Switch to a home-rolled commit step because git-cli is not using the ssh credentials attached to the service account.

.webhook_bridge/pipeline-format.yaml

@@ -214,32 +214,34 @@ spec:
           - name: docker-image
             value: "$(tasks.build-image.results.IMAGE_URL[1])"
       - name: commit-changes
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-cli/0.4/git-cli.yaml
-        params:
-          - name: GIT_USER_NAME
-            value: fluxcdbot
-          - name: GIT_USER_EMAIL
-            value: "fluxcdbot@users.noreply.github.com"
-          - name: GIT_SCRIPT
-            value: |
-              pwd
-              git config --global --add safe.directory /workspace/source
-              git_status=$(git status --porcelain)
-              if [ -n "$git_status" ]; then
-                git commit -a -m "CI: autofix rust code."
-                ln -s /tekton/home/.ssh /root/.ssh
-                git push origin HEAD:$(params.PULL_BASE_REF)
-              else
-                echo "No changes to commit."
-              fi
+        taskSpec:
+          metadata: {}
+          stepTemplate:
+            image: alpine:3.20
+            computeResources:
+              requests:
+                cpu: 10m
+                memory: 600Mi
+            workingDir: "$(workspaces.source.path)"
+          steps:
+            - image: alpine/git:v2.34.2
+              name: commit-changes-step
+              script: |
+                #!/usr/bin/env sh
+                set -euo pipefail
+                git config --global user.email "fluxcdbot@users.noreply.github.com"
+                git config --global user.name "fluxcdbot"
+                git config --global --add safe.directory /workspace/source
+                git_status=$(git status --porcelain)
+                if [ -n "$git_status" ]; then
+                  git commit -a -m "CI: autofix rust code."
+                  git push origin HEAD:$(params.PULL_BASE_REF)
+                else
+                  echo "No changes to commit."
+                fi
+              env:
+                - name: "GIT_SSH_COMMAND"
+                  value: "ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
         workspaces:
           - name: source
             workspace: git-source