fix: Remove executable bit from default file mode (#14497) (#14576)

* Fix file/directory opening mode



* Fix TestUntgz/preserves_file_mode



* Mention file mode fix in 2.7-2.8 release docs



---------

Signed-off-by: ramikg <72725910+ramikg@users.noreply.github.com>
Co-authored-by: Rami <72725910+ramikg@users.noreply.github.com>

docs/operator-manual/upgrading/2.7-2.8.md

@@ -65,3 +65,8 @@ p, role:action-runner, applications, action/argoproj.io/WorkflowTemplate/create-
 p, role:action-runner, applications, action/argoproj.io/CronWorkflow/create-workflow, *, allow
 p, role:action-runner, applications, action/batch/CronJob/create-job, *, allow
 ```
+
+## Change default file open mode
+
+In version 2.7, the CMP plugin was changed to open Git/Helm files with all executable bits set (unless `preserveFileMode` was specified).  
+Version 2.8 removes the executable bits in cases where they are not necessary.

util/io/files/tar.go

@@ -90,13 +90,12 @@ func Untgz(dstPath string, r io.Reader, maxSize int64, preserveFileMode bool) er
 			return fmt.Errorf("illegal filepath in archive: %s", target)
 		}
 
-		var mode os.FileMode = 0755
-		if preserveFileMode {
-			mode = os.FileMode(header.Mode)
-		}
-
 		switch header.Typeflag {
 		case tar.TypeDir:
+			var mode os.FileMode = 0755
+			if preserveFileMode {
+				mode = os.FileMode(header.Mode)
+			}
 			err := os.MkdirAll(target, mode)
 			if err != nil {
 				return fmt.Errorf("error creating nested folders: %w", err)
@@ -118,6 +117,11 @@ func Untgz(dstPath string, r io.Reader, maxSize int64, preserveFileMode bool) er
 				return fmt.Errorf("error creating symlink: %s", err)
 			}
 		case tar.TypeReg:
+			var mode os.FileMode = 0644
+			if preserveFileMode {
+				mode = os.FileMode(header.Mode)
+			}
+
 			err := os.MkdirAll(filepath.Dir(target), 0755)
 			if err != nil {
 				return fmt.Errorf("error creating nested folders: %w", err)

util/io/files/tar_test.go

@@ -216,7 +216,7 @@ func TestUntgz(t *testing.T) {
 
 		scriptFileInfo, err := os.Stat(path.Join(destDir, "script.sh"))
 		require.NoError(t, err)
-		assert.Equal(t, os.FileMode(0755), scriptFileInfo.Mode())
+		assert.Equal(t, os.FileMode(0644), scriptFileInfo.Mode())
 	})
 }