Inadequate Permissions reported when publishing to /bin/staticsites/ss-oryx/app

[csharpfritz]

My build script, that hasn't changed in the last 6 months, has started throwing an error "Inadequate Permissions. Run the command with elevated privileges" when writing to /bin/staticsites/ss-oryx/app

A clear and concise description of what the bug is.

To Reproduce Steps to reproduce the behavior:

1. Configure a package.json script with a 'build' script containing the command dotnet publish -c Release -o /bin/staticsites/ss-oryx/app

Expected behavior No errors, content is written to the output folder and application is deployed

[rustyonrampage]

Same issue npm WARN exec The following package was not found and will be installed: npm-force-resolutions@0.0.10 sh: 1: npm-force-resolutions: Permission denied

[Jarod1662]

I'm getting a similar issue - nothing has changed in our build and getting the following error:

Error: EACCES: permission denied, mkdir '/home/vsts/.config/gatsby' You don't have access to this file.

at Object.mkdirSync (node:fs:1382:3)

Any ideas?

[cormacpayne]

@csharpfritz @rustyonrampage @Jarod1662 -- Hey folks, sorry about the inconvenience here; if someone is able to, would you mind providing the logs for the unsuccessful build and deploy? I can check from the Oryx side where this failure is occurring during the build and why it would be happening with a more recent version of the underlying SWA client that uses Oryx.

[csharpfritz]

I have tests that I want run before my build, so I have a package.json file with the following command attached to a build script definition:

dotnet test ../Test.BlazorClient/ ; 
dotnet workload install wasm-tools ; 
dotnet publish -c Release -o /bin/staticsites/ss-oryx/app

Here is the build log with advanced debugging enabled. I have snipped out the compiler warnings when building my application for brevity.

##[debug]Evaluating: secrets.MyTelerikAccountUsername
##[debug]Evaluating Index:
##[debug]..Evaluating secrets:
##[debug]..=> Object
##[debug]..Evaluating String:
##[debug]..=> 'MyTelerikAccountUsername'
##[debug]=> '***'
##[debug]Result: '***'
##[debug]Evaluating: secrets.MyTelerikAccountPassword
##[debug]Evaluating Index:
##[debug]..Evaluating secrets:
##[debug]..=> Object
##[debug]..Evaluating String:
##[debug]..=> 'MyTelerikAccountPassword'
##[debug]=> '***'
##[debug]Result: '***'
##[debug]Evaluating condition for step: 'Build And Deploy'
##[debug]Evaluating: success()
##[debug]Evaluating success:
##[debug]=> true
##[debug]Result: true
##[debug]Starting: Build And Deploy
##[debug]Loading inputs
##[debug]Evaluating: secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_WHITE_RIVER_0221E770F
##[debug]Evaluating Index:
##[debug]..Evaluating secrets:
##[debug]..=> Object
##[debug]..Evaluating String:
##[debug]..=> 'AZURE_STATIC_WEB_APPS_API_TOKEN_WHITE_RIVER_0221E770F'
##[debug]=> '***'
##[debug]Result: '***'
##[debug]Evaluating: secrets.GITHUB_TOKEN
##[debug]Evaluating Index:
##[debug]..Evaluating secrets:
##[debug]..=> Object
##[debug]..Evaluating String:
##[debug]..=> 'GITHUB_TOKEN'
##[debug]=> '***'
##[debug]Result: '***'
##[debug]Loading env
Run Azure/static-web-apps-deploy@v1
/usr/bin/docker run --name d3c65ff97814e3399997b6e0b140b8d_3d27ec --label 290506 --workdir /github/workspace --rm -e "TELERIK_USERNAME" -e "TELERIK_PASSWORD" -e "INPUT_AZURE_STATIC_WEB_APPS_API_TOKEN" -e "INPUT_REPO_TOKEN" -e "INPUT_ACTION" -e "INPUT_APP_LOCATION" -e "INPUT_API_LOCATION" -e "INPUT_OUTPUT_LOCATION" -e "INPUT_API_BUILD_COMMAND" -e "INPUT_APP_ARTIFACT_LOCATION" -e "INPUT_APP_BUILD_COMMAND" -e "INPUT_ROUTES_LOCATION" -e "INPUT_SKIP_APP_BUILD" -e "INPUT_CONFIG_FILE_LOCATION" -e "INPUT_SKIP_API_BUILD" -e "INPUT_PRODUCTION_BRANCH" -e "INPUT_DEPLOYMENT_ENVIRONMENT" -e "INPUT_IS_STATIC_EXPORT" -e "HOME" -e "GITHUB_JOB" -e "GITHUB_REF" -e "GITHUB_SHA" -e "GITHUB_REPOSITORY" -e "GITHUB_REPOSITORY_OWNER" -e "GITHUB_RUN_ID" -e "GITHUB_RUN_NUMBER" -e "GITHUB_RETENTION_DAYS" -e "GITHUB_RUN_ATTEMPT" -e "GITHUB_ACTOR" -e "GITHUB_TRIGGERING_ACTOR" -e "GITHUB_WORKFLOW" -e "GITHUB_HEAD_REF" -e "GITHUB_BASE_REF" -e "GITHUB_EVENT_NAME" -e "GITHUB_SERVER_URL" -e "GITHUB_API_URL" -e "GITHUB_GRAPHQL_URL" -e "GITHUB_REF_NAME" -e "GITHUB_REF_PROTECTED" -e "GITHUB_REF_TYPE" -e "GITHUB_WORKSPACE" -e "GITHUB_ACTION" -e "GITHUB_EVENT_PATH" -e "GITHUB_ACTION_REPOSITORY" -e "GITHUB_ACTION_REF" -e "GITHUB_PATH" -e "GITHUB_ENV" -e "GITHUB_STEP_SUMMARY" -e "GITHUB_STATE" -e "GITHUB_OUTPUT" -e "RUNNER_DEBUG" -e "RUNNER_OS" -e "RUNNER_ARCH" -e "RUNNER_NAME" -e "RUNNER_TOOL_CACHE" -e "RUNNER_TEMP" -e "RUNNER_WORKSPACE" -e "ACTIONS_RUNTIME_URL" -e "ACTIONS_RUNTIME_TOKEN" -e "ACTIONS_CACHE_URL" -e GITHUB_ACTIONS=true -e CI=true -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/home/runner/work/_temp/_github_home":"/github/home" -v "/home/runner/work/_temp/_github_workflow":"/github/workflow" -v "/home/runner/work/_temp/_runner_file_commands":"/github/file_commands" -v "/home/runner/work/KlipTok/KlipTok":"/github/workspace" 290506:0d3c65ff97814e3399997b6e0b140b8d
DeploymentId: 3cff32ae-d052-4340-bdb5-5b622f8a62ac

