fix(deploy): resolve permission issues and stabilize asset build context

.gitea/workflows/deploy.yml

@@ -316,6 +316,7 @@ jobs:
             S3_BUCKET=${{ secrets.S3_BUCKET || vars.S3_BUCKET || 'mintel' }}
             S3_REGION=${{ secrets.S3_REGION || vars.S3_REGION || 'fsn1' }}
             S3_PREFIX=${{ secrets.S3_PREFIX || vars.S3_PREFIX || 'mintel.me' }}
+            BUILD_ID=${{ github.sha }}
           tags: registry.infra.mintel.me/mintel/mintel.me:${{ needs.prepare.outputs.image_tag }}
           cache-from: type=registry,ref=registry.infra.mintel.me/mintel/mintel.me:buildcache-${{ needs.prepare.outputs.target }}
           cache-to: type=registry,ref=registry.infra.mintel.me/mintel/mintel.me:buildcache-${{ needs.prepare.outputs.target }},mode=max

Dockerfile

@@ -13,6 +13,7 @@ ARG S3_SECRET_KEY
 ARG S3_BUCKET
 ARG S3_REGION
 ARG S3_PREFIX
+ARG BUILD_ID
 
 # Environment variables for Next.js build
 ENV NEXT_PUBLIC_BASE_URL=$NEXT_PUBLIC_BASE_URL
@@ -47,6 +48,10 @@ RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
     rm .npmrc
 
 # Copy source code
+# We use BUILD_ID here to ensure that if the commit changes, we always COPY the latest files
+# even if Docker's metadata-based fingerprinting for the public directory fails.
+ARG BUILD_ID
+RUN echo "Building with ID: ${BUILD_ID}"
 COPY . .
 
 # Build application (monorepo filter)
@@ -65,6 +70,13 @@ COPY --from=builder /app/apps/web/.next/static ./apps/web/.next/static
 
 # Explicitly copy Payload dynamically generated importMap.js excluded by Standalone tracing
 COPY --from=builder /app/apps/web/app/(payload)/admin/importMap.js ./apps/web/app/(payload)/admin/importMap.js
+
+# Fix permissions for the non-root user (Standard uid/gid from base image)
+# We do this as root before switching users
+USER root
+RUN chown -R 1001:65533 /app
+USER nextjs
+
 # Start from the app directory to ensure references solve correctly
 WORKDIR /app/apps/web
 CMD ["node", "server.js"]