[PATCH] test: check-security-policies: mark the source tree safe for git

[Sascha Hauer <s.hauer@pengutronix.de>]

The labgrid-pytest job runs the container as root, while the checkout
belongs to the user of the GitHub runner. git refuses a repository owned
by someone else, and the final

	git diff --exit-code -- '*.sconfig'

then never compares anything. Instead of failing with the ownership
error, git diff treats the tree as no repository at all, falls back to
--no-index and exits 129 with its usage message, which fails the job:

	Check security policy configurator
	Process completed with exit code 129.

Pass safe.directory on the command line, where it still counts as
protected configuration, and check up front that we are in a work tree
at all, so a future breakage of the repository lookup is reported
instead of being mistaken for modified policies.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 test/check-security-policies.sh | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/test/check-security-policies.sh b/test/check-security-policies.sh
index 09b5301590..946a1ccdde 100755
--- a/test/check-security-policies.sh
+++ b/test/check-security-policies.sh
@@ -71,5 +71,18 @@ for O in "" "$builddir"; do
 	make O="$O" mrproper
 done
 
+# The CI container runs as root, while the checkout belongs to the user
+# the runner uses, so git refuses the repository over its ownership. git
+# diff doesn't fail loudly in that case: it falls back to --no-index and
+# exits 129 with a usage message instead of comparing anything.
+srctree_git() {
+	git -c safe.directory="$PWD" "$@"
+}
+
+if ! srctree_git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+	echo >&2 "$0: not a git work tree, cannot look for modified policies"
+	exit 1
+fi
+
 # Catches security_oldconfig rewriting a committed policy.
-git diff --exit-code -- '*.sconfig'
+srctree_git diff --exit-code -- '*.sconfig'
-- 
2.47.3