File permissions in repo change on build machines

When our repo is cloned by the build servers some of the files have permissions changes that appear as changes on git status. Since our build inspects the state of the git repo to assign a buildstamp, all our builds on render are marked “dirty” because the repo has changes.

Specifically, some files ending in .sh are shown as changing from 644 → 755.

What changes does render apply to our repo before building and how can we prevent that?