composer should be executed by the user with same uid:gid as owner of composer.json

[zaporylie]

I've experienced this issue by running following 2-steps-job on the self-hosted runner:

 steps:
    - uses: actions/checkout@v2
    - uses: php-actions/composer@v4

I've managed to debug this issue and it is happening because actions/checkout cannot reset the state of the workdir, which is caused by php-actions/composer running as root:root. However,actions/checkout is being run by the same user who "owns" the self-hosted runner (non-root user).

[g105b]

Thanks for reporting this. I will look into creating a test case in https://github.com/php-actions/example-composer so we can replicate the issue. Any help to reproduce it will be appreciated.

[eugene-manuilov]

@g105b any progress on this issue?

[g105b]

I've just made a release of v5 to this repository, so I can take a proper look at this. The issue is caused by using a self-hosted runner (I missed that previously).

Please take a look here:

https://github.com/php-actions/composer/blob/master/composer-action.bash#L135-L143

It's possible to use the --user flag on Docker to run as a specific user ID (https://docs.docker.com/engine/reference/run/#user), but I'm unable to test this as I don't have any self-hosted runners.

I'm happy to do some testing with you to help solve this issue. First we will need to find what user to run as, then we can test this on a separate branch. How can we figure out the correct user to run as?

[g105b]

I'm closing this issue as I haven't had any further reports since the v5 release. Please feel free to re-open if this issue is still affecting you, and I'll pick it back up and dig a little deeper.

[constantinultius]

I confirm it still happens on self-hosted runner with @v5. It installs packages under "/vendor" folder with owner "root:root" and not runner user. It works on first run but then fails on subsequent, when runner tries to clean up working directory. Because "root" files can't be deleted.

      - name: Install PHP packages
        uses: php-actions/composer@v5
        with:
          php_version: 7.3
          args: --profile --ignore-platform-reqs --no-cache

[swichers]

Still an issue on v6.

[g105b]

Can anyone help me understand how to detect the user on a self-hosted runner? I'm not familiar with self-hosted Actions. Any advice is appreciated, so I can create a test case in example-composer

[DaxServer]

Still an issue on v6 using Github hosted runners