From bb133b88e18b940afe8004c368f9d69007b6d73d Mon Sep 17 00:00:00 2001 From: John Coffey Date: Sun, 20 Sep 2026 23:29:19 -0700 Subject: [PATCH] Let root jobs use a checkout the node job chowned The build directory is reused between jobs, and the node job chowns it to the unprivileged node user for its tests. A later job running git as root then finds the checkout owned by someone else and git refuses with "detected dubious ownership" (exit 128). Which cached directory a job lands on decides whether it happens, so it is intermittent: the first weekly release dry run passed and the second failed. The version job in the tag pipeline runs git as root too, so the same refusal would have stopped a release from ever publishing its image. Both jobs now mark the project directory safe before touching git. --- .gitlab-ci.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index db9dc60..0e1d2e7 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -115,6 +115,12 @@ version: GIT_DEPTH: "0" before_script: - apt-get update -qq && apt-get install -y -qq --no-install-recommends git >/dev/null + # The build directory is reused between jobs, and the node job chowns it to + # the unprivileged `node` user so its tests can run. A later job running + # git as root then finds the checkout owned by somebody else, and git + # refuses with "detected dubious ownership" (exit 128). Whether it happens + # depends on which cached directory a job lands on, so it comes and goes. + - git config --global --add safe.directory "$CI_PROJECT_DIR" script: - V="$(node scripts/version.mjs)" - echo "VERSION=$V" > version.env @@ -178,6 +184,8 @@ weekly-release: GIT_DEPTH: "0" before_script: - apt-get update -qq && apt-get install -y -qq --no-install-recommends git curl jq >/dev/null + # See the version job: same shared directory, same root, same refusal. + - git config --global --add safe.directory "$CI_PROJECT_DIR" script: - | set -euo pipefail