The change to git broke the Roundup Action's "Requirements" step and the change to ruby broke the "Changelog" step. (The changelog issue will be addressed in the github-actions-base repository in a separate issue.)
The issue with git is that version 2.36 introduced a fix to a security vulnerability (see the changelog for git and this more full explanation) wherein an suspicious owner of a parent directory is flagged if it's different from the owner of the current repository directory. This is the case with Github Actions since /github is owned by root but /github/workspace (the cloned repository) is owned by user 1001.
In order for the Roundup Action's "Requirements" step to work with git 2.36, it will need to set in the global git configuration that the workspace directory is safe.
🕵️ Expected behavior
I expected these two steps to work.
📜 To Reproduce
Use nasapds/github-actions-base:latest in the Roundup Action's Dockerfile as its FROM and watch things blow up mysteriously.
Checked for duplicates
No - I haven't checked
🐛 Describe the bug
A commit made directly to the
mainbranch ofgithub-actions-baseupgraded theFROMimage ofgithub-actions-basefrom Alpine 3.14 to Alpine 3.16.This resulted in:
gitbeing upgraded from 2.32.0 → 2.36.5rubybeing upgraded from 2.7.4 → 3.1.4The change to
gitbroke the Roundup Action's "Requirements" step and the change torubybroke the "Changelog" step. (The changelog issue will be addressed in thegithub-actions-baserepository in a separate issue.)The issue with
gitis that version 2.36 introduced a fix to a security vulnerability (see the changelog forgitand this more full explanation) wherein an suspicious owner of a parent directory is flagged if it's different from the owner of the current repository directory. This is the case with Github Actions since/githubis owned byrootbut/github/workspace(the cloned repository) is owned by user1001.In order for the Roundup Action's "Requirements" step to work with
git2.36, it will need to set in the global git configuration that the workspace directory is safe.🕵️ Expected behavior
I expected these two steps to work.
📜 To Reproduce
Use
nasapds/github-actions-base:latestin the Roundup Action'sDockerfileas itsFROMand watch things blow up mysteriously.🖥 Environment Info
Github Actions
📚 Version of Software Used
nasapds/github-actions-base:latest🩺 Test Data / Additional context
No response
🦄 Related requirements
🦄 #xyz
⚙️ Engineering Details
No response