From a472f6002626818d12706cad346d033e60a00390 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 13 Jul 2026 13:56:33 +0000
Subject: [PATCH 1/4] Fix Docker CI build failures

---
 Dockerfile.base    | 7 +++++--
 Dockerfile.sandbox | 2 +-
 Dockerfile.web     | 2 +-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/Dockerfile.base b/Dockerfile.base
index 3ef95bd..0e139f7 100644
--- a/Dockerfile.base
+++ b/Dockerfile.base
@@ -14,11 +14,14 @@ RUN curl -fsSL -o /tmp/covscript.7z \
       "https://github.com/covscript/csbuild/releases/download/${CS_TAG}/covscript-ubuntu-${CS_ARCH}.7z" \
     && curl -fsSL -o /tmp/cspkg.7z \
       "https://github.com/covscript/csbuild/releases/download/${CS_TAG}/cspkg-ubuntu-${CS_ARCH}.7z" \
-    && 7z x /tmp/covscript.7z -o/opt/covscript -y \
+    && mkdir -p /opt/covscript-tmp \
+    && 7z x /tmp/covscript.7z -o/opt/covscript-tmp -y \
+    && mkdir -p /opt/covscript \
+    && sh -c 'if [ -d /opt/covscript-tmp/build ]; then mv /opt/covscript-tmp/build/* /opt/covscript/; else mv /opt/covscript-tmp/* /opt/covscript/; fi' \
     && mkdir -p /opt/covscript/cspkg-repo \
     && 7z x /tmp/cspkg.7z -o/opt/pkg-tmp -y \
     && sh -c 'if [ -d /opt/pkg-tmp/cspkg-repo ]; then mv /opt/pkg-tmp/cspkg-repo/* /opt/covscript/cspkg-repo/; else mv /opt/pkg-tmp/* /opt/covscript/cspkg-repo/; fi' \
-    && rm -rf /tmp/covscript.7z /tmp/cspkg.7z /opt/pkg-tmp
+    && rm -rf /tmp/covscript.7z /tmp/cspkg.7z /opt/covscript-tmp /opt/pkg-tmp
 
 ENV COVSCRIPT_HOME=/opt/covscript
 ENV PATH=/opt/covscript/bin:$PATH
diff --git a/Dockerfile.sandbox b/Dockerfile.sandbox
index 4f71026..658b5c4 100644
--- a/Dockerfile.sandbox
+++ b/Dockerfile.sandbox
@@ -1,6 +1,6 @@
 ARG BASE_IMAGE=covscript-base:latest
 FROM ${BASE_IMAGE}
-RUN useradd -m -s /bin/bash sandbox && mkdir -p /app/data && chown sandbox:sandbox /app/data
+RUN useradd -m -s /bin/bash sandbox && mkdir -p /app/data && chown -R sandbox:sandbox /app
 USER sandbox
 WORKDIR /app
 COPY --chown=sandbox:sandbox configs/sandbox.json config.json
diff --git a/Dockerfile.web b/Dockerfile.web
index dc8b4f1..d5bb36a 100644
--- a/Dockerfile.web
+++ b/Dockerfile.web
@@ -1,4 +1,5 @@
 # Stage 1: Frontend build
+ARG BASE_IMAGE=covscript-base:latest
 FROM node:20-alpine AS frontend
 WORKDIR /app
 COPY package.json package-lock.json ./
@@ -9,7 +10,6 @@ COPY index.html vite.config.js ./
 RUN npm run build
 
 # Stage 2: Web server
-ARG BASE_IMAGE=covscript-base:latest
 FROM ${BASE_IMAGE}
 WORKDIR /app
 COPY configs/web.json config.json

From 74adea0f5290d771f02d35a86f076d7e412eb1cf Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 13 Jul 2026 14:16:02 +0000
Subject: [PATCH 2/4] Fix ghcr.io registry cache 403 on PR builds

---
 .github/workflows/docker.yml | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index faf51b7..0955aa5 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -55,6 +55,17 @@ jobs:
             type=sha,prefix=,format=short
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
 
