fatal: unsafe repository (REPO is owned by someone else) with ubuntu 20.04 container

[wez]

Hello!

This started happening recently; I see it both with v2.4.0 and v.3.0.0:

Syncing repository: wez/wezterm
Getting Git version info
Deleting the contents of '/__w/wezterm/wezterm'
Initializing the repository
  /usr/bin/git init /__w/wezterm/wezterm
  Initialized empty Git repository in /__w/wezterm/wezterm/.git/
  /usr/bin/git remote add origin https://github.com/wez/wezterm
  Error: fatal: unsafe repository ('/__w/wezterm/wezterm' is owned by someone else)
  To add an exception for this directory, call:
  
  	git config --global --add safe.directory /__w/wezterm/wezterm
  Error: The process '/usr/bin/git' failed with exit code 128

Is there a way to configure/advise the action how to handle this?
Is this really a problem elsewhere in the GH actions environment?

[wez]

https://github.com/wez/wezterm/runs/6000077214?check_suite_focus=true is this failing on v2.4.0
https://github.com/wez/wezterm/runs/5999826001?check_suite_focus=true is on 3.0.0

[Elsie19]

I'm getting the same issue with https://github.com/pacstall/pacstall-programs/runs/6000224485?check_suite_focus=true

[cbalioglu]

I think it is related to this: https://github.blog/2022-04-12-git-security-vulnerability-announced/

[strager]

I worked around this issue in my repo by adding the following step before the actions/checkout step:

      - name: work around permission issue
        run: git config --global --add safe.directory /__w/quick-lint-js/quick-lint-js

(My repo is named quick-lint-js.)

[wez]

I know nothing about how this repo works, but I'm assuming that it should probably configure the safe.directory somewhere around here:

checkout/src/git-directory-helper.ts

Lines 111 to 118 in eb8a193

	if (remove) {
	// Delete the contents of the directory. Don't delete the directory itself
	// since it might be the current working directory.
	core.info(`Deleting the contents of '${repositoryPath}'`)
	for (const file of await fs.promises.readdir(repositoryPath)) {
	await io.rmRF(path.join(repositoryPath, file))
	}
	}

[Locietta]

This issue seems only happens for workflows based on docker container, workflows directly running on runners is not affected.

git config --global --add safe.directory /__w/REPO/REPO workaround is only available with git v2.35.2, for older git, define the GIT_CEILING_DIRECTORIES to __w instead (but this won't work on v2.35.2).

So as a workaround for git before v2.35.2, add this step before checkout:

     - name: Trust My Directory
       run: export GIT_CEILING_DIRECTORIES=/__w # only work before git v2.35.2

My trial-and-errors are at
Locietta/github-action-playground.

[Konadu-Akwasi-Akuoko]

Hello!

This started happening recently; I see it both with v2.4.0 and v.3.0.0:

Syncing repository: wez/wezterm
Getting Git version info
Deleting the contents of '/__w/wezterm/wezterm'
Initializing the repository
  /usr/bin/git init /__w/wezterm/wezterm
  Initialized empty Git repository in /__w/wezterm/wezterm/.git/
  /usr/bin/git remote add origin https://github.com/wez/wezterm
  Error: fatal: unsafe repository ('/__w/wezterm/wezterm' is owned by someone else)
  To add an exception for this directory, call:
  
  	git config --global --add safe.directory /__w/wezterm/wezterm
  Error: The process '/usr/bin/git' failed with exit code 128

Is there a way to configure/advise the action how to handle this? Is this really a problem elsewhere in the GH actions environment?

I recently updated git and saw this error too.

I did what @strager said and it worked just fine; moved to the parent directory where .git is stored and did git config --global --add safe.directory /myProject

[alalazo]

Can anybody explain why, if the container is using a version of git < 2.35.2, we see the issue and an error message:

  To add an exception for this directory, call:
  
  	git config --global --add safe.directory /__w/spack/spack
  Error: The process '/usr/bin/git' failed with exit code 128

referencing an option that is introduced in v2.35.2 ? (If it matters in my case it's git v2.25.1 and Ubuntu 20.04)

EDIT: Leaving the reply here for the record. Ubuntu patched git on Apr 8th, so we get a breaking behavior and a security fix without any version bump.

[yoshz]

Other solution is just to make sure your container runs as the same user as actions-runner-controller.
In my case this was uid 1000.

[zefir-git]

Not related to this repository, but I recently upgraded my Git CLI on an Ubuntu 20.04 machine and got this error when attempting to run git commands as root in a user's home directory.

git version 2.25.1

[me-and]

Same issue with the Windows runners, and it is indeed because of the security fix for CVE-2022-24765.

The quick fix is to add a step before the checkout action to run git config --global --add safe.directory <path>. The better fix will be for the runners / containers / &c. to set this automatically; on the GitHub runners, at least, because they're not shared, I don't believe there's any risk of actually hitting this vulnerability.

[AMMJ93]

Running git config --global --add safe.directory /github/workspace doesnt fix the issue for me, nor does export GIT_CEILING_DIRECTORIES=/__w :

fatal: unsafe repository ('/github/workspace' is owned by someone else)
To add an exception for this directory, call:

	git config --global --add safe.directory /github/workspace

[thboop]

Thanks for the report, our team is working on a fix

[melroy89]

It's actually for some reason still not solved. Despite the git config command within the checkout action, for some reason I still get this issue.

[krystian3w]

CSS clean up "tool" for web version:

div[data-url^="/actions/checkout/issues/760/"] ~ div
    .TimelineItem ~ div
        [data-gid]:not([data-gid^="IC"]) {
            display: none !important;
}

Hides 11 elements (with 48 random references) {and 76 elements on full loaded topic [662 references]}.

[sambacha]

If you want to bypass the issue:

cat <<EOF >> /etc/gitconfig
[safe]
        directory = *
EOF

[Cirruslucent]

Syncing repository: wez/wezterm
Getting Git version info
Deleting the contents of '/__w/wezterm/wezterm'
Initializing the repository
/usr/bin/git init /__w/wezterm/wezterm
Initialized empty Git repository in /__w/wezterm/wezterm/.git/
/usr/bin/git remote add origin https://github.com/wez/wezterm
Error: fatal: unsafe repository ('/__w/wezterm/wezterm' is owned by someone else)
To add an exception for this directory, call:

git config --global --add safe.directory /__w/wezterm/wezterm

Error: The process '/usr/bin/git' failed with exit code 128

[brmonaghan]

Syncing repository: wez/wezterm Getting Git version info Deleting the contents of '/__w/wezterm/wezterm' Initializing the repository /usr/bin/git init /__w/wezterm/wezterm Initialized empty Git repository in /__w/wezterm/wezterm/.git/ /usr/bin/git remote add origin https://github.com/wez/wezterm Error: fatal: unsafe repository ('/__w/wezterm/wezterm' is owned by someone else) To add an exception for this directory, call:

git config --global --add safe.directory /__w/wezterm/wezterm

Error: The process '/usr/bin/git' failed with exit code 128

Umm, excuse me? Your answer is in the text.