Mark all server-side git checkouts as safe

The ownership repair added in e5b8de8c2 is not sufficient on every Ansible privilege-escalation setup. Git may still see a different effective owner after the checkout has been recursively chowned, as demonstrated by #5065.

Pass an exact, task-scoped safe.directory setting to all 56 server-side git tasks. Keep the ownership repair as well, because it remains necessary for filesystem permissions. The two controller-side theme checkouts already use the same protection.

roles/custom/matrix-alertmanager-receiver/tasks/install.yml

@@ -70,6 +70,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_alertmanager_receiver_container_src_path }}"
       register: matrix_alertmanager_receiver_git_pull_results
 
     - name: Ensure matrix-alertmanager-receiver container image is built

roles/custom/matrix-appservice-draupnir-for-all/tasks/setup_install.yml

@@ -53,6 +53,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_appservice_draupnir_for_all_container_src_files_path }}"
   register: matrix_appservice_draupnir_for_all_git_pull_results
   when: "matrix_appservice_draupnir_for_all_container_image_self_build | bool"
 

roles/custom/matrix-authentication-service/tasks/install.yml

@@ -112,6 +112,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_authentication_service_container_src_files_path }}"
 
     - name: Ensure Matrix Authentication Service container image is built
       ansible.builtin.command:

roles/custom/matrix-bot-baibot/tasks/install.yml

@@ -66,6 +66,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_bot_baibot_container_src_files_path }}"
       register: matrix_bot_baibot_git_pull_results
 
     - name: Ensure baibot container image is built

roles/custom/matrix-bot-buscarron/tasks/setup_install.yml

@@ -88,6 +88,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bot_buscarron_container_src_files_path }}"
   register: matrix_bot_buscarron_git_pull_results
   when: "matrix_bot_buscarron_container_image_self_build | bool"
 

roles/custom/matrix-bot-draupnir/tasks/setup_install.yml

@@ -65,6 +65,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bot_draupnir_container_src_files_path }}"
   register: matrix_bot_draupnir_git_pull_results
   when: "matrix_bot_draupnir_container_image_self_build | bool"
 

roles/custom/matrix-bot-honoroit/tasks/setup_install.yml

@@ -90,6 +90,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bot_honoroit_container_src_files_path }}"
   register: matrix_bot_honoroit_git_pull_results
   when: "matrix_bot_honoroit_container_image_self_build | bool"
 

roles/custom/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml

@@ -80,6 +80,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bot_matrix_reminder_bot_container_src_files_path }}"
   register: matrix_bot_matrix_reminder_bot_git_pull_results
   when: "matrix_bot_matrix_reminder_bot_container_image_self_build | bool"
 

roles/custom/matrix-bot-maubot/tasks/setup_install.yml

@@ -65,6 +65,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_bot_maubot_container_src_files_path }}"
       register: matrix_bot_maubot_git_pull_results
 
     - name: Ensure maubot image is built

roles/custom/matrix-bot-meowlnir/tasks/setup_install.yml

@@ -47,6 +47,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bot_meowlnir_container_src_files_path }}"
   register: matrix_bot_meowlnir_git_pull_results
   when: "matrix_bot_meowlnir_container_image_self_build | bool"
 

roles/custom/matrix-bot-mjolnir/tasks/setup_install.yml

@@ -55,6 +55,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bot_mjolnir_container_src_files_path }}"
   register: matrix_bot_mjolnir_git_pull_results
   when: "matrix_bot_mjolnir_container_image_self_build | bool"
 

roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml

@@ -107,6 +107,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_appservice_irc_container_src_files_path }}"
   register: matrix_bridge_appservice_irc_git_pull_results
   when: "matrix_bridge_appservice_irc_enabled | bool and matrix_bridge_appservice_irc_container_image_self_build | bool"
 

roles/custom/matrix-bridge-beeper-line/tasks/setup_install.yml

@@ -75,6 +75,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_beeper_line_container_src_files_path }}"
   register: matrix_bridge_beeper_line_git_pull_results
   when: "matrix_bridge_beeper_line_container_image_self_build | bool"
 

roles/custom/matrix-bridge-beeper-linkedin/tasks/setup_install.yml

@@ -72,6 +72,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_bridge_beeper_linkedin_container_src_files_path }}"
       register: matrix_bridge_beeper_linkedin_git_pull_results
 
