From 68d18a02123dbc70dc2567dcadfda0ff15123ff4 Mon Sep 17 00:00:00 2001
From: Gabor Demeter <demetergabor94@gmail.com>
Date: Mon, 13 Jul 2026 01:24:17 +0200
Subject: [PATCH] Fix: run SF CI/CD job containers as root (non-root images hit
 EACCES on runner file commands)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/sf-pr-validate.yml | 6 ++++++
 .github/workflows/sf-release.yml     | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/.github/workflows/sf-pr-validate.yml b/.github/workflows/sf-pr-validate.yml
index d6f0a0e..0a49309 100644
--- a/.github/workflows/sf-pr-validate.yml
+++ b/.github/workflows/sf-pr-validate.yml
@@ -28,6 +28,9 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: ${{ inputs.container-image }}
+      # Runner file-command dirs are owned by the host runner user; non-root
+      # container users (e.g. sf-devcontainer's vscode) hit EACCES without this.
+      options: --user root
     permissions:
       contents: read
     steps:
@@ -61,6 +64,9 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: ${{ inputs.container-image }}
+      # Runner file-command dirs are owned by the host runner user; non-root
+      # container users (e.g. sf-devcontainer's vscode) hit EACCES without this.
+      options: --user root
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/sf-release.yml b/.github/workflows/sf-release.yml
index c46166f..0bf27f3 100644
--- a/.github/workflows/sf-release.yml
+++ b/.github/workflows/sf-release.yml
@@ -63,6 +63,9 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: ${{ inputs.container-image }}
+      # Runner file-command dirs are owned by the host runner user; non-root
+      # container users (e.g. sf-devcontainer's vscode) hit EACCES without this.
+      options: --user root
     permissions:
       contents: read
     outputs:
@@ -217,6 +220,9 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: ${{ inputs.container-image }}
+      # Runner file-command dirs are owned by the host runner user; non-root
+      # container users (e.g. sf-devcontainer's vscode) hit EACCES without this.
+      options: --user root
     # The caller's environment gate (required reviewers) pauses this job; GitHub
     # records the deployment automatically for environment-bound jobs.
     environment: