Trust ROS CI workspaces inside containers

Author: PeterCalifano

.github/workflows/build_ros2_overlay.yml

@@ -80,6 +80,12 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Trust checked-out Git worktree
+        shell: bash
+        run: |
+          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
+          git -C "${GITHUB_WORKSPACE}" rev-parse --is-inside-work-tree
+
       - name: Install ROS 2 overlay dependencies
         run: |
           apt-get update
@@ -159,6 +165,12 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Trust checked-out Git worktree
+        shell: bash
+        run: |
+          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
+          git -C "${GITHUB_WORKSPACE}" rev-parse --is-inside-work-tree
+
       - name: Install ROS 2 overlay dependencies
         run: |
           apt-get update

.github/workflows/build_ros2_overlay.yml.tpl

@@ -47,6 +47,12 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Trust checked-out Git worktree
+        shell: bash
+        run: |
+          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
+          git -C "${GITHUB_WORKSPACE}" rev-parse --is-inside-work-tree
+
       - name: Install ROS 2 overlay dependencies
         run: |
           apt-get update

tests/cmake/VerifyTemplateProjectRos2Overlay.cmake

@@ -879,6 +879,26 @@ if(NOT _workflow_metadata_sync_count EQUAL 2)
       "Both ROS 2 workflow jobs must synchronize project metadata before rosdep; "
       "found ${_workflow_metadata_sync_count} invocations.")
 endif()
+string(REGEX MATCHALL
+    "git config --global --add safe\\.directory \"\\$\\{GITHUB_WORKSPACE\\}\""
+    _workflow_workspace_trusts
+    "${_workflow_contents}")
+list(LENGTH _workflow_workspace_trusts _workflow_workspace_trust_count)
+string(REGEX MATCHALL
+    "git -C \"\\$\\{GITHUB_WORKSPACE\\}\" rev-parse --is-inside-work-tree"
+    _workflow_worktree_probes
+    "${_workflow_contents}")
+list(LENGTH _workflow_worktree_probes _workflow_worktree_probe_count)
+if(NOT _workflow_workspace_trust_count EQUAL 2
+    OR NOT _workflow_worktree_probe_count EQUAL 2)
+  message(FATAL_ERROR
+      "Both ROS 2 workflow jobs must trust and validate the exact mounted Git workspace; "
+      "found ${_workflow_workspace_trust_count} trust commands and "
+      "${_workflow_worktree_probe_count} worktree probes.")
+endif()
+if(_workflow_contents MATCHES "safe\\.directory[^\n]*[\"']?\\*")
+  message(FATAL_ERROR "ROS 2 workflow must not trust every Git repository with safe.directory '*'.")
+endif()
 string(REGEX MATCHALL
     "git diff --exit-code -- ros2/\\*/package\\.xml"
     _workflow_manifest_drift_guards
@@ -978,6 +998,30 @@ if(NOT _project_workflow_metadata_sync_count EQUAL 1)
       "Generic ROS workflow must synchronize metadata exactly once; "
       "found ${_project_workflow_metadata_sync_count} invocations.")
 endif()
+string(REGEX MATCHALL
+    "git config --global --add safe\\.directory \"\\$\\{GITHUB_WORKSPACE\\}\""
+    _project_workflow_workspace_trusts
+    "${_workflow_template_contents}")
+list(LENGTH
+    _project_workflow_workspace_trusts
+    _project_workflow_workspace_trust_count)
+string(REGEX MATCHALL
+    "git -C \"\\$\\{GITHUB_WORKSPACE\\}\" rev-parse --is-inside-work-tree"
+    _project_workflow_worktree_probes
+    "${_workflow_template_contents}")
+list(LENGTH
+    _project_workflow_worktree_probes
+    _project_workflow_worktree_probe_count)
+if(NOT _project_workflow_workspace_trust_count EQUAL 1
+    OR NOT _project_workflow_worktree_probe_count EQUAL 1)
+  message(FATAL_ERROR
+      "Generic ROS workflow must trust and validate the exact mounted Git workspace once; "
+      "found ${_project_workflow_workspace_trust_count} trust commands and "
+      "${_project_workflow_worktree_probe_count} worktree probes.")
+endif()
+if(_workflow_template_contents MATCHES "safe\\.directory[^\n]*[\"']?\\*")
+  message(FATAL_ERROR "Generic ROS workflow must not trust every Git repository with safe.directory '*'.")
+endif()
 string(REGEX MATCHALL
     "git diff --exit-code -- ros2/\\*/package\\.xml"
     _project_workflow_manifest_drift_guards

tests/template_test/testRos2OverlayStatic.py

@@ -364,9 +364,21 @@ def test_workflowSyncsMetadataBeforeRosdepInstall(self) -> None:
         overlayJob_, rolloutJob_ = workflowText_.split("  rollout-rehearsal:", maxsplit=1)
         for jobText_ in (overlayJob_, rolloutJob_):
             installIndex_ = jobText_.find("apt-get install")
+            trustIndex_ = jobText_.find(
+                'git config --global --add safe.directory "${GITHUB_WORKSPACE}"'
+            )
+            worktreeIndex_ = jobText_.find(
+                'git -C "${GITHUB_WORKSPACE}" rev-parse --is-inside-work-tree'
+            )
             syncIndex_ = jobText_.find("./generate_version.sh --sync-ros2")
             rosdepIndex_ = jobText_.find("rosdep install --from-paths ros2")
-            assert min(installIndex_, syncIndex_, rosdepIndex_) >= 0
-            assert installIndex_ < syncIndex_ < rosdepIndex_
+            assert min(
+                installIndex_, trustIndex_, worktreeIndex_, syncIndex_, rosdepIndex_
+            ) >= 0
+            assert trustIndex_ < worktreeIndex_ < syncIndex_ < rosdepIndex_
+            assert installIndex_ < syncIndex_
             assert 'grep -q -- "--sync-ros2"' in jobText_
             assert 'grep -q -- "ROS2_PROJECT_METADATA_SYNC=1"' in jobText_
+
+        assert "safe.directory '*'" not in workflowText_
+        assert 'safe.directory "*"' not in workflowText_

tests/template_test/testWorkflowTemplates.py

@@ -17,6 +17,12 @@
 
 _PROJECT_WORKFLOW_MARKER = "# project-ci-template: generic"
 _MANIFEST_DRIFT_GUARD: str = "git diff --exit-code -- ros2/*/package.xml"
+_WORKSPACE_TRUST: str = (
+    'git config --global --add safe.directory "${GITHUB_WORKSPACE}"'
+)
+_WORKTREE_PROBE: str = (
+    'git -C "${GITHUB_WORKSPACE}" rev-parse --is-inside-work-tree'
+)
 
 _TEMPLATE_ONLY_PATTERNS = (
     "VerifyTemplateProject",
@@ -240,6 +246,32 @@ def test_dormantWorkflowsContainOnlyProjectCi(self) -> None:
                     requiredGate_,
                 )
 
+    def test_ros2ContainerJobsTrustExactWorkspaceBeforeMetadataSync(self) -> None:
+        workflowRoot_ = _RepoRoot() / ".github/workflows"
+        activeText_ = (
+            workflowRoot_ / "build_ros2_overlay.yml"
+        ).read_text(encoding="utf-8")
+        templateText_ = (
+            workflowRoot_ / "build_ros2_overlay.yml.tpl"
+        ).read_text(encoding="utf-8")
+
+        overlayJob_, rolloutJob_ = activeText_.split(
+            "  rollout-rehearsal:", maxsplit=1
+        )
+        for jobText_ in (overlayJob_, rolloutJob_, templateText_):
+            trustIndex_ = jobText_.find(_WORKSPACE_TRUST)
+            probeIndex_ = jobText_.find(_WORKTREE_PROBE)
+            syncIndex_ = jobText_.find("./generate_version.sh --sync-ros2")
+            assert min(trustIndex_, probeIndex_, syncIndex_) >= 0
+            assert trustIndex_ < probeIndex_ < syncIndex_
+            assert "safe.directory '*'" not in jobText_
+            assert 'safe.directory "*"' not in jobText_
+
+        assert activeText_.count(_WORKSPACE_TRUST) == 2
+        assert activeText_.count(_WORKTREE_PROBE) == 2
+        assert templateText_.count(_WORKSPACE_TRUST) == 1
+        assert templateText_.count(_WORKTREE_PROBE) == 1
+
     def test_manifestDriftGuardRejectsTrackedChanges(self, tmp_path: Path) -> None:
         repositoryRoot_ = tmp_path / "manifest-drift"
         manifestPath_ = repositoryRoot_ / "ros2" / "demo" / "package.xml"