From 0dd6138d05ad2cef3e50c388d2bb5b7a53c0e603 Mon Sep 17 00:00:00 2001
From: jenkins <brad@bstein.dev>
Date: Sun, 23 Aug 2026 23:10:26 -0300
Subject: [PATCH] ci(hermes): permit WebUI test package setup

---
 ci/Jenkinsfile.hermes-webui-image          |  5 +++--
 testing/tests/test_hermes_webui_release.py | 10 ++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/ci/Jenkinsfile.hermes-webui-image b/ci/Jenkinsfile.hermes-webui-image
index 47797ea0..f673fbce 100644
--- a/ci/Jenkinsfile.hermes-webui-image
+++ b/ci/Jenkinsfile.hermes-webui-image
@@ -59,8 +59,9 @@ spec:
         allowPrivilegeEscalation: false
         capabilities:
           drop: ["ALL"]
-        runAsNonRoot: true
-        runAsUser: 1000
+          add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETGID", "SETUID"]
+        runAsNonRoot: false
+        runAsUser: 0
         seccompProfile:
           type: RuntimeDefault
       resources:
diff --git a/testing/tests/test_hermes_webui_release.py b/testing/tests/test_hermes_webui_release.py
index bea7841d..d2646e4c 100644
--- a/testing/tests/test_hermes_webui_release.py
+++ b/testing/tests/test_hermes_webui_release.py
@@ -137,6 +137,16 @@ def test_pipeline_builds_exact_reviewed_anchor_from_main() -> None:
     assert spec["enableServiceLinks"] is False
     containers = {item["name"]: item for item in spec["containers"]}
     assert "kaniko" in containers
+    python_security = containers["python"]["securityContext"]
+    assert python_security["runAsUser"] == 0
+    assert python_security["runAsNonRoot"] is False
+    assert set(python_security["capabilities"]["add"]) == {
+        "CHOWN",
+        "FOWNER",
+        "DAC_OVERRIDE",
+        "SETGID",
+        "SETUID",
+    }
     assert containers["kaniko"]["resources"]["requests"]["ephemeral-storage"] == "10Gi"
     assert containers["kaniko"]["resources"]["limits"]["ephemeral-storage"] == "20Gi"
     assert spec["nodeSelector"] == {"kubernetes.io/arch": "arm64"}