configng: refresh clone once, early — fix matrix-prep cache fingerprint

Three coupled changes that together fix "I pushed to configng but the
new image still has the old YAML":

1) New helper `fetch_armbian_configng()` in
   lib/functions/configuration/config-desktop.sh. Idempotent wrapper
   around `fetch_from_repo` (mirror-friendly via GITHUB_SOURCE),
   returns early if BUILD_DESKTOP != yes, save/restores PWD, declares
   the locals fetch_from_repo writes to so they don't leak.

2) Call the helper from BOTH prep_conf_main_build_single (line 31,
   right after do_main_configuration) AND prep_conf_main_minimal_ni
   (line 73, same position). Previously only the full-build path
   ran the fetch via interactive_desktop_main_configuration; the
   json-info / matrix-prep path (cli-jsoninfo) silently used a
   stale or absent clone.

3) Revert artifact_rootfs_config_dump to a read-only consumer of
   the now-guaranteed-fresh on-disk clone. No fetch in there, no
   mid-flow side effects per artifact. Keeps the info-level
   breadcrumb that logs short-hash + commit subject.

Also fixes a latent bug in git_ensure_safe_directory
(lib/functions/general/git.sh): the gate on `[[ -e "$1/.git" ]]`
caused safe.directory to be silently skipped when fetch_from_repo
prepared a fresh work tree before `git init`. The subsequent
checkout/clean then failed with "fatal: detected dubious ownership"
in Docker-volume-mounted setups where the parent directory has a
non-matching uid. Dropping the gate makes the add unconditional;
setting safe.directory on a non-git path is harmless.

Net effect: every code path that reads CONFIGNG_DESKTOPS_HASH
now sees the actual HEAD of armbian-configng, the
artifact_full_oci_target resolves correctly, CI's remote-cache
lookup hits the right (or correctly-missing) tag, and full builds
under Docker stop hitting the safe-directory wall.

Author: igorpecovnik

lib/functions/artifacts/artifact-rootfs.sh

@@ -20,10 +20,23 @@ function artifact_rootfs_config_dump() {
 	# invalidates the desktop rootfs cache — the package list, browser
 	# mapping, tier overrides, or branding may have changed.
 	if [[ "${BUILD_DESKTOP}" == "yes" ]]; then
+		# Read CONFIGNG_DESKTOPS_HASH from the cache/sources/armbian-configng
+		# clone. The clone is guaranteed fresh by the fetch_armbian_configng
+		# call in prep_conf_main_{minimal_ni,build_single} — both build
+		# entry points refresh it before this function ever runs. Keeping
+		# the fetch out of here (it used to live here for a couple of
+		# revisions) means the matrix-prep path and the full-build path
+		# converge on the same authoritative state at the same point in
+		# time, instead of each artifact's config_dump fetching mid-flow.
 		declare configng_desktops_hash="undetermined"
 		local configng_dir="${SRC}/cache/sources/armbian-configng"
 		if [[ -d "${configng_dir}/.git" ]]; then
 			configng_desktops_hash="$(git -C "${configng_dir}" log -1 --format=%H -- tools/modules/desktops/ 2>/dev/null || echo "unknown")"
+			# Operator-facing breadcrumb: short hash + commit subject so
+			# build logs make the cache fingerprint trivially traceable.
+			local configng_desktops_subject
+			configng_desktops_subject="$(git -C "${configng_dir}" log -1 --format=%s -- tools/modules/desktops/ 2>/dev/null || true)"
+			display_alert "configng desktops HEAD" "${configng_desktops_hash:0:12} ${configng_desktops_subject}" "info"
 		fi
 		artifact_input_variables[CONFIGNG_DESKTOPS_HASH]="${configng_desktops_hash}"
 	fi

lib/functions/configuration/config-desktop.sh

@@ -25,30 +25,46 @@
 #   DESKTOP_ENVIRONMENT_CONFIG_NAME
 #   DESKTOP_APPGROUPS_SELECTED
 
+# Ensure cache/sources/armbian-configng is a fresh clone of
+# https://github.com/armbian/configng#main. Idempotent and safe to call
+# multiple times (fetch_from_repo handles initial-clone and refresh).
+#
+# Called once per build from both prep_conf_main_minimal_ni (the json-
+# info / matrix-prep path used by armbian/os CI) AND
+# prep_conf_main_build_single (full image build). Having both paths
+# call this guarantees CONFIGNG_DESKTOPS_HASH is computed against the
+# real HEAD of configng, not a stale on-disk snapshot — which was the
+# root cause of the "I pushed to configng but the image still has the
+# old YAML" class of bug.
+#
+# Save/restore PWD because fetch_from_repo cd's into the work tree and
+# doesn't restore. Declare fetched_revision/_ts locals because
+# fetch_from_repo writes to them in caller scope.
+#
+# Non-fatal: failed fetch (offline, network blip, mirror down) logs a
+# warning and falls through with whatever is on disk — downstream
+# consumers handle the "stale or missing clone" case explicitly.
+function fetch_armbian_configng() {
+	[[ "${BUILD_DESKTOP}" != "yes" ]] && return 0
+
+	declare _save_pwd="${PWD}"
+	declare fetched_revision="" fetched_revision_ts=""
+	fetch_from_repo "https://github.com/armbian/configng" "armbian-configng" "branch:main" || \
+		display_alert "armbian-configng fetch_from_repo failed" "falling back to on-disk state if any" "wrn"
+	cd "${_save_pwd}" || true
+}
+
 function interactive_desktop_main_configuration() {
 	[[ $BUILD_DESKTOP != "yes" ]] && return 0
 
 	display_alert "desktop-config" "DESKTOP_ENVIRONMENT entry: ${DESKTOP_ENVIRONMENT}" "debug"
 
