chore(webview): address CodeRabbit review feedback

Author: edelauna

.github/workflows/visual-regression.yml

@@ -26,6 +26,8 @@ jobs:
         steps:
             - name: Checkout code
               uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              with:
+                  persist-credentials: false
             - name: Setup Node.js and pnpm
               uses: ./.github/actions/setup-node-pnpm
               with:

webview-ui/package.json

@@ -9,7 +9,6 @@
 		"test": "vitest run",
 		"test:coverage": "vitest run --coverage",
 		"test:visual": "playwright test -c playwright-ct.config.ts",
-		"test:visual:update": "playwright test -c playwright-ct.config.ts --update-snapshots",
 		"test:visual:docker": "node playwright/run-docker.mjs",
 		"test:visual:docker:update": "node playwright/run-docker.mjs --update",
 		"format": "prettier --write src",

webview-ui/playwright/run-docker.mjs

@@ -9,13 +9,25 @@ const updateSnapshots = process.argv.includes("--update")
 const composeArgs = ["-f", composeFile, "run", "--rm", "visual"]
 
 if (updateSnapshots) {
-	composeArgs.push("sh", "-lc", "corepack pnpm --filter @roo-code/vscode-webview test:visual:update")
+	// Inlined so host-rendered baselines aren't reachable via a `pnpm` script.
+	composeArgs.push(
+		"sh",
+		"-lc",
+		"corepack pnpm --filter @roo-code/vscode-webview exec playwright test -c playwright-ct.config.ts --update-snapshots",
+	)
+}
+
+// Compose falls back to UID 1000 if not passed; that mis-owns generated files.
+const spawnEnv = {
+	...process.env,
+	UID: String(process.getuid?.() ?? 1000),
+	GID: String(process.getgid?.() ?? 1000),
 }
 
 const hasComposePlugin = spawnSync("docker", ["compose", "version"], { stdio: "ignore" }).status === 0
 const command = hasComposePlugin ? "docker" : "docker-compose"
 const args = hasComposePlugin ? ["compose", ...composeArgs] : composeArgs
-const result = spawnSync(command, args, { stdio: "inherit" })
+const result = spawnSync(command, args, { stdio: "inherit", env: spawnEnv })
 
 if (result.error) {
 	console.error(`Unable to run ${command}: ${result.error.message}`)