From 7a0c911ca57355a9311b1fcd3eb56e0519eea37d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 24 Apr 2026 13:06:27 +0000 Subject: [PATCH 1/7] Initial plan From 9bbd681e4dabe3b5d3e37ae14a1d5e6a70aa507f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 24 Apr 2026 13:08:34 +0000 Subject: [PATCH 2/7] Fix Dockerfile security: run as non-root user 10001 with access to /home/txnproc Agent-Logs-Url: https://github.com/TransactionProcessing/FileProcessor/sessions/651868bb-3109-432b-aafc-26931dfbd930 Co-authored-by: StuartFerguson <16325469+StuartFerguson@users.noreply.github.com> --- FileProcessor/Dockerfile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/FileProcessor/Dockerfile b/FileProcessor/Dockerfile index f917033..6d6efa1 100644 --- a/FileProcessor/Dockerfile +++ b/FileProcessor/Dockerfile @@ -22,9 +22,11 @@ RUN dotnet publish "FileProcessor.csproj" -c Release -o /app/publish FROM base AS mkdir WORKDIR /home -RUN mkdir -p /home/txnproc/bulkfiles +RUN mkdir -p /home/txnproc/bulkfiles && \ + chown -R 10001:10001 /home/txnproc FROM mkdir AS final WORKDIR /app COPY --from=publish /app/publish . +USER 10001 ENTRYPOINT ["dotnet", "FileProcessor.dll"] \ No newline at end of file From fcc545d9c7ace3e022bea23b966172426d711190 Mon Sep 17 00:00:00 2001 From: StuartFerguson Date: Fri, 24 Apr 2026 16:58:13 +0100 Subject: [PATCH 3/7] Update Dockerfile to create additional directories Create multiple directories for bulk file processing. --- FileProcessor/Dockerfile | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/FileProcessor/Dockerfile b/FileProcessor/Dockerfile index 6d6efa1..a57e59a 100644 --- a/FileProcessor/Dockerfile +++ b/FileProcessor/Dockerfile @@ -22,11 +22,14 @@ RUN dotnet publish "FileProcessor.csproj" -c Release -o /app/publish FROM base AS mkdir WORKDIR /home -RUN mkdir -p /home/txnproc/bulkfiles && \ - chown -R 10001:10001 /home/txnproc +RUN mkdir -p /home/txnproc/bulkfiles/temporary \ + /home/txnproc/bulkfiles/safaricom \ + /home/txnproc/bulkfiles/voucher \ + /home/txnproc/trace \ + && chown -R 10001:10001 /home/txnproc FROM mkdir AS final WORKDIR /app COPY --from=publish /app/publish . USER 10001 -ENTRYPOINT ["dotnet", "FileProcessor.dll"] \ No newline at end of file +ENTRYPOINT ["dotnet", "FileProcessor.dll"] From 4e8b8e46463b26556874fae8fb4bc7b8a6cc457e Mon Sep 17 00:00:00 2001 From: StuartFerguson Date: Fri, 24 Apr 2026 17:40:34 +0100 Subject: [PATCH 4/7] Refactor Dockerfile to clean up comments and directories Removed unnecessary comments and ensured runtime directories are created correctly. --- FileProcessor/Dockerfile | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/FileProcessor/Dockerfile b/FileProcessor/Dockerfile index a57e59a..c4f400f 100644 --- a/FileProcessor/Dockerfile +++ b/FileProcessor/Dockerfile @@ -1,5 +1,3 @@ -#See https://aka.ms/containerfastmode to understand how Visual Studio uses this Dockerfile to build your images for faster debugging. - FROM stuartferguson/txnprocbase:latest AS base WORKDIR /app @@ -22,14 +20,18 @@ RUN dotnet publish "FileProcessor.csproj" -c Release -o /app/publish FROM base AS mkdir WORKDIR /home -RUN mkdir -p /home/txnproc/bulkfiles/temporary \ +# Ensure runtime directories exist and are writable by the non-root user (see nlog.config and appsettings.json) +RUN mkdir -p /home/txnproc/config \ + /home/txnproc/trace \ + /home/txnproc/bulkfiles/temporary \ /home/txnproc/bulkfiles/safaricom \ /home/txnproc/bulkfiles/voucher \ - /home/txnproc/trace \ && chown -R 10001:10001 /home/txnproc FROM mkdir AS final WORKDIR /app COPY --from=publish /app/publish . +# If anything writes under /app at runtime (temp keys, diagnostics, etc.), avoid EACCES under USER 10001: +RUN chown -R 10001:10001 /app USER 10001 ENTRYPOINT ["dotnet", "FileProcessor.dll"] From 838423e5a5268083fdf3e7fcad529a07a929028c Mon Sep 17 00:00:00 2001 From: Stuart Ferguson Date: Fri, 24 Apr 2026 18:35:43 +0100 Subject: [PATCH 5/7] .. --- FileProcessor/nlog.config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/FileProcessor/nlog.config b/FileProcessor/nlog.config index adb458a..401f7f7 100644 --- a/FileProcessor/nlog.config +++ b/FileProcessor/nlog.config @@ -31,8 +31,8 @@ --> - - + + From 5d928150c3305c836c47a15e352ff23cd20c8bb6 Mon Sep 17 00:00:00 2001 From: Stuart Ferguson Date: Fri, 24 Apr 2026 19:33:15 +0100 Subject: [PATCH 6/7] :| --- .github/workflows/pullrequest.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pullrequest.yml b/.github/workflows/pullrequest.yml index 47b05cc..5f8de35 100644 --- a/.github/workflows/pullrequest.yml +++ b/.github/workflows/pullrequest.yml @@ -46,6 +46,14 @@ jobs: name: tracelogs path: /home/txnproc/trace/ + - name: Install tree + if: ${{ failure() }} + run: sudo apt-get update && sudo apt-get install -y tree + + - name: Show folder tree + if: ${{ failure() }} + run: tree /home/txnproc || echo "Directory missing" + - name: Publish test results uses: dorny/test-reporter@v1 if: always() @@ -53,7 +61,7 @@ jobs: name: Unit Test Results path: '**/TestResults/*.trx' reporter: dotnet-trx - fail-on-error: true + fail-on-error: false - name: Upload test results uses: actions/upload-artifact@v4 From 28e41aab5bfc72a4b76f7769076c6394dadc08fa Mon Sep 17 00:00:00 2001 From: Stuart Ferguson Date: Sat, 25 Apr 2026 08:21:00 +0100 Subject: [PATCH 7/7] .. --- .github/workflows/pullrequest.yml | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/.github/workflows/pullrequest.yml b/.github/workflows/pullrequest.yml index 5f8de35..c7a8094 100644 --- a/.github/workflows/pullrequest.yml +++ b/.github/workflows/pullrequest.yml @@ -44,15 +44,7 @@ jobs: if: ${{ failure() }} with: name: tracelogs - path: /home/txnproc/trace/ - - - name: Install tree - if: ${{ failure() }} - run: sudo apt-get update && sudo apt-get install -y tree - - - name: Show folder tree - if: ${{ failure() }} - run: tree /home/txnproc || echo "Directory missing" + path: /home/runner/trace/ - name: Publish test results uses: dorny/test-reporter@v1