Fix Git safe.directory errors across all roles (Git 2.35+)

playbooks/roles/edxapp/tasks/deploy.yml

@@ -45,6 +45,32 @@
     - install
     - install:base
 
+# Ensure correct ownership and mark as safe for Git operations
+# This mitigates Git's safe.directory / "dubious ownership" protections (Git 2.35+)
+- name: Ensure edxapp code directory ownership is correct for git
+  become: yes
+  file:
+    path: "{{ edxapp_code_dir }}"
+    owner: "{{ edxapp_user }}"
+    group: "{{ edxapp_user }}"
+    recurse: yes
+  when: edxapp_code_dir is defined
+  tags:
+    - install
+    - install:code
+
+- name: Mark edxapp code directory as safe for git
+  become: yes
+  become_user: "{{ edxapp_user }}"
+  shell: >
+    git config --global --get-all safe.directory | grep -qx "{{ edxapp_code_dir }}" ||
+    git config --global --add safe.directory "{{ edxapp_code_dir }}"
+  changed_when: false
+  when: edxapp_code_dir is defined
+  tags:
+    - install
+    - install:code
+
 # Do A Checkout
 - name: checkout edx-platform repo into {{ edxapp_code_dir }}
   git:

playbooks/roles/forum/tasks/deploy.yml

@@ -38,6 +38,32 @@
     - install
     - install:configuration
 
+# Ensure correct ownership and mark as safe for Git operations
+# This mitigates Git's safe.directory / "dubious ownership" protections (Git 2.35+)
+- name: Ensure forum code directory ownership is correct for git
+  become: yes
+  file:
+    path: "{{ forum_code_dir }}"
+    owner: "{{ forum_user }}"
+    group: "{{ forum_user }}"
+    recurse: yes
+  when: forum_code_dir is defined
+  tags:
+    - install
+    - install:code
+
+- name: Mark forum code directory as safe for git
+  become: yes
+  become_user: "{{ forum_user }}"
+  shell: >
+    git config --global --get-all safe.directory | grep -qx "{{ forum_code_dir }}" ||
+    git config --global --add safe.directory "{{ forum_code_dir }}"
+  changed_when: false
+  when: forum_code_dir is defined
+  tags:
+    - install
+    - install:code
+
 - name: git checkout forum repo into {{ forum_code_dir }}
   git:
     dest: "{{ forum_code_dir }}"

playbooks/roles/git_clone/tasks/main.yml

@@ -124,18 +124,42 @@
     - install
     - install:code
 
+# Ensure correct ownership and mark as safe for Git operations
+# This mitigates Git's safe.directory / "dubious ownership" protections (Git 2.35+)
+- name: Ensure code directory ownership is correct for git
+  become: yes
+  file:
+    path: "{{ item.DESTINATION }}"
+    owner: "{{ repo_owner }}"
+    group: "{{ repo_group }}"
+    recurse: yes
+  when: GIT_REPOS is defined
+  with_items: "{{ GIT_REPOS }}"
+  no_log: "{{ GIT_CLONE_NO_LOGGING }}"
+  tags:
+    - install
+    - install:code
+
 - name: Run git safe.directory
-  shell: git config --global --add safe.directory {{ item.DESTINATION }}
-  become: true
+  shell: >
+    git config --global --get-all safe.directory | grep -qx "{{ item.DESTINATION }}" ||
+    git config --global --add safe.directory "{{ item.DESTINATION }}"
+  become: yes
+  become_user: "{{ repo_owner }}"
+  changed_when: false
+  when: GIT_REPOS is defined
   with_items: "{{ GIT_REPOS }}"
   no_log: "{{ GIT_CLONE_NO_LOGGING }}"
   tags:
     - install
     - install:code
 
 - name: Run git clean after checking out code
-  shell: cd {{ item.DESTINATION }} && git clean -xdf
-  become: true
+  shell: cd "{{ item.DESTINATION }}" && git clean -xdf
+  become: yes
+  become_user: "{{ repo_owner }}"
+  changed_when: false
+  when: GIT_REPOS is defined
   with_items: "{{ GIT_REPOS }}"
   no_log: "{{ GIT_CLONE_NO_LOGGING }}"
   tags:

playbooks/roles/tableau/tasks/main.yml

@@ -57,6 +57,32 @@
     - install
     - install:base
 
+# Ensure correct ownership and mark as safe for Git operations
+# This mitigates Git's safe.directory / "dubious ownership" protections (Git 2.35+)
+- name: Ensure tableau code directory ownership is correct for git
+  become: yes
+  file:
+    path: "{{ tableau_code_dir }}"
+    owner: "{{ tableau_user }}"
+    group: "{{ tableau_user_group }}"
+    recurse: yes
+  when: tableau_code_dir is defined
+  tags:
+    - install
+    - install:code
+
+- name: Mark tableau code directory as safe for git
+  become: yes
+  become_user: "{{ tableau_user }}"
+  shell: >
+    git config --global --get-all safe.directory | grep -qx "{{ tableau_code_dir }}" ||
+    git config --global --add safe.directory "{{ tableau_code_dir }}"
+  changed_when: false
+  when: tableau_code_dir is defined
+  tags:
+    - install
+    - install:code
+
 # Clone tableau repo containing install scripts.
 - name: checkout tableau repo into {{ tableau_code_dir }}
   git: