wp-cli in a pipeline, and the user it runs as

A deploy step running WP-CLI as root, and every file it touches becoming unwritable by the web process.

# in the pipeline
docker compose exec -T -u www-data php 
  wp core update-db

# and the check that catches the alternative
docker compose exec -T php 
  find /var/www/html/wp-content -not -user www-data -print -quit 
  | grep -q . && { echo 'ownership drift'; exit 1; }

The --allow-root flag makes the warning go away and makes the ownership problem worse, which is why it is the wrong reflex. The find check is one line in the deploy and catches the whole category — including a plugin update run through the admin as a different user, which is the case the flag discussion never covers.