Run workspace-side mirror git commands with the checkout's git environment; adopt mirrors owned by another user

[piob-io]

Summary

Bug. In a job container (allow-inside-container: true, --privileged -v /dev:/dev) the runner creates /__w/<repo>/<repo> as the VM's runner user while the action runs git as root. The action handles that for its own commands by adding the workspace as safe.directory to a temporary global config and pointing the GitCommandManager's HOME at it. Two mirror-related paths in blacksmith-cache.ts ran git through @actions/exec with the plain process environment instead, so they never saw that config:

• dissociate() — git -C <workspace> repack -a -d → fatal: detected dubious ownership in repository → exit 128 → checkout step fails whenever a mirror is mounted and dissociate: true is set on a top-level container checkout. (Sub-path checkouts pass only because the action creates that directory itself.)
• copyRefsFromMirror() (fetch-depth: 0) — the workspace config/for-each-ref/update-ref/pack-refs calls fail the same way and silently fall back to the local fetch.

-c safe.directory=… is not a fix: git rejects it from the command line (it must come from a global/system config), verified on 2.34 — only the HOME route works.

Fix.

interface IGitCommandManager {
  getEnvironment(): {[key: string]: string}   // process.env + gitEnv (HOME override, GIT_TERMINAL_PROMPT, …)
}

fetchRefsFromMirror(workspacePath, mirrorPath, env?)   // → copyRefsFromMirror(…, env), local-fetch fallback
dissociate(workspacePath, env?)

git-source-provider.ts passes git.getEnvironment() to both. execGit now builds its env through the same method.

Related: mirror ownership. The same job mix (root container jobs and runner-user VM jobs) shares one sticky-disk mirror. A mirror hydrated by the other kind of job is dubiously owned to git and, for the runner user, not even writable, so every mirror sync/ref read would fail (fallback to network, no commit) until re-hydrated. ensureMirror now checks stat(mirrorPath).uid on an existing mirror and sudo chown -R the mirror dir to the current user when it differs (adoptMirrorOwnership, logged with duration; no-op in the common single-user case).

CI (test-blacksmith.yml).

• test-git-mirror-container: runs-on: blacksmith with container: ubuntu:24.04, --privileged -v /dev:/dev, checking out as root with allow-inside-container: true + dissociate: true into a directory chown --reference=.'d to the runner user (same ownership check as the workspace root — git ≥2.36 checks the worktree owner — without wiping the local action, whose problem-matcher.json the runner reads asynchronously). Asserts the sticky disk is actually mounted in the container, the mirror ended up root-owned (taken over from uid 1001), alternates gone, HEAD == GITHUB_SHA, fsck clean. Fails on main with the dubious-ownership error.
• test-git-mirror-after-container: VM job needs-chained after it — mirror runner-owned and used. Only a real takeover once a trusted-trigger (push to main) container job has committed a root-owned mirror; each checkout step mounts its own copy of the last commit, so ownership can't be flipped between steps of one job.

End-to-end control-vs-candidate on staging runners: useblacksmith/test-workflows#217.

Test. __test__/mirror-workspace-env-git.test.ts uses git's GIT_TEST_ASSUME_DIFFERENT_OWNER=1 to make a real workspace foreign-owned and a temp HOME/.gitconfig with safe.directory = <workspace>: dissociate with the plain env fails with exit 128 (the bug), and fetchRefsFromMirror + dissociate with the checkout env succeed and leave a self-contained workspace (fsck after deleting the mirror). Skipped on git builds without the knob.

dist/ rebuilt.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled. (Staging)}

Link to Devin session: https://app.devin.ai/sessions/a3b42ef15226438faf3f9cdde9662918
Open in Devin Desktop: https://app.devin.ai/desktop/session/a3b42ef15226438faf3f9cdde9662918?variant=devin
Requested by: @piob-io

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9248df6. Configure here.}