fix(ci): restore identity reads under the codecov step's redirected git config

[ywatanabe1989]

The bug I shipped in #20

GIT_CONFIG_GLOBAL replaces the global config — it does not layer on top of it. So #20, which redirected the codecov step's git writes away from the contended shared ~/.gitconfig, also hid user.name / user.email from git for that step.

Silently, because nothing in that step reads them today.

The fix

Seed the throwaway file with an include.path back to the real config, in a step carrying the same if: guard:

printf '[include]\n\tpath = %s\n' "$HOME/.gitconfig" > "${{ runner.temp }}/gitconfig-codecov"

Identity resolves through the include; --add safe.directory still lands in the throwaway file, so the lock contention #20 fixed stays fixed.

Provenance — I did not find this

I reasoned only about the lock when writing #20 and never considered identity. scitex-hpc caught the identical shape in their launcher-level fix, where it would have made every CI commit identity-less, and they caught it by asserting the mechanism rather than trusting it:

IDENTITY_PRESERVED_VIA_INCLUDE   user.name=Yusuke Watanabe  user.email=ywatanabe@scitex.ai
WRITE_LANDED_IN_PER_RUNNER_FILE  per_runner_hits=1
SSOT_UNTOUCHED                   before_bytes=4311455  after_bytes=4311455  ssot_hits=0

Mine is the same bug scoped to one step: harmless for what that step does today, silently wrong the moment anything under that env needs identity. "Appears not to need identity" was an assumption nobody had asserted.

Why now rather than waiting

This is superseded by the launcher-level fix, which sets GIT_CONFIG_GLOBAL once for every runner and every one of the ~58 per-repo callers this workflow never sees. That is the right place and I'll revert both this and #20 when it's deployed and live — not when it merges.

But that deployment is gated on an operator decision with no date, because redeploying the supervisor interrupts live CI. A known-latent config sitting in a workflow every scitex repo calls should not have an open-ended window. If the deployment lands tomorrow, this is one redundant line for a day — the better side of that trade.

scitex-hpc's words, which I agree with: "The cost of the include is one line; the cost of being wrong is a silently identity-less git operation in every repo that calls that workflow."

Verified

Parsed the YAML and asserted step order (seed precedes codecov), guard parity (identical if:), and that the env target is unchanged.

Context

The underlying contention is now understood: ~/.gitconfig had reached 35,396 lines / 4.3 MB of duplicated safe.directory entries — a positive feedback loop where every job read-modify-writes the whole file under lock, so more CI runs meant longer holds meant more collisions. scitex-hpc has cleaned it to 45 lines / 1 KB, which flattens the curve ahead of the launcher fix.