fix: preserve readable deployment source modes

Dockerfile

@@ -53,7 +53,7 @@ COPY --chown=magent:magent --from=frontend-builder /frontend/proxy.ts /app/front
 COPY --chown=magent:magent --from=frontend-builder /frontend/next-env.d.ts /app/frontend/next-env.d.ts
 COPY --chown=magent:magent --from=frontend-builder /frontend/tsconfig.json /app/frontend/tsconfig.json
 
-COPY docker/supervisord.conf /etc/supervisor/conf.d/magent.conf
+COPY --chown=magent:magent docker/supervisord.conf /etc/supervisor/conf.d/magent.conf
 
 RUN chown -R magent:magent /app
 USER magent:magent

scripts/deploy_ams_dev01.sh

@@ -28,7 +28,7 @@ git archive --format=tar HEAD | ssh ${ssh_opts} "${remote}" "
       cp -a \"\$path\" \"\${backup_root}/\"
     fi
   done
-  tar -xf - -C '${deploy_path}'
+  (umask 022; tar -xf - -C '${deploy_path}')
   if [ -f '${deploy_path}/.env' ]; then
     chmod 600 '${deploy_path}/.env'
   fi
@@ -41,7 +41,7 @@ git archive --format=tar HEAD | ssh ${ssh_opts} "${remote}" "
     chmod 600 .env
   fi
   docker compose run --rm --no-deps --entrypoint python magent -c \"from app.config import settings; from app.secret_storage import validate_secret_storage_configuration; assert len(str(settings.jwt_secret or '').strip()) >= 32, 'JWT_SECRET must contain at least 32 characters'; validate_secret_storage_configuration()\"
-  docker compose run --rm --user 0 magent chown -R 1000:1000 /app/data
+  docker compose run --rm --user 0 --cap-add CHOWN --cap-add DAC_OVERRIDE magent chown -R 1000:1000 /app/data
   docker compose up -d
 "
 

scripts/deploy_beta_ams_dev01.sh

@@ -29,7 +29,7 @@ git archive --format=tar HEAD | ssh ${ssh_opts} "${remote}" "
       cp -a \"\$path\" \"\${backup_root}/\"
     fi
   done
-  tar -xf - -C '${deploy_path}'
+  (umask 022; tar -xf - -C '${deploy_path}')
 
   if [ ! -f '${deploy_path}/.env' ]; then
     echo 'Beta .env is missing. Provision independent beta secrets before deploying.' >&2