Re: [PATCH] test: check-security-policies: mark the source tree safe for git

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

On 9/23/26 9:30 AM, Sascha Hauer wrote:
> The labgrid-pytest job runs the container as root, while the checkout
> belongs to the user of the GitHub runner. git refuses a repository owned
> by someone else, and the final
> 
> 	git diff --exit-code -- '*.sconfig'
> 
> then never compares anything. Instead of failing with the ownership
> error, git diff treats the tree as no repository at all, falls back to
> --no-index and exits 129 with its usage message, which fails the job:
> 
> 	Check security policy configurator
> 	Process completed with exit code 129.
> 
> Pass safe.directory on the command line, where it still counts as
> protected configuration, and check up front that we are in a work tree
> at all, so a future breakage of the repository lookup is reported
> instead of being mistaken for modified policies.
> 
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Acked-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

> ---
>  test/check-security-policies.sh | 15 ++++++++++++++-
>  1 file changed, 14 insertions(+), 1 deletion(-)
> 
> diff --git a/test/check-security-policies.sh b/test/check-security-policies.sh
> index 09b5301590..946a1ccdde 100755
> --- a/test/check-security-policies.sh
> +++ b/test/check-security-policies.sh
> @@ -71,5 +71,18 @@ for O in "" "$builddir"; do
>  	make O="$O" mrproper
>  done
>  
> +# The CI container runs as root, while the checkout belongs to the user
> +# the runner uses, so git refuses the repository over its ownership. git
> +# diff doesn't fail loudly in that case: it falls back to --no-index and
> +# exits 129 with a usage message instead of comparing anything.
> +srctree_git() {
> +	git -c safe.directory="$PWD" "$@"
> +}
> +
> +if ! srctree_git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
> +	echo >&2 "$0: not a git work tree, cannot look for modified policies"
> +	exit 1
> +fi
> +
>  # Catches security_oldconfig rewriting a committed policy.
> -git diff --exit-code -- '*.sconfig'
> +srctree_git diff --exit-code -- '*.sconfig'

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |