From e6e19a20b451d8307867c3f3e8d078bcdf075b39 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 22 Sep 2026 14:58:26 +0300 Subject: [PATCH] Mark all server-side git checkouts as safe The ownership repair added in e5b8de8c2 is not sufficient on every Ansible privilege-escalation setup. Git may still see a different effective owner after the checkout has been recursively chowned, as demonstrated by #5065. Pass an exact, task-scoped safe.directory setting to all 56 server-side git tasks. Keep the ownership repair as well, because it remains necessary for filesystem permissions. The two controller-side theme checkouts already use the same protection. --- .../matrix-alertmanager-receiver/tasks/install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../matrix-authentication-service/tasks/install.yml | 5 +++++ roles/custom/matrix-bot-baibot/tasks/install.yml | 5 +++++ .../matrix-bot-buscarron/tasks/setup_install.yml | 5 +++++ .../custom/matrix-bot-draupnir/tasks/setup_install.yml | 5 +++++ .../custom/matrix-bot-honoroit/tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ roles/custom/matrix-bot-maubot/tasks/setup_install.yml | 5 +++++ .../custom/matrix-bot-meowlnir/tasks/setup_install.yml | 5 +++++ .../custom/matrix-bot-mjolnir/tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../matrix-bridge-beeper-line/tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../matrix-bridge-hookshot/tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../tasks/install.yml | 5 +++++ .../tasks/install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../matrix-bridge-postmoogle/tasks/setup_install.yml | 5 +++++ .../matrix-bridge-rustpush/tasks/setup_install.yml | 5 +++++ .../custom/matrix-bridge-steam/tasks/setup_install.yml | 5 +++++ roles/custom/matrix-bridge-wechat/tasks/install.yml | 10 ++++++++++ .../matrix-cactus-comments/tasks/setup_install.yml | 5 +++++ .../matrix-client-commet/tasks/setup_install.yml | 5 +++++ .../matrix-client-element/tasks/setup_install.yml | 5 +++++ .../matrix-client-fluffychat/tasks/setup_install.yml | 5 +++++ .../matrix-client-schildichat/tasks/setup_install.yml | 5 +++++ roles/custom/matrix-corporal/tasks/setup_install.yml | 5 +++++ roles/custom/matrix-dendrite/tasks/setup_install.yml | 5 +++++ roles/custom/matrix-element-admin/tasks/install.yml | 5 +++++ roles/custom/matrix-ketesa/tasks/setup_install.yml | 5 +++++ .../matrix-livekit-jwt-service/tasks/install.yml | 5 +++++ roles/custom/matrix-matrixto/tasks/install.yml | 5 +++++ roles/custom/matrix-media-repo/tasks/setup_install.yml | 5 +++++ roles/custom/matrix-pantalaimon/tasks/install.yml | 5 +++++ roles/custom/matrix-rageshake/tasks/install.yml | 5 +++++ .../matrix-synapse-auto-compressor/tasks/install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ .../tasks/ext/mjolnir-antispam/setup_install.yml | 5 +++++ .../tasks/ext/synapse-http-antispam/setup_install.yml | 5 +++++ .../ext/synapse-simple-antispam/setup_install.yml | 5 +++++ .../matrix-synapse/tasks/synapse/setup_install.yml | 5 +++++ .../tasks/setup_install.yml | 5 +++++ 55 files changed, 280 insertions(+) diff --git a/roles/custom/matrix-alertmanager-receiver/tasks/install.yml b/roles/custom/matrix-alertmanager-receiver/tasks/install.yml index ff707c8dc..f6ee1e6a2 100644 --- a/roles/custom/matrix-alertmanager-receiver/tasks/install.yml +++ b/roles/custom/matrix-alertmanager-receiver/tasks/install.yml @@ -70,6 +70,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_alertmanager_receiver_container_src_path }}" register: matrix_alertmanager_receiver_git_pull_results - name: Ensure matrix-alertmanager-receiver container image is built diff --git a/roles/custom/matrix-appservice-draupnir-for-all/tasks/setup_install.yml b/roles/custom/matrix-appservice-draupnir-for-all/tasks/setup_install.yml index 68f12b161..d4822a12d 100644 --- a/roles/custom/matrix-appservice-draupnir-for-all/tasks/setup_install.yml +++ b/roles/custom/matrix-appservice-draupnir-for-all/tasks/setup_install.yml @@ -53,6 +53,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_appservice_draupnir_for_all_container_src_files_path }}" register: matrix_appservice_draupnir_for_all_git_pull_results when: "matrix_appservice_draupnir_for_all_container_image_self_build | bool" diff --git a/roles/custom/matrix-authentication-service/tasks/install.yml b/roles/custom/matrix-authentication-service/tasks/install.yml index d1927a45f..544c4fafe 100644 --- a/roles/custom/matrix-authentication-service/tasks/install.yml +++ b/roles/custom/matrix-authentication-service/tasks/install.yml @@ -112,6 +112,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_authentication_service_container_src_files_path }}" - name: Ensure Matrix Authentication Service container image is built ansible.builtin.command: diff --git a/roles/custom/matrix-bot-baibot/tasks/install.yml b/roles/custom/matrix-bot-baibot/tasks/install.yml index db77eac90..bd23102df 100644 --- a/roles/custom/matrix-bot-baibot/tasks/install.yml +++ b/roles/custom/matrix-bot-baibot/tasks/install.yml @@ -66,6 +66,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bot_baibot_container_src_files_path }}" register: matrix_bot_baibot_git_pull_results - name: Ensure baibot container image is built diff --git a/roles/custom/matrix-bot-buscarron/tasks/setup_install.yml b/roles/custom/matrix-bot-buscarron/tasks/setup_install.yml index d37f77823..81819da10 100644 --- a/roles/custom/matrix-bot-buscarron/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-buscarron/tasks/setup_install.yml @@ -88,6 +88,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bot_buscarron_container_src_files_path }}" register: matrix_bot_buscarron_git_pull_results when: "matrix_bot_buscarron_container_image_self_build | bool" diff --git a/roles/custom/matrix-bot-draupnir/tasks/setup_install.yml b/roles/custom/matrix-bot-draupnir/tasks/setup_install.yml index 6629c9868..00da8efee 100644 --- a/roles/custom/matrix-bot-draupnir/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-draupnir/tasks/setup_install.yml @@ -65,6 +65,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bot_draupnir_container_src_files_path }}" register: matrix_bot_draupnir_git_pull_results when: "matrix_bot_draupnir_container_image_self_build | bool" diff --git a/roles/custom/matrix-bot-honoroit/tasks/setup_install.yml b/roles/custom/matrix-bot-honoroit/tasks/setup_install.yml index 846bcbf19..bffe36371 100644 --- a/roles/custom/matrix-bot-honoroit/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-honoroit/tasks/setup_install.yml @@ -90,6 +90,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bot_honoroit_container_src_files_path }}" register: matrix_bot_honoroit_git_pull_results when: "matrix_bot_honoroit_container_image_self_build | bool" diff --git a/roles/custom/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml b/roles/custom/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml index 448d4bb8e..32a991b1e 100644 --- a/roles/custom/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml @@ -80,6 +80,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bot_matrix_reminder_bot_container_src_files_path }}" register: matrix_bot_matrix_reminder_bot_git_pull_results when: "matrix_bot_matrix_reminder_bot_container_image_self_build | bool" diff --git a/roles/custom/matrix-bot-maubot/tasks/setup_install.yml b/roles/custom/matrix-bot-maubot/tasks/setup_install.yml index 3486bcc56..baf7c8f20 100644 --- a/roles/custom/matrix-bot-maubot/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-maubot/tasks/setup_install.yml @@ -65,6 +65,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bot_maubot_container_src_files_path }}" register: matrix_bot_maubot_git_pull_results - name: Ensure maubot image is built diff --git a/roles/custom/matrix-bot-meowlnir/tasks/setup_install.yml b/roles/custom/matrix-bot-meowlnir/tasks/setup_install.yml index 5fd071b5c..500f9f625 100644 --- a/roles/custom/matrix-bot-meowlnir/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-meowlnir/tasks/setup_install.yml @@ -47,6 +47,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bot_meowlnir_container_src_files_path }}" register: matrix_bot_meowlnir_git_pull_results when: "matrix_bot_meowlnir_container_image_self_build | bool" diff --git a/roles/custom/matrix-bot-mjolnir/tasks/setup_install.yml b/roles/custom/matrix-bot-mjolnir/tasks/setup_install.yml index bae12a370..49e4fe1e6 100644 --- a/roles/custom/matrix-bot-mjolnir/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-mjolnir/tasks/setup_install.yml @@ -55,6 +55,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bot_mjolnir_container_src_files_path }}" register: matrix_bot_mjolnir_git_pull_results when: "matrix_bot_mjolnir_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml b/roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml index