From df00279a0176487524e4a5de231891e7174b6dfc Mon Sep 17 00:00:00 2001
From: Matt Robenolt <m@robenolt.com>
Date: Mon, 9 Nov 2026 15:42:33 -0800
Subject: [PATCH] Fix ~/.cache ownership after restoring the store

cache-nix-action restores as root, because /nix needs it, and extracts
absolute paths. The archive therefore creates ~/.cache owned by root, and the
action only restores write permission to ~/.cache/nix, not to its parent.

Any tool that creates a directory under ~/.cache then fails. Zig does, with
`unable to open global cache directory "/home/runner/.cache/zig": AccessDenied`,
which broke wormhole's test jobs.

Chown the directory after the restore, and assert writability in CI.
---
 .github/actions/setup-nix/action.yml | 14 ++++++++++++++
 .github/workflows/ci.yml             |  5 +++++
 2 files changed, 19 insertions(+)

diff --git a/.github/actions/setup-nix/action.yml b/.github/actions/setup-nix/action.yml
index 50b0e70..23485bb 100644
--- a/.github/actions/setup-nix/action.yml
+++ b/.github/actions/setup-nix/action.yml
@@ -85,3 +85,17 @@ runs:
         paths: |
           ~/.cache/nix
           /nix
+
+    # The restore runs as root (it has to, for /nix) and extracts absolute
+    # paths, so ~/.cache is created owned by root. cache-nix-action fixes the
+    # permissions of ~/.cache/nix itself, not of its parent, and anything that
+    # creates a directory under ~/.cache then fails with AccessDenied. Zig is
+    # the one that bit us, with ~/.cache/zig.
+    - name: Fix ownership of the cache directory
+      if: ${{ inputs.cache == 'true' }}
+      shell: bash
+      run: |
+        set -euo pipefail
+        if [ -d "$HOME/.cache" ] && [ ! -w "$HOME/.cache" ]; then
+          sudo chown "$(id -u):$(id -g)" "$HOME/.cache"
+        fi
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d1560b..e428462 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,6 +32,11 @@ jobs:
       - name: Check the devshell evaluates
         run: nix develop .#dev --command nix --version
 
+      # Guards the restore, which extracts as root and would otherwise leave
+      # ~/.cache unwritable for tools that create a cache there.
+      - name: Check the user cache is writable
+        run: mkdir -p "$HOME/.cache/setup-nix-smoke" && rmdir "$HOME/.cache/setup-nix-smoke"
+
       - name: Report cache
         env:
           CACHE_HIT: ${{ steps.nix.outputs.cache-hit }}