Using semrel docker image as GitHub action does fail with file permission errors

[neovatar]

semrel version

0.24.0

What happened?

I am using the following code snippet, derived from the semrel docs, in a GitHub workflow:

      - name: Run semrel
        uses: docker://ghcr.io/semrels/semrel:0.24.0-alpine@sha256:a4768f7a74e8bed61f9e7a6643a10464e46bfee4274f1f541979a66c794f0591
        with:
          args: release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The running action container errors when it tries to access the file system:

Run docker://ghcr.io/semrels/semrel:0.24.0-alpine@sha256:a4768f7a74e8bed61f9e7a6643a10464e46bfee4274f1f541979a66c794f0591
/usr/bin/docker run --name ghcriosemrelssemrel0240alpinesha256a4768f7a74e8bed61f9e7a6643a10464e46bfee4274f1f541979a66c794f0591_9abf08 --label 6caa77 --workdir /github/workspace --rm -e "GITHUB_TOKEN" -e "INPUT_ARGS" -e "HOME" -e "GITHUB_JOB" -e "GITHUB_REF" -e "GITHUB_SHA" -e "GITHUB_REPOSITORY" -e "GITHUB_REPOSITORY_OWNER" -e "GITHUB_REPOSITORY_OWNER_ID" -e "GITHUB_RUN_ID" -e "GITHUB_RUN_NUMBER" -e "GITHUB_RETENTION_DAYS" -e "GITHUB_RUN_ATTEMPT" -e "GITHUB_ACTOR_ID" -e "GITHUB_ACTOR" -e "GITHUB_WORKFLOW" -e "GITHUB_HEAD_REF" -e "GITHUB_BASE_REF" -e "GITHUB_EVENT_NAME" -e "GITHUB_SERVER_URL" -e "GITHUB_API_URL" -e "GITHUB_GRAPHQL_URL" -e "GITHUB_REF_NAME" -e "GITHUB_REF_PROTECTED" -e "GITHUB_REF_TYPE" -e "GITHUB_WORKFLOW_REF" -e "GITHUB_WORKFLOW_SHA" -e "GITHUB_REPOSITORY_ID" -e "GITHUB_TRIGGERING_ACTOR" -e "GITHUB_WORKSPACE" -e "GITHUB_ACTION" -e "GITHUB_EVENT_PATH" -e "GITHUB_ACTION_REPOSITORY" -e "GITHUB_ACTION_REF" -e "GITHUB_PATH" -e "GITHUB_ENV" -e "GITHUB_STEP_SUMMARY" -e "GITHUB_STATE" -e "GITHUB_OUTPUT" -e "RUNNER_OS" -e "RUNNER_ARCH" -e "RUNNER_NAME" -e "RUNNER_ENVIRONMENT" -e "RUNNER_TOOL_CACHE" -e "RUNNER_TEMP" -e "RUNNER_WORKSPACE" -e "ACTIONS_RUNTIME_URL" -e "ACTIONS_RUNTIME_TOKEN" -e "ACTIONS_CACHE_URL" -e "ACTIONS_RESULTS_URL" -e "ACTIONS_ORCHESTRATION_ID" -e GITHUB_ACTIONS=true -e CI=true -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/home/runner/work/_temp":"/github/runner_temp" -v "/home/runner/work/_temp/_github_home":"/github/home" -v "/home/runner/work/_temp/_github_workflow":"/github/workflow" -v "/home/runner/work/_temp/_runner_file_commands":"/github/file_commands" -v "/home/runner/work/more-text-options/more-text-options":"/github/workspace" ghcr.io/semrels/semrel:0.24.0-alpine@sha256:a4768f7a74e8bed61f9e7a6643a10464e46bfee4274f1f541979a66c794f0591 release
⬇  plugins missing — running semrel plugin restore from .semrel.lock…
⬇  restoring @semrel/changelog-md@0.6.1 ...
⬇  restoring @semrel/conventional@0.3.1 ...
✗  failed to restore @semrel/changelog-md: registry cache_error: create registry cache directory: mkdir .semrel: permission denied
⬇  restoring @semrel/github-actions@0.2.1 ...
⬇  restoring @semrel/release-notes@0.4.1 ...
✗  failed to restore @semrel/conventional: registry cache_error: create registry cache directory: mkdir .semrel: permission denied
✗  failed to restore @semrel/github-actions: registry cache_error: create registry cache directory: mkdir .semrel: permission denied
✗  failed to restore @semrel/release-notes: registry cache_error: create registry cache directory: mkdir .semrel: permission denied
Error: auto-restoring plugins: failed to restore 4 plugin(s): [@semrel/changelog-md @semrel/conventional @semrel/github-actions @semrel/release-notes]

Could it be a mismatch of the UID used in the docker image opposed to the UID of the GitHub workflow? It seems that images used as GitHub Actions usually drop the USER directive.

//edit: There is also documentation for this behaviour

What did you expect?

Using the docker image as a GitHub action with uses: ... works as mentioned in the documentation ("GitHub Actions Docker" tab)

Steps to reproduce

Use semrel via Docker in a workflow (instead of using the composite action which installs golang and compiles):

      - name: Run semrel
        uses: docker://ghcr.io/semrels/semrel:0.24.0-alpine@sha256:a4768f7a74e8bed61f9e7a6643a10464e46bfee4274f1f541979a66c794f0591
        with:
          args: release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Environment

No response

[tboerger]

Are you using selfhosted runners by any chance?

[mwaldheim]

Thanks for the detailed report. We confirmed that this is the documented GitHub Docker-action ownership behavior and is not limited to self-hosted runners.

The regular semrel images intentionally run as non-root. A uses: docker://... action, however, receives a runner-owned /github/workspace, so the image user cannot create the .semrel plugin cache
there.

We have prepared a dedicated action image, published as ghcr.io/semrels/semrel:<version>-action / latest-action. Only this action-specific variant runs as root, as required by GitHub's container-action contract; the regular distroless and Alpine images remain non-root. The change also includes a Linux regression that reproduces the permission failure with the regular image and verifies plugin restore with the action image, plus updated English and German documentation.

This tag is not released yet. Until a release containing it is available, please use the composite/go-install action rather than the regular image through docker://.

[mwaldheim]

Implementation is under review at #242, with matching documentation at SemRels/semrel-docs#10. Regular images remain non-root; a dedicated root-only -action image handles the runner-owned mounted workspace and has regression coverage. Neither is merged or released, so please continue using the composite/go-install action for now.