(plc4x-extras) 03/03: chore: Made the scripts in Docker run under the current user's id.

[cd...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

chrisdutz pushed a commit to branch rel/1.0
in repository https://gitbox.apache.org/repos/asf/plc4x-extras.git

commit 9015dba97f72a354cf9516e08dcc68377a652937
Author: Christofer Dutz <ch...@c-ware.de>
AuthorDate: Sun Sep 20 18:19:24 2026 +0200

    chore: Made the scripts in Docker run under the current user's id.
---
 tools/Dockerfile                 |  5 ++++-
 tools/docker-compose.yaml        | 11 +++++++++++
 tools/release-0-build.sh         |  8 ++++++++
 tools/release-1-create-branch.sh |  8 ++++++++
 tools/release-abort.sh           |  8 ++++++++
 tools/release-common.sh          | 22 +++++++++++++++++++---
 6 files changed, 58 insertions(+), 4 deletions(-)

diff --git a/tools/Dockerfile b/tools/Dockerfile
index 191e917f..d4496438 100644
--- a/tools/Dockerfile
+++ b/tools/Dockerfile
@@ -34,7 +34,10 @@ RUN apt install -y build-essential
 # Required for running on Windows systems
 RUN apt install -y dos2unix
 
-RUN git config --global --add safe.directory /ws
+# The release scripts can run this image as the calling user, so the exception for the
+# bind-mounted checkout has to live in the system config: a "--global" one lands in
+# "/root/.gitconfig", which that user never reads, and git then refuses to touch "/ws".
+RUN git config --system --add safe.directory /ws
 
 # Change the working directory (where commands are executed) into the new "ws" directory
 WORKDIR /ws
\ No newline at end of file
diff --git a/tools/docker-compose.yaml b/tools/docker-compose.yaml
index a5b7273b..455de288 100644
--- a/tools/docker-compose.yaml
+++ b/tools/docker-compose.yaml
@@ -24,6 +24,17 @@ services:
       dockerfile: ./tools/Dockerfile
     # Builds all modules and uses an alternate maven local repo and deploys artifacts to a local directory.
     command: ["/ws/mvnw", "-e", "-Dskip-pgp-signing=true", "-P", "with-c,with-go,with-java,apache-release", "-Dmaven.repo.local=/ws/out/.repository", "-DaltDeploymentRepository=snapshot-repo::file:/ws/out/.local-snapshots-dir", "clean", "deploy"]
+    # The build writes into the bind mount below. Running as root, everything it creates - "out",
+    # every "target", the commits the release plugin makes - stays owned by root once the container
+    # is gone. That only hurts on Linux: Docker Desktop on macOS and Windows remaps the ownership to
+    # the calling user anyway. The release scripts export RELEASE_UID/RELEASE_GID on Linux, and the
+    # "0:0" default below keeps the previous behaviour everywhere else.
+    user: "${RELEASE_UID:-0}:${RELEASE_GID:-0}"
+    environment:
+      # That uid has no entry in the image's "/etc/passwd", so HOME would fall back to "/", which is
+      # not writable - and "mvnw" unpacks Maven below HOME. Inside the mount it is writable for the
+      # same user and survives between runs.
+      - HOME=/ws/out/home
     volumes:
       # Bind the local directory as "/ws"
       - type: bind
diff --git a/tools/release-0-build.sh b/tools/release-0-build.sh
index 2f9235ff..bb83571b 100755
--- a/tools/release-0-build.sh
+++ b/tools/release-0-build.sh
@@ -20,6 +20,14 @@
 # ----------------------------------------------------------------------------
 
 DIRECTORY="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# Values shared with the other release scripts (Nexus staging profile, dist.apache.org URLs) and the
+# ownership settings for the docker builds.
+if [[ ! -f "$DIRECTORY/tools/release-common.sh" ]]; then
+    echo "❌ '$DIRECTORY/tools/release-common.sh' not found, aborting."
+    exit 1
+fi
+# shellcheck source=release-common.sh
+source "$DIRECTORY/tools/release-common.sh"
 
