fix: [APPSEC-327] run Docker formatter without root privileges (#282)

* fix: run Docker formatter without root privileges

* style: remove trailing Dockerfile whitespace

* fix: [APPSEC-327] pin CI to supported Java 11 runtime

Added Java 11 setup step to CI workflow.

Author: peter-matkovski

.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: Build
 
 on: [pull_request]
 
-concurrency: 
+concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
@@ -19,6 +19,12 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Set up Java 11
+        uses: actions/setup-java@v4
+        with:
+          distribution: corretto
+          java-version: '11'
+
       - name: Test
         env:
           STREAM_KEY: ${{ secrets.STREAM_KEY }}

Dockerfile

@@ -11,4 +11,11 @@ COPY settings.gradle .
 # Make gradlew executable
 RUN chmod +x gradlew
 
-CMD ["sh", "-c", "./gradlew :spotlessApply"] 
+RUN yum install -y shadow-utils findutils && yum clean all \
+    && useradd --create-home --uid 1000 formatter \
+    && chown -R formatter:formatter /code
+
+ENV GRADLE_USER_HOME=/tmp/gradle
+USER formatter
+
+CMD ["sh", "-c", "./gradlew :spotlessApply"]

Makefile

@@ -12,4 +12,4 @@ test_with_docker:
 
 format_with_docker:
 	docker build -t stream-chat-java-formatter . && \
-	docker run -v $(PWD):/code stream-chat-java-formatter
+	docker run --user $$(id -u):$$(id -g) -v $(PWD):/code stream-chat-java-formatter