From 74b30bbf750417121f3b0c26017d2f011a2a8286 Mon Sep 17 00:00:00 2001
From: Cole Speelman <crspeelman@gmail.com>
Date: Fri, 9 Oct 2026 18:47:58 -0400
Subject: [PATCH] Prepare repository workspace for unprivileged Gitea checkout

---
 .gitea/workflows/linux.yml     | 2 +-
 SHIPMENT.md                    | 4 +++-
 scripts/gitea-linux.Dockerfile | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/linux.yml b/.gitea/workflows/linux.yml
index 49d35b0..5c72148 100644
--- a/.gitea/workflows/linux.yml
+++ b/.gitea/workflows/linux.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: himesan-node24
     timeout-minutes: 20
     container:
-      image: sha256:514512270649a85769c2b8ecfcc3a860d3a7da67c29b9b7b1cfe4c75de41d322
+      image: sha256:271ca1d26057c95a6fd30df7ccc0c053ab394c0e81cd1e4efa182b5b0b60ee97
       options: >-
         --user 65532:65532
         --tmpfs /tmp/sized-mount-test:rw,nosuid,nodev,noexec,size=16m,uid=65532,gid=65532,mode=0700
diff --git a/SHIPMENT.md b/SHIPMENT.md
index 450d073..6dafe0c 100644
--- a/SHIPMENT.md
+++ b/SHIPMENT.md
@@ -41,7 +41,9 @@ ssh cliff-mads 'docker image inspect local/gamertan-ci:sized-rust188 --format "{
 ```
 
 Review and update the workflow's image ID after an intentional rebuild; images
-stay local to the runner host. No runner labels, global isolation settings or
+stay local to the runner host. The image pre-owns `/workspace/gamertan/sized`
+for UID 65532 so the runner's workspace setup permits unprivileged checkout.
+No runner labels, global isolation settings or
 publishing credentials are required. Repository Actions must be enabled.
 Only owner-triggered, same-repository code runs on this shared homelab runner.
 Source changes on main/the review branch and PRs to main trigger checks;
diff --git a/scripts/gitea-linux.Dockerfile b/scripts/gitea-linux.Dockerfile
index 26572b9..b0f95ac 100644
--- a/scripts/gitea-linux.Dockerfile
+++ b/scripts/gitea-linux.Dockerfile
@@ -5,6 +5,6 @@ RUN rustup component add rustfmt clippy
 COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
 # A new runner workspace volume inherits this ownership. No setuid step or
 # Docker socket is needed in jobs, even with all capabilities dropped.
-RUN mkdir -p /workspace && chown 65532:65532 /workspace
+RUN mkdir -p /workspace/gamertan/sized && chown -R 65532:65532 /workspace
 USER 65532:65532
 WORKDIR /workspace