Heal git checkout ownership in all roles cloning repositories on the server

6b4b7647e fixed this for synapse-usage-exporter only. A checkout owned by
a different user makes the git task fail from then on, either with a
permission error or with git's dubious-ownership protection, until
someone removes the directory on the host by hand. It gets into that
state when the matrix user's uid changes (a server migration or a restore
onto a differently numbered user), when an earlier clone ran as another
user, or when someone runs git as root inside the checkout.

Every other role cloning a repository onto the server was open to the
same failure, so ensure the checkout's ownership recursively before
updating it at the remaining 54 sites.

The three matrix-synapse ext clones also gain force=yes. They were the
only on-server clones without it, which left a checkout that an
interrupted run had half-written wedged, instead of repaired on the next
run.

matrix-matrixto used to clone as root into a directory that nothing ever
chowned, unlike every other role. It now becomes the matrix user too.

The Element Web and SchildiChat Web theme checkouts live on the Ansible
controller, where correcting ownership is not ours to do, so they merely
mark the checkout as a safe directory for git.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/custom/matrix-alertmanager-receiver/tasks/install.yml

@@ -53,6 +53,15 @@
 
 - when: matrix_alertmanager_receiver_container_image_self_build | bool
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure matrix-alertmanager-receiver repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_alertmanager_receiver_container_src_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure matrix-alertmanager-receiver repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_alertmanager_receiver_container_image_self_build_repo }}"

roles/custom/matrix-appservice-draupnir-for-all/tasks/setup_install.yml

@@ -35,6 +35,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_appservice_draupnir_for_all_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Draupnir repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_appservice_draupnir_for_all_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_appservice_draupnir_for_all_container_image_self_build | bool"
+
 - name: Ensure Draupnir repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_appservice_draupnir_for_all_container_image_self_build_repo }}"

roles/custom/matrix-authentication-service/tasks/install.yml

@@ -95,6 +95,15 @@
 
 - when: "matrix_authentication_service_container_image_self_build | bool"
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure Matrix Authentication Service repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_authentication_service_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure Matrix Authentication Service repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_authentication_service_container_repo }}"

roles/custom/matrix-bot-baibot/tasks/install.yml

@@ -49,6 +49,15 @@
 
 - when: "matrix_bot_baibot_container_image_self_build | bool"
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure baibot repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_bot_baibot_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure baibot repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_bot_baibot_container_repo }}"

roles/custom/matrix-bot-buscarron/tasks/setup_install.yml

@@ -70,6 +70,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bot_buscarron_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Buscarron repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bot_buscarron_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bot_buscarron_container_image_self_build | bool"
+
 - name: Ensure Buscarron repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bot_buscarron_container_repo }}"

roles/custom/matrix-bot-draupnir/tasks/setup_install.yml

@@ -47,6 +47,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bot_draupnir_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Draupnir repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bot_draupnir_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bot_draupnir_container_image_self_build | bool"
+
 - name: Ensure Draupnir repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bot_draupnir_container_image_self_build_repo }}"

roles/custom/matrix-bot-honoroit/tasks/setup_install.yml

@@ -72,6 +72,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bot_honoroit_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Honoroit repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bot_honoroit_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bot_honoroit_container_image_self_build | bool"
+
 - name: Ensure Honoroit repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bot_honoroit_container_repo }}"

roles/custom/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml

@@ -62,6 +62,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bot_matrix_reminder_bot_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure matrix-reminder-bot repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bot_matrix_reminder_bot_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bot_matrix_reminder_bot_container_image_self_build | bool"
+
 - name: Ensure matrix-reminder-bot repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bot_matrix_reminder_bot_container_repo }}"

roles/custom/matrix-bot-maubot/tasks/setup_install.yml

@@ -48,6 +48,15 @@
 
 - when: matrix_bot_maubot_container_image_self_build | bool
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure maubot repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_bot_maubot_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure maubot repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_bot_maubot_container_repo }}"

