From 6692fdb183b3efe24222996c09b0318dae14a1f0 Mon Sep 17 00:00:00 2001
From: Ian Duffy <iduffy@cloudsmith.io>
Date: Thu, 30 Jul 2026 22:28:07 +0100
Subject: [PATCH] fix: run swagger-codegen as the invoking user and stop
 masking build failures

The scheduled "Update API bindings" workflow failed with exit code 127.

Two separate defects combined to produce that:

1. Codegen output was root-owned. `docker container run` writes into the
   bind-mounted `bindings/<lang>/src` directory as root, so on Linux the
   generated files end up owned by root. `scripts/fix-ruby-escaping.sh` uses
   `ruby -i` (in-place edit), which must unlink the original file and therefore
   needs write permission on the containing directory. That unlink failed with
   "Can't remove ...: Permission denied, skipping file", the apostrophe fix was
   silently skipped, and the following `ruby -c` reported the expected syntax
   error. The same wall would have been hit by the `uvx ruff check --fix` pass.
   This never reproduced locally because macOS bind mounts map container-root
   writes back to the host user.

   Fixed by running the codegen container as the invoking user.

2. The real error was then masked. `scripts/build.sh` dispatched languages via
   `test -z "$language" && { for ...; } || { build_language $language; }`. When
   a per-language build failed, the loop returned non-zero and the `||` branch
   ran with an empty `$language`, invoking `bindings//build.sh` and replacing
   the genuine exit status with 127.

   Fixed by using a plain if/else so a failing language build propagates.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 bindings/java/build.sh   | 2 +-
 bindings/python/build.sh | 2 +-
 bindings/ruby/build.sh   | 2 +-
 scripts/build.sh         | 6 +++---
 scripts/common.sh        | 6 ++++++
 5 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/bindings/java/build.sh b/bindings/java/build.sh
index 684c4943..371e7327 100755
--- a/bindings/java/build.sh
+++ b/bindings/java/build.sh
@@ -45,7 +45,7 @@ cat > $build_json <<EOC
 }
 EOC
 
-docker container run --rm -v $self_dir:/local "${swagger_codegen_cli_image:?}" generate \
+docker container run --rm --user "${codegen_run_user:?}" -v $self_dir:/local "${swagger_codegen_cli_image:?}" generate \
     --type-mappings Integer=java.math.BigInteger \
     -c /local/src/build.json \
     -i $openapi_url \
diff --git a/bindings/python/build.sh b/bindings/python/build.sh
index 0a4f4325..2eb8ba07 100755
--- a/bindings/python/build.sh
+++ b/bindings/python/build.sh
@@ -24,7 +24,7 @@ cat > $build_json <<EOC
 }
 EOC
 
-docker container run --rm -v $self_dir:/local "${swagger_codegen_cli_image:?}" generate \
+docker container run --rm --user "${codegen_run_user:?}" -v $self_dir:/local "${swagger_codegen_cli_image:?}" generate \
     -c /local/src/build.json \
     -i $openapi_url \
     -l python \
diff --git a/bindings/ruby/build.sh b/bindings/ruby/build.sh
index de6fcde5..de1f97cf 100755
--- a/bindings/ruby/build.sh
+++ b/bindings/ruby/build.sh
@@ -31,7 +31,7 @@ cat > $build_json <<EOC
 }
 EOC
 
-docker container run --rm -v $self_dir:/local "${swagger_codegen_cli_image:?}" generate \
+docker container run --rm --user "${codegen_run_user:?}" -v $self_dir:/local "${swagger_codegen_cli_image:?}" generate \
     -c /local/src/build.json \
     -i $openapi_url \
     -l ruby \
diff --git a/scripts/build.sh b/scripts/build.sh
index 125e18ef..4518f9c0 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -36,13 +36,13 @@ build_language() {
   $root_dir/bindings/$language/build.sh
 }
 
-test -z "$language" && {
+if test -z "$language"; then
   for I in $root_dir/bindings/*; do
     build_language $(basename $I)
   done
-} || {
+else
   build_language $language
-}
+fi
 
 echo "Applying ruff autofixes to generated sources ..."
 uvx ruff check --fix "$root_dir"
diff --git a/scripts/common.sh b/scripts/common.sh
index 2f5334d6..d2d9cd63 100755
--- a/scripts/common.sh
+++ b/scripts/common.sh
@@ -34,6 +34,12 @@ summary="Cloudsmith API"
 
 common_codegen_options="--git-user-id $git_user_id --git-repo-id $git_repo_id"
 
+# Codegen writes into a bind-mounted directory. On Linux the container's root
+# user owns the result, which blocks the post-generation fixups (Ruby
+# re-escaping, ruff autofixes) from rewriting those files, so run as the
+# invoking user instead.
+codegen_run_user="$(id -u):$(id -g)"
+
 function die {
   echo "$@"
   exit 1