From 86b770e4487d32b871ae7599a888aa37db36c9a2 Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 28 Aug 2026 01:07:51 -0700
Subject: [PATCH] fix(release): trust Linux floor workspace (#16988)

* fix(release): trust Linux floor workspace

* test(release): ratchet workspace trust scope
---
 .github/workflows/release-cut.yml              |  3 +++
 .../skill-sharing-release-workflow.test.mjs    | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index 5d81a8b7ae3..af0fe9b45ba 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -1005,6 +1005,9 @@ jobs:
         with:
           ref: refs/tags/${{ needs.cut.outputs.tag }}
 
+      - name: Trust the checked-out workspace in the job container
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
       - name: Restore skill-sharing test harness from the workflow ref
         shell: bash
         env:
diff --git a/config/scripts/skill-sharing-release-workflow.test.mjs b/config/scripts/skill-sharing-release-workflow.test.mjs
index 4b963ae38f3..b6611a1aa18 100644
--- a/config/scripts/skill-sharing-release-workflow.test.mjs
+++ b/config/scripts/skill-sharing-release-workflow.test.mjs
@@ -51,6 +51,24 @@ describe('skill-sharing release workflow', () => {
     expect(prerequisites.run).toMatch(/apt-get install[^\n]*\bunzip\b/)
   })
 
+  it('trusts only the checked-out workspace before container git operations', () => {
+    const linux = workflow.jobs['skill-sharing-linux-floor-release-gate']
+    const trustWorkspace = stepNamed(linux, 'Trust the checked-out workspace in the job container')
+    const restoreHarness = stepNamed(
+      linux,
+      'Restore skill-sharing test harness from the workflow ref'
+    )
+    const safeDirectoryCommands = linux.steps
+      .filter((step) => typeof step.run === 'string' && step.run.includes('safe.directory'))
+      .map((step) => step.run)
+
+    expect(trustWorkspace.run).toBe('git config --global --add safe.directory "$GITHUB_WORKSPACE"')
+    expect(linux.steps.indexOf(trustWorkspace)).toBeLessThan(linux.steps.indexOf(restoreHarness))
+    expect(safeDirectoryCommands).toEqual([
+      'git config --global --add safe.directory "$GITHUB_WORKSPACE"'
+    ])
+  })
+
   it('validates immutable tags with the current skill-sharing test harness', () => {
     for (const jobName of [
       'skill-sharing-release-gate',