roles/custom/matrix-bot-mjolnir/tasks/setup_install.yml

@@ -37,6 +37,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bot_mjolnir_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure mjolnir repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bot_mjolnir_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bot_mjolnir_container_image_self_build | bool"
+
 - name: Ensure mjolnir repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bot_mjolnir_container_image_self_build_repo }}"

roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml

@@ -89,6 +89,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_appservice_irc_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure matrix-appservice-irc repository ownership is correct when self-building
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_appservice_irc_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_appservice_irc_enabled | bool and matrix_bridge_appservice_irc_container_image_self_build | bool"
+
 - name: Ensure matrix-appservice-irc repository is present when self-building
   ansible.builtin.git:
     repo: "{{ matrix_bridge_appservice_irc_container_repo }}"

roles/custom/matrix-bridge-beeper-line/tasks/setup_install.yml

@@ -57,6 +57,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_beeper_line_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Beeper LINE repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_beeper_line_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_beeper_line_container_image_self_build | bool"
+
 - name: Ensure Beeper LINE repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_beeper_line_container_image_self_build_repo }}"

roles/custom/matrix-bridge-beeper-linkedin/tasks/setup_install.yml

@@ -55,6 +55,15 @@
 
 - when: "matrix_bridge_beeper_linkedin_container_image_self_build | bool"
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure Beeper LinkedIn repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_bridge_beeper_linkedin_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure Beeper LinkedIn repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_bridge_beeper_linkedin_container_image_self_build_repo }}"

roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml

@@ -38,6 +38,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_hookshot_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure hookshot repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_hookshot_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_hookshot_container_image_self_build | bool"
+
 - name: Ensure hookshot repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_hookshot_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mautrix-bluesky/tasks/setup_install.yml

@@ -31,6 +31,16 @@
     - {path: "{{ matrix_bridge_mautrix_bluesky_container_src_files_path }}", when: "{{ matrix_bridge_mautrix_bluesky_container_image_self_build }}"}
   when: item.when | bool
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Mautrix Bluesky repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_mautrix_bluesky_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_mautrix_bluesky_enabled | bool and matrix_bridge_mautrix_bluesky_container_image_self_build"
+
 - name: Ensure Mautrix Bluesky repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_mautrix_bluesky_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mautrix-discord/tasks/setup_install.yml

@@ -59,6 +59,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_mautrix_discord_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Mautrix discord repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_mautrix_discord_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_mautrix_discord_container_image_self_build | bool"
+
 - name: Ensure Mautrix discord repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_mautrix_discord_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mautrix-gmessages/tasks/setup_install.yml

@@ -59,6 +59,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_mautrix_gmessages_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Mautrix gmessages repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_mautrix_gmessages_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_mautrix_gmessages_container_image_self_build | bool"
+
 - name: Ensure Mautrix gmessages repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_mautrix_gmessages_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml

@@ -61,6 +61,16 @@
     - {path: "{{ matrix_bridge_mautrix_googlechat_container_src_files_path }}", when: "{{ matrix_bridge_mautrix_googlechat_container_image_self_build }}"}
   when: "item.when | bool"
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Mautrix Hangots repository ownership is correct on self build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_mautrix_googlechat_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_mautrix_googlechat_container_image_self_build | bool"
+
 - name: Ensure Mautrix Hangots repository is present on self build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_mautrix_googlechat_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mautrix-gvoice/tasks/setup_install.yml

@@ -57,6 +57,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_mautrix_gvoice_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Mautrix gvoice repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_mautrix_gvoice_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_mautrix_gvoice_container_image_self_build | bool"
+
 - name: Ensure Mautrix gvoice repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_mautrix_gvoice_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mautrix-linkedin/tasks/setup_install.yml

@@ -57,6 +57,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_mautrix_linkedin_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Mautrix linkedin repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_mautrix_linkedin_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_mautrix_linkedin_container_image_self_build | bool"
+
 - name: Ensure Mautrix linkedin repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_mautrix_linkedin_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml

