[supervisor] Don't install git msg annotation hook in headless workspaces

[filiptronicek]

Description

Fixes an issue with setting up the supervisor git hook we've seen in catfood, during content init when restoring the prebuild snapshot, clearWorkspace doesn't have enough permissions to clean everything in the git repo:

gitpod/components/content-service/pkg/initializer/prebuild.go

Lines 63 to 89 in 087c38e

	if p.Prebuild != nil {
	var (
	snapshot = p.Prebuild.Snapshot
	location = p.Prebuild.Location
	log = log.WithField("location", p.Prebuild.Location)
	)
	_, s, err := p.Prebuild.Run(ctx, mappings)
	if err == nil {
	stats = append(stats, s...)
	}
	if err != nil {
	log.WithError(err).Warnf("prebuilt init was unable to restore snapshot %s. Resorting the regular Git init", snapshot)
	if err := clearWorkspace(location); err != nil {
	return csapi.WorkspaceInitFromOther, nil, xerrors.Errorf("prebuild initializer: %w", err)
	}
	for _, gi := range p.Git {
	_, s, err := gi.Run(ctx, mappings)
	if err != nil {
	return csapi.WorkspaceInitFromOther, nil, xerrors.Errorf("prebuild initializer: Git fallback: %w", err)
	}
	stats = append(stats, s...)
	}
	}
	}

cannot initialize workspace:

    github.com/gitpod-io/gitpod/content-service/pkg/initializer.InitializeWorkspace

        github.com/gitpod-io/gitpod/[email protected]/pkg/initializer/initializer.go:483

  - prebuild initializer:

    github.com/gitpod-io/gitpod/content-service/pkg/initializer.(*PrebuildInitializer).Run

        github.com/gitpod-io/gitpod/[email protected]/pkg/initializer/prebuild.go:78

  - prebuild initializer:

    github.com/gitpod-io/gitpod/content-service/pkg/initializer.clearWorkspace

        github.com/gitpod-io/gitpod/[email protected]/pkg/initializer/prebuild.go:134

  - unlinkat /dst/gitpod/.git/hooks/prepare-commit-msg: permission denied

This is fixed by:

1. Not installing the hook in prebuilds and image builds
2. Changing the owner of the file from superuser to the gitpod user
3. Delaying the hook install after ContentReady

How to test

• Start a workspace from a prebuild (you can use my org and https://github.com/gitpod-io/gitpod/pull/20545 as context)
• Check that injection is still working

[filiptronicek]

$ cat ../.gitpod/ready | jq .
{
  "source": "from-prebuild",
  "metrics": [
    {
      "type": "snapshot",
      "duration": 45410255492,
      "size": 3573866496
    },
    {
      "type": "prebuild",
      "duration": 46613850069,
      "size": 3573866496
    }
  ]
}

$ git log
commit b97b639eb09a21e743a85185bee80595f36d5212 (HEAD -> gpl/1098-dockerup)
Author: Filip Troníček <[email protected]>
Date:   Mon Jan 27 10:47:42 2025 +0000

    haha
    
    Tool: gitpod/ft-fix-sup599f22970e.preview.gitpod-dev.com

Commits still seem to be annotated

[geropl]

@filiptronicek What about moving the go fun()... into `configureGit()´? Feels that would match the pattern we have going here, and reduces the noise on the outside. 👍

[filiptronicek]

Sounds good, will move it to reduce the LOC we have in the main supervisor func. The reason I put it here at first is to not have to pass the cstate around.

[filiptronicek]

Fixed in 0712aea (#20548)

[geropl]

Hm, wonder whether there is a nicer way to do that... but can't imagine one, besides resorting to a shell and exec.Command etc.
So I guess what we have here is the best solution. 👍

[filiptronicek]

Looks like Claude agrees with me, but it offered to move the chown block so that the two chowns are just besides each other. Made that change in c0de48f (#20548), but if we ever introduce more hooks, we could recursively walk the tree to chown instead of calling os.Chown multiple times explicitly.

[geropl]

Tested and works! ✔️

Started from a prebuild, has the hook in place, with correct permissions.