+      - name: Set build cache options
+        id: cache
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo "from=" >> "$GITHUB_OUTPUT"
+            echo "to=" >> "$GITHUB_OUTPUT"
+          else
+            echo "from=type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/buildcache:base" >> "$GITHUB_OUTPUT"
+            echo "to=type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/buildcache:base,mode=max" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Build and push base image
         uses: docker/build-push-action@v6
         with:
@@ -62,8 +73,8 @@ jobs:
           file: Dockerfile.base
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/base:${{ steps.meta.outputs.version }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/buildcache:base
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/buildcache:base,mode=max
+          cache-from: ${{ steps.cache.outputs.from }}
+          cache-to: ${{ steps.cache.outputs.to }}
 
       - name: Build and push web image
         uses: docker/build-push-action@v6
@@ -75,8 +86,8 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/buildcache:base
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/buildcache:base,mode=max
+          cache-from: ${{ steps.cache.outputs.from }}
+          cache-to: ${{ steps.cache.outputs.to }}
 
       - name: Build and push sandbox image
         uses: docker/build-push-action@v6
@@ -90,5 +101,5 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/sandbox:${{ steps.meta.outputs.version }}
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/sandbox:latest
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/buildcache:base
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/buildcache:base,mode=max
+          cache-from: ${{ steps.cache.outputs.from }}
+          cache-to: ${{ steps.cache.outputs.to }}

From 36caebbb4038a26a0f796d6a75739993283daa6c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 13 Jul 2026 14:20:48 +0000
Subject: [PATCH 3/4] Fix ghcr.io anonymous pull 403 for PR builds by using
 docker buildx driver

---
 .github/workflows/docker.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 0955aa5..9ab7b2b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -36,6 +36,14 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          # PR builds don't log in or push, so the base image built in this job
+          # must stay in the local Docker image store for the web/sandbox stages
+          # to consume via FROM without pulling from (or pushing to) ghcr.io.
+          # The classic "docker" driver shares images with the host daemon
+          # automatically; the "docker-container" driver (needed for registry
+          # cache export/import) does not.
+          driver: ${{ github.event_name == 'pull_request' && 'docker' || 'docker-container' }}
 
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'

From 6291153771fdff8cd42753d2b920107efe62573b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 13 Jul 2026 14:21:56 +0000
Subject: [PATCH 4/4] Add clarifying comments per GHCR docs and code review

---
 .github/workflows/docker.yml | 7 +++++++
 Dockerfile.base              | 7 ++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 9ab7b2b..af95e4a 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -66,6 +66,13 @@ jobs:
       - name: Set build cache options
         id: cache
         run: |
+          # Registry cache import/export requires authentication. PR builds
+          # don't log in to ghcr.io (see step above) and packages published
+          # via GITHUB_TOKEN are private by default (see
+          # https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry),
+          # so an anonymous cache pull/push would fail with 403. Leaving these
+          # empty simply disables cache import/export for PR builds; it does
+          # not require any manual package visibility change on GitHub.
           if [ "${{ github.event_name }}" = "pull_request" ]; then
             echo "from=" >> "$GITHUB_OUTPUT"
             echo "to=" >> "$GITHUB_OUTPUT"
diff --git a/Dockerfile.base b/Dockerfile.base
index 0e139f7..9861e8b 100644
--- a/Dockerfile.base
+++ b/Dockerfile.base
@@ -9,7 +9,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 ARG CS_TAG=ubuntu-schedule-release
 ARG CS_ARCH=x86_64
 
-# Download and extract CovScript SDK + cspkg repo
+# Download and extract CovScript SDK + cspkg repo.
+# The upstream release archives are not guaranteed to have a stable internal
+# layout across csbuild versions: some releases place the SDK files directly
+# at the archive root, while others nest them under a top-level "build/" (or
+# "cspkg-repo/") directory. The conditional moves below normalize either
+# layout into the expected /opt/covscript and /opt/covscript/cspkg-repo paths.
 RUN curl -fsSL -o /tmp/covscript.7z \
       "https://github.com/covscript/csbuild/releases/download/${CS_TAG}/covscript-ubuntu-${CS_ARCH}.7z" \
     && curl -fsSL -o /tmp/cspkg.7z \