From d0d7d64434a8b96b9f7cc154b4643125e65d0d63 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=B1=9F=E6=9E=97=E9=93=96?=
 <jianglincheng@jianglinchengdeMacBook-Pro.local>
Date: Tue, 25 Aug 2026 09:29:50 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E7=94=9F=E4=BA=A7=E8=BF=81?=
 =?UTF-8?q?=E7=A7=BB=E9=95=9C=E5=83=8F=E5=BC=95=E6=93=8E=E6=9D=83=E9=99=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Dockerfile                               | 2 ++
 scripts/safe-production-migrate.test.mjs | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 567833f..95e46c4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -140,6 +140,8 @@ COPY --from=builder /app/scripts/safe-production-migrate.mjs ./scripts/safe-prod
 COPY --from=builder /app/scripts/create-verified-production-backup.mjs ./scripts/create-verified-production-backup.mjs
 COPY --from=builder /app/DEPLOYMENT_COMMIT /app/DEPLOYMENT_COMMIT
 RUN test "$(cat /app/DEPLOYMENT_COMMIT)" = "$VCS_REF" && \
+    test -x /app/node_modules/prisma/node_modules/@prisma/engines/schema-engine-linux-musl && \
+    chown -R node:node /app/node_modules/prisma/node_modules/@prisma/engines && \
     chmod -R a-w /app/prisma /app/scripts /app/DEPLOYMENT_COMMIT
 USER node
 ENTRYPOINT ["node", "scripts/safe-production-migrate.mjs"]
diff --git a/scripts/safe-production-migrate.test.mjs b/scripts/safe-production-migrate.test.mjs
index 2ed67f8..1e580ae 100644
--- a/scripts/safe-production-migrate.test.mjs
+++ b/scripts/safe-production-migrate.test.mjs
@@ -519,6 +519,8 @@ test('container supply chain and migrator image are immutable while SOP keeps co
   assert.match(migrator, /command -v pg_restore >\/dev\/null/)
   assert.match(migrator, /command -v psql >\/dev\/null/)
   assert.match(migrator, /COPY --from=builder \/app\/scripts\/create-verified-production-backup\.mjs/)
+  assert.match(migrator, /test -x \/app\/node_modules\/prisma\/node_modules\/@prisma\/engines\/schema-engine-linux-musl/)
+  assert.match(migrator, /chown -R node:node \/app\/node_modules\/prisma\/node_modules\/@prisma\/engines/)
   assert.match(sop, /tar -xOf "\$MIGRATOR_ARCHIVE" manifest\.json/)
   assert.match(sop, /entry\.RepoTags\.includes\(image\)/)
   assert.match(sop, /\^blobs\\\/sha256\\\/\(\[0-9a-f\]\{64\}\)\$/)