]

I think it is related to this: https://github.blog/2022-04-12-git-security-vulnerability-announced/

[strager]

I worked around this issue in my repo by adding the following step before the actions/checkout step:

      - name: work around permission issue
        run: git config --global --add safe.directory /__w/quick-lint-js/quick-lint-js

(My repo is named quick-lint-js.)

[wez]

I know nothing about how this repo works, but I'm assuming that it should probably configure the safe.directory somewhere around here:

checkout/src/git-directory-helper.ts

Lines 111 to 118 in eb8a193

	if (remove) {
	// Delete the contents of the directory. Don't delete the directory itself
	// since it might be the current working directory.
	core.info(`Deleting the contents of '${repositoryPath}'`)
	for (const file of await fs.promises.readdir(repositoryPath)) {
	await io.rmRF(path.join(repositoryPath, file))
	}
	}

[Locietta]

This issue seems only happens for workflows based on docker container, workflows directly running on runners is not affected.

git config --global --add safe.directory /__w/REPO/REPO workaround is only available with git v2.35.2, for older git, define the GIT_CEILING_DIRECTORIES to __w instead (but this won't work on v2.35.2).

So as a workaround for git before v2.35.2, add this step before checkout:

     - name: Trust My Directory
       run: export GIT_CEILING_DIRECTORIES=/__w # only work before git v2.35.2

My trial-and-errors are at
Locietta/github-action-playground.

[Konadu-Akwasi-Akuoko]

Hello!

This started happening recently; I see it both with v2.4.0 and v.3.0.0:

Syncing repository: wez/wezterm
Getting Git version info
Deleting the contents of '/__w/wezterm/wezterm'
Initializing the repository
  /usr/bin/git init /__w/wezterm/wezterm
  Initialized empty Git repository in /__w/wezterm/wezterm/.git/
  /usr/bin/git remote add origin https://github.com/wez/wezterm
  Error: fatal: unsafe repository ('/__w/wezterm/wezterm' is owned by someone else)
  To add an exception for this directory, call:
  
  	git config --global --add safe.directory /__w/wezterm/wezterm
  Error: The process '/usr/bin/git' failed with exit code 128

Is there a way to configure/advise the action how to handle this? Is this really a problem elsewhere in the GH actions environment?

I recently updated git and saw this error too.

I did what @strager said and it worked just fine; moved to the parent directory where .git is stored and did git config --global --add safe.directory /myProject

[alalazo]

Can anybody explain why, if the container is using a version of git < 2.35.2, we see the issue and an error message:

  To add an exception for this directory, call:
  
  	git config --global --add safe.directory /__w/spack/spack
  Error: The process '/usr/bin/git' failed with exit code 128

referencing an option that is introduced in v2.35.2 ? (If it matters in my case it's git v2.25.1 and Ubuntu 20.04)

EDIT: Leaving the reply here for the record. Ubuntu patched git on Apr 8th, so we get a breaking behavior and a security fix without any version bump.