-	# Refresh the armbian-configng clone on EVERY desktop build,
-	# regardless of whether DESKTOP_ENVIRONMENT was pre-set. The
-	# clone feeds two downstream consumers:
-	#
-	#   1. The interactive DE-selection dialog below — only fires
-	#      when DESKTOP_ENVIRONMENT is empty.
-	#   2. artifact_rootfs_config_dump, which reads the clone's
-	#      `git log -1 -- tools/modules/desktops/` as the
-	#      CONFIGNG_DESKTOPS_HASH input that (via create-cache.sh's
-	#      cache_type) fingerprints the rootfs tarball filename.
-	#
-	# Keeping the fetch inside the `-z DESKTOP_ENVIRONMENT` branch
-	# meant every non-interactive build (CI, items-from-inventory,
-	# scripted local) skipped it — so the hash was computed against
-	# whatever stale clone happened to be on disk and the build
-	# happily cache-hit a pre-configng-change rootfs. Hoisting the
-	# fetch up here makes the clone authoritative for every
-	# BUILD_DESKTOP=yes invocation.
-	fetch_from_repo "https://github.com/armbian/configng" "armbian-configng" "branch:main"
+	# Refresh the armbian-configng clone before the DE-selection dialog
+	# runs. fetch_armbian_configng is idempotent — typically already
+	# invoked once by prep_conf_main_{minimal_ni,build_single} above
+	# this in the call chain; re-calling here is a cheap no-op that
+	# also handles standalone callers (e.g. plain config-only paths).
+	fetch_armbian_configng
 
 	local configng_dir="${SRC}/cache/sources/armbian-configng"
 	local yaml_dir="${configng_dir}/tools/modules/desktops/yaml"

lib/functions/general/git.sh

@@ -55,10 +55,16 @@ function improved_git_fetch() {
 function git_ensure_safe_directory() {
 	if [[ -n "$(command -v git)" ]]; then
 		local git_dir="$1"
-		if [[ -e "$1/.git" ]]; then
-			display_alert "git: Marking all directories as safe, which should include" "$git_dir" "debug"
-			git config --global --get safe.directory "$1" > /dev/null || regular_git config --global --add safe.directory "$1"
-		fi
+		# Mark the directory safe unconditionally. The previous gate on
+		# `-e "$1/.git"` was a bug: fetch_from_repo calls us BEFORE
+		# running `git init`, so on a freshly-prepared work tree (no
+		# .git yet) the safe.directory add was silently skipped — then
+		# the subsequent `regular_git checkout/clean` after init blew
+		# up with "fatal: detected dubious ownership". Setting
+		# safe.directory on a non-git path is harmless; git only
+		# consults the entry when an actual repo is accessed there.
+		display_alert "git: Marking directory as safe" "$git_dir" "debug"
+		git config --global --get safe.directory "$1" > /dev/null || regular_git config --global --add safe.directory "$1"
 	else
 		display_alert "git not installed" "a true wonder how you got this far without git - it will be installed for you" "warn"
 	fi

lib/functions/main/config-prepare.sh

@@ -28,6 +28,14 @@ function prep_conf_main_build_single() {
 
 	LOG_SECTION="do_main_configuration" do_with_conditional_logging do_main_configuration # This initializes the extension manager among a lot of other things, and call extension_prepare_config() hook
 
+	# Refresh armbian-configng once, early — needs BUILD_DESKTOP to be
+	# authoritative (set by do_main_configuration above). The clone is a
+	# build-wide input: feeds CONFIGNG_DESKTOPS_HASH (cache fingerprint)
+	# AND the DE dialog AND the runtime YAML parser. Doing this here
+	# means artifact_rootfs_config_dump can rely on a fresh on-disk
+	# tree instead of fetching mid-flow per artifact.
+	fetch_armbian_configng
+
 	interactive_desktop_main_configuration
 	interactive_finish # cleans up vars used for interactive
 
@@ -72,6 +80,14 @@ function prep_conf_main_minimal_ni() {
 	allow_no_family="${allow_no_family:-"yes"}" \
 		LOG_SECTION="do_main_configuration" do_with_conditional_logging do_main_configuration # This initializes the extension manager among a lot of other things, and call extension_prepare_config() hook
 
+	# Refresh armbian-configng for the non-interactive path too (matrix-
+	# prep / json-info / cli-build's minimal config). Same rationale as
+	# in prep_conf_main_build_single: every code path that ends up
+	# reading CONFIGNG_DESKTOPS_HASH (from artifact_rootfs_config_dump)
+	# needs the clone fresh, OR the OCI cache fingerprint resolves to
+	# the wrong tag and CI ships the pre-change config.
+	fetch_armbian_configng
+
 	# Required: does a lot of stuff and extension_prepare_config() hook
 	LOG_SECTION="do_extra_configuration" do_with_conditional_logging do_extra_configuration