go build fails to read vcs info when .git is owned by a different user

[forsaken628]

golang:bullseye built-in install git(2.30.2) which break our CI/CD system.

golang/go#53532

[peterdeme]

Same here, it messed up our CI/CD on GitHub Actions.

  test:
    name: Test
    runs-on: ubuntu-latest
    container: golang:1.19
    steps:
      - name: Test the code
        run: go test ./...

Output:

error obtaining VCS status: exit status 128
	Use -buildvcs=false to disable VCS stamping.

We fixed it by using the previous version of the container:

    container: golang@sha256:bb9811fad43a7d6fd2173248d8331b2dcf5ac9af20976b1937ecd214c5b8c383

[TeddiO]

Can confirm a similar issue in our CI/CD pipelines. In addition if you run go build with the -v flag you get the extra output:

fatal: detected dubious ownership in repository at '/__w/<path>'
To add an exception for this directory, call:

	git config --global --add safe.directory /__w/<path>

What's curious is actions/checkout calls this command yet it doesn't seem to be applied. Calling the command manually does work though.

1.20 and 1.19.5 based builds are affected.

1.19.4 and previous are functioning as intended.

[peterdeme]

The interesting thing is that actions/checkout@v3 even adds the current directory to the safe directories by default:

But for some reason it still doesn't work. If you manually add it, it starts to work:

      - name: Check out repository code
        uses: actions/checkout@v3

      - name: Set workspace as safe
        run: git config --global --add safe.directory $GITHUB_WORKSPACE

Weird.

[sozercan]

Looks like this is due to git update that backports CVE fixes in debian bullseye and bumps the version to 2.30.2-1+deb11u1
https://release.debian.org/proposed-updates/bullseye_diffs/git_2.30.2-1+deb11u1.debdiff

[tianon]

The best solution here is probably going to be using git config --add safe.directory /... to your CI/builds 😞

[yosifkit]

Closing as this is not something we can work around generally and safely in the image and is the result of a CVE fix in git.