Harden deploy permission repair

scripts/deploy_gitlab.sh

@@ -66,26 +66,22 @@ repair_deploy_permissions() {
     alpine:3.21 \
     sh -lc '
       set -eu
-      prune_expr="
-        -path /deploy/.env.production -o
-        -path /deploy/.env.production.* -o
-        -path /deploy/.data -o -path /deploy/.data/* -o
-        -path /deploy/.data_local -o -path /deploy/.data_local/* -o
-        -path /deploy/.data_gate3 -o -path /deploy/.data_gate3/* -o
-        -path /deploy/.data_gate4 -o -path /deploy/.data_gate4/* -o
-        -path /deploy/.data_uat_dry_run -o -path /deploy/.data_uat_dry_run/* -o
-        -path /deploy/.data_uat_preflight -o -path /deploy/.data_uat_preflight/* -o
-        -path /deploy/.models -o -path /deploy/.models/* -o
-        -path /deploy/.asterisk_assets -o -path /deploy/.asterisk_assets/* -o
-        -path /deploy/.db_backups -o -path /deploy/.db_backups/* -o
-        -path /deploy/.deploy_backups -o -path /deploy/.deploy_backups/*
-      "
-      # shellcheck disable=SC2086
-      find /deploy \( $prune_expr \) -prune -o -exec chown "$TARGET_UID:$TARGET_GID" {} +
-      # shellcheck disable=SC2086
-      find /deploy \( $prune_expr \) -prune -o -type d -exec chmod u+rwx {} +
-      # shellcheck disable=SC2086
-      find /deploy \( $prune_expr \) -prune -o -type f -exec chmod u+rw {} +
+      chown "$TARGET_UID:$TARGET_GID" /deploy
+      chmod u+rwx /deploy
+      for path in /deploy/* /deploy/.[!.]* /deploy/..?*; do
+        [ -e "$path" ] || continue
+        case "$path" in
+          /deploy/.env.production|/deploy/.env.production.*|\
+          /deploy/.data|/deploy/.data_local|/deploy/.data_gate3|/deploy/.data_gate4|\
+          /deploy/.data_uat_dry_run|/deploy/.data_uat_preflight|\
+          /deploy/.models|/deploy/.asterisk_assets|/deploy/.db_backups|/deploy/.deploy_backups)
+            continue
+            ;;
+        esac
+        chown -R "$TARGET_UID:$TARGET_GID" "$path"
+        find "$path" -type d -exec chmod u+rwx {} +
+        find "$path" -type f -exec chmod u+rw {} +
+      done
     '
 }