checkout@v4: remote: git: 'lariat' is not a git command

[leongross]

In the u-root project we use (presumably) the latest version of checkout@v4 in our CI. The CI failed once with the following error:

 remote: git: 'lariat' is not a git command. See 'git --help'.        
  remote: aborting due to possible repository corruption on the remote side.
  Error: fatal: protocol error: bad pack header
  The process '/usr/bin/git' failed with exit code 128
  Waiting 13 seconds before trying again
  /usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --depth=1 origin +fa57918e80ab835d92553a72110f9e56adcd43f1:refs/remotes/pull/3111/merge
  remote: git: 'lariat' is not a git command. See 'git --help'.        
  remote: aborting due to possible repository corruption on the remote side.
  Error: fatal: protocol error: bad pack header
  The process '/usr/bin/git' failed with exit code 128
  Waiting 10 seconds before trying again
  /usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --depth=1 origin +fa57918e80ab835d92553a72110f9e56adcd43f1:refs/remotes/pull/3111/merge
  remote: git: 'lariat' is not a git command. See 'git --help'.        
  remote: aborting due to possible repository corruption on the remote side.
  Error: fatal: protocol error: bad pack header
  Error: The process '/usr/bin/git' failed with exit code 128

After re-running the ci (more precisely git commit --amend --no-edit && git push -f)

[doowb]

I came here because I'm getting the exact same error in a workflow that's triggered by a cron schedule. The run that ran 1 hour earlier was successful using the same git fetch command and sha. Could this be on GitHub's server side?

/edit: just found this: https://www.githubstatus.com/incidents/q3xqwmcxzkqq

[alynn-coefficient]

Appears to be a symptom of this incident: https://www.githubstatus.com/incidents/q3xqwmcxzkqq

[leongross]

The issue seems to be resolved, but it seems as if there was some race condition that should be fixed, so I keep this issue open.

[joshmgross]

👋 This was due to a GitHub status incident and not directly an issue with this action or how it functions.

[leongross]

But can you explain how the command line that was executed was changed? This seems to have the potential to execute arbitrary commands on the runner which in fact could be considered a security risk.

[joshmgross]

@leongross these are commands run on the remote Git server, not on the runner itself.

The status incident has more details

The root cause was traced to a bug in a build script for a component that runs on the file servers that host git repository data. The build script incurred an error that did not cause the overall build process to fail, resulting in a faulty set of artifacts being deployed to production.

https://www.githubstatus.com/incidents/q3xqwmcxzkqq

[Danstiv]

@leongross see also https://github.com/orgs/community/discussions/139743#discussioncomment-10959902

[leongross]

I see, thank you for clarifying.