From 4d9a785ec565311a4046fa63800ab9b707ee3226 Mon Sep 17 00:00:00 2001
From: zcode_mulm <zcode_mulm@moneywood.site>
Date: Mon, 31 Aug 2026 21:35:12 +0800
Subject: [PATCH] =?UTF-8?q?fix(digest):=20digest=20=E6=B1=87=E6=80=BB?=
 =?UTF-8?q?=E6=96=87=E4=BB=B6=E6=94=B9=20mktemp=EF=BC=88PLAT-014=20?=
 =?UTF-8?q?=E4=BA=8C=E6=AE=B5=EF=BC=9A=E5=AE=BF=E4=B8=BB=E9=9D=9E=20root?=
 =?UTF-8?q?=20=E6=92=9E=E5=AE=B9=E5=99=A8=20chown=20=E5=90=8E=E7=9A=84=20w?=
 =?UTF-8?q?orkspace=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

run 924 build 红根因：容器 install chown -R node:node workspace → 宿主 digest 步
mkdir -p .tmp-ci EACCES（897 时代 runner 为 root 故绿；治理后必红）。
修法：digest/manifest 暂存文件改宿主 mktemp 目录（runner 自建 tmp 可写），
两处 digest 步（verify/script 路径）同修。合并后打 v5。
---
 .gitea/workflows/reusable/oci-build-push-verify.yml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/reusable/oci-build-push-verify.yml b/.gitea/workflows/reusable/oci-build-push-verify.yml
index 990c7ae..47dbb95 100644
--- a/.gitea/workflows/reusable/oci-build-push-verify.yml
+++ b/.gitea/workflows/reusable/oci-build-push-verify.yml
@@ -193,8 +193,11 @@ jobs:
           set -eu
           IMAGE_TAG="git-${GITHUB_SHA}"
           printf '%s' "${GITHUB_SHA}" | grep -Eq '^[0-9a-f]{40}$'
-          mkdir -p .tmp-ci
-          digest_file=".tmp-ci/digests.txt"
+          # PLAT-014: the containerized install chowns the workspace to the
+          # helper's node user, so a host-side mkdir in $PWD fails with EACCES
+          # on the non-root runner. Keep host-written scratch in mktemp space.
+          digest_dir="$(mktemp -d)"
+          digest_file="$digest_dir/digests.txt"
           : >"$digest_file"
           cache_args=""
           if [ -n "${CACHE_REGISTRY_REF}" ]; then
@@ -248,7 +251,7 @@ jobs:
               --provenance=mode=max \
               --sbom=true \
               --push .
-            manifest_file=".tmp-ci/index-${service}.json"
+            manifest_file="${digest_dir}/index-${service}.json"
             docker buildx imagetools inspect "${image}" --raw >"$manifest_file"
             if [ -n "${VERIFY_COMMAND}" ]; then
               # VERIFY_COMMAND carries its own interpreter (e.g. "node x.mjs"
@@ -284,8 +287,8 @@ jobs:
         run: |
           set -eu
           image_tag="git-${GITHUB_SHA}"
-          digest_file=".tmp-ci/digests-script.txt"
-          mkdir -p .tmp-ci
+          digest_dir="$(mktemp -d)"
+          digest_file="${digest_dir}/digests-script.txt"
           : >"$digest_file"
           while IFS='|' read -r service dockerfile target; do
             [ -n "${service:-}" ] || continue