fix(deploy): preserve storage volume ownership

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

.github/workflows/pr-scripts.yml

@@ -7,6 +7,7 @@ on:
       - '.env.release.example'
       - '.env.release.draft'
       - 'compose.release.yml'
+      - 'server/Dockerfile'
       - 'Makefile'
       - 'web/Dockerfile'
       - 'web/nginx.conf.template'
@@ -43,4 +44,5 @@ jobs:
       - run: bash scripts/tests/web-base-path-routing-test.sh
       - run: bash scripts/tests/web-base-path-nginx-smoke-test.sh
       - run: bash scripts/tests/dev-web-host-test.sh
+      - run: bash scripts/tests/server-image-compat-test.sh
       - run: bash scripts/tests/workflow-security-test.sh

scripts/tests/server-image-compat-test.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+DOCKERFILE="$REPO_ROOT/server/Dockerfile"
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+grep -Fq 'groupadd --system --gid 101 app' "$DOCKERFILE" \
+  || fail 'server runtime group must retain the v0.2.17 gid 101 for storage-volume upgrades'
+grep -Fq 'useradd --system --uid 100 --gid app --create-home app' "$DOCKERFILE" \
+  || fail 'server runtime user must retain the v0.2.17 uid 100 for storage-volume upgrades'
+grep -Eq '^USER app[[:space:]]*$' "$DOCKERFILE" \
+  || fail 'server runtime must continue to run as the non-root app user'
+
+echo 'server-image-compat-test passed'

scripts/tests/workflow-security-test.sh

@@ -69,6 +69,8 @@ grep -Fq '.env.release.draft' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run when release env draft changes"
 grep -Fq 'compose.release.yml' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run when release compose changes"
+grep -Fq 'server/Dockerfile' "$PR_SCRIPTS_WORKFLOW" \
+  || fail "pr-scripts must run when the production server image changes"
 grep -Fq 'web/Dockerfile' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run when the web image changes"
 grep -Fq 'web/nginx.conf.template' "$PR_SCRIPTS_WORKFLOW" \
@@ -87,6 +89,8 @@ grep -Fq 'bash scripts/tests/runtime-secret-test.sh' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run runtime-secret-test"
 grep -Fq 'bash scripts/tests/dev-web-host-test.sh' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run dev-web-host-test"
+grep -Fq 'bash scripts/tests/server-image-compat-test.sh' "$PR_SCRIPTS_WORKFLOW" \
+  || fail "pr-scripts must run server-image-compat-test"
 grep -Fq 'bash scripts/tests/workflow-security-test.sh' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run workflow-security-test"
 

server/Dockerfile

@@ -23,11 +23,12 @@ RUN ./mvnw package -DskipTests -B
 # The Noble variant publishes a linux/riscv64 image; the Alpine JRE currently
 # used by this project is limited to amd64 and arm64.
 FROM eclipse-temurin:21-jre-noble
+# Keep the Alpine image's numeric IDs so existing storage volumes remain writable.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends wget && \
     rm -rf /var/lib/apt/lists/* && \
-    groupadd --system app && \
-    useradd --system --gid app --create-home app
+    groupadd --system --gid 101 app && \
+    useradd --system --uid 100 --gid app --create-home app
 WORKDIR /app
 
 COPY --from=build /app/skillhub-app/target/*.jar app.jar