@@ -58,6 +58,15 @@
 
 - when: matrix_bridge_mautrix_meta_instagram_container_image_self_build | bool
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure mautrix-meta-instagram repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_bridge_mautrix_meta_instagram_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure mautrix-meta-instagram repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_bridge_mautrix_meta_instagram_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml

@@ -58,6 +58,15 @@
 
 - when: matrix_bridge_mautrix_meta_messenger_container_image_self_build | bool
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure mautrix-meta-messenger repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_bridge_mautrix_meta_messenger_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure mautrix-meta-messenger repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_bridge_mautrix_meta_messenger_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mautrix-signal/tasks/setup_install.yml

@@ -64,6 +64,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_mautrix_signal_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Mautrix signal repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_mautrix_signal_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_mautrix_signal_container_image_self_build | bool"
+
 - name: Ensure Mautrix signal repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_mautrix_signal_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mautrix-slack/tasks/setup_install.yml

@@ -58,6 +58,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_mautrix_slack_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Mautrix slack repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_mautrix_slack_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_mautrix_slack_container_image_self_build | bool"
+
 - name: Ensure Mautrix slack repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_mautrix_slack_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml

@@ -103,6 +103,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_mautrix_telegram_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Mautrix Telegram repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_mautrix_telegram_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_mautrix_telegram_container_image_self_build | bool"
+
 - name: Ensure Mautrix Telegram repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_mautrix_telegram_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mautrix-twitter/tasks/setup_install.yml

@@ -37,6 +37,16 @@
     - {path: "{{ matrix_bridge_mautrix_twitter_container_src_files_path }}", when: "{{ matrix_bridge_mautrix_twitter_container_image_self_build }}"}
   when: item.when | bool
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Mautrix Twitter repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_mautrix_twitter_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_mautrix_twitter_enabled | bool and matrix_bridge_mautrix_twitter_container_image_self_build"
+
 - name: Ensure Mautrix Twitter repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_mautrix_twitter_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml

@@ -69,6 +69,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_mautrix_whatsapp_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Mautrix Whatsapp repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_mautrix_whatsapp_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_mautrix_whatsapp_container_image_self_build | bool"
+
 - name: Ensure Mautrix Whatsapp repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_mautrix_whatsapp_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml

@@ -82,6 +82,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_mx_puppet_groupme_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure MX Puppet Groupme repository ownership is correct on self build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_mx_puppet_groupme_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_mx_puppet_groupme_enabled | bool and matrix_bridge_mx_puppet_groupme_container_image_self_build"
+
 - name: Ensure MX Puppet Groupme repository is present on self build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_mx_puppet_groupme_container_image_self_build_repo }}"

roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml

@@ -84,6 +84,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_mx_puppet_steam_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure MX Puppet Steam repository ownership is correct on self build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_mx_puppet_steam_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_mx_puppet_steam_enabled | bool and matrix_bridge_mx_puppet_steam_container_image_self_build"
+
 - name: Ensure MX Puppet Steam repository is present on self build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_mx_puppet_steam_container_image_self_build_repo }}"

roles/custom/matrix-bridge-postmoogle/tasks/setup_install.yml

@@ -88,6 +88,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_bridge_postmoogle_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure postmoogle repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_postmoogle_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_postmoogle_container_image_self_build | bool"
+
 - name: Ensure postmoogle repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_postmoogle_container_repo }}"

roles/custom/matrix-bridge-rustpush/tasks/setup_install.yml

@@ -19,6 +19,16 @@
     - {path: "{{ matrix_bridge_rustpush_container_src_files_path }}", when: "{{ matrix_bridge_rustpush_container_image_self_build }}"}
   when: item.when | bool
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure RustPush repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_rustpush_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_rustpush_enabled | bool and matrix_bridge_rustpush_container_image_self_build"
+
 - name: Ensure RustPush repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_rustpush_container_image_self_build_repo }}"