 ########################################################################################################################
 # 0. Check Docker Memory Availability
diff --git a/tools/release-1-create-branch.sh b/tools/release-1-create-branch.sh
index 59b03886..0d9d5fb5 100755
--- a/tools/release-1-create-branch.sh
+++ b/tools/release-1-create-branch.sh
@@ -20,6 +20,14 @@
 # ----------------------------------------------------------------------------
 
 DIRECTORY="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# Values shared with the other release scripts (Nexus staging profile, dist.apache.org URLs) and the
+# ownership settings for the docker builds.
+if [[ ! -f "$DIRECTORY/tools/release-common.sh" ]]; then
+    echo "❌ '$DIRECTORY/tools/release-common.sh' not found, aborting."
+    exit 1
+fi
+# shellcheck source=release-common.sh
+source "$DIRECTORY/tools/release-common.sh"
 
 
 # BSD and GNU sed disagree about "-i": BSD wants a backup suffix as a separate argument, GNU
diff --git a/tools/release-abort.sh b/tools/release-abort.sh
index 25101770..157f8b7a 100755
--- a/tools/release-abort.sh
+++ b/tools/release-abort.sh
@@ -24,6 +24,14 @@
 # deleted files from the PARENT of the checkout - and that is where the plc4x-build-tools and
 # plc4x-extras checkouts usually live - whenever the script was not started from "tools".
 DIRECTORY="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# Values shared with the other release scripts (Nexus staging profile, dist.apache.org URLs) and the
+# ownership settings for the docker builds.
+if [[ ! -f "$DIRECTORY/tools/release-common.sh" ]]; then
+    echo "❌ '$DIRECTORY/tools/release-common.sh' not found, aborting."
+    exit 1
+fi
+# shellcheck source=release-common.sh
+source "$DIRECTORY/tools/release-common.sh"
 
 ########################################################################################################################
 # 1. Work out what to roll the versions back to
diff --git a/tools/release-common.sh b/tools/release-common.sh
index 490b733c..0ae6624b 100644
--- a/tools/release-common.sh
+++ b/tools/release-common.sh
@@ -19,9 +19,9 @@
 # shellcheck shell=bash
 # shellcheck disable=SC2034  # these are consumed by the scripts that source this file
 
-# Values that more than one of the release scripts has to agree on. Sourced by
-# "release-2-prepare-release.sh", "release-3-finish-release.sh" and "validate-release.sh" - it is
-# not meant to be executed.
+# Values that more than one of the release scripts has to agree on, and the ownership settings
+# every script that starts the releaser container needs. Sourced by all of the "release-*"
+# scripts and by "validate-release.sh" - it is not meant to be executed.
 
 # The Nexus staging profile of "org.apache.plc4x". If deploying to Nexus starts failing with
 # "404 not found", this is the first thing to check: log in to $NEXUS_URL, open "Staging Profiles",
@@ -44,3 +44,19 @@ DIST_BASE="https://dist.apache.org/repos/dist"
 DIST_DEV="$DIST_BASE/dev/plc4x/plc4x-extras"
 DIST_RELEASE="$DIST_BASE/release/plc4x/plc4x-extras"
 KEYS_URL="$DIST_BASE/release/plc4x/KEYS"
+
+# The docker-compose file runs the releaser container as "$RELEASE_UID:$RELEASE_GID", defaulting to
+# "0:0". Only Linux needs the override: there the bind-mounted checkout keeps the uid the container
+# used, so a build as root leaves an "out" directory, "target" directories and release commits that
+# the user running these scripts can no longer delete. Docker Desktop on macOS and Windows remaps
+# the ownership by itself, so the default is left alone there.
+if [[ "$(uname)" == "Linux" ]]; then
+  RELEASE_UID="$(id -u)"
+  RELEASE_GID="$(id -g)"
+  export RELEASE_UID RELEASE_GID
+fi
+
+# HOME for the container, see the docker-compose file. Created here because the container may not be
+# able to create it itself: the mount root belongs to the user, but a missing directory would have to
+# be created by whoever runs the build.
+mkdir -p "$DIRECTORY/out/home"