Skip to content

feat: add user input to not create downloaded files with root owner#309

Merged
andrii-bodnar merged 1 commit intocrowdin:masterfrom
opf:fix-user
Mar 27, 2026
Merged

feat: add user input to not create downloaded files with root owner#309
andrii-bodnar merged 1 commit intocrowdin:masterfrom
opf:fix-user

Conversation

@toy
Copy link
Copy Markdown
Contributor

@toy toy commented Mar 26, 2026

We noticed that downloaded files are created owned by root which created a problem in our workflow, this is caused by action being a docker action and container being run by root.
There doesn't seem to be an option to specify the container user, so this PR introduces user input that accepts either explicit uid:git pair or given value auto will set them to the owner of .git and run the docker script as that user/group.

@toy toy changed the title add user input to not create downloaded files with root owner feat: add user input to not create downloaded files with root owner Mar 26, 2026
@andrii-bodnar
Copy link
Copy Markdown
Member

Hi @toy, thank you for the contribution!
Is this the same case as described in #284?

@toy
Copy link
Copy Markdown
Contributor Author

toy commented Mar 26, 2026

@andrii-bodnar Yes it is, sorry for not checking previous issues here, did it only for the CLI repo before realising that the issue is in the action

@toy
Copy link
Copy Markdown
Contributor Author

toy commented Mar 26, 2026

@andrii-bodnar I assume this solution would be better then #285, as it doesn't change the behaviour if user is not set

Copy link
Copy Markdown
Member

@andrii-bodnar andrii-bodnar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@toy yes, making it configurable and opt-in makes much more sense and safer. The only thing I concerned in the current approach is the possibility to specify explicit ID.

There is a risk that running the whole action under an arbitrary uid:gid may break access to GitHub Actions runner-mounted paths such as $GITHUB_OUTPUT or other internal directories if that user does not match the actual runner/workspace ownership.

Some related reports: runner-images#10915, runner#1282.

The auto feels safer to support than arbitrary IDs. Please let me know what you think.

@andrii-bodnar andrii-bodnar linked an issue Mar 27, 2026 that may be closed by this pull request
@toy
Copy link
Copy Markdown
Contributor Author

toy commented Mar 27, 2026

@andrii-bodnar I think I'm on the side of allowing people to «shoot themselves in the foot» if they want to, but if you foresee support requests, probably better to make it a boolean renaming to something like switch-to-workspace-user

@andrii-bodnar
Copy link
Copy Markdown
Member

@toy it's difficult to foresee whether it will become common issue. Let's release it as it is and observe. It should only be relevant to a very small number of users.

@andrii-bodnar andrii-bodnar merged commit 7ca9c45 into crowdin:master Mar 27, 2026
2 of 3 checks passed
@andrii-bodnar
Copy link
Copy Markdown
Member

Available in v2.16.0 (as well as in the v2 alias)

@toy toy deleted the fix-user branch March 27, 2026 14:10
@toy
Copy link
Copy Markdown
Contributor Author

toy commented Mar 27, 2026

thank you

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Run action as non root user

2 participants