ci: trust all Git directories for non-root CI/CD execution

[appleboy]

• Configure Git to trust all directories to prevent errors when running as a non-root user in CI/CD environments

fix #112
fix #111

[Copilot]

Pull request overview

This PR configures Git to trust all directories in the Docker container to resolve "fatal: not in a git directory" errors that occur when running as a non-root user in CI/CD environments. This addresses issues #112 and #111.

• Adds Git system-level configuration to trust all directories using the wildcard pattern
• Places the configuration command before the USER switch to ensure proper permissions
• Includes explanatory comments about the purpose and necessity in CI/CD contexts

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Setting safe.directory '*' in the system Git config disables Git’s ownership safety checks (introduced for CVE-2022-24765), effectively trusting every Git working directory on the filesystem. If this image is ever used in a shared or multi-tenant environment, an attacker who can place a malicious Git repository owned by another user could trigger Git commands that honor that repository’s config and hooks, leading to arbitrary command execution or credential exfiltration under the appuser (or container) privileges. To reduce this risk, avoid the wildcard and restrict safe.directory to the specific workspace path(s) used in CI, or adjust the filesystem/UID setup so that Git does not see an ownership mismatch instead of globally trusting all directories.

Suggested change

	# Configure Git to trust all directories to avoid "fatal: not in a git directory" errors
	# This is necessary when running as non-root user in CI/CD environments
	RUN git config --system --add safe.directory '*'
	# Configure Git to trust the Drone workspace directory to avoid ownership errors
	# when running as non-root user in CI/CD environments, without trusting all paths
	RUN git config --system --add safe.directory /drone/src