From 747df03c121988475874e0484d392e936054a5d7 Mon Sep 17 00:00:00 2001
From: Anton Afanasyeu <a.afanasieff@gmail.com>
Date: Sun, 9 Aug 2026 19:04:28 +0200
Subject: [PATCH] CI: allow git safe.directory for nobody-owned isolated clones
 in Docker.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 ci-build-and-publish-ota.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/ci-build-and-publish-ota.sh b/ci-build-and-publish-ota.sh
index 46457db..082552e 100755
--- a/ci-build-and-publish-ota.sh
+++ b/ci-build-and-publish-ota.sh
@@ -31,6 +31,12 @@ exec > >(tee -a "${OUT_DIR}/build.log") 2>&1
 
 echo "==> Phase: init build_id=${BUILD_ID} channel=${OTA_CHANNEL}"
 
+# Isolated trees are cloned by PHP-FPM (nobody); container runs as root.
+if [[ -d "${ROOT}/.git" ]]; then
+  git config --global --add safe.directory "${ROOT}" 2>/dev/null || true
+  git config --global --add safe.directory '*' 2>/dev/null || true
+fi
+
 if [[ -n "${GIT_REF:-}" ]]; then
   echo "==> Phase: git checkout ${GIT_REF}"
   current_head="$(git rev-parse HEAD 2>/dev/null || echo "")"