[bcurcin-godaddy]

Adds USER node to the gren release-tooling Dockerfile, making the existing unprivileged account the image’s default runtime user. Package installation remains before this instruction and continues to run as root.

The Makefile’s existing -u $(CURRENT_UID):$(CURRENT_GID) override remains unchanged, preserving host-user ownership of generated files in the mounted checkout. No entrypoint or release-workflow changes are required.

Validation:

• Semgrep reproduces the missing-user finding on the original Dockerfile and reports none on the modified file.
• Focused container checks verified UID/GID 1000:1000, access to the CI files, and execution of gren --version as the non-root user.
• The host UID/GID override and generated-file ownership were verified.
• Whitespace checks passed.

Complete builds of both the original and modified Dockerfiles fail at the unchanged APT step because Debian Stretch repository URLs return HTTP 404. Focused runtime checks omitted that failing step; the base-image upgrade remains separate work.

After merge, rescanning should confirm closure of both alerts, including the entrypoint-specific rule that was not separately tested locally.

Created by GPT-6-Astra.

[cla-checker-service]

❌ Author of the following commits did not sign a Contributor Agreement:
, 24086c6, 5583c43, 9a9fbe5

Please, read and sign the above mentioned agreement if you want to contribute to this project

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[bcurcin-godaddy]

Closing: retargeting this change to gdcorp-wordpress/ecs-logging-php:main (cannot change base repo on an existing PR).