f267ff5b5..73bab1b74 100644 --- a/roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml @@ -107,6 +107,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_appservice_irc_container_src_files_path }}" register: matrix_bridge_appservice_irc_git_pull_results when: "matrix_bridge_appservice_irc_enabled | bool and matrix_bridge_appservice_irc_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-beeper-line/tasks/setup_install.yml b/roles/custom/matrix-bridge-beeper-line/tasks/setup_install.yml index 58a66299d..ee0d9d7df 100644 --- a/roles/custom/matrix-bridge-beeper-line/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-beeper-line/tasks/setup_install.yml @@ -75,6 +75,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_beeper_line_container_src_files_path }}" register: matrix_bridge_beeper_line_git_pull_results when: "matrix_bridge_beeper_line_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-beeper-linkedin/tasks/setup_install.yml b/roles/custom/matrix-bridge-beeper-linkedin/tasks/setup_install.yml index 163d83559..85146a5e1 100644 --- a/roles/custom/matrix-bridge-beeper-linkedin/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-beeper-linkedin/tasks/setup_install.yml @@ -72,6 +72,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_beeper_linkedin_container_src_files_path }}" register: matrix_bridge_beeper_linkedin_git_pull_results # Building the container image (using the default Dockerfile) requires that a docker-requirements.txt file be generated. diff --git a/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml b/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml index bae2432f4..0be1694a1 100644 --- a/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml @@ -56,6 +56,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_hookshot_container_src_files_path }}" register: matrix_bridge_hookshot_git_pull_results when: "matrix_bridge_hookshot_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-mautrix-bluesky/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-bluesky/tasks/setup_install.yml index 98e6f499e..da7d1286f 100644 --- a/roles/custom/matrix-bridge-mautrix-bluesky/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-bluesky/tasks/setup_install.yml @@ -49,6 +49,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_bluesky_container_src_files_path }}" register: matrix_bridge_mautrix_bluesky_git_pull_results when: "matrix_bridge_mautrix_bluesky_enabled | bool and matrix_bridge_mautrix_bluesky_container_image_self_build" diff --git a/roles/custom/matrix-bridge-mautrix-discord/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-discord/tasks/setup_install.yml index 92aecc6a0..af3c052e2 100644 --- a/roles/custom/matrix-bridge-mautrix-discord/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-discord/tasks/setup_install.yml @@ -77,6 +77,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_discord_container_src_files_path }}" register: matrix_bridge_mautrix_discord_git_pull_results when: "matrix_bridge_mautrix_discord_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-mautrix-gmessages/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-gmessages/tasks/setup_install.yml index 5465a1a4f..f62e5323b 100644 --- a/roles/custom/matrix-bridge-mautrix-gmessages/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-gmessages/tasks/setup_install.yml @@ -77,6 +77,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_gmessages_container_src_files_path }}" register: matrix_bridge_mautrix_gmessages_git_pull_results when: "matrix_bridge_mautrix_gmessages_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml index a9249a38c..421457686 100644 --- a/roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml @@ -79,6 +79,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_googlechat_container_src_files_path }}" register: matrix_bridge_mautrix_googlechat_git_pull_results when: "matrix_bridge_mautrix_googlechat_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-mautrix-gvoice/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-gvoice/tasks/setup_install.yml index f16785a55..d05ea5073 100644 --- a/roles/custom/matrix-bridge-mautrix-gvoice/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-gvoice/tasks/setup_install.yml @@ -75,6 +75,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_gvoice_container_src_files_path }}" register: matrix_bridge_mautrix_gvoice_git_pull_results when: "matrix_bridge_mautrix_gvoice_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-mautrix-linkedin/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-linkedin/tasks/setup_install.yml index 32957b60c..47d65fbd3 100644 --- a/roles/custom/matrix-bridge-mautrix-linkedin/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-linkedin/tasks/setup_install.yml @@ -75,6 +75,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_linkedin_container_src_files_path }}" register: matrix_bridge_mautrix_linkedin_git_pull_results when: "matrix_bridge_mautrix_linkedin_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml index 7da752b7c..d1a015f19 100644 --- a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml +++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml @@ -75,6 +75,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_meta_instagram_container_src_files_path }}" register: matrix_bridge_mautrix_meta_instagram_git_pull_results - name: Ensure mautrix-meta-instagram container image is built diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml index b18a6ef6a..d61e81d81 100644 --- a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml +++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml @@ -75,6 +75,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_meta_messenger_container_src_files_path }}" register: matrix_bridge_mautrix_meta_messenger_git_pull_results - name: Ensure mautrix-meta-messenger container image is built diff --git a/roles/custom/matrix-bridge-mautrix-signal/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-signal/tasks/setup_install.yml index 3d6bbbb30..f15732d14 100644 --- a/roles/custom/matrix-bridge-mautrix-signal/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-signal/tasks/setup_install.yml @@ -82,6 +82,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_signal_container_src_files_path }}" register: matrix_bridge_mautrix_signal_git_pull_results when: "matrix_bridge_mautrix_signal_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-mautrix-slack/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-slack/tasks/setup_install.yml index 0506c7343..6ff610360 100644 --- a/roles/custom/matrix-bridge-mautrix-slack/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-slack/tasks/setup_install.yml @@ -76,6 +76,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_slack_container_src_files_path }}" register: matrix_bridge_mautrix_slack_git_pull_results when: "matrix_bridge_mautrix_slack_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml index c6de5c077..345c186ba 100644 --- a/roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml @@ -121,6 +121,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_telegram_container_src_files_path }}" register: matrix_bridge_mautrix_telegram_git_pull_results when: "matrix_bridge_mautrix_telegram_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-mautrix-twitter/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-twitter/tasks/setup_install.yml index 801039d89..c20c255ad 100644 --- a/roles/custom/matrix-bridge-mautrix-twitter/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-twitter/tasks/setup_install.yml @@ -55,6 +55,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_twitter_container_src_files_path }}" register: matrix_bridge_mautrix_twitter_git_pull_results when: "matrix_bridge_mautrix_twitter_enabled | bool and matrix_bridge_mautrix_twitter_container_image_self_build" diff --git a/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml index 9f1eaaa6e..f9813809d 100644 --- a/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml @@ -87,6 +87,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_whatsapp_container_src_files_path }}" register: matrix_bridge_mautrix_whatsapp_git_pull_results when: "matrix_bridge_mautrix_whatsapp_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml b/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml index 43aa99d27..9447e1ab8 100644 --- a/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml @@ -100,6 +100,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mx_puppet_groupme_container_src_files_path }}" register: matrix_bridge_mx_puppet_groupme_git_pull_results when: "matrix_bridge_mx_puppet_groupme_enabled | bool and matrix_bridge_mx_puppet_groupme_container_image_self_build" diff --git a/roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml b/roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml index cf89a245a..424c65f5a 