From a4b2350b06bcba09f0ce4093bb798b56b627ba7d Mon Sep 17 00:00:00 2001 From: Jinwoo-H Date: Fri, 28 Aug 2026 04:00:25 -0400 Subject: [PATCH] fix(release): trust Linux floor workspace --- .github/workflows/release-cut.yml | 3 +++ config/scripts/skill-sharing-release-workflow.test.mjs | 7 +++++++ 2 files changed, 10 insertions(+) diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml index 5d81a8b7ae3..af0fe9b45ba 100644 --- a/.github/workflows/release-cut.yml +++ b/.github/workflows/release-cut.yml @@ -1005,6 +1005,9 @@ jobs: with: ref: refs/tags/${{ needs.cut.outputs.tag }} + - name: Trust the checked-out workspace in the job container + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + - name: Restore skill-sharing test harness from the workflow ref shell: bash env: diff --git a/config/scripts/skill-sharing-release-workflow.test.mjs b/config/scripts/skill-sharing-release-workflow.test.mjs index 4b963ae38f3..cd006d7bc34 100644 --- a/config/scripts/skill-sharing-release-workflow.test.mjs +++ b/config/scripts/skill-sharing-release-workflow.test.mjs @@ -51,6 +51,13 @@ describe('skill-sharing release workflow', () => { expect(prerequisites.run).toMatch(/apt-get install[^\n]*\bunzip\b/) }) + it('trusts only the checked-out workspace before container git operations', () => { + const linux = workflow.jobs['skill-sharing-linux-floor-release-gate'] + const trustWorkspace = stepNamed(linux, 'Trust the checked-out workspace in the job container') + + expect(trustWorkspace.run).toBe('git config --global --add safe.directory "$GITHUB_WORKSPACE"') + }) + it('validates immutable tags with the current skill-sharing test harness', () => { for (const jobName of [ 'skill-sharing-release-gate',