Skip to content

Commit 14cdc52

Browse files
EliahKaganclaude
EliahKagan
and
claude
committed
Restructure CI diagnostic steps
Cleanups on the ownership-display step from the previous commit: - Split into per-shell steps (bash POSIX `ls -ld`, pwsh NTFS `Get-Acl`, bash safe.directory `git config`), removing the bash-driven PowerShell subprocess with `cygpath -w` and quote-escaping. Use `pwsh`, not `powershell.exe`. Gate pythonpackage's two views by `matrix.os-type` (Git Bash's `ls -ld` on Windows reports a uniform `runneradmin 197121` for every path, ignoring NTFS Owner -- MSYS2's SID-to-uid mapping doesn't have Cygwin's fidelity). - Trim the decorative `$HOME` entry from POSIX path lists: it isn't part of any git trust decision -- only `~/.gitconfig` is. Use `${HOME:?HOME is not set}/.gitconfig` for the remaining entry so an unset HOME fails loudly. - Move the pwsh path list into a `$paths = @(...)` variable. Unix shells keep the inline `for p in WORD WORD ...` form: alpine's `sh` (busybox ash) doesn't support arrays, and the others shouldn't differ from it unnecessarily. - Drop `2>&1` from the safe.directory step. Drop the `|| echo "(none)"` fallback on cygwin (entries are explicitly configured; bare command fails on regression). Keep it on pythonpackage and alpine, where `actions/checkout`'s safe.directory add lives under a throwaway HOME override and doesn't persist, so there legitimately are no entries to display. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent f368f17 commit 14cdc52

3 files changed

Lines changed: 129 additions & 88 deletions

File tree

‎.github/workflows/alpine-test.yml‎

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -61,25 +61,28 @@ jobs:
6161
. .venv/bin/activate
6262
pip install '.[test]'
6363
64-
- name: Show file ownership and safe.directory entries
64+
- name: Show POSIX file ownership
6565
run: |
66-
echo "==================== File ownership ===================="
6766
for p in \
68-
"$(pwd)" \
69-
"$(pwd)/.git" \
70-
"$(pwd)/git/ext/gitdb" \
71-
"$(pwd)/git/ext/gitdb/.git" \
72-
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap" \
73-
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap/.git" \
74-
"${HOME:-}" \
75-
"${HOME:-}/.gitconfig"; do
76-
if [ -n "$p" ]; then
77-
ls -ld -- "$p" 2>/dev/null || echo "(missing: $p)"
78-
fi
67+
"$(pwd)" \
68+
"$(pwd)/.git" \
69+
"$(pwd)/git/ext/gitdb" \
70+
"$(pwd)/git/ext/gitdb/.git" \
71+
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap" \
72+
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap/.git" \
73+
"${HOME:?HOME is not set}/.gitconfig"
74+
do
75+
ls -ld -- "$p" 2>/dev/null || echo "(missing: $p)"
7976
done
80-
echo
81-
echo "==================== safe.directory entries ===================="
82-
git config --global --get-all safe.directory 2>&1 || echo "(none)"
77+
78+
- name: Show safe.directory entries
79+
# `actions/checkout`'s safe.directory add is only durable for the
80+
# checkout itself (it writes under a throwaway HOME override and
81+
# then discards it), so by the time this step runs the runner
82+
# user's `~/.gitconfig` has no entries -- and the Alpine container
83+
# chowns the workspace to runner:docker to match the test user, so
84+
# git accepts the ownership without one. Expected: `(none)`.
85+
run: git config --global --get-all safe.directory || echo "(none)"
8386

8487
- name: Show version and platform information
8588
run: |

‎.github/workflows/cygwin-test.yml‎

Lines changed: 56 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -90,64 +90,62 @@ jobs:
9090
run: |
9191
pip install '.[test]'
9292
93-
- &ownership-display
94-
name: Show file ownership and safe.directory entries
93+
- &ownership-posix-display
94+
name: Show POSIX file ownership
95+
# Cygwin's `ls -ld` reports the NTFS Owner SID via Cygwin's SID-to-uid
96+
# mapping (well-known SIDs by their RID, machine-local accounts by
97+
# 0x30000+RID). That mapping is what Cygwin git's
98+
# `is_path_owned_by_current_user` reduces to, so this is the view that
99+
# determines whether `safe.directory` is consulted.
95100
run: |
96-
echo "==================== File ownership (Cygwin view, ls -ld) ===================="
97101
for p in \
98-
"$(pwd)" \
99-
"$(pwd)/.git" \
100-
"$(pwd)/git/ext/gitdb" \
101-
"$(pwd)/git/ext/gitdb/.git" \
102-
"$(pwd)/.git/modules/gitdb" \
103-
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap" \
104-
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap/.git" \
105-
"$(pwd)/.git/modules/gitdb/modules/smmap" \
106-
"${HOME:-}" \
107-
"${HOME:-}/.gitconfig"; do
108-
if [ -n "$p" ]; then
109-
ls -ld -- "$p" 2>/dev/null || echo "(missing: $p)"
110-
fi
102+
"$(pwd)" \
103+
"$(pwd)/.git" \
104+
"$(pwd)/git/ext/gitdb" \
105+
"$(pwd)/git/ext/gitdb/.git" \
106+
"$(pwd)/.git/modules/gitdb" \
107+
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap" \
108+
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap/.git" \
109+
"$(pwd)/.git/modules/gitdb/modules/smmap" \
110+
"${HOME:?HOME is not set}/.gitconfig"
111+
do
112+
ls -ld -- "$p" 2>/dev/null || echo "(missing: $p)"
111113
done
112-
echo
113-
echo "==================== File ownership (Win32 view, Get-Acl) ===================="
114-
# Cygwin's ls -ld and stat go through Cygwin's SID-to-uid mapping
115-
# (well-known SIDs by their RID, machine-local accounts by 0x30000+RID).
116-
# The mapping is deterministic, but going via Win32 Get-Acl gives the
117-
# NTAccount form of the NTFS Owner SID directly, with no Cygwin layer
118-
# in between -- useful for confirming that what Cygwin reports as
119-
# "Administrators" really is the BUILTIN\Administrators SID (S-1-5-32-544)
120-
# rather than some local-machine account that Cygwin happens to map to
121-
# the same uid. The workflow sets CYGWIN_NOWINPATH=1, so Windows paths
122-
# are not on Cygwin's $PATH; invoke powershell.exe by absolute path.
123-
ps_exe=/cygdrive/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe
124-
if [ -x "$ps_exe" ]; then
125-
for p in \
126-
"$(pwd)" \
127-
"$(pwd)/.git" \
128-
"$(pwd)/git/ext/gitdb" \
129-
"$(pwd)/git/ext/gitdb/.git" \
130-
"$(pwd)/.git/modules/gitdb" \
131-
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap" \
132-
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap/.git" \
133-
"$(pwd)/.git/modules/gitdb/modules/smmap" \
134-
"${HOME:-}/.gitconfig"; do
135-
if [ -n "$p" ] && [ -e "$p" ]; then
136-
wp=$(cygpath -w "$p")
137-
# Escape single-quotes for PowerShell single-quoted string literal: ' -> ''
138-
wp_escaped=${wp//\'/\'\'}
139-
owner=$("$ps_exe" -NoProfile -NonInteractive -Command \
140-
"try { (Get-Acl -LiteralPath '${wp_escaped}').Owner } catch { 'ERROR: ' + \$_.Exception.Message }" \
141-
2>/dev/null | tr -d '\r')
142-
printf " %-44s %s\n" "$owner" "$wp"
143-
fi
144-
done
145-
else
146-
echo "($ps_exe not found -- skipping Win32 view)"
147-
fi
148-
echo
149-
echo "==================== safe.directory entries ===================="
150-
git config --global --get-all safe.directory 2>&1 || echo "(none)"
114+
115+
- &ownership-ntfs-display
116+
name: Show NTFS file ownership
117+
# Authoritative NTFS Owner via Get-Acl, with no Cygwin SID-to-uid layer
118+
# in between -- useful for confirming what the Cygwin view reports as
119+
# "Administrators" is the BUILTIN\Administrators SID (S-1-5-32-544).
120+
shell: pwsh
121+
run: |
122+
$paths = @(
123+
"$pwd",
124+
"$pwd\.git",
125+
"$pwd\git\ext\gitdb",
126+
"$pwd\git\ext\gitdb\.git",
127+
"$pwd\.git\modules\gitdb",
128+
"$pwd\git\ext\gitdb\gitdb\ext\smmap",
129+
"$pwd\git\ext\gitdb\gitdb\ext\smmap\.git",
130+
"$pwd\.git\modules\gitdb\modules\smmap",
131+
"$env:USERPROFILE\.gitconfig"
132+
)
133+
foreach ($p in $paths) {
134+
if (Test-Path -LiteralPath $p) {
135+
try {
136+
$owner = (Get-Acl -LiteralPath $p).Owner
137+
} catch {
138+
$owner = "ERROR: $($_.Exception.Message)"
139+
}
140+
"{0,-44} {1}" -f $owner, $p
141+
} else {
142+
"(missing: $p)"
143+
}
144+
}
145+
146+
- &safe-directory-display
147+
name: Show safe.directory entries
148+
run: git config --global --get-all safe.directory
151149

