# Git "detected dubious ownership" - Add safe.directory in CI

> Configure Git safe.directory in CI for "fatal: detected dubious ownership in repository" - add the workspace as a safe directory when it is owned by a different user.

Source: https://latchkey.dev/learn/git/git-safe-directory-dubious-ownership  
Updated: 2026-06-25

When a checkout is owned by a different user than the one running Git, Git blocks it and tells you to add a `safe.directory` exception. This page is the focused recipe for setting that config correctly in CI.

## Diagnose it: depth, refs, or credentials?

CI checkouts are shallow and detached by default, which breaks anything that needs history or a branch name. Before treating it as a credential problem, confirm what the runner actually fetched.

```.github/workflows/ci.yml
- run: |
    git rev-parse --is-shallow-repository
    git rev-parse --abbrev-ref HEAD      # prints HEAD when detached
    git log --oneline -3
    git remote -v
    git for-each-ref --format="%(refname)" | head
```

> `actions/checkout` fetches depth 1 and leaves you on a detached HEAD. Anything diffing against a base ref, reading the branch name, or running `git describe` needs `fetch-depth: 0` and usually an explicit ref.

## The checkout options that fix most of this

```.github/workflows/ci.yml
- uses: actions/checkout@v4
  with:
    fetch-depth: 0        # full history: diffs, tags, git describe
    submodules: recursive # submodules are NOT fetched by default
    persist-credentials: false  # if a later step pushes with its own token
```

## FAQ

### What causes Git "detected dubious ownership"?

There are 2 common causes: checkout uid differs from the git process uid and restored cache/artifact owned by another user. A container step running as root over a workspace checked out by the runner user triggers Git’s ownership safety check.

### How do I fix Git "detected dubious ownership"?

There are 3 fixes depending on which cause you have: add the specific path as a safe directory, trust the workspace on an isolated runner, and set it via env for container steps. Work through them in order, since the first is the most common.

### What does Git "detected dubious ownership" actually mean?

Git refuses to operate on the checkout and prints the safe.directory instruction.

### How do I stop Git "detected dubious ownership" happening again?

Keep the checkout owner and the Git process user consistent. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt