DEVPROD-10373 Reset global git config at the end of every task (#8322)

agent/agent.go

@@ -79,6 +79,7 @@ type Options struct {
 	// SendTaskLogsToGlobalSender indicates whether task logs should also be
 	// sent to the global agent file log.
 	SendTaskLogsToGlobalSender bool
+	HomeDirectory              string
 }
 
 // AddLoggableInfo is a helper to add relevant information about the agent
@@ -883,6 +884,7 @@ func (a *Agent) runTeardownGroupCommands(ctx context.Context, tc *taskContext) {
 			grip.Error(tc.logger.Close())
 		}
 	}()
+	defer a.clearGitConfig(tc)
 
 	teardownGroup, err := tc.getTeardownGroup()
 	if err != nil {
@@ -1237,6 +1239,27 @@ func (a *Agent) killProcs(ctx context.Context, tc *taskContext, ignoreTaskGroupC
 	}
 }
 
+func (a *Agent) clearGitConfig(tc *taskContext) {
+	logger := grip.GetDefaultJournaler()
+	if tc.logger != nil && !tc.logger.Closed() {
+		logger = tc.logger.Execution()
+	}
+
+	logger.Infof("Clearing git config.")
+
+	globalGitConfigPath := filepath.Join(a.opts.HomeDirectory, ".gitconfig")
+	if _, err := os.Stat(globalGitConfigPath); os.IsNotExist(err) {
+		logger.Info("Global git config file does not exist.")
+		return
+	}
+	if err := os.Remove(globalGitConfigPath); err != nil {
+		logger.Error(errors.Wrap(err, "removing global git config file"))
+		return
+	}
+
+	logger.Info("Cleared git config.")
+}
+
 func (a *Agent) shouldKill(tc *taskContext, ignoreTaskGroupCheck bool) bool {
 	// Never kill if the agent is not configured to clean up.
 	if !a.opts.Cleanup {

agent/agent_test.go

@@ -112,6 +112,7 @@ func (s *AgentSuite) SetupTest() {
 			LogOutput:        globals.LogOutputStdout,
 			LogPrefix:        "agent",
 			WorkingDirectory: s.testTmpDirName,
+			HomeDirectory:    s.suiteTmpDirName,
 		},
 		comm:   client.NewMock("url"),
 		tracer: otel.GetTracerProvider().Tracer("noop_tracer"),
@@ -2729,6 +2730,34 @@ tasks:
 	s.Equal(expectedLines, actualLines)
 }
 
+func (s *AgentSuite) TestClearsGitConfig() {
+	s.setupRunTask(defaultProjYml)
+	// create a fake git config file
+	gitConfigPath := filepath.Join(s.a.opts.HomeDirectory, ".gitconfig")
+	gitConfigContents := `
+[user]
+  name = foo bar
+  email = [email protected]
+`
+	err := os.WriteFile(gitConfigPath, []byte(gitConfigContents), 0600)
+	s.Require().NoError(err)
+	s.Require().FileExists(gitConfigPath)
+
+	s.a.runTeardownGroupCommands(s.ctx, s.tc)
+	s.NoError(err)
+
+	s.NoError(s.tc.logger.Close())
+	checkMockLogs(s.T(), s.mockCommunicator, s.tc.taskConfig.Task.Id, []string{
+		"Clearing git config.",
+		"Cleared git config.",
+	}, []string{
+		panicLog,
+		"Running task commands failed",
+	})
+
+	s.Assert().NoFileExists(gitConfigPath)
+}
+
 func (s *AgentSuite) TestShouldRunSetupGroup() {
 	nextTask := &apimodels.NextTaskResponse{
 		TaskGroup: "",

agent/agent_timeout_test.go

@@ -37,11 +37,12 @@ func TestTimeoutSuite(t *testing.T) {
 func (s *TimeoutSuite) SetupTest() {
 	s.a = &Agent{
 		opts: Options{
-			HostID:     "host",
-			HostSecret: "secret",
-			StatusPort: 2286,
-			LogOutput:  globals.LogOutputStdout,
-			LogPrefix:  "agent",
+			HostID:        "host",
+			HostSecret:    "secret",
+			StatusPort:    2286,
+			LogOutput:     globals.LogOutputStdout,
+			LogPrefix:     "agent",
+			HomeDirectory: s.tmpDirName,
 		},
 		comm:   client.NewMock("url"),
 		tracer: otel.GetTracerProvider().Tracer("noop_tracer"),

agent/background_test.go

@@ -35,11 +35,12 @@ func (s *BackgroundSuite) SetupTest() {
 	var err error
 	s.a = &Agent{
 		opts: Options{
-			HostID:     "host",
-			HostSecret: "secret",
-			StatusPort: 2286,
-			LogOutput:  globals.LogOutputStdout,
-			LogPrefix:  "agent",
+			HostID:        "host",
+			HostSecret:    "secret",
+			StatusPort:    2286,
+			LogOutput:     globals.LogOutputStdout,
+			LogPrefix:     "agent",
+			HomeDirectory: s.T().TempDir(),
 		},
 		comm:   client.NewMock("url"),
 		tracer: otel.GetTracerProvider().Tracer("noop_tracer"),

agent/command_test.go

@@ -55,6 +55,7 @@ func (s *CommandSuite) SetupTest() {
 			LogOutput:        globals.LogOutputStdout,
 			LogPrefix:        "agent",
 			WorkingDirectory: s.tmpDirName,
+			HomeDirectory:    s.tmpDirName,
 		},
 		comm:   client.NewMock("url"),
 		tracer: otel.GetTracerProvider().Tracer("noop_tracer"),

agent/directory.go

@@ -178,3 +178,18 @@ func (a *Agent) tryCleanupDirectory(dir string) {
 		}
 	}
 }
+
+// SetHomeDirectory sets the agent's home directory to the user's home directory
+// if it is not already set.
+func (a *Agent) SetHomeDirectory() {
+	if a.opts.HomeDirectory != "" {
+		return
+	}
+
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		grip.Warning(errors.Wrap(err, "getting home directory"))
+		return
+	}
+	a.opts.HomeDirectory = homeDir
+}

agent/logging_test.go

@@ -30,6 +30,7 @@ func TestStartLogging(t *testing.T) {
 			LogOutput:        globals.LogOutputStdout,
 			LogPrefix:        "agent",
 			WorkingDirectory: tmpDirName,
+			HomeDirectory:    tmpDirName,
 		},
 		comm: client.NewMock("url"),
 	}

config.go

@@ -38,7 +38,7 @@ var (
 
 	// Agent version to control agent rollover. The format is the calendar date
 	// (YYYY-MM-DD).
-	AgentVersion = "2024-09-23"
+	AgentVersion = "2024-09-24"
 )
 
 const (

docs/Project-Configuration/Task-Runtime-Behavior.md

@@ -147,6 +147,11 @@ a task group, it will keep the task directory as long as it is running tasks
 in the same task group. Once all the task group tasks have finished, it will
 clean up the task directory.
 
+### Global Git Config Cleanup
+For tasks not in a task group, the global git config will be reset at the end of the 
+task after all commands have finished running. For a tasks in a task group, the reset 
+will occur after the all the tasks in the task group tasks have finished.
+
 ## Task Timeouts
 
 Tasks are not allowed to run forever, so all commands that run for a task are

operations/agent.go

@@ -191,6 +191,7 @@ func Agent() cli.Command {
 				return errors.Wrap(err, "setting up global logger")
 			}
 			agt.SetDefaultLogger(sender)
+			agt.SetHomeDirectory()
 
 			err = agt.Start(ctx)
 			if err != nil {