(plc4x) branch develop updated: chore: Made the scripts in Docker run under the current user's id.

[cd...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

chrisdutz pushed a commit to branch develop
in repository https://gitbox.apache.org/repos/asf/plc4x.git


The following commit(s) were added to refs/heads/develop by this push:
     new cc39e0a995 chore: Made the scripts in Docker run under the current user's id.
cc39e0a995 is described below

commit cc39e0a99586f37e72ff36928fb0967e482fbd47
Author: Christofer Dutz <ch...@c-ware.de>
AuthorDate: Sun Sep 20 18:40:38 2026 +0200

    chore: Made the scripts in Docker run under the current user's id.
---
 Dockerfile                               |  5 +++++
 tools/docker-compose.yaml                | 11 +++++++++++
 tools/release-0-update-generated-code.sh |  8 ++++++++
 tools/release-1-create-branch.sh         |  8 ++++++++
 tools/release-abort.sh                   |  8 ++++++++
 tools/release-common.sh                  | 22 +++++++++++++++++++---
 6 files changed, 59 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 461384a246..fa54cb1a60 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -48,5 +48,10 @@ RUN pip3 install wheel
 # Required for running on Windows systems
 RUN apt install -y dos2unix
 
+# The checkout is bind-mounted at "/ws" and the release scripts can run this image as the
+# calling user, so git needs an exception for it. It has to live in the system config: a
+# "--global" one lands in "/root/.gitconfig", which that user never reads.
+RUN git config --system --add safe.directory /ws
+
 # Change the working directory (where commands are executed) into the new "ws" directory
 WORKDIR /ws
\ No newline at end of file
diff --git a/tools/docker-compose.yaml b/tools/docker-compose.yaml
index 7e987cc264..c8cccb5062 100644
--- a/tools/docker-compose.yaml
+++ b/tools/docker-compose.yaml
@@ -24,6 +24,17 @@ services:
       dockerfile: ./Dockerfile
     # Builds all modules and uses an alternate maven local repo and deploys artifacts to a local directory.
     command: ["/ws/mvnw", "-e", "-Dskip-pgp-signing=true", "-P", "with-c,with-dotnet,with-go,with-java,with-python,enable-all-checks,apache-release", "-Dmaven.repo.local=/ws/out/.repository", "-DaltDeploymentRepository=snapshot-repo::file:/ws/out/.local-snapshots-dir", "clean", "deploy"]
+    # The build writes into the bind mount below. Running as root, everything it creates - "out",
+    # every "target", the commits the release plugin makes - stays owned by root once the container
+    # is gone. That only hurts on Linux: Docker Desktop on macOS and Windows remaps the ownership to
+    # the calling user anyway. The release scripts export RELEASE_UID/RELEASE_GID on Linux, and the
+    # "0:0" default below keeps the previous behaviour everywhere else.
+    user: "${RELEASE_UID:-0}:${RELEASE_GID:-0}"
+    environment:
+      # That uid has no entry in the image's "/etc/passwd", so HOME would fall back to "/", which is
+      # not writable - and "mvnw" unpacks Maven below HOME. Inside the mount it is writable for the
+      # same user and survives between runs.
+      - HOME=/ws/out/home
     volumes:
       # Bind the local directory as "/ws"
       - type: bind
diff --git a/tools/release-0-update-generated-code.sh b/tools/release-0-update-generated-code.sh
index e7f858e789..3d310b1d87 100755
--- a/tools/release-0-update-generated-code.sh
+++ b/tools/release-0-update-generated-code.sh
@@ -20,6 +20,14 @@
 # ----------------------------------------------------------------------------
 
 DIRECTORY="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# Values shared with the other release scripts (Nexus staging profile, dist.apache.org URLs) and the
+# ownership settings for the docker builds.
+if [[ ! -f "$DIRECTORY/tools/release-common.sh" ]]; then
+    echo "❌ '$DIRECTORY/tools/release-common.sh' not found, aborting."
+    exit 1
+fi
+# shellcheck source=release-common.sh
+source "$DIRECTORY/tools/release-common.sh"
 
