Make ordinary workspaces group shareable

internal/manifest/store.go

@@ -8,6 +8,8 @@ import (
 	"path/filepath"
 	"strings"
 	"time"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
 // Store persists manifests to and from durable storage.
@@ -90,7 +92,7 @@ func (s *LocalStore) Save(ctx context.Context, path string, m *Manifest) error {
 	data = append(data, '\n')
 
 	dir := filepath.Dir(path)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := fileops.EnsureWorkspaceDirectory(dir); err != nil {
 		return fmt.Errorf("save manifest: create directory %q: %w", dir, err)
 	}
 
@@ -117,6 +119,9 @@ func (s *LocalStore) Save(ctx context.Context, path string, m *Manifest) error {
 	if err := tmp.Close(); err != nil {
 		return fmt.Errorf("save manifest: close temp file: %w", err)
 	}
+	if err := os.Chmod(tmpName, fileops.WorkspaceFileMode); err != nil {
+		return fmt.Errorf("save manifest: set temp file permissions: %w", err)
+	}
 	if err := checkContext(ctx); err != nil {
 		return err
 	}
@@ -287,7 +292,7 @@ func normalizeRunManifest(m *RunManifest) {
 
 func writeJSONAtomically(ctx context.Context, path, tempPattern string, data []byte) error {
 	dir := filepath.Dir(path)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := fileops.EnsureWorkspaceDirectory(dir); err != nil {
 		return fmt.Errorf("create directory %q: %w", dir, err)
 	}
 
@@ -314,6 +319,9 @@ func writeJSONAtomically(ctx context.Context, path, tempPattern string, data []b
 	if err := tmp.Close(); err != nil {
 		return fmt.Errorf("close temp file: %w", err)
 	}
+	if err := os.Chmod(tmpName, fileops.WorkspaceFileMode); err != nil {
+		return fmt.Errorf("set temp file permissions: %w", err)
+	}
 	if err := checkContext(ctx); err != nil {
 		return err
 	}