git safe directory issue with tf modules

[pat-s]

Even when setting git config --global --add safe.directory explicitly in the step before, the error is thrown in the final tf call.

Actually safe dir support is already included in the clone plugin. So I actually call it two times in the linked pipeline without practical effect on future steps.

The included git safe dir supports works for all other steps and plugins with the exception of this one. I don't know yet why this happens (maybe the git config is somehow getting reset during the start of this plugin step?).

Initializing modules...
Downloading git::https://github.com/pat-s/terraform-hcloud-kube-hetzner.git?ref=all-patches for kube-hetzner...
╷
│ Error: Failed to download module
│ 
│   on kube.tf line 10:
│   10: module "kube-hetzner" {
│ 
│ Could not download module "kube-hetzner" (kube.tf:10) source code from
│ "git::[https://github.com/pat-s/terraform-hcloud-kube-hetzner.git?ref=all-patches":](https://github.com/pat-s/terraform-hcloud-kube-hetzner.git?ref=all-patches%22:)
│ error downloading
│ '[https://github.com/pat-s/terraform-hcloud-kube-hetzner.git?ref=all-patches':](https://github.com/pat-s/terraform-hcloud-kube-hetzner.git?ref=all-patches%27:)
│ /usr/bin/git exited with 128: fatal: detected dubious ownership in
│ repository at
│ '/woodpecker/src/git.devxy.io/devxy/hetzner-kube/.terraform/modules/kube-hetzner'
│ To add an exception for this directory, call:
│ 
│ 	git config --global --add safe.directory
│ /woodpecker/src/git.devxy.io/devxy/hetzner-kube/.terraform/modules/kube-hetzner
│ 
╵

[pat-s]

I am now using the opentofu image directly prepended with a safe.directory call. This works. Surely an edge case as I am downloading a custom git module and this won't be triggered for official modules, so I am OK to live with the workaround for some repos.

[xoxys]

Would like to fix it for the plugin as well. Just hadnt time to look into it.

[xoxys]

@pat-s after looking into this, I'm a bit confused:

Actually safe dir support is already included in the clone plugin.

The clone plugin is executing git config --global --replace-all safe.directory /woodpecker/src/... which means the git config is stored in $HOME/.gitconfig. In most cases it will be outside the workspace dir and is therefor not persisted across steps. So I dont see how other step containers should be able to reuse this git config.

Even when setting git config --global --add safe.directory explicitly in the step before, the error is thrown in the final tf call.

The same applies here.

The included git safe dir supports works for all other steps and plugins with the exception of this one.

Given the observations above, I don't know what you mean by that.

---

You can either run git config --local --replace-all safe.directory $CI_WORKSPACE (--local instead of --global) in a previous step or the plugin needs to do it.