Commit authored as Prebuilds Owner
- Lingua principale
- Nessun dato sulla lingua
- Stelle
- 3
- Fork
- 0
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
## Description
In dogfood, a commit on a claimed prebuild workspace was authored as Prebuilds Owner instead of a real user.
* Commit: https://github.com/coder/coder/commit/5f1f2d987501e77369bcce594bab1d67d48b483d.patch
* PR:https://github.com/coder/coder/pull/19742/commits
* Internal slack thread: https://codercom.slack.com/archives/C07GRNNRW03/p1757468203149319
## Current Behavior
The `Write Coder on Coder` template includes the git-config module, which sets environment variables GIT_AUTHOR_NAME, GIT_COMMITTER_NAME, GIT_AUTHOR_EMAIL, and GIT_COMMITTER_EMAIL from `data.coder_workspace_owner`: https://github.com/coder/registry/blob/main/registry/coder/modules/git-config/main.tf
In the template, the module runs when `data.coder_workspace.me.start_count > 0`. Since `start_count` is set to 1 for the [start transition](https://github.com/coder/terraform-provider-coder/blob/main/provider/workspace.go#L26), this runs for both prebuild creation and prebuild claim.
As a result, on prebuild creation the module sets these environment variables to `Prebuilds Owner` and `prebuilds@system`, making it possible for any pre-claim or in-claim processes to author commits with the prebuild identity.
**Likely root cause:** A race at claim combined with the fact that commit identity and push auth are separate. During prebuild creation, `git-config` exported `GIT_AUTHOR_NAME` and `GIT_COMMITTER_EMAIL` as Prebuilds Owner. A terminal spawned while claim was still applying, inherited those env vars. After claim, Coder provisioned push credentials (SSH key/agent or HTTPS credential helper). The commit used the prebuild identity from the environment variables, and the subsequent push succeeded because git push uses runtime credentials. This yields a commit with Prebuilds Owner as author and a successful push under the user’s credentials.
## Steps to reproduce
1) Connect to an unclaimed prebuild (or start an app/terminal that runs pre‑claim).
2) Check env: `GIT_AUTHOR_NAME` and `GIT_COMMITTER_EMAIL` show `Prebuilds Owner`.
3) Create a commit, and the author is `Prebuilds Owner`.
4) Claim the prebuild.
5) Push the commit, and the author remains `Prebuilds Owner`.
## Possible solutions
* Configuring the git-config module to only execute when a prebuild claim is performed does not set the environment variables for the prebuilds user:
```
module "git-config" {
count = data.coder_workspace.me.is_prebuild ? 0 : data.coder_workspace.me.start_count
source = "dev.registry.coder.com/coder/git-config/coder"
version = "1.0.31"
agent_id = coder_agent.dev.id
# If you prefer to commit with a different email, this allows you to do so.
allow_email_change = true
}
```
* Configure the git-config module to not set the environment variables in case of prebuild creation
* Another possible solution would be to set ´data.coder_workspace_owner´ to empty values on prebuild creation. This, however, would be a breaking change and might break templates that use this value even when it is set for the prebuilds user.
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Direzione di ricerca
Inizia con il modulo git-config in registry/coder/modules/git-config/main.tf e con la transizione di avvio in terraform-provider-coder/provider/workspace.go. Riproduci il flusso di prebuild verificando GIT_AUTHOR_NAME e GIT_COMMITTER_EMAIL prima e dopo il claim, quindi crea e invia un commit. Il lavoro è completato quando i workspaces creati dai prebuild non producono più commit con autore Prebuilds Owner, mentre i push dell’utente che ha effettuato il claim continuano ad avere esito positivo.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- git, terraform
- Ambito
- devops, infrastructure
- Tipo di issue
- Bug
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Ferma
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 35/100