From 5d0eeb1408ca8dd9090c817d035a31679fdbaa6a Mon Sep 17 00:00:00 2001
From: Franco <franco@giantswarm.io>
Date: Tue, 2 Jun 2026 13:37:32 -0300
Subject: [PATCH] fix(sync-from-upstream): set git safe.directory for
 values-sync drift detection

The values-sync drift step mounts the workspace into a container running
as root, while actions/checkout writes the repo as the runner user. Git
then aborts with 'detected dubious ownership' (exit 128) when computing the
upstream diff, so drift detection silently fails.

Inject safe.directory=/github/workspace via GIT_CONFIG env vars so git
trusts the mounted workspace.
---
 .github/workflows/sync-from-upstream.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/sync-from-upstream.yaml b/.github/workflows/sync-from-upstream.yaml
index fa0e521..4a698aa 100644
--- a/.github/workflows/sync-from-upstream.yaml
+++ b/.github/workflows/sync-from-upstream.yaml
@@ -106,6 +106,9 @@ jobs:
           fi
           drift=$(docker run --rm \
             -v ${{ github.workspace }}:/github/workspace \
+            -e GIT_CONFIG_COUNT=1 \
+            -e GIT_CONFIG_KEY_0=safe.directory \
+            -e GIT_CONFIG_VALUE_0=/github/workspace \
             gsoci.azurecr.io/giantswarm/shield-values-sync:0.0.5 \
             --show-git-diff \
             --chart-dir /github/workspace/${{ steps.chart.outputs.chart_dir }} \