From b9bcf758042757e92fd764f3bdf438c25bccaece Mon Sep 17 00:00:00 2001 From: Ian Duffy Date: Thu, 30 Jul 2026 22:27:27 +0100 Subject: [PATCH] Run the generator container as the invoking user The openapi-generator container ran as root, so any directory it created inside the bind-mounted repo (notably test/) was root-owned. The post-generation cleanup runs on the host as an unprivileged user and cannot unlink files in a root-owned directory, so `rm -rfv test/` failed with "Permission denied" and the Update API bindings workflow has failed on every run since it was added. macOS Docker Desktop maps bind-mount ownership to the host user, which is why this only ever broke on Linux/CI. Passing --user keeps generated files owned by the invoking user. HOME is pointed at /tmp since the mapped user has no home directory in the image. Co-Authored-By: Claude Opus 5 (1M context) --- bin/generate | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/bin/generate b/bin/generate index 0428e7eb..329d77d8 100755 --- a/bin/generate +++ b/bin/generate @@ -31,7 +31,12 @@ API_VERSION="$(api_version)" SWAGGER_SPEC="$(swagger_spec "$API_VERSION")" DOCKER_IMAGE="$(docker build -q .)" +# Run as the invoking user so generated files and directories (e.g. test/) are +# owned by us and can be cleaned up afterwards. Without this the container runs +# as root and the post-generation cleanup fails on Linux/CI runners. docker run --rm \ + --user "$(id -u):$(id -g)" \ + -e HOME=/tmp \ -e PKG_VERSION="$PKG_VERSION" \ -e GO_POST_PROCESS_FILE="gofmt -w" \ -v "$SWAGGER_SPEC":/tmp/swagger_spec \