App Directory Location: 'KlipTok.Client' was found.
Looking for event info
Starting to build app with Oryx
Azure Static Web Apps utilizes Oryx to build both static applications and Azure Functions. You can find more details on Oryx here: https://github.com/microsoft/Oryx
---Oryx build logs---

Operation performed by Microsoft Oryx, https://github.com/Microsoft/Oryx
You can report issues at https://github.com/Microsoft/Oryx/issues

Oryx Version: 0.2.20221103.1, Commit: a2c65dde152b749fea395f4d1242ea9350942258, ReleaseTagName: 20221103.1

Build Operation ID: |VF/yyOomBeM=.4a451402_
Repository Commit : 2f6299f3c8aa15637b5f449b3c73578d2ef52917

Detecting platforms...
Detected following platforms:
  nodejs: 16.18.0
  dotnet: 6.0.9
Version '16.18.0' of platform 'nodejs' is not installed. Generating script to install it...
Version '6.0.9' of platform 'dotnet' is not installed. Generating script to install it...

Source directory     : /github/workspace/KlipTok.Client
Destination directory: /bin/staticsites/ss-oryx/app

Downloading and extracting 'nodejs' version '16.18.0' to '/opt/nodejs/16.18.0'...
Detected image debian flavor: bullseye.
Downloaded in 0 sec(s).
Verifying checksum...
Extracting contents...
performing sha512 checksum for: nodejs...
Done in 1 sec(s).

Downloading and extracting 'dotnet' version '6.0.401' to '/opt/dotnet/6.0.401'...
Detected image debian flavor: bullseye.
Downloaded in 1 sec(s).
Verifying checksum...
Extracting contents...
performing sha512 checksum for: dotnet...
Done in 7 sec(s).

image detector file exists, platform is dotnet..
Removing existing manifest file
Creating directory for command manifest file if it does not exist
Creating a manifest file...
Node Build Command Manifest file created.

Using Node version:
v16.18.0

Using Npm version:
8.19.2

Running 'npm install --unsafe-perm'...

npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated source-map-resolve@0.6.0: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies

added 412 packages, and audited 413 packages in 8s

13 packages are looking for funding
  run `npm fund` for details

7 high severity vulnerabilities

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

Running 'npm run build'...

> kliptok.client@1.0.0 build
> npm run dotnet:publish

> kliptok.client@1.0.0 dotnet:publish
> dotnet test ../Test.BlazorClient/ ; dotnet workload install wasm-tools ; dotnet publish -c Release -o /bin/staticsites/ss-oryx/app

Welcome to .NET 6.0!
---------------------
SDK Version: 6.0.401

Telemetry
---------
The .NET tools collect usage data in order to help us improve your experience. It is collected by Microsoft and shared with the community. You can opt-out of telemetry by setting the DOTNET_CLI_TELEMETRY_OPTOUT environment variable to '1' or 'true' using your favorite shell.

Read more about .NET CLI Tools telemetry: https://aka.ms/dotnet-cli-telemetry

----------------
Installed an ASP.NET Core HTTPS development certificate.
To trust the certificate run 'dotnet dev-certs https --trust' (Windows and macOS only).
Learn about HTTPS: https://aka.ms/dotnet-https
----------------
Write your first app: https://aka.ms/dotnet-hello-world
Find out what's new: https://aka.ms/dotnet-whats-new
Explore documentation: https://aka.ms/dotnet-docs
Report issues and find source on GitHub: https://github.com/dotnet/core
Use 'dotnet --help' to see available commands or visit: https://aka.ms/dotnet-cli
--------------------------------------------------------------------------------------
  Determining projects to restore...
  Restored /github/workspace/KlipTok.Common/KlipTok.Common.csproj (in 1.02 sec).
  Restored /github/workspace/KlipTok.Components/KlipTok.Components.csproj (in 1.01 sec).
  Restored /github/workspace/KlipTok.Client/KlipTok.Client.csproj (in 5.48 sec).
  Restored /github/workspace/KlipTok.ViewModels/KlipTok.ViewModels.csproj (in 3 ms).
  Restored /github/workspace/KlipTok.Twitch/KlipTok.Twitch.csproj (in 4 ms).
  Restored /github/workspace/Test.BlazorClient/Test.BlazorClient.csproj (in 5.51 sec).
  Restored /github/workspace/KlipTok.Services/KlipTok.Services.csproj (in 80 ms).
  KlipTok.Common -> /github/workspace/KlipTok.Common/bin/Debug/net6.0/KlipTok.Common.dll

-- SNIPPED COMPILER WARNINGS --

  Test.BlazorClient -> /github/workspace/Test.BlazorClient/bin/Debug/net6.0/Test.BlazorClient.dll
Test run for /github/workspace/Test.BlazorClient/bin/Debug/net6.0/Test.BlazorClient.dll (.NETCoreApp,Version=v6.0)
Microsoft (R) Test Execution Command Line Tool Version 17.3.0 (x64)
Copyright (c) Microsoft Corporation.  All rights reserved.

Starting test execution, please wait...
A total of 1 test files matched the specified pattern.

Passed!  - Failed:     0, Passed:    22, Skipped:     0, Total:    22, Duration: 966 ms - /github/workspace/Test.BlazorClient/bin/Debug/net6.0/Test.BlazorClient.dll (net6.0)
Inadequate permissions. Run the command with elevated privileges.
MSBuild version 17.3.1+2badb37d1 for .NET
  Determining projects to restore...
  All projects are up-to-date for restore.

-- SNIPPED COMPILER WARNINGS --

  KlipTok.Client -> /github/workspace/KlipTok.Client/bin/Release/net6.0/KlipTok.Client.dll
  KlipTok.Client (Blazor output) -> /github/workspace/KlipTok.Client/bin/Release/net6.0/wwwroot
  Optimizing assemblies for size, which may change the behavior of the app. Be sure to test after publishing. See: https://aka.ms/dotnet-illink
  Compressing Blazor WebAssembly publish artifacts. This may take a while...
/opt/dotnet/6.0.401/sdk/6.0.401/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(248,5): error MSB3021: Unable to copy file "/github/workspace/KlipTok.Client/package-lock.json" to "/bin/staticsites/ss-oryx/app/package-lock.json". Access to the path '/bin/staticsites/ss-oryx/app/package-lock.json' is denied. [/github/workspace/KlipTok.Client/KlipTok.Client.csproj]
/opt/dotnet/6.0.401/sdk/6.0.401/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(248,5): error MSB3021: Unable to copy file "/github/workspace/KlipTok.Client/package.json" to "/bin/staticsites/ss-oryx/app/package.json". Access to the path '/bin/staticsites/ss-oryx/app/package.json' is denied. [/github/workspace/KlipTok.Client/KlipTok.Client.csproj]
/opt/dotnet/6.0.401/sdk/6.0.401/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(248,5): error MSB3021: Unable to copy file "/github/workspace/KlipTok.Client/staticwebapp.config.json" to "/bin/staticsites/ss-oryx/app/staticwebapp.config.json". Access to the path '/bin/staticsites/ss-oryx/app/staticwebapp.config.json' is denied. [/github/workspace/KlipTok.Client/KlipTok.Client.csproj]
/opt/dotnet/6.0.401/sdk/6.0.401/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(248,5): error MSB3021: Unable to copy file "/github/workspace/KlipTok.Client/Themes/bootstrap-scss/package.json" to "/bin/staticsites/ss-oryx/app/Themes/bootstrap-scss/package.json". Access to the path '/bin/staticsites/ss-oryx/app/Themes/bootstrap-scss' is denied. [/github/workspace/KlipTok.Client/KlipTok.Client.csproj]
/opt/dotnet/6.0.401/sdk/6.0.401/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(248,5): error MSB3021: Unable to copy file "/github/workspace/KlipTok.Client/Themes/kliptok.json" to "/bin/staticsites/ss-oryx/app/Themes/kliptok.json". Access to the path '/bin/staticsites/ss-oryx/app/Themes' is denied. [/github/workspace/KlipTok.Client/KlipTok.Client.csproj]
/opt/dotnet/6.0.401/sdk/6.0.401/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(248,5): error MSB3021: Unable to copy file "/github/workspace/KlipTok.Client/tsconfig.json" to "/bin/staticsites/ss-oryx/app/tsconfig.json". Access to the path '/bin/staticsites/ss-oryx/app/tsconfig.json' is denied. [/github/workspace/KlipTok.Client/KlipTok.Client.csproj]
/opt/dotnet/6.0.401/sdk/6.0.401/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(248,5): error MSB3021: Unable to copy file "/github/workspace/KlipTok.Client/Themes/app.scss" to "/bin/staticsites/ss-oryx/app/Themes/app.scss". Access to the path '/bin/staticsites/ss-oryx/app/Themes' is denied. [/github/workspace/KlipTok.Client/KlipTok.Client.csproj]
/opt/dotnet/6.0.401/sdk/6.0.401/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(248,5): error MSB3021: Unable to copy file "/github/workspace/KlipTok.Client/Themes/Components/_layout.scss" to "/bin/staticsites/ss-oryx/app/Themes/Components/_layout.scss". Access to the path '/bin/staticsites/ss-oryx/app/Themes/Components' is denied. [/github/workspace/KlipTok.Client/KlipTok.Client.csproj]
/opt/dotnet/6.0.401/sdk/6.0.401/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(248,5): error MSB3021: Unable to copy file "/opt/dotnet/6.0.401/sdk/6.0.401/Sdks/Microsoft.NET.Sdk.BlazorWebAssembly/targets/BlazorWasm.web.config" to "/bin/staticsites/ss-oryx/app/web.config". Access to the path '/bin/staticsites/ss-oryx/app/web.config' is denied. [/github/workspace/KlipTok.Client/KlipTok.Client.csproj]
/opt/dotnet/6.0.401/sdk/6.0.401/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Publish.targets(248,5): error MSB3021: Unable to copy file "/github/workspace/KlipTok.Client/libman.json" to "/bin/staticsites/ss-oryx/app/libman.json". Access to the path '/bin/staticsites/ss-oryx/app/libman.json' is denied. [/github/workspace/KlipTok.Client/KlipTok.Client.csproj]

---End of Oryx build logs---
Oryx has failed to build the solution.

For further information, please visit the Azure Static Web Apps documentation at https://docs.microsoft.com/en-us/azure/static-web-apps/
If you believe this behavior is unexpected, please raise a GitHub issue at https://github.com/azure/static-web-apps/issues/
Exiting
##[debug]Docker Action run completed with exit code 1
##[debug]Finishing: Build And Deploy

[cormacpayne]

@csharpfritz thanks for providing the logs -- would you mind trying the following if you're able to: in your app's package.json file, set the engines.node field to the following:

{
  "name": "...",
  "version": "...",
  ...
  "engines": {
    "node": "14.x"
  }
}

The previous version of Static Web Apps was using node 14, but has recently bumped up to node 16. This change to the engines field will force Oryx to use the latest version of node 14 supported, which, I'm hoping, should fix the issue that you're seeing.

[Reshmi-Sriram]

Hey @csharpfritz , Could you please confirm if you're still facing this issue? If not, please do let us know so that we can update and close the same. Thanks!

[csharpfritz]

I have been working around this issue by not using the build script capabilities for the last 4 months.

I'll re-introduce the build script and report back

[csharpfritz]

No... wait...

That did not work. All of my routing is broken with this configuration

[Reshmi-Sriram]

cc// @cormacpayne