fix: adjust file permissions in case the symfony dev server is starte…

[philipreinken]

…d as root

---

We've got failing builds due to permission errros like this one:

"errors": [
    {
      "status": "400",
      "code": "THEME__COMPILING_ERROR",
      "title": "Bad Request",
      "meta": {
        "parameters": {
          "themeName": "Storefront",
          "message": "Unable to set visibility for file theme-variables.scss. chmod(): Operation not permitted"
        }
      },
      "trace": [
...

I think this is due to the symfony dev server dropping privileges automatically when being run as root: https://github.com/symfony-cli/symfony-cli/blob/main/local/php/fpm.go#L41-L51

This PR adds similar logic to our workflow to set the file permissions accordingly.

[shyim]

why is the image running as root?

[philipreinken]

why is the image running as root?

We've just been using the defaults of the catthehacker/ubuntu image. Thanks for the hint, I think we could circumvent it as well by providing the corresponding options to the container config. I'll try that out.

[philipreinken]

The shivammathur/setup-php action requires root privileges to interact with apt and install various packages. So I don't see an easy way around it at the moment 🤔

[shyim]

isn't it just calling sudo?

[philipreinken]

isn't it just calling sudo?

Yes, it can do that - but the image needs to support that. The base image (catthehacker/ubuntu) we use on our self-hosted runners doesn't as far as I can tell:

sudo /bin/true

:~$ docker run --rm -it -u www-data:www-data ghcr.io/catthehacker/ubuntu:act-latest sudo true
[sudo] password for www-data: 
sudo: a password is required

[philipreinken]

As it turns out, the base image we're using is in fact not the one closest to the default GHA runner config. Instead this one is, since it's using a non-root user already, like the default runners are.

I'll try swapping out the base image and check how it affects test pipelines. Locally it seems to work out nicely.

If that works, we don't need to change anything else, the specific problem I tried to solve here should be gone then.

[philipreinken]

It seems fine, so let's update the base image instead. I'll close this PR.