fix: only chmod the nitro binary right after extracting it

[glen-84]

Summary

• installNitro marks the Nitro binary executable only in the download branch, right after tc.cacheDir. A binary that tc.find returns from the tool cache is left untouched.
• On self-hosted runners the tool cache is shared between jobs, and a job that runs in a container does so as root. When such a job is the first to cache a new Nitro release, the binary is root-owned, and the unconditional chmod +x that followed every cache hit failed with "Operation not permitted". That failed every host-user job using any Nitro action on that runner until the cache entry was deleted by hand. The cached binary is always already executable, because the job that installed it ran this same chmod.

Test plan

• yarn install --immutable and tsc --noEmit pass.
• The repo has no test runner, and the change moves one call inside an existing branch. End-to-end verification is a consumer action rebuilt against the published package and run twice on the same self-hosted runner: the first job downloads and runs chmod, the second hits the cache and skips it.

[Copilot]

🟢 Approval recommended

The change is small, locally contained, and directly addresses the reported failure mode without altering the cache-hit behavior beyond removing the failing chmod step.

Pull request overview

This PR adjusts installNitro to avoid attempting to chmod +x a Nitro binary when it was retrieved from the shared GitHub Actions tool cache, preventing failures on self-hosted runners where the cached binary may be owned by a different user (e.g., root from a container job).

Changes:

• Move chmod +x so it only runs immediately after extracting and caching a newly downloaded Nitro release.
• Leave tool-cache hits untouched to avoid EPERM/“Operation not permitted” failures on shared self-hosted runner caches.

File summaries

File	Description
src/index.ts	Restricts chmod +x to the fresh-download path to avoid failing on cache hits with mismatched file ownership.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.