Run the binding generator container as the invoking user

[cloudsmith-iduffy]

The Update API bindings workflow has failed on every run since it was added (latest run):

removed '.travis.yml'
removed 'git_push.sh'
rm: cannot remove 'test/api_user_test.go': Permission denied
rm: cannot remove 'test/api_vulnerabilities_test.go': Permission denied
...
[generate] ERROR task failed

Cause

bin/generate runs openapitools/openapi-generator-cli as root with the repo bind-mounted at /local. Directories that already exist in the repo (docs/, api/) stay owned by the checkout user, so root-owned files inside them can still be replaced — but test/ is created by the container, so on Linux it lands root-owned. The post-generation rm -rfv test/ runs on the host as the unprivileged runner user, which has no write permission on that directory and therefore cannot unlink its contents.

macOS Docker Desktop maps bind-mount ownership onto the host user regardless of the container uid, which is why this never reproduced for local runs and only broke in CI.

Fix

Pass --user "$(id -u):$(id -g)" so generated files and directories are owned by the invoking user, plus HOME=/tmp since the mapped uid has no home directory in the image.

Verification

• ./bin/generate run locally with the change: generator completes, test/ is removed cleanly, go build ./... passes.
• Generated output is identical to the committed bindings apart from the API version header (1.1288.1 → 1.1321.5) and one maxLength spec change — the change does not affect generation itself.
• Confirmed the image's entrypoint does not re-escalate: id inside the container reports the mapped uid, and files it creates carry that uid.

🤖 Generated with Claude Code

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.