Improve Deploy Speed by Replacing Slow Permissions Task (drupal:permissions:recommended)

[StirStudios]

🚀 Improve Deploy Speed by Replacing Slow Permissions Task (drupal:permissions:recommended)

🗬️ Is your feature request related to a problem? Please describe.

Capistrano deploys using drupal:permissions:recommended spend 40–50 seconds running:

find ./ -type f ! -perm 444 -exec chmod 444 {} \;

This task is one of the biggest bottlenecks during our Drupal deployment process. For teams doing 100–200 deploys per month across multiple projects, this results in hours of cumulative time lost.

The current approach is also overly strict on how it applies file-level permissions — running one chmod per file rather than batching them efficiently.

🧾 Describe the solution you'd like

We replaced drupal:permissions:recommended with a new task:

desc 'Apply secure file & directory permissions to full release (files 444, dirs 555)'
task :secure_release_permissions do
  on roles(:app) do
    within release_path do
      info "🔐 Securing file & directory permissions on release..."
      execute :find, '.', '-type', 'f', '!', '-perm', '444', '-exec', 'chmod', '444', '{}', '+'
      execute :find, '.', '-type', 'd', '!', '-perm', '555', '-exec', 'chmod', '555', '{}', '+'
    end
  end
end

This drops deployment time by 45+ seconds per deploy, while preserving the same security posture — locking files to read-only (444) and directories to execute-only (555) for non-writable shared folders.

☝️ Describe alternatives you've considered

• Keeping the original drupal:permissions:recommended task (but it's too slow)
• Running chmod -R manually (not safe, as it recursively applies wrong perms to writable folders)
• Delaying permissions until after release activation (adds complexity and risk)

This fast replacement is safe, atomic, and backwards-compatible — just needs to be swapped into the Capistrano flow with:

after :updated, "drupal:permissions:secure_release_permissions"

Let me know if you'd like a PR — happy to upstream it!

[gido]

Oh, I will study your proposition as I also found this task extremely slow.
Thanks!

[StirStudios]

Hey @gido thanks so much for taking this into consideration.

I have been tweaking this a little as I realized this was affecting CLI commands, Drush etc, here is what I have been using successfully:

desc 'Apply secure file & directory permissions to full release (files 444, dirs 555, executables 555)'
task :secure_release_permissions do
  on roles(:app) do
    within release_path do
      info "Securing file & directory permissions on release..."
      writable = "#{fetch(:app_path)}/sites/#{fetch(:site_path)}/files"

      # Lock files (not executable, not in writable)
      execute :find, '.', '-path', "./#{writable}", '-prune', '-o',
                      '-type', 'f', '!', '-executable', '!', '-perm', '444',
                      '-exec', 'chmod', '444', '{}', '+'

      # Lock executables (outside writable)
      execute :find, '.', '-path', "./#{writable}", '-prune', '-o',
                      '-type', 'f', '-executable', '!', '-perm', '555',
                      '-exec', 'chmod', '555', '{}', '+'
 
     # Lock directories (outside writable)
     execute :find, '.', '-path', "./#{writable}", '-prune', '-o',
                      '-type', 'd', '!', '-perm', '555',
                      '-exec', 'chmod', '555', '{}', '+'
    end
  end
end

Let me know what else I can do.