Stop chowning all of ${RUNNER_TEMP} in linux_job/linux_job_v2

${RUNNER_TEMP} is not ours to chown. It also holds the runner's own
control files -- _github_workflow/event.json, _runner_file_commands/ --
and the recursive chown we issue from inside an alpine container is not
guaranteed to land on the runner's UID.

On a runner whose docker daemon remaps container UIDs it does not. The
gfx1100 ROCm runners (ctr-navi3x-b13-ws*) run rootless docker (`docker
info` reports DockerRootDir=/home/pytorchci/.local/share/docker), where
container UID 0 maps to the host runner user and container UID N>0 maps
into that user's subuid range. `chown -R $(id -u)` -- the runner's *host*
UID, expanded outside the container -- therefore lands on a subordinate
UID that nothing on the host owns. The runner then cannot read
event.json, and every remaining step of the job fails with

    ##[error]Access to the path
    '/home/pytorchci/actions-runner/_work/_temp/_github_workflow/event.json'
    is denied.

Chown only the three directories we actually hand to the container:
$RUNNER_ARTIFACT_DIR, $RUNNER_DOCS_DIR and $RUNNER_TEST_RESULTS_DIR.
Those are the bind mounts the exec container writes to as root, so they
are the only ones that need restoring, and none of them belong to the
runner. setup-linux, setup-rocm and setup-xpu all set the three env vars
to ${RUNNER_TEMP}/{artifacts,docs,test-results}.

chown-directory now no-ops on an empty or missing directory, since v1
runs these steps with `if: always()` and a skipped setup-* action leaves
the env vars unset. That also stops docker from creating the bind mount
source itself, which it would do as root.

Hoist the repeated ALPINE_IMAGE expression to a job-level env var rather
than repeat it four times.

Author: huydhn

.github/actions/chown-directory/action.yml

@@ -22,4 +22,12 @@ runs:
         ALPINE_IMAGE: ${{ inputs.ALPINE_IMAGE }}
         DIRECTORY: ${{ inputs.directory }}
       run: |
+        # A missing directory is not an error: callers pass directories that are
+        # only created by the matching setup-* action, which may have been
+        # skipped. Bailing out also keeps docker from creating the bind mount
+        # source itself, which it would do as root.
+        if [[ -z "${DIRECTORY}" || ! -d "${DIRECTORY}" ]]; then
+          echo "Nothing to chown, ${DIRECTORY:-<empty>} is not a directory"
+          exit 0
+        fi
         docker run --rm -v "${DIRECTORY}":/v -w /v "${ALPINE_IMAGE}" chown -R "$(id -u):$(id -g)" .

.github/workflows/linux_job.yml

@@ -119,6 +119,7 @@ jobs:
       # Will be blank outside of this
       PR_NUMBER: ${{ github.event.pull_request.number }}
       SCRIPT: ${{ inputs.script }}
+      ALPINE_IMAGE: ${{ startsWith(inputs.runner, 'linux.arm64') && 'arm64v8/alpine' || '308535385114.dkr.ecr.us-east-1.amazonaws.com/tool/alpine' }}
     runs-on: ${{ inputs.runner }}
     # TODO: Eventually this should run in a container, we need to make a container that matches up
     #       with the users for our self hosted runner infra since using actions/checkout with a root
@@ -280,14 +281,36 @@ jobs:
         uses: ./test-infra/.github/actions/chown-directory
         with:
           directory: ${{ github.workspace }}/${{ env.repository }}
-          ALPINE_IMAGE: ${{ startsWith(inputs.runner, 'linux.arm64') && 'arm64v8/alpine' || '308535385114.dkr.ecr.us-east-1.amazonaws.com/tool/alpine' }}
+          ALPINE_IMAGE: ${{ env.ALPINE_IMAGE }}
 
