Skip to content

[deep-report] [safe-outputs] Tracking: Changeset Generator push_to_pull_request_branch dubious-ownership hardfail (bridge safe.directory) #46028

Description

@github-actions

Description

Tracking issue for the highest-priority open safe-output production signature. The Changeset Generator push_to_pull_request_branch handler hard-fails with patch-format:BUNDLEdetected dubious ownership (last actuating failure 2026-06-26; latent/read-only every window since, so it never re-fires to self-file).

Inferred root cause (per safe-output-health audit): the safeoutputs bridge runs outside the container as a different user/HOME, so the in-container git config --global safe.directory never reaches the bridge. Proposed remediation:

  1. Add git config --global --add safe.directory in the bridge HOME (or align bridge user+HOME with the container).
  2. Pre-bundle the Process Safe Outputs step log on failure so the exact error is recoverable (see companion observability task).
  3. Graceful retry/skip so a bundle-transport failure does not red the daily run.

Expected Impact

Restores write capability for the Changeset Generator (currently silently read-only) and removes the top-priority latent hardfail signature.

Suggested Agent

New Agent or workflow-infra maintainer (safeoutputs bridge / container user alignment).

Estimated Effort

Medium (1-4 hours)

Data Source

DeepReport Intelligence Briefing 2026-07-16, from the [safe-output-health] report longitudinal watch-list (item 1). No existing tracking issue as of this run.

Generated by 🔬 Deep Report · 247.5 AIC · ⌖ 12.4 AIC · ⊞ 10K ·

  • expires on Jul 18, 2026, 7:30 AM UTC-08:00

Metadata

Metadata

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions