Skip to content

Safe Outputs is failing to use create_pull_request GitHub MCP tool. #39876

@MatthewBunker

Description

@MatthewBunker

The create_pull_request tool repeatedly failed with a git safe.directory ownership error:

"Failed to pin branch 'fix/security-remix-router-cve-2025-xss' before bundle generation: fatal: detected dubious ownership in repository at '/home/runner/work/...".

Two recovery approaches were attempted:
(1) adding the specific repo path to safe.directory in ~/.gitconfig
(2) adding safe.directory=* (wildcard) to ~/.gitconfig.

Both failed — the safeoutputs bundle service runs as a different user context that does not pick up the runner's gitconfig.

The changes are committed to local branch 'fix/security-remix-router-cve-2025-xss' (react-router-dom 6.29.0→6.30.4, @remix-run/router 1.22.0→1.23.3) but could not be pushed as a PR.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions