go-task / task

A task runner / simpler Make alternative written in Go
https://taskfile.dev
MIT License
10.97k stars 584 forks source link

Clearly error when ownership check fails when walking parent directories to find a Taskfile #1683

Open deviantintegral opened 3 months ago

deviantintegral commented 3 months ago

I ran into a tricky issue where Task wasn't finding an expected Taskfile: https://github.com/orgs/ddev/discussions/6273

What was confusing to me is that https://taskfile.dev/next/usage/#running-a-taskfile-from-a-subdirectory says

it will walk up the file tree until it finds one (similar to how git works)

I think it's common for this to refer to git not crossing mounted file systems when looking for a .git directory. It wasn't clear to me that this would also involve ownership checks, which is done here: https://github.com/go-task/task/blob/40d77156df28e87c7cded7d99f312d98257439fc/taskfile/taskfile.go#L148-L150

I assume this is all to prevent potential security issues like the one in Git https://github.blog/2022-04-12-git-security-vulnerability-announced/.

It'd be great if Task could either:

NikitaCOEUR commented 1 month ago

Same problem on my side, an issue in a GITHUB ACTION CI running in a container.

I am working in a child directory of the GitHub repository, and the owner is different between :

Also, if no Taskfile is found by going up from the child directories to the root of the repository, no Taskfile is found at the root either since the owner has changed...

Only workaround: execute the task by targeting the Taskfile directly:

task --taskfile "${GITHUB_WORKSPACE}/Taskfile.yml" ...