fix: execute git safe.directory at run time

.env

@@ -1,3 +1,4 @@
+GITHUB_WORKSPACE=/github/workspace
 GITHUB_EVENT_PATH=/github/workspace/action/test/fixtures/payload.json
 GITHUB_EVENT_NAME=push
 INPUT_CONFIG=/github/workspace/.semantic.json

Dockerfile

@@ -5,12 +5,9 @@ FROM alpine:3.16 AS base
 # hadolint ignore=DL3018
 RUN apk add --no-cache --update nodejs npm git openssh ca-certificates ruby-bundler
 
-# alpine has trust issues
-RUN git config --global --add safe.directory '*'
-
 WORKDIR /action
 
-ENTRYPOINT [ "node" ]
+ENTRYPOINT [ "/action/entrypoint.sh" ]
 
 # --- build stage --- #
 
@@ -37,5 +34,3 @@ COPY --from=build /action/node_modules ./node_modules
 
 # copy files
 COPY action ./
-
-CMD ["--no-warnings=ExperimentalWarnings", "/action/index.js"]

action/entrypoint.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+# this must be executed at run time, because github action runner changes $HOME value to /github/home
+git config --global --add safe.directory "${GITHUB_WORKSPACE:=.}"
+
+# normal execution
+node --no-warnings=ExperimentalWarnings /action/index.js