Run it in a Docker container and give readonly access to the .git folder.

This way the agent can read git logs (this is very useful) but cannot commit directly (I don't see any value in this).