152150
- name: Show version and platform information
153151
run: |
@@ -251,7 +249,9 @@ jobs:
251249
- *setup-venv
252250
- *update-pypa
253251
- *install-deps
254-
- *ownership-display
252+
- *ownership-posix-display
253+
- *ownership-ntfs-display
254+
- *safe-directory-display
255255

256256
- name: Run submodule tests
257257
run: |

‎.github/workflows/pythonpackage.yml‎

Lines changed: 54 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -87,25 +87,63 @@ jobs:
8787
run: |
8888
pip install '.[test]'
8989
90-
- name: Show file ownership and safe.directory entries
90+
- name: Show POSIX file ownership
91+
# Linux and macOS only. On Windows, Git Bash's `ls -ld` reports a
92+
# uniform uid+gid for every path regardless of NTFS Owner (MSYS2's
93+
# SID-to-uid mapping doesn't have Cygwin's fidelity), so it would
94+
# not be informative here. The NTFS Owner check below covers Windows.
95+
if: matrix.os-type != 'windows'
9196
run: |
92-
echo "==================== File ownership ===================="
9397
for p in \
94-
"$(pwd)" \
95-
"$(pwd)/.git" \
96-
"$(pwd)/git/ext/gitdb" \
97-
"$(pwd)/git/ext/gitdb/.git" \
98-
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap" \
99-
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap/.git" \
100-
"${HOME:-}" \
101-
"${HOME:-}/.gitconfig"; do
102-
if [ -n "$p" ]; then
103-
ls -ld -- "$p" 2>/dev/null || echo "(missing: $p)"
104-
fi
98+
"$(pwd)" \
99+
"$(pwd)/.git" \
100+
"$(pwd)/git/ext/gitdb" \
101+
"$(pwd)/git/ext/gitdb/.git" \
102+
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap" \
103+
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap/.git" \
104+
"${HOME:?HOME is not set}/.gitconfig"
105+
do
106+
ls -ld -- "$p" 2>/dev/null || echo "(missing: $p)"
105107
done
106-
echo
107-
echo "==================== safe.directory entries ===================="
108-
git config --global --get-all safe.directory 2>&1 || echo "(none)"
108+
109+
- name: Show NTFS file ownership
110+
# Windows only. Reads NTFS Owner directly via Get-Acl, which is the
111+
# authoritative view for Windows-side ownership questions; the POSIX
112+
# view via Git Bash's MSYS2 layer is not a reliable proxy here.
113+
if: matrix.os-type == 'windows'
114+
shell: pwsh
115+
run: |
116+
$paths = @(
117+
"$pwd",
118+
"$pwd\.git",
119+
"$pwd\git\ext\gitdb",
120+
"$pwd\git\ext\gitdb\.git",
121+
"$pwd\git\ext\gitdb\gitdb\ext\smmap",
122+
"$pwd\git\ext\gitdb\gitdb\ext\smmap\.git",
123+
"$env:USERPROFILE\.gitconfig"
124+
)
125+
foreach ($p in $paths) {
126+
if (Test-Path -LiteralPath $p) {
127+
try {
128+
$owner = (Get-Acl -LiteralPath $p).Owner
129+
} catch {
130+
$owner = "ERROR: $($_.Exception.Message)"
131+
}
132+
"{0,-44} {1}" -f $owner, $p
133+
} else {
134+
"(missing: $p)"
135+
}
136+
}
137+
138+
- name: Show safe.directory entries
139+
# `actions/checkout`'s safe.directory add is only durable for the
140+
# checkout itself (it writes under a throwaway HOME override and
141+
# then discards it), so by the time this step runs the runner
142+
# user's `~/.gitconfig` has no entries -- and git accepts the
143+
# workspace's ownership anyway: Git for Windows via its
144+
# Admins-group exemption on the windows matrix; on Linux/macOS
145+
# the workspace is owned by the test user. Expected: `(none)`.
146+
run: git config --global --get-all safe.directory || echo "(none)"
109147

110148
- name: Show version and platform information
111149
run: |

0 commit comments

Comments
 (0)