fix(civisibility): Use -c flag for git safe.directory instead of modifying global config #4344

anmarchenko · 2026-01-13T11:13:39Z

What does this PR do?

Replaced proactive global git config modification with per-command -c safe.directory=<path> flag
Added getSafeDirectoryConfig() function that caches the repository root path (via sync.Once)
Updated execGit() and execGitStringWithInput() to automatically include the safe.directory config
Removed the code in getLocalGitData() that was adding entries to global git config

Motivation

The previous approach modified the global git config by running:

git config --global --add safe.directory <path>

This caused several problems:

Config pollution: Using --add creates duplicate entries on repeated runs
Security: Modifying global config affects all repositories, not just the current one
Persistence: Changes remain after the tool finishes running

Instead of modifying global config, we now pass safe.directory as a command-line config override:

git -c safe.directory=/path/to/repo <command>

Benefits:

No modification to any config files (global, local, or system)
Only affects the single command execution
Cannot cause config pollution
More secure (isolated to single invocation)
Repository root is cached via sync.Once for performance

Port of DataDog/ddtest#29

Reviewer's Checklist

Changed code has unit tests for its functionality at or near 100% coverage.
System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
There is a benchmark for any new code, or changes to existing code.
If this interacts with the agent in a new way, a system test has been added.
New code is free of linting errors. You can check this by running ./scripts/lint.sh locally.
Add an appropriate team label so this PR gets put in the right place for the release notes.
Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.

Unsure? Have a question? Request a review!

…appended to the global configuration

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 496930f949

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

internal/civisibility/utils/git.go

codecov · 2026-01-13T11:18:29Z

Codecov Report

❌ Patch coverage is 60.00000% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 54.87%. Comparing base (27a40d0) to head (5d88e29).
⚠️ Report is 8 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/civisibility/utils/git.go	60.00%	5 Missing and 3 partials ⚠️

Additional details and impacted files

Files with missing lines	Coverage Δ
internal/civisibility/utils/git.go	`58.23% <60.00%> (+0.09%)`	⬆️

... and 9 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

pr-commenter · 2026-01-13T11:26:31Z

Benchmarks

⚠️ Warning: Unable to generate benchmark comparison - missing baseline or candidate data. Check the pipeline logs for details.

tonyredondo · 2026-01-13T11:53:46Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-01-13T11:53:49Z

View all feedbacks in Devflow UI.

2026-01-13 11:53:49 UTC ℹ️ Start processing command /merge

2026-01-13 11:53:53 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 33m (p90).

2026-01-13 11:56:26 UTC ℹ️ MergeQueue: Readding this merge request to the queue because another merge request processed with yours failed. No action is needed from your side.

2026-01-13 12:03:00 UTC ⚠️ MergeQueue: This merge request build was cancelled

dario.castane@datadoghq.com cancelled this merge request build

darccio · 2026-01-13T12:02:49Z

/remove

gh-worker-devflow-routing-ef8351 · 2026-01-13T12:02:52Z

View all feedbacks in Devflow UI.

2026-01-13 12:02:52 UTC ℹ️ Start processing command /remove

2026-01-13 12:02:56 UTC ℹ️ Devflow: /remove

darccio · 2026-01-13T12:04:51Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-01-13T12:04:55Z

View all feedbacks in Devflow UI.

2026-01-13 12:04:55 UTC ℹ️ Start processing command /merge

2026-01-13 12:05:03 UTC ℹ️ MergeQueue: waiting for PR to be ready

This pull request is not mergeable according to GitHub. Common reasons include pending required checks, missing approvals, or merge conflicts — but it could also be blocked by other repository rules or settings.
It will be added to the queue as soon as checks pass and/or get approvals. View in MergeQueue UI.
Note: if you pushed new commits since the last approval, you may need additional approval.
You can remove it from the waiting list with /remove command.

2026-01-13 12:30:38 UTC ℹ️ MergeQueue: merge request added to the queue

The expected merge time in main is approximately 33m (p90).

2026-01-13 12:57:54 UTC ❌ MergeQueue: The checks failed on this merge request

Tests failed on this commit a6cf2d0:

What to do next?

Investigate the failures and when ready, re-add your pull request to the queue!
If your PR checks are green, try to rebase/merge. It might be because the CI run is a bit old.
Any question, go check the FAQ.

darccio · 2026-01-14T11:14:59Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-01-14T11:15:03Z

View all feedbacks in Devflow UI.

2026-01-14 11:15:03 UTC ℹ️ Start processing command /merge

2026-01-14 11:15:07 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 33m (p90).

2026-01-14 11:37:51 UTC ℹ️ MergeQueue: Readding this merge request to the queue because another merge request processed with yours failed. No action is needed from your side.

2026-01-14 12:01:52 UTC ❌ MergeQueue: The checks failed on this merge request

Tests failed on this commit f225a88:

What to do next?

Investigate the failures and when ready, re-add your pull request to the queue!
If your PR checks are green, try to rebase/merge. It might be because the CI run is a bit old.
Any question, go check the FAQ.

darccio · 2026-01-14T12:11:28Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-01-14T12:11:31Z

View all feedbacks in Devflow UI.

2026-01-14 12:11:31 UTC ℹ️ Start processing command /merge

2026-01-14 12:11:36 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 33m (p90).

2026-01-14 12:37:59 UTC ℹ️ MergeQueue: This merge request was merged

fix(civisibility): fix an issue when safe.directory config is always …

496930f

…appended to the global configuration

anmarchenko requested a review from a team as a code owner January 13, 2026 11:13

anmarchenko changed the title ~~fix(civisibility): Use -c flag for git safe.directory instead of modifying global config~~ [SDTEST-3227] fix(civisibility): Use -c flag for git safe.directory instead of modifying global config Jan 13, 2026

anmarchenko changed the title ~~[SDTEST-3227] fix(civisibility): Use -c flag for git safe.directory instead of modifying global config~~ fix(civisibility): Use -c flag for git safe.directory instead of modifying global config Jan 13, 2026

chatgpt-codex-connector bot reviewed Jan 13, 2026

View reviewed changes

internal/civisibility/utils/git.go Show resolved Hide resolved

kakkoyun approved these changes Jan 13, 2026

View reviewed changes

tonyredondo approved these changes Jan 13, 2026

View reviewed changes

dd-devflow bot added mergequeue-status: queued mergequeue-status: in_progress mergequeue-status: retrying and removed mergequeue-status: queued mergequeue-status: in_progress mergequeue-status: retrying labels Jan 13, 2026

Merge branch 'main' into anmarchenko/fix_safe_directory_issue

3b19934

dd-devflow bot added mergequeue-status: removed and removed mergequeue-status: in_progress labels Jan 13, 2026

dd-devflow bot added mergequeue-status: waiting and removed mergequeue-status: removed labels Jan 13, 2026

anmarchenko mentioned this pull request Jan 13, 2026

[SDTEST-3223] Pass -c safe.directory to all git commands to fix dubious ownership errors DataDog/datadog-ci-rb#454

Merged

dd-devflow bot added mergequeue-status: queued and removed mergequeue-status: waiting labels Jan 13, 2026

dd-devflow bot added mergequeue-status: in_progress mergequeue-status: retrying mergequeue-status: rejected and removed mergequeue-status: queued mergequeue-status: in_progress mergequeue-status: retrying labels Jan 14, 2026

dd-devflow bot added mergequeue-status: queued mergequeue-status: in_progress mergequeue-status: retrying mergequeue-status: rejected and removed mergequeue-status: rejected mergequeue-status: queued mergequeue-status: in_progress mergequeue-status: retrying labels Jan 14, 2026

dd-devflow bot added mergequeue-status: queued mergequeue-status: in_progress and removed mergequeue-status: rejected mergequeue-status: queued labels Jan 14, 2026

dd-mergequeue bot merged commit e83252c into main Jan 14, 2026
186 checks passed

dd-devflow bot removed the mergequeue-status: in_progress label Jan 14, 2026

dd-mergequeue bot deleted the anmarchenko/fix_safe_directory_issue branch January 14, 2026 12:37

dd-devflow bot added the mergequeue-status: done label Jan 14, 2026

fix(civisibility): Use -c flag for git safe.directory instead of modifying global config #4344

fix(civisibility): Use -c flag for git safe.directory instead of modifying global config #4344

Uh oh!

Conversation

anmarchenko commented Jan 13, 2026

What does this PR do?

Motivation

Reviewer's Checklist

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

codecov bot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

pr-commenter bot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Uh oh!

tonyredondo commented Jan 13, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 bot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

darccio commented Jan 13, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 bot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

darccio commented Jan 13, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 bot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What to do next?

Uh oh!

darccio commented Jan 14, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 bot commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What to do next?

Uh oh!

darccio commented Jan 14, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 bot commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

codecov bot commented Jan 13, 2026 •

edited

Loading

pr-commenter bot commented Jan 13, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 bot commented Jan 13, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 bot commented Jan 13, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 bot commented Jan 13, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 bot commented Jan 14, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 bot commented Jan 14, 2026 •

edited

Loading