[BUG] Hugo ≥0.166 strips GIT_CONFIG_* env, defeating safe.directory (#203) #211

Summary

#203 delivers safe.directory=/workspace through GIT_CONFIG_COUNT / GIT_CONFIG_KEY_n / GIT_CONFIG_VALUE_n in containerEnv. Hugo ≥ 0.166 runs git (for enableGitInfo) through its exec sandbox, which forwards only env vars matching security.exec.osEnv. GIT_CONFIG_* isn't on Hugo's default allowlist, so git never sees safe.directory.

When the intermittent bind-mount ownership mismatch from #172 strikes, every Hugo build in the container fails:

ERROR error building site: assemble: failed to create page from pageMetaSource /contact:
"…/content/contact.md:1:1": failed to load Git data: fatal: detected dubious ownership in repository at '/workspace'

Hugo 0.164 forwarded the full environment, so the env-var approach worked there. The image now ships Hugo 0.167, so any Hugo project with enableGitInfo: true is affected.

Reproduction

1. In a downstream Hugo project with enableGitInfo: true, open the claude-code devcontainer.
2. Run a build while git reports dubious ownership (intermittent on macOS bind mounts, claude-code template: VS Code's Git extension intermittently hits "dubious ownership" on /workspace, and SSH GitHub remotes can't use the container's gh login #172), e.g. hugo --minify.

Deterministic check that Hugo strips the env. It doesn't need the ownership flake: inject an invalid git config and see whether git ever receives it.

export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=core.bare GIT_CONFIG_VALUE_0=notabool
hugo -d /tmp/out          # Hugo 0.166: builds fine -> git never saw the env
git status                # git itself: "bad boolean config value" -> env is set

Verification

• hugo config | grep -A1 osenv shows the default allowlist: (?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM|GO\w+|(XDG_CONFIG_)?HOME|USERPROFILE|SSH_AUTH_SOCK|DISPLAY|LANG|SYSTEMDRIVE|PROGRAMDATA)$, with no GIT_CONFIG_*.
• Same repo and env: Hugo 0.164.0 builds; Hugo 0.166.0 fails with dubious ownership.
• safe.directory supplied through $HOME/.gitconfig instead (HOME is allowlisted): Hugo 0.166.0 builds.

Suggested fix

Set safe.directory at a level no env filter can strip, and keep the env vars for everything else.

1. In claude-code/.devcontainer/Dockerfile:

   RUN git config --system --add safe.directory /workspace

   /etc/gitconfig is read by every git process regardless of its environment. The extension-copied ~/.gitconfig doesn't override it, because safe.directory is additive.

2. Alternatively, or in addition, document the per-project workaround in the README for Hugo projects:

   security:
     exec:
       osEnv:
         - '(?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM|GO\w+|(XDG_CONFIG_)?HOME|USERPROFILE|SSH_AUTH_SOCK|DISPLAY|LANG|SYSTEMDRIVE|PROGRAMDATA)$'
         - '^GIT_CONFIG_(COUNT|KEY_\d+|VALUE_\d+)$'

   uxcringe.com already ships this workaround in its hugo.yaml.

Affected files in this repo

• claude-code/.devcontainer/devcontainer.json (containerEnv GIT_CONFIG_*)
• claude-code/.devcontainer/claude-sandbox/devcontainer.json (same)
• claude-code/.devcontainer/Dockerfile (where the system-level fix would go)

Related

• claude-code template: VS Code's Git extension intermittently hits "dubious ownership" on /workspace, and SSH GitHub remotes can't use the container's gh login #172 (intermittent dubious ownership), fix(claude-code): set git safe.directory and gh credential helper via env #203 (env-var fix)
• Other tools that sanitize child env (e.g. sandboxed task runners) hit the same gap.