started to have failures pushing docs to gh pages

[hellt]

Hi all,
Today I noticed my publishing pipeline started to error when attempting to use gh-deploy.

Here is what I see in the gh actions logs:

docker run -v $(pwd):/docs --entrypoint mkdocs ghcr.io/srl-labs/mkdocs-material-insiders:$MKDOCS_MATERIAL_VER gh-deploy --force

INFO     -  Cleaning site directory
INFO     -  Building documentation to directory: /docs/site
INFO     -  The following pages exist in the docs directory, but are not included in the "nav" configuration:
  - alwayson.md
INFO     -  Documentation built in 4.58 seconds
ERROR    -  Cannot deploy - this directory does not appear to be a git repository
WARNING  -  Version check skipped: No version specified in previous deployment.
INFO     -  Copying '/docs/site' to 'gh-pages' branch and pushing to GitHub.
ERROR    -  Failed to deploy to GitHub with error: 
unsafe repository ('/docs' is owned by someone else)
To add an exception for this directory, call:
	git config --global --add safe.directory /docs
Deployment Aborted!

Before spending too much time on this I wonder if anyone spotted anything like this?

[squidfunk]

Never seen anything like that. Does it happen with an older version of Material for MkDocs and/or Insiders? If the answer is yes, it's very likely not directly related to us, but either MkDocs, GitHub Actions, or Docker. Feel free to share your findings.

[hellt]

it is indeed appears to be related with gh actions internal mechanics...
I used the same container locally on my machine and were able to use gh-deploy command...

For the sake of completeness here is the shell command that does the trick

docker run -v /run/user/0/vscode-ssh-auth-sock-794053704:/ssh-agent --env SSH_AUTH_SOCK=/ssh-agent --env GIT_SSH_COMMAND="ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" -v $(pwd):/docs --entrypoint mkdocs <your-material-mkdocs-container-image> gh-deploy --force --strict

[hellt]

This is likely an effect of two events:

• new git version supported by gh actions which addressed some security vulnerabilities
• running mkdocs in a container as I show in the original posting

a mitigation seems to be explained here actions/checkout#760 (comment). I am yet to try it

[hellt]

finally found a woring workaround for gh actions. Based on the discussions in the original issue thread, one needs to mark a dir inside the container as safe.
In my case, the docker command becomes

docker run -v $(pwd):/docs --entrypoint ash ghcr.io/srl-labs/mkdocs-material-insiders:$MKDOCS_MATERIAL_VER -c 'git config --global --add safe.directory /docs; mkdocs gh-deploy --force'

note the git config portion of a cmd

[squidfunk]

Thanks for sharing your solution! I'm certain this will help other users 😊

[hellt]

appears to be related to gh actions #4011 (reply in thread)

[saltydk]

Couldn't you just run the image as the runner user that Github Actions uses? Guessing this happens because the mounted volume is owned by runner and not root.

[hellt]

that should be another way to fix this, do you know how to do that?

[saltydk]

Example of how it works:

➜  ~ docker run --rm -i --entrypoint ash squidfunk/mkdocs-material -c 'id'
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
➜  ~ docker run --rm -i --user $(id -u):$(id -g) --entrypoint ash squidfunk/mkdocs-material -c 'id'
uid=1000 gid=1001

[hellt]

thanks @saltydk this seems to work just fine. This is a better solution