[build-tools] Normalize extracted project permissions

[expo-tuft]

Why

A seven-day EAS Build scan found 2,934 Android prebuild failures across 783 accounts and 816 apps with:

withAndroidDangerousBaseMod: EACCES: permission denied, open './assets/images/android-icon-foreground.png'

The cluster accelerated from 87 events in the preceding week to 2,354 and then 2,934. The project archive can contain source entries that are readable by the producing environment but retain permissions that make them unreadable after extraction by the Unix EAS worker user.

Sanitized Datadog evidence

What changed

After extracting a project archive, normalize its owner permissions with chmod -R u+rwX. This makes source files readable/writable by the worker and directories traversable, while preserving executable semantics: uppercase X only adds execute permission to directories and files that were executable already.

This applies at the worker/build-tools boundary, so it also covers archives produced outside the standard EAS CLI packaging path.

Reproduction

• Production EAS Build 3fa68caf fails in PREBUILD with the exact withAndroidDangerousBaseMod: EACCES: permission denied signature after an intentionally malformed archive records one source file as mode 000.
• A synthetic project tarball with unreadable source entries reproduces the worker-side EACCES after the current GNU tar extraction command; the added normalization makes the same file readable.
• A Windows → Ubuntu archive investigation tested normal, read-only, and chmod-zero files through tar portable: true. Ordinary Windows packaging normalized all three to readable 0644, so generic Windows EAS CLI packaging is not claimed as the root cause.
• The sanitized case record, classifier, and reproduction are tracked in expo/build-watch#6.

Validation

• Staging A/B with the same malformed archive and project fingerprint:
  • Baseline worker build d00c8de7 errored in PREBUILD with the expected EACCES.
  • Patched worker build 3d8eebff finished and produced an APK. The worker used the same effective patch at commit 843b77d; this PR was subsequently rebased without changing the patch.
  • Staging worker deployment
• @expo/build-tools unit suite: 109 suites, 1,093 tests
• @expo/build-tools typecheck
• Focused extraction regression test
• Synthetic baseline/fixed GNU tar reproduction
• Cross-platform Windows → Ubuntu archive run

Author

@AbbanMustafa

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.70%. Comparing base (dfaa2df) to head (794b7ef).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4287      +/-   ##
==========================================
+ Coverage   64.70%   64.70%   +0.01%     
==========================================
  Files        1048     1048              
  Lines       48474    48477       +3     
  Branches    10218    10218              
==========================================
+ Hits        31359    31362       +3     
  Misses      16999    16999              
  Partials      116      116              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[expo-tuft]

Validated end-to-end on staging with a project archive that records the source asset used during Android prebuild as mode 000.

• Baseline staging worker: d00c8de7-0355-49ac-a636-cb13a99afa14 — ERRORED in PREBUILD with withAndroidDangerousBaseMod: EACCES: permission denied while opening unreadable-archive-asset.txt.
• PR staging worker (843b77d): 3d8eebff-7523-47c8-a51c-dc2f9870fe8a — FINISHED, APK produced.
• Worker deploy: 32986510160.

[sjchmiela]

shall we add some log so it's clear to users we're doing that?

[expo-tuft]

Added in 794b7ef: the worker now logs Normalizing project source permissions immediately before the recursive chmod, with a focused assertion covering the user-visible log. Focused tests, build-tools typecheck, and formatting pass.

[github-actions]

✅ Thank you for adding the changelog entry!