ci: trust the CI workspace for the app's git subprocess + log raw gitInfo

The qa audit's cockpit.gitInfo check stayed red after putting the checkout on a
branch, so the app's `git -C <repo> status` subprocess is returning null in the CI
electron context rather than merely reporting a detached HEAD. Add safe.directory
for the workspace (covers git's "dubious ownership" refusal, which a subprocess can
hit even when the shell step does not) and log the raw gitInfo object on failure so
the exact cause is visible if this still doesn't resolve.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mg6v4fHnr1g2UsVUVv2VDi

Author: writingdeveloper

.github/workflows/ci.yml

@@ -53,7 +53,9 @@ jobs:
       # in detached HEAD (no current branch), so that check would fail for an environment reason unrelated
       # to the app — put the checkout on a real branch first. (Local `npm run qa:audit` is already on one.)
       - name: Put the checkout on a branch for the gitInfo check
-        run: git checkout -B ci-audit
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git checkout -B ci-audit
       - name: Run the audit under a virtual display
         run: xvfb-run -a node qa/audit.mjs
         env:

qa/audit.mjs

@@ -42,10 +42,8 @@ ipc.langRoundTrip = await win.evaluate(async () => {
 // The handler is allowlist-guarded, so register this checkout as an allowed folder first
 // (on CI the checkout lives outside the default ~/Documents/GitHub scan root).
 await win.evaluate(async (p) => window.devdeck.addFolder(p), root);
-ipc.cockpitGitInfo = await win.evaluate(async (p) => {
-  const info = await window.devdeck.cockpit.gitInfo(p);
-  return typeof info?.branch === 'string' && info.branch.length > 0;
-}, root);
+const gitInfoRaw = await win.evaluate(async (p) => (await window.devdeck.cockpit.gitInfo(p)) ?? null, root);
+ipc.cockpitGitInfo = typeof gitInfoRaw?.branch === 'string' && gitInfoRaw.branch.length > 0;
 ipc.usageShape = await win.evaluate(async () => {
   const r = await window.devdeck.usageReport(0);
   return { hasGlobal: !!r.global, hasByProject: Array.isArray(r.byProject), hasByModel: Array.isArray(r.byModel) };
@@ -110,7 +108,7 @@ if (criticalViolations.length > 0 || surfaceFails.length > 0 || titlebarFails.le
   if (criticalViolations.length > 0) console.error('  a11y critical/serious:', JSON.stringify(criticalViolations, null, 2));
   if (surfaceFails.length > 0) console.error('  ipc.surface checks failed:', surfaceFails.map(([k]) => k).join(', '));
   if (titlebarFails.length > 0) console.error('  ipc.titlebar checks failed:', titlebarFails.map(([k]) => k).join(', '));
-  if (gitInfoFail) console.error('  cockpit.gitInfo did not resolve a branch for the repo root:', ipc.cockpitGitInfo);
+  if (gitInfoFail) console.error('  cockpit.gitInfo did not resolve a branch for the repo root:', ipc.cockpitGitInfo, '· raw gitInfo:', JSON.stringify(gitInfoRaw));
   process.exit(1);
 }
 console.log('done');