 ########################################################################################################################
 # 0. Check Docker Memory Availability
diff --git a/tools/release-1-create-branch.sh b/tools/release-1-create-branch.sh
index abd9ed288e..0040f8a789 100755
--- a/tools/release-1-create-branch.sh
+++ b/tools/release-1-create-branch.sh
@@ -20,6 +20,14 @@
 # ----------------------------------------------------------------------------
 
 DIRECTORY="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# Values shared with the other release scripts (Nexus staging profile, dist.apache.org URLs) and the
+# ownership settings for the docker builds.
+if [[ ! -f "$DIRECTORY/tools/release-common.sh" ]]; then
+    echo "❌ '$DIRECTORY/tools/release-common.sh' not found, aborting."
+    exit 1
+fi
+# shellcheck source=release-common.sh
+source "$DIRECTORY/tools/release-common.sh"
 
 # BSD and GNU sed disagree about "-i": BSD wants a backup suffix as a separate argument, GNU
 # treats that argument as the expression. Editing through a temporary file works on both, and
diff --git a/tools/release-abort.sh b/tools/release-abort.sh
index 306f667772..47be2b693d 100755
--- a/tools/release-abort.sh
+++ b/tools/release-abort.sh
@@ -24,6 +24,14 @@
 # deleted files from the PARENT of the checkout - and that is where the plc4x-build-tools and
 # plc4x-extras checkouts usually live - whenever the script was not started from "tools".
 DIRECTORY="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# Values shared with the other release scripts (Nexus staging profile, dist.apache.org URLs) and the
+# ownership settings for the docker builds.
+if [[ ! -f "$DIRECTORY/tools/release-common.sh" ]]; then
+    echo "❌ '$DIRECTORY/tools/release-common.sh' not found, aborting."
+    exit 1
+fi
+# shellcheck source=release-common.sh
+source "$DIRECTORY/tools/release-common.sh"
 
 ########################################################################################################################
 # 1. Work out what to roll the versions back to
diff --git a/tools/release-common.sh b/tools/release-common.sh
index 6a9c7b149e..51694bf79b 100644
--- a/tools/release-common.sh
+++ b/tools/release-common.sh
@@ -19,9 +19,9 @@
 # shellcheck shell=bash
 # shellcheck disable=SC2034  # these are consumed by the scripts that source this file
 
-# Values that more than one of the release scripts has to agree on. Sourced by
-# "release-2-prepare-release.sh", "release-3-finish-release.sh" and "validate-release.sh" - it is
-# not meant to be executed.
+# Values that more than one of the release scripts has to agree on, and the ownership settings
+# every script that starts the releaser container needs. Sourced by all of the "release-*"
+# scripts and by "validate-release.sh" - it is not meant to be executed.
 
 # The Nexus staging profile of "org.apache.plc4x". If deploying to Nexus starts failing with
 # "404 not found", this is the first thing to check: log in to $NEXUS_URL, open "Staging Profiles",
@@ -44,3 +44,19 @@ DIST_BASE="https://dist.apache.org/repos/dist"
 DIST_DEV="$DIST_BASE/dev/plc4x"
 DIST_RELEASE="$DIST_BASE/release/plc4x"
 KEYS_URL="$DIST_RELEASE/KEYS"
+
+# The docker-compose file runs the releaser container as "$RELEASE_UID:$RELEASE_GID", defaulting to
+# "0:0". Only Linux needs the override: there the bind-mounted checkout keeps the uid the container
+# used, so a build as root leaves an "out" directory, "target" directories and release commits that
+# the user running these scripts can no longer delete. Docker Desktop on macOS and Windows remaps
+# the ownership by itself, so the default is left alone there.
+if [[ "$(uname)" == "Linux" ]]; then
+  RELEASE_UID="$(id -u)"
+  RELEASE_GID="$(id -g)"
+  export RELEASE_UID RELEASE_GID
+fi
+
+# HOME for the container, see the docker-compose file. Created here because the container may not be
+# able to create it itself: the mount root belongs to the user, but a missing directory would have to
+# be created by whoever runs the build.
+mkdir -p "$DIRECTORY/out/home"