ci: isolate checkout from global git hook config on runners

2026-02-26 06:20:16 +00:00
parent 54b4b7cad4
commit 570722f0e6
29 changed files with 127 additions and 1 deletions
@@ -17,6 +17,9 @@ permissions:
    contents: read

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    CARGO_TERM_COLOR: always

 jobs:
@@ -80,6 +80,12 @@ permissions:
    contents: read
    actions: read

+env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
+
+
 jobs:
    canary-plan:
        name: Canary Plan
@@ -41,6 +41,12 @@ concurrency:
 permissions:
    contents: read

+env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
+
+
 jobs:
    audit:
        name: CI Change Audit
@@ -19,6 +19,12 @@ concurrency:
 permissions:
    contents: read

+env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
+
+
 jobs:
    probes:
        name: Provider Connectivity Probes
@@ -30,6 +30,12 @@ concurrency:
 permissions:
    contents: read

+env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
+
+
 jobs:
    probe:
        name: Provider Connectivity Probe
@@ -42,6 +42,9 @@ permissions:
    contents: read

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    CARGO_TERM_COLOR: always

 jobs:
@@ -55,6 +55,12 @@ permissions:
    contents: read
    actions: read

+env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
+
+
 jobs:
    rollback-plan:
        name: Rollback Guard Plan
@@ -16,6 +16,9 @@ permissions:
    contents: read

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    CARGO_TERM_COLOR: always

 jobs:
@@ -23,6 +23,9 @@ permissions:
    id-token: write

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    CARGO_TERM_COLOR: always

 jobs:
@@ -47,6 +47,12 @@ concurrency:
 permissions:
    contents: read

+env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
+
+
 jobs:
    docs-quality:
        name: Docs Quality Gate
@@ -52,6 +52,9 @@ permissions:
    contents: read

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    CARGO_TERM_COLOR: always

 jobs:
@@ -11,6 +11,12 @@ concurrency:
 permissions:
    contents: read

+env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
+
+
 jobs:
    enforce-dev-promotion:
        name: Enforce Dev -> Main Promotion
@@ -19,6 +19,9 @@ permissions:
    contents: read

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    CARGO_TERM_COLOR: always

 jobs:
@@ -10,6 +10,9 @@ on:
 permissions: {}

 env:
+  GIT_CONFIG_COUNT: "1"
+  GIT_CONFIG_KEY_0: core.hooksPath
+  GIT_CONFIG_VALUE_0: /dev/null
  LABEL_POLICY_PATH: .github/label-policy.json

 jobs:
@@ -7,6 +7,11 @@ on:

 permissions: {}

+env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
+
 jobs:
    stale:
        permissions:
@@ -11,6 +11,11 @@ concurrency:
  group: pr-check-status
  cancel-in-progress: true

+env:
+  GIT_CONFIG_COUNT: "1"
+  GIT_CONFIG_KEY_0: core.hooksPath
+  GIT_CONFIG_VALUE_0: /dev/null
+
 jobs:
  nudge-stale-prs:
    runs-on: self-hosted
@@ -23,7 +28,6 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
      - name: Nudge PRs that need rebase or CI refresh
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        with:
@@ -14,6 +14,12 @@ permissions:
    pull-requests: write
    issues: write

+env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
+
+
 jobs:
    intake:
        name: Intake Checks
@@ -19,6 +19,12 @@ concurrency:
 permissions:
    contents: read

+env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
+
+
 jobs:
    contributor-tier-consistency:
        runs-on: self-hosted
@@ -25,6 +25,9 @@ permissions:
    issues: write

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    LABEL_POLICY_PATH: .github/label-policy.json

 jobs:
@@ -23,6 +23,9 @@ concurrency:
    cancel-in-progress: true

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    REGISTRY: ghcr.io
    IMAGE_NAME: ${{ github.repository }}

@@ -35,6 +35,9 @@ permissions:
    contents: write

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    CARGO_TERM_COLOR: always

 jobs:
@@ -39,6 +39,9 @@ permissions:
    id-token: write # Required for cosign keyless signing via OIDC

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    CARGO_TERM_COLOR: always

 jobs:
@@ -78,6 +78,9 @@ permissions:
    checks: write

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    CARGO_TERM_COLOR: always

 jobs:
@@ -34,6 +34,12 @@ permissions:
    security-events: write
    actions: read

+env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
+
+
 jobs:
    codeql:
        name: CodeQL Analysis
@@ -82,6 +82,12 @@ permissions:
    checks: write
    pull-requests: write

+env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
+
+
 jobs:
    vorpal:
        name: Vorpal Reviewdog Scan
@@ -14,6 +14,9 @@ permissions:
    pull-requests: write

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    CARGO_TERM_COLOR: always

 jobs:
@@ -13,6 +13,9 @@ permissions:
    contents: read

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    CARGO_TERM_COLOR: always

 jobs:
@@ -19,6 +19,9 @@ permissions:
    issues: write

 env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
    CARGO_TERM_COLOR: always

 jobs:
@@ -19,6 +19,12 @@ concurrency:
 permissions:
    contents: read

+env:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: core.hooksPath
+    GIT_CONFIG_VALUE_0: /dev/null
+
+
 jobs:
    no-tabs:
        runs-on: self-hosted