     # Building the container image (using the default Dockerfile) requires that a docker-requirements.txt file be generated.

roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml

@@ -56,6 +56,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_hookshot_container_src_files_path }}"
   register: matrix_bridge_hookshot_git_pull_results
   when: "matrix_bridge_hookshot_container_image_self_build | bool"
 

roles/custom/matrix-bridge-mautrix-bluesky/tasks/setup_install.yml

@@ -49,6 +49,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_bluesky_container_src_files_path }}"
   register: matrix_bridge_mautrix_bluesky_git_pull_results
   when: "matrix_bridge_mautrix_bluesky_enabled | bool and matrix_bridge_mautrix_bluesky_container_image_self_build"
 

roles/custom/matrix-bridge-mautrix-discord/tasks/setup_install.yml

@@ -77,6 +77,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_discord_container_src_files_path }}"
   register: matrix_bridge_mautrix_discord_git_pull_results
   when: "matrix_bridge_mautrix_discord_container_image_self_build | bool"
 

roles/custom/matrix-bridge-mautrix-gmessages/tasks/setup_install.yml

@@ -77,6 +77,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_gmessages_container_src_files_path }}"
   register: matrix_bridge_mautrix_gmessages_git_pull_results
   when: "matrix_bridge_mautrix_gmessages_container_image_self_build | bool"
 

roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml

@@ -79,6 +79,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_googlechat_container_src_files_path }}"
   register: matrix_bridge_mautrix_googlechat_git_pull_results
   when: "matrix_bridge_mautrix_googlechat_container_image_self_build | bool"
 

roles/custom/matrix-bridge-mautrix-gvoice/tasks/setup_install.yml

@@ -75,6 +75,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_gvoice_container_src_files_path }}"
   register: matrix_bridge_mautrix_gvoice_git_pull_results
   when: "matrix_bridge_mautrix_gvoice_container_image_self_build | bool"
 

roles/custom/matrix-bridge-mautrix-linkedin/tasks/setup_install.yml

@@ -75,6 +75,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_linkedin_container_src_files_path }}"
   register: matrix_bridge_mautrix_linkedin_git_pull_results
   when: "matrix_bridge_mautrix_linkedin_container_image_self_build | bool"
 

roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml

@@ -75,6 +75,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_meta_instagram_container_src_files_path }}"
       register: matrix_bridge_mautrix_meta_instagram_git_pull_results
 
     - name: Ensure mautrix-meta-instagram container image is built

roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml

@@ -75,6 +75,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_meta_messenger_container_src_files_path }}"
       register: matrix_bridge_mautrix_meta_messenger_git_pull_results
 
     - name: Ensure mautrix-meta-messenger container image is built

roles/custom/matrix-bridge-mautrix-signal/tasks/setup_install.yml

@@ -82,6 +82,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_signal_container_src_files_path }}"
   register: matrix_bridge_mautrix_signal_git_pull_results
   when: "matrix_bridge_mautrix_signal_container_image_self_build | bool"
 

roles/custom/matrix-bridge-mautrix-slack/tasks/setup_install.yml

@@ -76,6 +76,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_slack_container_src_files_path }}"
   register: matrix_bridge_mautrix_slack_git_pull_results
   when: "matrix_bridge_mautrix_slack_container_image_self_build | bool"
 

roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml

@@ -121,6 +121,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_telegram_container_src_files_path }}"
   register: matrix_bridge_mautrix_telegram_git_pull_results
   when: "matrix_bridge_mautrix_telegram_container_image_self_build | bool"
 

roles/custom/matrix-bridge-mautrix-twitter/tasks/setup_install.yml

@@ -55,6 +55,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_twitter_container_src_files_path }}"
   register: matrix_bridge_mautrix_twitter_git_pull_results
   when: "matrix_bridge_mautrix_twitter_enabled | bool and matrix_bridge_mautrix_twitter_container_image_self_build"
 

roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml

@@ -87,6 +87,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mautrix_whatsapp_container_src_files_path }}"
   register: matrix_bridge_mautrix_whatsapp_git_pull_results
   when: "matrix_bridge_mautrix_whatsapp_container_image_self_build | bool"
 

roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml

@@ -100,6 +100,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mx_puppet_groupme_container_src_files_path }}"
   register: matrix_bridge_mx_puppet_groupme_git_pull_results
   when: "matrix_bridge_mx_puppet_groupme_enabled | bool and matrix_bridge_mx_puppet_groupme_container_image_self_build"
 

roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml

@@ -102,6 +102,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_mx_puppet_steam_container_src_files_path }}"
   register: matrix_bridge_mx_puppet_steam_git_pull_results
   when: "matrix_bridge_mx_puppet_steam_enabled | bool and matrix_bridge_mx_puppet_steam_container_image_self_build"
 

roles/custom/matrix-bridge-postmoogle/tasks/setup_install.yml

@@ -106,6 +106,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_postmoogle_container_src_files_path }}"
   register: matrix_bridge_postmoogle_git_pull_results
   when: "matrix_bridge_postmoogle_container_image_self_build | bool"
 

roles/custom/matrix-bridge-rustpush/tasks/setup_install.yml

@@ -37,6 +37,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_rustpush_container_src_files_path }}"
   register: matrix_bridge_rustpush_git_pull_results
   when: "matrix_bridge_rustpush_enabled | bool and matrix_bridge_rustpush_container_image_self_build"
 

roles/custom/matrix-bridge-steam/tasks/setup_install.yml

@@ -49,6 +49,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_bridge_steam_container_src_files_path }}"
   register: matrix_bridge_steam_git_pull_results
   when: "matrix_bridge_steam_enabled | bool and matrix_bridge_steam_container_image_self_build"
 

roles/custom/matrix-bridge-wechat/tasks/install.yml

@@ -49,6 +49,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_bridge_wechat_container_src_files_path }}"
       register: matrix_bridge_wechat_git_pull_results
 
     - name: Ensure WeChat Bridge container image is built
@@ -89,6 +94,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_bridge_wechat_agent_container_src_files_path }}"
       register: matrix_bridge_wechat_agent_git_pull_results
 
     - name: Ensure WeChat Agent container image is built

roles/custom/matrix-cactus-comments/tasks/setup_install.yml

@@ -65,6 +65,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_cactus_comments_container_src_files_path }}"
   register: matrix_cactus_comments_git_pull_results
   when: "matrix_cactus_comments_container_image_self_build | bool"
 

roles/custom/matrix-client-commet/tasks/setup_install.yml

@@ -57,6 +57,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_client_commet_container_src_path }}"
       register: matrix_client_commet_git_pull_results
 
     - name: Set git hash fact

roles/custom/matrix-client-element/tasks/setup_install.yml

@@ -51,6 +51,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_client_element_container_src_files_path }}"
   register: matrix_client_element_git_pull_results
   when: "matrix_client_element_container_image_self_build | bool"
 

roles/custom/matrix-client-fluffychat/tasks/setup_install.yml

@@ -46,6 +46,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_client_fluffychat_container_src_files_path }}"
       register: matrix_client_fluffychat_git_pull_results
 
     - name: Ensure FluffyChat Web container image is built

roles/custom/matrix-client-schildichat/tasks/setup_install.yml

@@ -49,6 +49,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_client_schildichat_container_src_files_path }}"
       register: matrix_client_schildichat_git_pull_results
 
     # See:

roles/custom/matrix-corporal/tasks/setup_install.yml

@@ -42,6 +42,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_corporal_container_src_files_path }}"
   register: matrix_corporal_git_pull_results
   when: matrix_corporal_container_image_self_build | bool
 

roles/custom/matrix-dendrite/tasks/setup_install.yml

@@ -108,6 +108,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_dendrite_container_src_files_path }}"
       register: matrix_dendrite_git_pull_results
 
     - name: Check if Dendrite Docker image exists

roles/custom/matrix-element-admin/tasks/install.yml

@@ -60,6 +60,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_element_admin_container_src_path }}"
       register: matrix_element_admin_git_pull_results
 
     - name: Ensure Element Admin container image is built

roles/custom/matrix-ketesa/tasks/setup_install.yml

@@ -98,6 +98,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_ketesa_container_src_files_path }}"
   register: matrix_ketesa_git_pull_results
   when: matrix_ketesa_container_image_self_build | bool
 

roles/custom/matrix-livekit-jwt-service/tasks/install.yml

@@ -57,6 +57,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_livekit_jwt_service_container_src_files_path }}"
       register: matrix_livekit_jwt_service_git_pull_results
 
     - name: Ensure LiveKit JWT Service container image is built

roles/custom/matrix-matrixto/tasks/install.yml

@@ -43,6 +43,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_matrixto_container_image_self_build_src_files_path }}"
   register: matrix_matrixto_git_pull_results
 
 - name: Ensure Matrix.to container image is built

roles/custom/matrix-media-repo/tasks/setup_install.yml

@@ -75,6 +75,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_media_repo_container_src_files_path }}"
       register: matrix_media_repo_git_pull_results
 
     - name: Check if media-repo Docker image exists

roles/custom/matrix-pantalaimon/tasks/install.yml

@@ -55,6 +55,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_pantalaimon_container_src_files_path }}"
   register: matrix_pantalaimon_git_pull_results
   when: "matrix_pantalaimon_container_image_self_build | bool"
 

roles/custom/matrix-rageshake/tasks/install.yml

@@ -69,6 +69,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_rageshake_container_src_files_path }}"
   register: matrix_rageshake_git_pull_results
   when: "matrix_rageshake_container_image_self_build | bool"
 

roles/custom/matrix-synapse-auto-compressor/tasks/install.yml

@@ -68,6 +68,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_synapse_auto_compressor_container_src_files_path }}"
       register: matrix_synapse_auto_compressor_git_pull_results
 
     - name: Check if synapse-auto-compressor image exists

roles/custom/matrix-synapse-usage-exporter/tasks/setup_install.yml

@@ -60,6 +60,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_user_name }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_synapse_usage_exporter_docker_src_files_path }}"
       register: matrix_synapse_usage_exporter_git_pull_results
 
     - name: Check if synapse-usage-exporter Docker image exists

roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml

@@ -29,6 +29,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_synapse_username }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_synapse_ext_path }}/mjolnir"
 
 - ansible.builtin.set_fact:
     matrix_synapse_modules: >

roles/custom/matrix-synapse/tasks/ext/synapse-http-antispam/setup_install.yml

@@ -27,6 +27,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_synapse_username }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_synapse_ext_path }}/synapse-http-antispam"
 
 - ansible.builtin.set_fact:
     matrix_synapse_modules: >

roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_install.yml

@@ -36,6 +36,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_synapse_username }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_synapse_ext_path }}/synapse-simple-antispam"
 
 - ansible.builtin.set_fact:
     matrix_synapse_modules: >

roles/custom/matrix-synapse/tasks/synapse/setup_install.yml

@@ -52,6 +52,11 @@
         force: "yes"
       become: true
       become_user: "{{ matrix_synapse_username }}"
+      # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_synapse_container_src_files_path }}"
       register: matrix_synapse_git_pull_results
 
     - name: Check if Synapse Docker image exists

roles/custom/matrix-user-verification-service/tasks/setup_install.yml

@@ -46,6 +46,11 @@
     force: "yes"
   become: true
   become_user: "{{ matrix_user_name }}"
+  # Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: safe.directory
+    GIT_CONFIG_VALUE_0: "{{ matrix_user_verification_service_container_src_files_path }}"
   register: matrix_user_verification_service_git_pull_results
   when: "matrix_user_verification_service_container_image_self_build | bool"