From c0358682fd894ffa129164102b96b1e108e59b9e Mon Sep 17 00:00:00 2001 From: priyaselvaganesan Date: Fri, 28 Aug 2026 15:16:29 -0700 Subject: [PATCH] fix(ci): trust the checkout inside image-push-manual's bazel-ci container git rev-parse fails silently with "dubious ownership" (CVE-2022-24765) when the bazel-ci container job runs against a checkout owned by the runner host's UID, so workspace_status.sh falls back to the literal "unknown" and event-ledger's manual-dispatch images embed mr-unknown instead of a real short SHA. Signed-off-by: priyaselvaganesan --- .github/workflows/image-push-manual.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/image-push-manual.yml b/.github/workflows/image-push-manual.yml index 4b5424951..940766029 100644 --- a/.github/workflows/image-push-manual.yml +++ b/.github/workflows/image-push-manual.yml @@ -143,6 +143,16 @@ jobs: - name: Checkout uses: actions/checkout@v4 + # actions/checkout runs on the runner host; this job's steps run inside + # the bazel-ci container, which mounts that checkout under a different + # UID. Since git 2.35.2 (CVE-2022-24765) git refuses to operate on a + # repo it does not own ("detected dubious ownership"), which makes + # workspace_status.sh's `git rev-parse --short HEAD` fail silently + # (stderr redirected) and fall back to the literal "unknown", landing + # in the built binary as `mr-unknown` instead of a real short SHA. + - name: Trust the checkout inside the container + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Resolve service name for cache keys id: svc env: