Fix release builds failing in the containerized smoke job

[michaelneale]

Release dispatches now get past the smoke job again. v0.76.0-rc6 failed 8 seconds into inference_smoke_tests / Skippy Inference Smoke Tests with:

fatal: detected dubious ownership in repository at '/__w/mesh-llm/mesh-llm'
no Cargo.toml manifests found under crates/ or tools/

Cause

#1380 containerized the hosted smoke job (smoke.yml container.image). The image's public stage runs as root while the Actions workspace is mounted owned by the host runner uid, so git refuses every command in it. scripts/release-version.sh:223 enumerates manifests with git ls-files, gets nothing, and the empty-array guard at :229 exits 1.

Every other containerized job that shells out to git already adds git config --global --add safe.directory "$GITHUB_WORKSPACE" — release.yml has 8, native-sdk-artifact.yml and node-sdk-addon-artifact.yml one each. The newly containerized smoke.yml had none.

The step is gated if: inputs.release_tag != '', which is only non-empty on the release lane, so PR and main CI stayed green and could not have caught this.

Change

One step in smoke.yml, before Prepare dispatched release version, gated on job.container.id != '' so the bare-metal gpu-nvidia row is untouched.

Validation

Structural audit of .github/workflows/*.yml: every job that both declares a container image and calls release-version.sh now carries the trust step (11 jobs; smoke.yml smoke_tests was the only one missing it). swift-sdk-artifact.yml calls the script but does not containerize, so it is unaffected.

Runtime proof requires a release dispatch — the next rc6 attempt is the check.

Summary by CodeRabbit

• Bug Fixes
  • Improved container-based release workflows by ensuring the checked-out project is recognized as trusted before version preparation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f7f0e237-f0bc-419d-b1a8-a3ea60a0010b

📥 Commits

Reviewing files that changed from the base of the PR and between 4dcc35e and 4484573.

📒 Files selected for processing (1)

• .github/workflows/smoke.yml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The smoke workflow adds a container-only step that marks $GITHUB_WORKSPACE as a trusted Git directory before release version preparation.

Changes

Container checkout trust

Layer / File(s)	Summary
Trust checkout directory .github/workflows/smoke.yml	When the job runs in a container, the workflow globally configures $GITHUB_WORKSPACE as a Git safe directory before release-version processing.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 44845

This change adds the required repository trust configuration only to the containerized smoke path, allowing release manifest discovery to proceed without affecting bare-metal jobs. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: ndizazzo, i386

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the fix for release builds failing in the containerized smoke job.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/smoke-container-safe-directory

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}