From 68bd23a3f40318a6411f5c6f49d03e9961cf7d6f Mon Sep 17 00:00:00 2001
From: Constantin Lungu <lungupconstantin@gmail.com>
Date: Sun, 13 Sep 2026 22:45:17 +0300
Subject: [PATCH 1/2] EXPERIMENT: superset connects read-only, no CI chmod

---
 .github/workflows/ci.yml | 5 -----
 superset/Dockerfile      | 3 ++-
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aadba9e..65d97b6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,11 +35,6 @@ jobs:
           cp .env.example .env
           mkdir -p shared/db
           cp shared/db/datamart.duckdb.example shared/db/datamart.duckdb
-          # The Superset container runs as uid 1000 and DuckDB opens the warehouse
-          # read-write, so the bind-mounted file and its directory (for the .wal)
-          # have to be writable by a user the runner does not share a uid with.
-          chmod a+rwx shared/db
-          chmod a+rw shared/db/datamart.duckdb
 
       - name: Build images
         run: docker compose build
diff --git a/superset/Dockerfile b/superset/Dockerfile
index 9bf1a6b..7b3c057 100644
--- a/superset/Dockerfile
+++ b/superset/Dockerfile
@@ -19,4 +19,5 @@ RUN superset fab create-admin \
               --password ${SUPERSET_PASSWORD}
 RUN superset db upgrade
 RUN superset init
-RUN superset set_database_uri -d DW  -u duckdb:///superset_home/db/datamart.duckdb
+RUN superset set_database_uri -d DW \
+    -u "duckdb:///superset_home/db/datamart.duckdb?access_mode=read_only"

From 4ccbcc856852fe13cce1ea91b8a6f70753d96822 Mon Sep 17 00:00:00 2001
From: Constantin Lungu <lungupconstantin@gmail.com>
Date: Sun, 13 Sep 2026 22:49:06 +0300
Subject: [PATCH 2/2] TEMP: capture read_only failure detail

---
 .github/workflows/ci.yml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 65d97b6..0c0e7f0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,7 +40,22 @@ jobs:
         run: docker compose build
 
       - name: Start the stack
-        run: docker compose up --detach
+        run: |
+          set +e
+          docker compose up --detach
+          echo "::notice::compose up exit=$?"
+          set -e
+          echo "=== host-side file ==="
+          ls -ln shared/db/
+          echo "=== as seen inside superset ==="
+          docker compose exec -T superset id
+          docker compose exec -T superset ls -ln /app/superset_home/db/
+          echo "=== stored connection uri ==="
+          docker compose exec -T superset sh -lc "superset db-connection list 2>/dev/null || true"
+          echo "=== direct duckdb read_only open ==="
+          docker compose exec -T superset python -c "import duckdb; duckdb.connect('/app/superset_home/db/datamart.duckdb', read_only=True); print('read_only open OK')" || echo "read_only open FAILED"
+          echo "=== the post_start command by hand ==="
+          docker compose exec -T superset sh -lc 'superset import-dashboards -p ./dashboard.zip -u admin 2>&1 | tail -25; echo "exit=${PIPESTATUS[0]}"' || true
 
       - name: Wait for services
         run: |