fix(ci): keep buildx cache group-writable across runner users - #3304
Merged
Merged
Conversation
Non-href card variant was mouse-only and its toggle rendered 0x0 with no focus target (WCAG 2.4.7/2.5.8). Replace with a real inner button: visible caret reflecting expanded state, aria-expanded/aria-label, closest() guard on the card click keeps nested interactives on native Enter/Space. Closes #3183
The cache dir is shared by seven runner users, any of which can take any matrix row. The workflow's `umask 002` governs only its own shell; BuildKit writes index.json, oci-layout and blobs from inside its buildkitd container, so those files inherit that container's umask and land group-read-only. The default ACL on /var/buildx-cache is ANDed with it, collapsing the mask to r-- and leaving every runner except the last writer with: ERROR: failed to build: open /var/buildx-cache/<image>/oci-layout: permission denied Re-grant group write at the end of the prune step, which already runs unconditionally on every job (`if: always()`), so the invariant is repaired on the same run that would otherwise poison the next one.
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
This was referenced Sep 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three PRs (#3297, #3298, #3301, #3302) fail on
backend-servicewith:Root cause
/var/buildx-cache/<image>is shared by seven runner users and any of them can take any matrix row. The workflow setsumask 002beforemkdir, but that governs only the workflow's own shell. BuildKit writesindex.json,oci-layoutand the blobs from inside its buildkitd container, under that container's own umask, so the files land group-read-only./var/buildx-cachedoes carry a default ACL (group:github-ci-runner:rwx), but an inherited ACL entry is still ANDed with the creating process's umask. The result ismask::r--:So only the runner that happened to write last can build the next image sharing that cache dir. Measured directly on the homeserver:
Fix
Re-grant group write at the end of
scripts/prune-buildx-cache.sh, which the Containers workflow already runs on every job unconditionally (if: always()). The invariant is repaired on the same run that would otherwise poison the next one, rather than needing a separate repair step.Verification
/var/buildx-cache/backend-service; all four runner users then wrote successfully.