100644 --- a/roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml @@ -102,6 +102,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mx_puppet_steam_container_src_files_path }}" register: matrix_bridge_mx_puppet_steam_git_pull_results when: "matrix_bridge_mx_puppet_steam_enabled | bool and matrix_bridge_mx_puppet_steam_container_image_self_build" diff --git a/roles/custom/matrix-bridge-postmoogle/tasks/setup_install.yml b/roles/custom/matrix-bridge-postmoogle/tasks/setup_install.yml index 8b2c703da..bafe1a876 100644 --- a/roles/custom/matrix-bridge-postmoogle/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-postmoogle/tasks/setup_install.yml @@ -106,6 +106,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_postmoogle_container_src_files_path }}" register: matrix_bridge_postmoogle_git_pull_results when: "matrix_bridge_postmoogle_container_image_self_build | bool" diff --git a/roles/custom/matrix-bridge-rustpush/tasks/setup_install.yml b/roles/custom/matrix-bridge-rustpush/tasks/setup_install.yml index 21e3302b4..2814d96e3 100644 --- a/roles/custom/matrix-bridge-rustpush/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-rustpush/tasks/setup_install.yml @@ -37,6 +37,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_rustpush_container_src_files_path }}" register: matrix_bridge_rustpush_git_pull_results when: "matrix_bridge_rustpush_enabled | bool and matrix_bridge_rustpush_container_image_self_build" diff --git a/roles/custom/matrix-bridge-steam/tasks/setup_install.yml b/roles/custom/matrix-bridge-steam/tasks/setup_install.yml index 33c8de1fa..64f254afd 100644 --- a/roles/custom/matrix-bridge-steam/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-steam/tasks/setup_install.yml @@ -49,6 +49,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_steam_container_src_files_path }}" register: matrix_bridge_steam_git_pull_results when: "matrix_bridge_steam_enabled | bool and matrix_bridge_steam_container_image_self_build" diff --git a/roles/custom/matrix-bridge-wechat/tasks/install.yml b/roles/custom/matrix-bridge-wechat/tasks/install.yml index 890dd8d87..0e22e5b1d 100644 --- a/roles/custom/matrix-bridge-wechat/tasks/install.yml +++ b/roles/custom/matrix-bridge-wechat/tasks/install.yml @@ -49,6 +49,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_wechat_container_src_files_path }}" register: matrix_bridge_wechat_git_pull_results - name: Ensure WeChat Bridge container image is built @@ -89,6 +94,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_bridge_wechat_agent_container_src_files_path }}" register: matrix_bridge_wechat_agent_git_pull_results - name: Ensure WeChat Agent container image is built diff --git a/roles/custom/matrix-cactus-comments/tasks/setup_install.yml b/roles/custom/matrix-cactus-comments/tasks/setup_install.yml index 2e3e3546a..3b0a50cd1 100644 --- a/roles/custom/matrix-cactus-comments/tasks/setup_install.yml +++ b/roles/custom/matrix-cactus-comments/tasks/setup_install.yml @@ -65,6 +65,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_cactus_comments_container_src_files_path }}" register: matrix_cactus_comments_git_pull_results when: "matrix_cactus_comments_container_image_self_build | bool" diff --git a/roles/custom/matrix-client-commet/tasks/setup_install.yml b/roles/custom/matrix-client-commet/tasks/setup_install.yml index 15515b4a4..cd535da6d 100644 --- a/roles/custom/matrix-client-commet/tasks/setup_install.yml +++ b/roles/custom/matrix-client-commet/tasks/setup_install.yml @@ -57,6 +57,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_client_commet_container_src_path }}" register: matrix_client_commet_git_pull_results - name: Set git hash fact diff --git a/roles/custom/matrix-client-element/tasks/setup_install.yml b/roles/custom/matrix-client-element/tasks/setup_install.yml index 116d50f89..c045e3281 100644 --- a/roles/custom/matrix-client-element/tasks/setup_install.yml +++ b/roles/custom/matrix-client-element/tasks/setup_install.yml @@ -51,6 +51,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_client_element_container_src_files_path }}" register: matrix_client_element_git_pull_results when: "matrix_client_element_container_image_self_build | bool" diff --git a/roles/custom/matrix-client-fluffychat/tasks/setup_install.yml b/roles/custom/matrix-client-fluffychat/tasks/setup_install.yml index 851d94a03..719d0ec7f 100644 --- a/roles/custom/matrix-client-fluffychat/tasks/setup_install.yml +++ b/roles/custom/matrix-client-fluffychat/tasks/setup_install.yml @@ -46,6 +46,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_client_fluffychat_container_src_files_path }}" register: matrix_client_fluffychat_git_pull_results - name: Ensure FluffyChat Web container image is built diff --git a/roles/custom/matrix-client-schildichat/tasks/setup_install.yml b/roles/custom/matrix-client-schildichat/tasks/setup_install.yml index e421fdb0c..c5b95e8e6 100644 --- a/roles/custom/matrix-client-schildichat/tasks/setup_install.yml +++ b/roles/custom/matrix-client-schildichat/tasks/setup_install.yml @@ -49,6 +49,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_client_schildichat_container_src_files_path }}" register: matrix_client_schildichat_git_pull_results # See: diff --git a/roles/custom/matrix-corporal/tasks/setup_install.yml b/roles/custom/matrix-corporal/tasks/setup_install.yml index ede0b2b7a..7f766547d 100644 --- a/roles/custom/matrix-corporal/tasks/setup_install.yml +++ b/roles/custom/matrix-corporal/tasks/setup_install.yml @@ -42,6 +42,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_corporal_container_src_files_path }}" register: matrix_corporal_git_pull_results when: matrix_corporal_container_image_self_build | bool diff --git a/roles/custom/matrix-dendrite/tasks/setup_install.yml b/roles/custom/matrix-dendrite/tasks/setup_install.yml index ef5735254..c3dab4463 100644 --- a/roles/custom/matrix-dendrite/tasks/setup_install.yml +++ b/roles/custom/matrix-dendrite/tasks/setup_install.yml @@ -108,6 +108,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_dendrite_container_src_files_path }}" register: matrix_dendrite_git_pull_results - name: Check if Dendrite Docker image exists diff --git a/roles/custom/matrix-element-admin/tasks/install.yml b/roles/custom/matrix-element-admin/tasks/install.yml index c54ac9c8d..55fb6b242 100644 --- a/roles/custom/matrix-element-admin/tasks/install.yml +++ b/roles/custom/matrix-element-admin/tasks/install.yml @@ -60,6 +60,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_element_admin_container_src_path }}" register: matrix_element_admin_git_pull_results - name: Ensure Element Admin container image is built diff --git a/roles/custom/matrix-ketesa/tasks/setup_install.yml b/roles/custom/matrix-ketesa/tasks/setup_install.yml index d0bec5633..31017a1ae 100644 --- a/roles/custom/matrix-ketesa/tasks/setup_install.yml +++ b/roles/custom/matrix-ketesa/tasks/setup_install.yml @@ -98,6 +98,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_ketesa_container_src_files_path }}" register: matrix_ketesa_git_pull_results when: matrix_ketesa_container_image_self_build | bool diff --git a/roles/custom/matrix-livekit-jwt-service/tasks/install.yml b/roles/custom/matrix-livekit-jwt-service/tasks/install.yml index bf369b5df..65e7c7c6e 100644 --- a/roles/custom/matrix-livekit-jwt-service/tasks/install.yml +++ b/roles/custom/matrix-livekit-jwt-service/tasks/install.yml @@ -57,6 +57,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_livekit_jwt_service_container_src_files_path }}" register: matrix_livekit_jwt_service_git_pull_results - name: Ensure LiveKit JWT Service container image is built diff --git a/roles/custom/matrix-matrixto/tasks/install.yml b/roles/custom/matrix-matrixto/tasks/install.yml index 3da68b309..1449534e9 100644 --- a/roles/custom/matrix-matrixto/tasks/install.yml +++ b/roles/custom/matrix-matrixto/tasks/install.yml @@ -43,6 +43,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_matrixto_container_image_self_build_src_files_path }}" register: matrix_matrixto_git_pull_results - name: Ensure Matrix.to container image is built diff --git a/roles/custom/matrix-media-repo/tasks/setup_install.yml b/roles/custom/matrix-media-repo/tasks/setup_install.yml index 43155e687..0d05fee80 100755 --- a/roles/custom/matrix-media-repo/tasks/setup_install.yml +++ b/roles/custom/matrix-media-repo/tasks/setup_install.yml @@ -75,6 +75,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_media_repo_container_src_files_path }}" register: matrix_media_repo_git_pull_results - name: Check if media-repo Docker image exists diff --git a/roles/custom/matrix-pantalaimon/tasks/install.yml b/roles/custom/matrix-pantalaimon/tasks/install.yml index 618a22d5e..f4ae7f471 100644 --- a/roles/custom/matrix-pantalaimon/tasks/install.yml +++ b/roles/custom/matrix-pantalaimon/tasks/install.yml @@ -55,6 +55,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_pantalaimon_container_src_files_path }}" register: matrix_pantalaimon_git_pull_results when: "matrix_pantalaimon_container_image_self_build | bool" diff --git a/roles/custom/matrix-rageshake/tasks/install.yml b/roles/custom/matrix-rageshake/tasks/install.yml index 31e5fdcba..57a615e17 100644 --- a/roles/custom/matrix-rageshake/tasks/install.yml +++ b/roles/custom/matrix-rageshake/tasks/install.yml @@ -69,6 +69,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_rageshake_container_src_files_path }}" register: matrix_rageshake_git_pull_results when: "matrix_rageshake_container_image_self_build | bool" diff --git a/roles/custom/matrix-synapse-auto-compressor/tasks/install.yml b/roles/custom/matrix-synapse-auto-compressor/tasks/install.yml index e64a32aaa..a98d03f16 100644 --- a/roles/custom/matrix-synapse-auto-compressor/tasks/install.yml +++ b/roles/custom/matrix-synapse-auto-compressor/tasks/install.yml @@ -68,6 +68,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_synapse_auto_compressor_container_src_files_path }}" register: matrix_synapse_auto_compressor_git_pull_results - name: Check if synapse-auto-compressor image exists diff --git a/roles/custom/matrix-synapse-usage-exporter/tasks/setup_install.yml b/roles/custom/matrix-synapse-usage-exporter/tasks/setup_install.yml index 32ff5a02e..9ddc1fec4 100644 --- a/roles/custom/matrix-synapse-usage-exporter/tasks/setup_install.yml +++ b/roles/custom/matrix-synapse-usage-exporter/tasks/setup_install.yml @@ -60,6 +60,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_synapse_usage_exporter_docker_src_files_path }}" register: matrix_synapse_usage_exporter_git_pull_results - name: Check if synapse-usage-exporter Docker image exists diff --git a/roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml index 0b3f191e4..5e4c1b224 100644 --- a/roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml @@ -29,6 +29,11 @@ force: "yes" become: true become_user: "{{ matrix_synapse_username }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_synapse_ext_path }}/mjolnir" - ansible.builtin.set_fact: matrix_synapse_modules: > diff --git a/roles/custom/matrix-synapse/tasks/ext/synapse-http-antispam/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/synapse-http-antispam/setup_install.yml index 56e7a1c5d..88e44b480 100644 --- a/roles/custom/matrix-synapse/tasks/ext/synapse-http-antispam/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/ext/synapse-http-antispam/setup_install.yml @@ -27,6 +27,11 @@ force: "yes" become: true become_user: "{{ matrix_synapse_username }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_synapse_ext_path }}/synapse-http-antispam" - ansible.builtin.set_fact: matrix_synapse_modules: > diff --git a/roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_install.yml index 13b587a9b..f45ec1917 100644 --- a/roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_install.yml @@ -36,6 +36,11 @@ force: "yes" become: true become_user: "{{ matrix_synapse_username }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_synapse_ext_path }}/synapse-simple-antispam" - ansible.builtin.set_fact: matrix_synapse_modules: > diff --git a/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml b/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml index a5daf50a9..4f0926ead 100644 --- a/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml @@ -52,6 +52,11 @@ force: "yes" become: true become_user: "{{ matrix_synapse_username }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_synapse_container_src_files_path }}" register: matrix_synapse_git_pull_results - name: Check if Synapse Docker image exists diff --git a/roles/custom/matrix-user-verification-service/tasks/setup_install.yml b/roles/custom/matrix-user-verification-service/tasks/setup_install.yml index 533380c7c..a859d188c 100644 --- a/roles/custom/matrix-user-verification-service/tasks/setup_install.yml +++ b/roles/custom/matrix-user-verification-service/tasks/setup_install.yml @@ -46,6 +46,11 @@ force: "yes" become: true become_user: "{{ matrix_user_name }}" + # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065). + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ matrix_user_verification_service_container_src_files_path }}" register: matrix_user_verification_service_git_pull_results when: "matrix_user_verification_service_container_image_self_build | bool"