roles/custom/matrix-bridge-steam/tasks/setup_install.yml

@@ -31,6 +31,16 @@
     - {path: "{{ matrix_bridge_steam_container_src_files_path }}", when: "{{ matrix_bridge_steam_container_image_self_build }}"}
   when: item.when | bool
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Steam bridge repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_bridge_steam_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_bridge_steam_enabled | bool and matrix_bridge_steam_container_image_self_build"
+
 - name: Ensure Steam bridge repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_bridge_steam_container_image_self_build_repo }}"

roles/custom/matrix-bridge-wechat/tasks/install.yml

@@ -32,6 +32,15 @@
 
 - when: matrix_bridge_wechat_container_image_self_build | bool
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure WeChat Bridge repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_bridge_wechat_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure WeChat Bridge repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_bridge_wechat_container_image_self_build_repo }}"
@@ -63,6 +72,15 @@
 
 - when: matrix_bridge_wechat_agent_container_image_self_build | bool
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure WeChat Agent repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_bridge_wechat_agent_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure WeChat Agent repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_bridge_wechat_agent_container_image_self_build_repo }}"

roles/custom/matrix-cactus-comments/tasks/setup_install.yml

@@ -47,6 +47,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_cactus_comments_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure matrix-cactus-comments repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_cactus_comments_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_cactus_comments_container_image_self_build | bool"
+
 - name: Ensure matrix-cactus-comments repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_cactus_comments_container_repo }}"

roles/custom/matrix-client-commet/tasks/setup_install.yml

@@ -40,6 +40,15 @@
       when: not matrix_client_commet_git_config_file_stat.stat.exists
       become: true
 
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure Commet repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_client_commet_container_src_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure Commet repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_client_commet_container_image_self_build_repo }}"

roles/custom/matrix-client-element/tasks/prepare_themes.yml

@@ -15,11 +15,17 @@
   delegate_to: 127.0.0.1
   become: false
   block:
+    # This checkout lives on the Ansible controller, so we cannot correct its ownership like we do for checkouts on the server.
+    # Marking it as a safe directory keeps git's dubious-ownership protection from failing the task when the playbook directory belongs to another user.
     - name: Ensure Element Web themes repository is pulled
       ansible.builtin.git:
         repo: "{{ matrix_client_element_themes_repository_url }}"
         version: "{{ matrix_client_element_themes_repository_version }}"
         dest: "{{ role_path }}/files/scratchpad/themes"
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ role_path }}/files/scratchpad/themes"
 
     - name: Find all Element Web theme files
       ansible.builtin.find:

roles/custom/matrix-client-element/tasks/setup_install.yml

@@ -33,6 +33,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_client_element_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Element Web repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_client_element_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_client_element_container_image_self_build | bool"
+
 - name: Ensure Element Web repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_client_element_container_image_self_build_repo }}"

roles/custom/matrix-client-fluffychat/tasks/setup_install.yml

@@ -29,6 +29,15 @@
 
 - when: "matrix_client_fluffychat_container_image_self_build | bool"
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure FluffyChat Web repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_client_fluffychat_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure FluffyChat Web repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_client_fluffychat_container_image_self_build_repo }}"

roles/custom/matrix-client-schildichat/tasks/prepare_themes.yml

@@ -14,11 +14,17 @@
   delegate_to: 127.0.0.1
   become: false
   block:
+    # This checkout lives on the Ansible controller, so we cannot correct its ownership like we do for checkouts on the server.
+    # Marking it as a safe directory keeps git's dubious-ownership protection from failing the task when the playbook directory belongs to another user.
     - name: Ensure SchildiChat Web themes repository is pulled
       ansible.builtin.git:
         repo: "{{ matrix_client_schildichat_themes_repository_url }}"
         version: "{{ matrix_client_schildichat_themes_repository_version }}"
         dest: "{{ role_path }}/files/scratchpad/themes"
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ role_path }}/files/scratchpad/themes"
 
