On 9/23/26 9:30 AM, Sascha Hauer wrote:
> The labgrid-pytest job runs the container as root, while the checkout
> belongs to the user of the GitHub runner. git refuses a repository owned
> by someone else, and the final
>
> git diff --exit-code -- '*.sconfig'
>
> then never compares anything. Instead of failing with the ownership
> error, git diff treats the tree as no repository at all, falls back to
> --no-index and exits 129 with its usage message, which fails the job:
>
> Check security policy configurator
> Process completed with exit code 129.
>
> Pass safe.directory on the command line, where it still counts as
> protected configuration, and check up front that we are in a work tree
> at all, so a future breakage of the repository lookup is reported
> instead of being mistaken for modified policies.
>
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Sascha Hauer <[email protected]>
Acked-by: Ahmad Fatoum <[email protected]>
> ---
> test/check-security-policies.sh | 15 ++++++++++++++-
> 1 file changed, 14 insertions(+), 1 deletion(-)
>
> diff --git a/test/check-security-policies.sh b/test/check-security-policies.sh
> index 09b5301590..946a1ccdde 100755
> --- a/test/check-security-policies.sh
> +++ b/test/check-security-policies.sh
> @@ -71,5 +71,18 @@ for O in "" "$builddir"; do
> make O="$O" mrproper
> done
>
> +# The CI container runs as root, while the checkout belongs to the user
> +# the runner uses, so git refuses the repository over its ownership. git
> +# diff doesn't fail loudly in that case: it falls back to --no-index and
> +# exits 129 with a usage message instead of comparing anything.
> +srctree_git() {
> + git -c safe.directory="$PWD" "$@"
> +}
> +
> +if ! srctree_git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
> + echo >&2 "$0: not a git work tree, cannot look for modified policies"
> + exit 1
> +fi
> +
> # Catches security_oldconfig rewriting a committed policy.
> -git diff --exit-code -- '*.sconfig'
> +srctree_git diff --exit-code -- '*.sconfig'
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
