The hash of the directory does not match the expected value in post job step

[vvanouytsel]

I noticed an issue related to the actions/checkout action in combination with the new copy functionality. I am using the latest main of runner-container-hooks.

The bug results in the hash validation mechanism failing after copying files from the workflow pod to the runner pod. This only occurs in the 'Post' step of the job.

There are a couple of requirements that need to be met before you trigger the bug.

• You need to call a reusable action (can be local or in a different repository).
• That reusable action needs to do a checkout using actions/checkout, but it needs to use v6.
• That reusable action also needs to perform any action on your git directory, for example setting the safe dir.

Once all these requirements are met, the 'Post' step of job will indicate that there is different hash on the runner pod then on the workflow pod.

As mentioned before, using actions/checkout@v6 is a requirement as actions/checkout@v5 does not trigger the issue.
If we look into the changes done in v6, we can see the following:

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of [v2.329.0](https://github.com/actions/runner/releases/tag/v2.329.0) to 
access the persisted credentials for [Docker container action](https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action) scenarios.

This is the workflow used to reproduce the issue.

name: Showcase issue
on:
  workflow_dispatch:

jobs:
  test:
    runs-on: default-staging
    container:
      image: ubuntu:24.04
    steps:
      - name: Install git
        run: |
          apt-get update && apt-get install -y git

      - name: Call action
        uses: TrendMiner/tm-pnt-dummy@main # cannot reference local actions due to https://github.com/actions/runner-container-hooks/issues/260

This is the reusable action used in the workflow. I used a local reusable action for ease, but the same occurs if your reusable action is in a separate repository.

---
name: Hello
description: Hello
runs:
  using: composite
  steps:
    - name: Checkout repository
      uses: actions/checkout@v6

    - name: Set git safe directory
      shell: bash
      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

Below are the logs of the 'Post Call action' step that showcase the mismatch in hash.

##[debug]Evaluating condition for step: 'Post Call action'
##[debug]Evaluating: always()
##[debug]Evaluating always:
##[debug]=> true
##[debug]Result: true
##[debug]Starting: Post Call action
##[debug]Loading inputs
##[debug]Loading env
Post job cleanup.
##[debug]Evaluating condition for step: 'run'
##[debug]Evaluating: always()
##[debug]Evaluating always:
##[debug]=> true
##[debug]Result: true
##[debug]Starting: run
##[debug]Loading inputs
##[debug]Evaluating: github.repository
##[debug]Evaluating Index:
##[debug]..Evaluating github:
##[debug]..=> Object
##[debug]..Evaluating String:
##[debug]..=> 'repository'
##[debug]=> 'mycompany/tm-pnt-dummy'
##[debug]Result: 'mycompany/tm-pnt-dummy'
##[debug]Evaluating: github.token
##[debug]Evaluating Index:
##[debug]..Evaluating github:
##[debug]..=> Object
##[debug]..Evaluating String:
##[debug]..=> 'token'
##[debug]=> '***'
##[debug]Result: '***'
##[debug]Loading env
Post job cleanup.
##[debug]Running JavaScript Action with default external tool: node24
Run '/home/runner/k8s/index.js'
##[debug]/home/runner/externals/node20/bin/node /home/runner/k8s/index.js
##[debug]Copying /home/runner/_work/_temp to pod default-staging-xjndr-runner-hnpxv-workflow at /__w/_temp
(node:424) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]execPodStep response: {"metadata":{},"status":"Success"}
##[debug]Getting git version
/usr/bin/git version
git version 2.43.0
##[debug]0
##[debug]git version 2.43.0
##[debug]
##[debug]Set git useragent to: git/2.43.0 (github-actions-checkout)
::add-mask::***
Copying '/root/.gitconfig' to '/__w/_temp/0469fab8-c4c2-435c-ae26-513ada0b2849/.gitconfig'
Temporarily overriding HOME='/__w/_temp/0469fab8-c4c2-435c-ae26-513ada0b2849' before making global git config changes
Adding repository directory to the temporary git global config as a safe directory
/usr/bin/git config --global --add safe.directory /__w/tm-pnt-dummy/tm-pnt-dummy
##[debug]0
##[debug]
Removing SSH command configuration
/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
##[debug]1
##[debug]
/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
##[debug]0
##[debug]
Removing HTTP extra header
/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
##[debug]1
##[debug]
/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
##[debug]0
##[debug]
Removing includeIf entries pointing to credentials config files
/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
includeif.gitdir:/__w/tm-pnt-dummy/tm-pnt-dummy/.git.path
includeif.gitdir:/github/workspace/.git.path
##[debug]0
##[debug]includeif.gitdir:/__w/tm-pnt-dummy/tm-pnt-dummy/.git.path
##[debug]includeif.gitdir:/github/workspace/.git.path
##[debug]
/usr/bin/git config --local --get-all includeif.gitdir:/__w/tm-pnt-dummy/tm-pnt-dummy/.git.path
/__w/_temp/git-credentials-08a51a8f-a532-4af2-9653-32c5a0e88715.config
##[debug]0
##[debug]/__w/_temp/git-credentials-08a51a8f-a532-4af2-9653-32c5a0e88715.config
##[debug]
/usr/bin/git config --local --unset includeif.gitdir:/__w/tm-pnt-dummy/tm-pnt-dummy/.git.path /__w/_temp/git-credentials-08a51a8f-a532-4af2-9653-32c5a0e88715.config
##[debug]0
##[debug]
/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git.path
/github/runner_temp/git-credentials-08a51a8f-a532-4af2-9653-32c5a0e88715.config
##[debug]0
##[debug]/github/runner_temp/git-credentials-08a51a8f-a532-4af2-9653-32c5a0e88715.config
##[debug]
/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git.path /github/runner_temp/git-credentials-08a51a8f-a532-4af2-9653-32c5a0e88715.config
##[debug]0
##[debug]
/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
##[debug]0
##[debug]
Removing credentials config '/__w/_temp/git-credentials-08a51a8f-a532-4af2-9653-32c5a0e88715.config'
##[debug]Skipping removal of credentials config '/github/runner_temp/git-credentials-08a51a8f-a532-4af2-9653-32c5a0e88715.config' - not under RUNNER_TEMP
##[debug]Unsetting HOME override
##[debug]execPodStep response: {"metadata":{},"status":"Success"}
##[debug]Copying from job pod 'default-staging-xjndr-runner-hnpxv-workflow' /__w/_temp to /home/runner/_work/_temp
##[debug]Copying from pod default-staging-xjndr-runner-hnpxv-workflow /__w/_temp to /home/runner/_work/_temp
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]internalExecOutput response: {"metadata":{},"status":"Success"}
##[debug]The hash of the directory does not match the expected value; want='31be5782b03b197e2fb8839448edeb9dcc053bed027135014891087f66b55861' got='f729dc2ea97570b3cadc50558e05a8c893054fee2c8c3558f8fd10f639f781c0'
##[debug]Node Action run completed with exit code 0
##[debug]Finished: run
##[debug]Finishing: Post Call action

[vvanouytsel]

The diff between the files in the workflow pod an runner pod is shown below.
The runner pod has 1 extra file named ./git-credentials-aa549f2c-abc1-4b27-b35a-940821f8d8c3.config.

 ❯ diff workflow-pod.txt runner-pod.txt
4c4,5
< 60 ./bde3bddf-9a7f-4aa0-8595-25a63e4dd32d.sh
---
> 142 ./git-credentials-aa549f2c-abc1-4b27-b35a-940821f8d8c3.config
> 41 ./b09d0594-b5c5-4046-a369-184262761ac6.sh
5a7
> 60 ./bde3bddf-9a7f-4aa0-8595-25a63e4dd32d.sh
7,13d8
< 0 ./_runner_file_commands/save_state_f2a3652d-4e48-4689-98db-490b7ecb5a1f
< 0 ./_runner_file_commands/add_path_f2a3652d-4e48-4689-98db-490b7ecb5a1f
< 270 ./_runner_file_commands/set_output_6b533f11-2cb3-4134-a3ed-0a3fb94ca59d
< 0 ./_runner_file_commands/set_output_5ffd77c7-a632-44df-bff1-e52cc8775950
< 0 ./_runner_file_commands/set_env_f2a3652d-4e48-4689-98db-490b7ecb5a1f
< 0 ./_runner_file_commands/add_path_16205159-2fbc-4350-a71c-afefb0158d36
< 0 ./_runner_file_commands/add_path_c0dd864e-31f1-41f4-a9b5-89c538e7a224
15,20c10
< 0 ./_runner_file_commands/set_env_16205159-2fbc-4350-a71c-afefb0158d36
< 0 ./_runner_file_commands/set_output_16205159-2fbc-4350-a71c-afefb0158d36
< 0 ./_runner_file_commands/add_path_5ffd77c7-a632-44df-bff1-e52cc8775950
< 0 ./_runner_file_commands/set_output_c0dd864e-31f1-41f4-a9b5-89c538e7a224
< 0 ./_runner_file_commands/set_env_898669be-3747-4ab3-abc1-7af88a603687
< 0 ./_runner_file_commands/step_summary_898669be-3747-4ab3-abc1-7af88a603687
---
> 0 ./_runner_file_commands/set_env_f2a3652d-4e48-4689-98db-490b7ecb5a1f
21a12,15
> 0 ./_runner_file_commands/step_summary_5ffd77c7-a632-44df-bff1-e52cc8775950
> 0 ./_runner_file_commands/save_state_f2a3652d-4e48-4689-98db-490b7ecb5a1f
> 0 ./_runner_file_commands/add_path_5ffd77c7-a632-44df-bff1-e52cc8775950
> 0 ./_runner_file_commands/set_output_16205159-2fbc-4350-a71c-afefb0158d36
23c17,19
< 0 ./_runner_file_commands/add_path_898669be-3747-4ab3-abc1-7af88a603687
---
> 270 ./_runner_file_commands/set_output_6b533f11-2cb3-4134-a3ed-0a3fb94ca59d
> 0 ./_runner_file_commands/step_summary_898669be-3747-4ab3-abc1-7af88a603687
> 0 ./_runner_file_commands/add_path_c0dd864e-31f1-41f4-a9b5-89c538e7a224
25c21,28
< 0 ./_runner_file_commands/set_env_5ffd77c7-a632-44df-bff1-e52cc8775950
---
> 0 ./_runner_file_commands/set_env_898669be-3747-4ab3-abc1-7af88a603687
> 0 ./_runner_file_commands/set_output_c0dd864e-31f1-41f4-a9b5-89c538e7a224
> 0 ./_runner_file_commands/set_output_898669be-3747-4ab3-abc1-7af88a603687
> 0 ./_runner_file_commands/step_summary_16205159-2fbc-4350-a71c-afefb0158d36
> 0 ./_runner_file_commands/set_env_16205159-2fbc-4350-a71c-afefb0158d36
> 0 ./_runner_file_commands/save_state_898669be-3747-4ab3-abc1-7af88a603687
> 0 ./_runner_file_commands/add_path_f2a3652d-4e48-4689-98db-490b7ecb5a1f
> 0 ./_runner_file_commands/set_output_5ffd77c7-a632-44df-bff1-e52cc8775950
26a30,33
> 0 ./_runner_file_commands/set_env_c0dd864e-31f1-41f4-a9b5-89c538e7a224
> 0 ./_runner_file_commands/set_env_5ffd77c7-a632-44df-bff1-e52cc8775950
> 0 ./_runner_file_commands/save_state_16205159-2fbc-4350-a71c-afefb0158d36
> 0 ./_runner_file_commands/add_path_898669be-3747-4ab3-abc1-7af88a603687
28c35,36
< 0 ./_runner_file_commands/save_state_898669be-3747-4ab3-abc1-7af88a603687
---
> 0 ./_runner_file_commands/step_summary_f2a3652d-4e48-4689-98db-490b7ecb5a1f
> 0 ./_runner_file_commands/add_path_16205159-2fbc-4350-a71c-afefb0158d36
31,37d38
< 0 ./_runner_file_commands/step_summary_5ffd77c7-a632-44df-bff1-e52cc8775950
< 0 ./_runner_file_commands/set_env_c0dd864e-31f1-41f4-a9b5-89c538e7a224
< 0 ./_runner_file_commands/step_summary_f2a3652d-4e48-4689-98db-490b7ecb5a1f
< 0 ./_runner_file_commands/step_summary_16205159-2fbc-4350-a71c-afefb0158d36
< 0 ./_runner_file_commands/save_state_16205159-2fbc-4350-a71c-afefb0158d36
< 0 ./_runner_file_commands/set_output_898669be-3747-4ab3-abc1-7af88a603687
< 41 ./b09d0594-b5c5-4046-a369-184262761ac6.sh