     - name: Find all SchildiChat Web theme files
       ansible.builtin.find:

roles/custom/matrix-client-schildichat/tasks/setup_install.yml

@@ -32,6 +32,15 @@
 
 - when: "matrix_client_schildichat_container_image_self_build | bool"
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure SchildiChat Web repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_client_schildichat_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure SchildiChat Web repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_client_schildichat_container_image_self_build_repo }}"

roles/custom/matrix-corporal/tasks/setup_install.yml

@@ -24,6 +24,16 @@
     - "{{ matrix_corporal_cache_dir_path }}"
     - "{{ matrix_corporal_var_dir_path }}"
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Matrix Corporal repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_corporal_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: matrix_corporal_container_image_self_build | bool
+
 - name: Ensure Matrix Corporal repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_corporal_container_image_self_build_repo }}"

roles/custom/matrix-dendrite/tasks/setup_install.yml

@@ -91,6 +91,15 @@
 
 - when: "matrix_dendrite_container_image_self_build | bool"
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure Dendrite repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_dendrite_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure Dendrite repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_dendrite_container_image_self_build_repo }}"

roles/custom/matrix-element-admin/tasks/install.yml

@@ -43,6 +43,15 @@
 
 - when: matrix_element_admin_container_image_self_build | bool
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure Element Admin repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_element_admin_container_src_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure Element Admin repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_element_admin_container_image_self_build_repo }}"

roles/custom/matrix-ketesa/tasks/setup_install.yml

@@ -80,6 +80,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_ketesa_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure matrix-ketesa repository ownership is correct when self-building
+  ansible.builtin.file:
+    path: "{{ matrix_ketesa_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: matrix_ketesa_container_image_self_build | bool
+
 - name: Ensure matrix-ketesa repository is present when self-building
   ansible.builtin.git:
     repo: "{{ matrix_ketesa_container_image_self_build_repo }}"

roles/custom/matrix-livekit-jwt-service/tasks/install.yml

@@ -40,6 +40,15 @@
 
 - when: "matrix_livekit_jwt_service_container_image_self_build | bool"
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure LiveKit JWT Service repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_livekit_jwt_service_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure LiveKit JWT Service repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_livekit_jwt_service_container_repo }}"

roles/custom/matrix-matrixto/tasks/install.yml

@@ -26,12 +26,23 @@
     - labels
   register: matrix_matrixto_support_files_result
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Matrix.to repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_matrixto_container_image_self_build_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+
 - name: Ensure Matrix.to repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_matrixto_container_image_self_build_repo }}"
     version: "{{ matrix_matrixto_container_image_self_build_repo_version }}"
     dest: "{{ matrix_matrixto_container_image_self_build_src_files_path }}"
     force: "yes"
+  become: true
+  become_user: "{{ matrix_user_name }}"
   register: matrix_matrixto_git_pull_results
 
 - name: Ensure Matrix.to container image is built

roles/custom/matrix-media-repo/tasks/setup_install.yml

@@ -58,6 +58,15 @@
 
 - when: "matrix_media_repo_container_image_self_build | bool"
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure media-repo repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_media_repo_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure media-repo repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_media_repo_container_image_self_build_repo }}"

roles/custom/matrix-pantalaimon/tasks/install.yml

@@ -37,6 +37,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_pantalaimon_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure pantalaimon repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_pantalaimon_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_pantalaimon_container_image_self_build | bool"
+
 - name: Ensure pantalaimon repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_pantalaimon_container_image_self_build_repo }}"

roles/custom/matrix-rageshake/tasks/install.yml

@@ -51,6 +51,16 @@
   delay: "{{ devture_playbook_help_container_retries_delay }}"
   until: matrix_rageshake_container_image_pull_result is not failed
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure rageshake repository ownership is correct on self-build
+  ansible.builtin.file:
+    path: "{{ matrix_rageshake_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_rageshake_container_image_self_build | bool"
+
 - name: Ensure rageshake repository is present on self-build
   ansible.builtin.git:
     repo: "{{ matrix_rageshake_container_image_self_build_repo }}"

roles/custom/matrix-synapse-auto-compressor/tasks/install.yml

@@ -51,6 +51,15 @@
 
 - when: "matrix_synapse_auto_compressor_container_image_self_build | bool"
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure synapse-auto-compressor repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_synapse_auto_compressor_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
     - name: Ensure synapse-auto-compressor repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_synapse_auto_compressor_container_image_self_build_repo }}"

roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml

@@ -12,11 +12,21 @@
     name: git
     state: present
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure mjolnir-antispam repository ownership is correct
+  ansible.builtin.file:
+    path: "{{ matrix_synapse_ext_path }}/mjolnir"
+    state: directory
+    owner: "{{ matrix_synapse_uid }}"
+    group: "{{ matrix_synapse_gid }}"
+    recurse: true
+
 - name: Clone mjolnir-antispam git repository
   ansible.builtin.git:
     repo: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_git_repository_url }}"
     version: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_git_version }}"
     dest: "{{ matrix_synapse_ext_path }}/mjolnir"
+    force: "yes"
   become: true
   become_user: "{{ matrix_synapse_username }}"
 

roles/custom/matrix-synapse/tasks/ext/synapse-http-antispam/setup_install.yml

@@ -10,11 +10,21 @@
     name: git
     state: present
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure synapse-http-antispam repository ownership is correct
+  ansible.builtin.file:
+    path: "{{ matrix_synapse_ext_path }}/synapse-http-antispam"
+    state: directory
+    owner: "{{ matrix_synapse_uid }}"
+    group: "{{ matrix_synapse_gid }}"
+    recurse: true
+
 - name: Clone synapse-http-antispam git repository
   ansible.builtin.git:
     repo: "{{ matrix_synapse_ext_synapse_http_antispam_git_repository_url }}"
     version: "{{ matrix_synapse_ext_synapse_http_antispam_git_version }}"
     dest: "{{ matrix_synapse_ext_path }}/synapse-http-antispam"
+    force: "yes"
   become: true
   become_user: "{{ matrix_synapse_username }}"
 

roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_install.yml

@@ -19,11 +19,21 @@
     name: git
     state: present
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure synapse-simple-antispam repository ownership is correct
+  ansible.builtin.file:
+    path: "{{ matrix_synapse_ext_path }}/synapse-simple-antispam"
+    state: directory
+    owner: "{{ matrix_synapse_uid }}"
+    group: "{{ matrix_synapse_gid }}"
+    recurse: true
+
 - name: Clone synapse-simple-antispam git repository
   ansible.builtin.git:
     repo: "{{ matrix_synapse_ext_spam_checker_synapse_simple_antispam_git_repository_url }}"
     version: "{{ matrix_synapse_ext_spam_checker_synapse_simple_antispam_git_version }}"
     dest: "{{ matrix_synapse_ext_path }}/synapse-simple-antispam"
+    force: "yes"
   become: true
   become_user: "{{ matrix_synapse_username }}"
 

roles/custom/matrix-synapse/tasks/synapse/setup_install.yml

@@ -35,6 +35,15 @@
 
 - when: "matrix_synapse_container_image_self_build | bool"
   block:
+    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+    - name: Ensure Synapse repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_synapse_container_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_synapse_uid }}"
+        group: "{{ matrix_synapse_gid }}"
+        recurse: true
+
     - name: Ensure Synapse repository is present on self-build
       ansible.builtin.git:
         repo: "{{ matrix_synapse_container_image_self_build_repo }}"

roles/custom/matrix-user-verification-service/tasks/setup_install.yml

@@ -28,6 +28,16 @@
   until: matrix_user_verification_service_container_image_pull_result is not failed
   when: "not matrix_user_verification_service_container_image_self_build | bool"
 
+# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
+- name: Ensure Matrix User Verification Service repository ownership is correct when self-building
+  ansible.builtin.file:
+    path: "{{ matrix_user_verification_service_container_src_files_path }}"
+    state: directory
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+    recurse: true
+  when: "matrix_user_verification_service_container_image_self_build | bool"
+
 - name: Ensure Matrix User Verification Service repository is present when self-building
   ansible.builtin.git:
     repo: "{{ matrix_user_verification_service_container_image_self_build_repo }}"