From dd1d1e0851b98c24305722e558e5a4db367c8aa5 Mon Sep 17 00:00:00 2001
From: Rafael Lopes <rafael.lopes@sothis.com.br>
Date: Mon, 20 Jul 2026 15:23:28 -0300
Subject: [PATCH] =?UTF-8?q?CI:=20Definido=20para=20que=20automa=C3=A7?=
 =?UTF-8?q?=C3=A3o=20rode=20como=20user=20desenvolvimento=20ao=20inv=C3=A9?=
 =?UTF-8?q?s=20de=20root?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/deploy-production.yml | 80 +++++++++++++++-----------
 1 file changed, 48 insertions(+), 32 deletions(-)

diff --git a/.gitea/workflows/deploy-production.yml b/.gitea/workflows/deploy-production.yml
index c87351c..18a405f 100644
--- a/.gitea/workflows/deploy-production.yml
+++ b/.gitea/workflows/deploy-production.yml
@@ -54,56 +54,72 @@ jobs:
           mkdir -p "$DEPLOY_PATH"
           printf '%s\n' "$ENV_PRODUCTION" > "$DEPLOY_PATH/.env.production"
           chmod 600 "$DEPLOY_PATH/.env.production"
+          chown desenvolvimento:desenvolvimento "$DEPLOY_PATH/.env.production"
 
       - name: Deploy files and restart PM2
         shell: bash
         run: |
           set -euo pipefail
 
+          # O runner roda como root (compartilhado com outras automacoes deste servidor), mas o
+          # app deve rodar como 'desenvolvimento' - e o dono do PM2/logs/.env.production hoje.
+          # Em vez de mudar o usuario do runner (afetaria outras automacoes), so essa etapa troca
+          # de usuario via sudo -u, escrevendo o script num arquivo temporario pra evitar qualquer
+          # ambiguidade de escaping de aspas dentro do 'run:' do workflow.
           DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
           LOCK_FILE="/tmp/sn-glpi-sync-new.deploy.lock"
+          DEPLOY_SCRIPT="/tmp/sn-glpi-sync-new.deploy.sh"
 
           mkdir -p "$DEPLOY_PATH"
 
+          cat > "$DEPLOY_SCRIPT" <<'DEPLOY_EOF'
+          #!/usr/bin/env bash
+          set -euo pipefail
+
+          if [ -d "$DEPLOY_PATH" ] && [ -n "$(ls -A "$DEPLOY_PATH" 2>/dev/null)" ]; then
+            rsync -a --delete "$DEPLOY_PATH"/ "$DEPLOY_PATH.previous"/
+          fi
+
+          rsync -az --delete \
+            --exclude='.git/' \
+            --exclude='.gitea/' \
+            --exclude='.env*' \
+            --exclude='node_modules/' \
+            --exclude='logs/' \
+            "$SRC_DIR"/ "$DEPLOY_PATH"/
+
+          cd "$DEPLOY_PATH"
+
+          test -f .env.production || {
+            echo "Missing $DEPLOY_PATH/.env.production"
+            exit 1
+          }
+
+          grep -q '^SERVICENOW_CAOA_TI_GROUP_ID=.\+' .env.production || {
+            echo "SERVICENOW_CAOA_TI_GROUP_ID must be set in $DEPLOY_PATH/.env.production"
+            exit 1
+          }
+
+          npm ci --omit=dev
+
+          find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check
+
+          pm2 startOrRestart ecosystem.config.js --env production
+          pm2 save
+          pm2 list
+          DEPLOY_EOF
+          chmod +x "$DEPLOY_SCRIPT"
+
           (
             flock -n 9 || {
               echo "Another deploy is already running."
               exit 1
             }
-
-            if [ -d "$DEPLOY_PATH" ] && [ -n "$(ls -A "$DEPLOY_PATH" 2>/dev/null)" ]; then
-              rsync -a --delete "$DEPLOY_PATH"/ "$DEPLOY_PATH.previous"/
-            fi
-
-            rsync -az --delete \
-              --exclude='.git/' \
-              --exclude='.gitea/' \
-              --exclude='.env*' \
-              --exclude='node_modules/' \
-              --exclude='logs/' \
-              ./ "$DEPLOY_PATH"/
-
-            cd "$DEPLOY_PATH"
-
-            test -f .env.production || {
-              echo "Missing $DEPLOY_PATH/.env.production"
-              exit 1
-            }
-
-            grep -q '^SERVICENOW_CAOA_TI_GROUP_ID=.\+' .env.production || {
-              echo "SERVICENOW_CAOA_TI_GROUP_ID must be set in $DEPLOY_PATH/.env.production"
-              exit 1
-            }
-
-            npm ci --omit=dev
-
-            find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check
-
-            pm2 startOrRestart ecosystem.config.js --env production
-            pm2 save
-            pm2 list
+            sudo -u desenvolvimento -H DEPLOY_PATH="$DEPLOY_PATH" SRC_DIR="$PWD" bash "$DEPLOY_SCRIPT"
           ) 9>"$LOCK_FILE"
 
+          rm -f "$DEPLOY_SCRIPT"
+
       - name: Show sync logs
         if: always()
         shell: bash