Deployment fails if files are not writable or owned by root

[opeik]

Hi there,

I tried to deploy my site which is built with NIx and actions/deploy-pages would fail with a cryptic error message.

name: Continuous deployment

on:
  push:
    branches: [main]
  
permissions:
  contents: read
  pages: write
  id-token: write

concurrency:
  group: cd
  cancel-in-progress: true

jobs:
  deploy:
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}

    runs-on: ubuntu-latest

    steps:
      - name: Checkout repo
        uses: actions/checkout@v3

      - name: Install Nix
        uses: cachix/install-nix-action@v15
        with:
          extra_nix_config: access-tokens = github.com=${{ github.token }}

      - name: Build website
        run: nix build --print-build-logs

      - name: Setup GitHub Pages
        uses: actions/configure-pages@v1

      - name: Upload website
        uses: actions/upload-pages-artifact@v1
        with:
          path: public

      - name: Deploy website
        id: deployment
        uses: actions/deploy-pages@v1

Which outputs this:

Actor: danth
Action ID: 2761250916
Artifact URL: https://pipelines.actions.githubusercontent.com/TbYKgfAZOYa7gipiGxQgSbih1nRuFlBDNpZeQ6z2I00IpqUyZA/_apis/pipelines/workflows/2761250916/artifacts?api-version=6.0-preview
{"count":1,"value":[{"containerId":1480084,"size":61440,"signedContent":null,"fileContainerResourceUrl":"https://pipelines.actions.githubusercontent.com/TbYKgfAZOYa7gipiGxQgSbih1nRuFlBDNpZeQ6z2I00IpqUyZA/_apis/resources/Containers/1480084","type":"actions_storage","name":"github-pages","url":"https://pipelines.actions.githubusercontent.com/TbYKgfAZOYa7gipiGxQgSbih1nRuFlBDNpZeQ6z2I00IpqUyZA/_apis/pipelines/1/runs/14/artifacts?artifactName=github-pages","expiresOn":"2022-07-30T14:44:47.4503161Z","items":null}]}
Creating deployment with payload:
{
	"artifact_url": "https://pipelines.actions.githubusercontent.com/TbYKgfAZOYa7gipiGxQgSbih1nRuFlBDNpZeQ6z2I00IpqUyZA/_apis/pipelines/1/runs/14/artifacts?artifactName=github-pages&%24expand=SignedContent",
	"pages_build_version": "5d3a8f8ecf3635514f0046294ddc600728eb75c4",
	"oidc_token": "***"
}
Created deployment for 5d3a8f8ecf3635514f0046294ddc600728eb75c4
{"page_url":"https://danth.github.io/coricamu/","status_url":"https://api.github.com/repos/danth/coricamu/pages/deployment/status/5d3a8f8ecf3635514f0046294ddc600728eb75c4","preview_url":""}

Error: Deployment failed, try again later.

From my testing actions/deploy-pages fails if the files are either not writable or owned by root. The output of a Nix build is both not writable and owned by root. I worked around this by clearing the permissions after building:

cp --recursive --dereference --no-preserve=mode,ownership result public

I don't think this should fail, since I expect the file permissions be cleared on deployment. Even so, the error message should at least be more clear.