Fix permission fix for dotfiles directory

playbook.yml

@@ -834,8 +834,17 @@
 
     - name: fix permissions for dotfiles directory
       shell: |
-        chown --changes --recursive dotfiles:dotfiles /var/lib/dotfiles
-        chmod --changes --recursive g+wX /var/lib/dotfiles
+        # There is no sane way to specify the global .gitconfig to use, so we
+        # actually have to override HOME so git looks into ~/.gitconfig
+        export HOME="$(mktemp -d)"
+        set -o pipefail
+        set -o errexit
+        cd /var/lib/dotfiles
+        git config --global --add safe.directory /var/lib/dotfiles
+        git ls-tree -z --name-only HEAD | xargs --null chown --changes --recursive dotfiles:dotfiles
+        git ls-tree -z --name-only HEAD | xargs --null chmod --changes --recursive g+wX /var/lib/dotfiles
+      args:
+        executable: /bin/bash
       register: dotfiles_permission_change
       become: true
       become_user: root