From aa4ea17c4af84fab9f1e0afaba037415924b095f Mon Sep 17 00:00:00 2001
From: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Date: Sat, 29 Aug 2026 15:58:55 +0800
Subject: [PATCH] fix(deploy): preserve storage volume ownership

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
---
 .github/workflows/pr-scripts.yml          |  2 ++
 scripts/tests/server-image-compat-test.sh | 19 +++++++++++++++++++
 scripts/tests/workflow-security-test.sh   |  4 ++++
 server/Dockerfile                         |  5 +++--
 4 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100755 scripts/tests/server-image-compat-test.sh

diff --git a/.github/workflows/pr-scripts.yml b/.github/workflows/pr-scripts.yml
index 937dc05d..1ab4a2ee 100644
--- a/.github/workflows/pr-scripts.yml
+++ b/.github/workflows/pr-scripts.yml
@@ -7,6 +7,7 @@ on:
       - '.env.release.example'
       - '.env.release.draft'
       - 'compose.release.yml'
+      - 'server/Dockerfile'
       - 'Makefile'
       - 'web/Dockerfile'
       - 'web/nginx.conf.template'
@@ -43,4 +44,5 @@ jobs:
       - run: bash scripts/tests/web-base-path-routing-test.sh
       - run: bash scripts/tests/web-base-path-nginx-smoke-test.sh
       - run: bash scripts/tests/dev-web-host-test.sh
+      - run: bash scripts/tests/server-image-compat-test.sh
       - run: bash scripts/tests/workflow-security-test.sh
diff --git a/scripts/tests/server-image-compat-test.sh b/scripts/tests/server-image-compat-test.sh
new file mode 100755
index 00000000..064f4937
--- /dev/null
+++ b/scripts/tests/server-image-compat-test.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+DOCKERFILE="$REPO_ROOT/server/Dockerfile"
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+grep -Fq 'groupadd --system --gid 101 app' "$DOCKERFILE" \
+  || fail 'server runtime group must retain the v0.2.17 gid 101 for storage-volume upgrades'
+grep -Fq 'useradd --system --uid 100 --gid app --create-home app' "$DOCKERFILE" \
+  || fail 'server runtime user must retain the v0.2.17 uid 100 for storage-volume upgrades'
+grep -Eq '^USER app[[:space:]]*$' "$DOCKERFILE" \
+  || fail 'server runtime must continue to run as the non-root app user'
+
+echo 'server-image-compat-test passed'
diff --git a/scripts/tests/workflow-security-test.sh b/scripts/tests/workflow-security-test.sh
index 281d4092..2a465e71 100755
--- a/scripts/tests/workflow-security-test.sh
+++ b/scripts/tests/workflow-security-test.sh
@@ -69,6 +69,8 @@ grep -Fq '.env.release.draft' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run when release env draft changes"
 grep -Fq 'compose.release.yml' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run when release compose changes"
+grep -Fq 'server/Dockerfile' "$PR_SCRIPTS_WORKFLOW" \
+  || fail "pr-scripts must run when the production server image changes"
 grep -Fq 'web/Dockerfile' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run when the web image changes"
 grep -Fq 'web/nginx.conf.template' "$PR_SCRIPTS_WORKFLOW" \
@@ -87,6 +89,8 @@ grep -Fq 'bash scripts/tests/runtime-secret-test.sh' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run runtime-secret-test"
 grep -Fq 'bash scripts/tests/dev-web-host-test.sh' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run dev-web-host-test"
+grep -Fq 'bash scripts/tests/server-image-compat-test.sh' "$PR_SCRIPTS_WORKFLOW" \
+  || fail "pr-scripts must run server-image-compat-test"
 grep -Fq 'bash scripts/tests/workflow-security-test.sh' "$PR_SCRIPTS_WORKFLOW" \
   || fail "pr-scripts must run workflow-security-test"
 
diff --git a/server/Dockerfile b/server/Dockerfile
index bfd02cd1..801ced80 100644
--- a/server/Dockerfile
+++ b/server/Dockerfile
@@ -23,11 +23,12 @@ RUN ./mvnw package -DskipTests -B
 # The Noble variant publishes a linux/riscv64 image; the Alpine JRE currently
 # used by this project is limited to amd64 and arm64.
 FROM eclipse-temurin:21-jre-noble
+# Keep the Alpine image's numeric IDs so existing storage volumes remain writable.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends wget && \
     rm -rf /var/lib/apt/lists/* && \
-    groupadd --system app && \
-    useradd --system --gid app --create-home app
+    groupadd --system --gid 101 app && \
+    useradd --system --uid 100 --gid app --create-home app
 WORKDIR /app
 
 COPY --from=build /app/skillhub-app/target/*.jar app.jar