-      - name: Chown runner temp
+      # Chown only the directories we hand to the container, never the whole of
+      # ${RUNNER_TEMP}: it also holds the runner's own control files
+      # (_github_workflow/event.json, _runner_file_commands/). Those must stay
+      # owned by the runner, and a chown issued from inside a container is not
+      # guaranteed to land on the runner's UID -- on a runner whose docker
+      # daemon remaps UIDs (rootless docker) it lands on a subordinate UID
+      # instead, after which the runner cannot read event.json and every
+      # remaining step of the job fails with "Access to the path ... is denied".
+      - name: Chown runner artifacts dir
         if: always()
         uses: ./test-infra/.github/actions/chown-directory
         with:
-          directory: ${{ runner.temp }}
-          ALPINE_IMAGE: ${{ startsWith(inputs.runner, 'linux.arm64') && 'arm64v8/alpine' || '308535385114.dkr.ecr.us-east-1.amazonaws.com/tool/alpine' }}
+          directory: ${{ env.RUNNER_ARTIFACT_DIR }}
+          ALPINE_IMAGE: ${{ env.ALPINE_IMAGE }}
+
+      - name: Chown runner docs dir
+        if: always()
+        uses: ./test-infra/.github/actions/chown-directory
+        with:
+          directory: ${{ env.RUNNER_DOCS_DIR }}
+          ALPINE_IMAGE: ${{ env.ALPINE_IMAGE }}
+
+      - name: Chown runner test results dir
+        if: always()
+        uses: ./test-infra/.github/actions/chown-directory
+        with:
+          directory: ${{ env.RUNNER_TEST_RESULTS_DIR }}
+          ALPINE_IMAGE: ${{ env.ALPINE_IMAGE }}
 
       - name: Prepare artifacts for upload
         if: always()

.github/workflows/linux_job_v2.yml

@@ -137,6 +137,7 @@ jobs:
       # Will be blank outside of this
       PR_NUMBER: ${{ github.event.pull_request.number }}
       SCRIPT: ${{ inputs.script }}
+      ALPINE_IMAGE: ${{ startsWith(inputs.runner, 'linux.arm64') && 'arm64v8/alpine' || startsWith(inputs.runner, 'linux.idc') && 'alpine' || '308535385114.dkr.ecr.us-east-1.amazonaws.com/tool/alpine' }}
       filter: ${{ inputs.checkout-mode == 'blobless' && 'blob:none' || inputs.checkout-mode == 'treeless' && 'tree:0' || null }}
     runs-on: ${{ inputs.runner }}
     # TODO: Eventually this should run in a container, we need to make a container that matches up
@@ -311,13 +312,33 @@ jobs:
         uses: ./test-infra/.github/actions/chown-directory
         with:
           directory: ${{ github.workspace }}/${{ env.repository }}
-          ALPINE_IMAGE: ${{ startsWith(inputs.runner, 'linux.arm64') && 'arm64v8/alpine' || startsWith(inputs.runner, 'linux.idc') && 'alpine' || '308535385114.dkr.ecr.us-east-1.amazonaws.com/tool/alpine' }}
+          ALPINE_IMAGE: ${{ env.ALPINE_IMAGE }}
 
-      - name: Chown runner temp
+      # Chown only the directories we hand to the container, never the whole of
+      # ${RUNNER_TEMP}: it also holds the runner's own control files
+      # (_github_workflow/event.json, _runner_file_commands/). Those must stay
+      # owned by the runner, and a chown issued from inside a container is not
+      # guaranteed to land on the runner's UID -- on a runner whose docker
+      # daemon remaps UIDs (rootless docker) it lands on a subordinate UID
+      # instead, after which the runner cannot read event.json and every
+      # remaining step of the job fails with "Access to the path ... is denied".
+      - name: Chown runner artifacts dir
         uses: ./test-infra/.github/actions/chown-directory
         with:
-          directory: ${{ runner.temp }}
-          ALPINE_IMAGE: ${{ startsWith(inputs.runner, 'linux.arm64') && 'arm64v8/alpine' || startsWith(inputs.runner, 'linux.idc') && 'alpine' || '308535385114.dkr.ecr.us-east-1.amazonaws.com/tool/alpine' }}
+          directory: ${{ env.RUNNER_ARTIFACT_DIR }}
+          ALPINE_IMAGE: ${{ env.ALPINE_IMAGE }}
+
+      - name: Chown runner docs dir
+        uses: ./test-infra/.github/actions/chown-directory
+        with:
+          directory: ${{ env.RUNNER_DOCS_DIR }}
+          ALPINE_IMAGE: ${{ env.ALPINE_IMAGE }}
+
+      - name: Chown runner test results dir
+        uses: ./test-infra/.github/actions/chown-directory
+        with:
+          directory: ${{ env.RUNNER_TEST_RESULTS_DIR }}
+          ALPINE_IMAGE: ${{ env.ALPINE_IMAGE }}
 
       - name: Prepare artifacts for upload
         if: always()