Can’t run custom-built toolchain in GitHub Actions?

Using Swift
1

i’m trying to use a custom-build toolchain with GitHub Actions, and i am running into a permissions issue:

Status: Downloaded newer image for tayloraswift/5.10.0-amazonlinux2023:latest
Swift version 5.10 (swift-5.10-RELEASE)
Target: x86_64-unknown-linux-gnu

error: Error Domain=NSCocoaErrorDomain Code=513 "You don’t have permission."
Error: Process completed with exit code 1.

it looks as if the error is being thrown from the compiler, as the swift --version command succeeds. i modeled my docker image on the official images.

# install swift
COPY --from=swift-toolchain-builder:5.10.0 /home/build-user/swift-install /swift-install
RUN ln -s /bin/ld /usr/bin/ld.gold

RUN    cp -r /swift-install/usr/bin/* /usr/bin \
    && cp -r /swift-install/usr/include/* /usr/include/ \
    && cp -r /swift-install/usr/libexec/* /usr/libexec/ \
    && cp -r /swift-install/usr/lib/* /usr/lib/ \
    && cp -r /swift-install/usr/local/* /usr/local \
    && cp -r /swift-install/usr/share/* /usr/share \
    && rm -r /swift-install

RUN chmod -R o+r /usr/lib/swift

here is what i see inside a container launched from that image:

$ docker run -it --rm --entrypoint=/bin/bash tayloraswift/5.10.0-amazonlinux2023:latest
~$ ls -l /usr/lib/ | grep swift
-rwxr-xr-x  1 root root    488904 Mar  6 22:58 libswiftDemangle.so
drwxr-xr-x  1 root root      4096 Mar  6 22:58 swift
drwxr-xr-x 10 root root      4096 Mar  6 22:58 swift_static
~$ ls -l /usr/bin/ | grep swift
-rwxr-xr-x 1 root root     16440 Mar  6 22:58 repl_swift
lrwxrwxrwx 1 root root        14 Mar  6 22:58 swift -> swift-frontend
-rwxr-xr-x 1 root root     11865 Mar  6 22:58 swift-api-checker.py
lrwxrwxrwx 1 root root        14 Mar  6 22:58 swift-api-digester -> swift-frontend
lrwxrwxrwx 1 root root        14 Mar  6 22:58 swift-api-extract -> swift-frontend
lrwxrwxrwx 1 root root        14 Mar  6 22:58 swift-autolink-extract -> swift-frontend
lrwxrwxrwx 1 root root        13 Mar  6 22:58 swift-build -> swift-package
-rwxr-xr-x 1 root root  37547376 Mar  6 22:58 swift-build-sdk-interfaces
-rwxr-xr-x 1 root root   1413136 Mar  6 22:58 swift-build-tool
lrwxrwxrwx 1 root root        14 Mar  6 22:58 swift-cache-tool -> swift-frontend
-rwxr-xr-x 1 root root   1718408 Mar  6 22:58 swift-demangle
-rwxr-xr-x 1 root root  37514936 Mar  6 22:58 swift-driver
lrwxrwxrwx 1 root root        13 Mar  6 22:58 swift-experimental-sdk -> swift-package
-rwxr-xr-x 1 root root 175719496 Mar  6 22:58 swift-frontend
-rwxr-xr-x 1 root root  10650928 Mar  6 22:58 swift-help
-rwxr-xr-x 1 root root 105112624 Mar  6 22:58 swift-package
lrwxrwxrwx 1 root root        13 Mar  6 22:58 swift-package-collection -> swift-package
lrwxrwxrwx 1 root root        13 Mar  6 22:58 swift-package-registry -> swift-package
-rwxr-xr-x 1 root root   1892128 Mar  6 22:58 swift-plugin-server
lrwxrwxrwx 1 root root        13 Mar  6 22:58 swift-run -> swift-package
lrwxrwxrwx 1 root root        14 Mar  6 22:58 swift-symbolgraph-extract -> swift-frontend
lrwxrwxrwx 1 root root        13 Mar  6 22:58 swift-test -> swift-package
lrwxrwxrwx 1 root root        14 Mar  6 22:58 swiftc -> swift-frontend
~$ ls -l /usr/include/ | grep swift
drwxr-xr-x  2 root root   4096 Mar  6 22:58 swift
~$ ls -l /usr/local/ | grep swift
~$ ls -l /usr/share/ | grep swift
drwxr-xr-x  3 root root 4096 Mar  6 22:58 icuswift
drwxr-xr-x  3 root root 4096 Mar  6 22:58 swift
~$ ls -l /bin/ld                 
lrwxrwxrwx 1 root root 20 Feb 17 14:33 /bin/ld -> /etc/alternatives/ld
~$ ls -l /usr/bin/ld.gold
lrwxrwxrwx 1 root root 7 Mar  6 22:58 /usr/bin/ld.gold -> /bin/ld
~$ ls -l /etc/alternatives/ld
lrwxrwxrwx 1 root root 15 Feb 17 14:33 /etc/alternatives/ld -> /usr/bin/ld.bfd

anyone run into something similar?

2

so, i think this has something to do with permissions inside of Docker not matching permissions of folders mounted from the GitHub actions environment. i was puzzled as to why the official Amazon Linux 2 images do not have this problem, and then i realized that everything in those images runs as root, as they don’t set up any user at all.

i think that the compiler does not complain about permissions normally when it runs as a normal user if it is being invoked on a repo that has matching permissions, but repos cloned by the GHA step can only be accessed as root from a Docker image. so the solution is to either skip creating users all together in custom Docker images, or run Docker-managed compilation commands with --user root on GitHub actions.