From bab5cf059d26735b5f13b621e75c2d56ba8e5b81 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Sun, 10 May 2026 22:21:48 +0300 Subject: ci: clean self-hosted runner workspace after each job MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Self-hosted runners don't auto-clean their workspace between jobs, so PR fork content + cloned vyos-1x source + downloaded reference DB + the App-token-bearing pip install cache all linger on the runner host until the next job overwrites them. That's a leak surface for both secret material and disk space. Adds atos-actions/clean-self-hosted-runner@v1.4.34 (SHA-pinned) as the LAST step in both prepare and validate jobs, gated with `if: always()` so it runs after success, failure, or cancellation. The action is from atos-actions, a verified GitHub Marketplace partner. Composite action — no Node 20/24 deprecation. Logic is auditable (rm -rf ./* ./.[!.]*). Has a DISABLE_RUNNER_CLEANUP env var kill-switch for debugging if a job needs to leave residual state for inspection. 🤖 Generated by [robots](https://vyos.io) --- .github/workflows/ai-validation.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to '.github/workflows') diff --git a/.github/workflows/ai-validation.yml b/.github/workflows/ai-validation.yml index 57cd12a1..18671c9d 100644 --- a/.github/workflows/ai-validation.yml +++ b/.github/workflows/ai-validation.yml @@ -76,6 +76,14 @@ jobs: diff-md.patch _changed_md/ + # Self-hosted-runner workspace cleanup. Composite action; the upstream + # already wraps its own logic in `if: ${{ always() && ... }}`, but the + # outer step also needs `if: always()` so it runs even after a prior + # step fails. + - name: Clean self-hosted runner workspace + if: always() + uses: atos-actions/clean-self-hosted-runner@c6ce136031329a4435508e02b3f97fd85353f744 # v1.4.34 + validate: needs: [prepare] runs-on: [self-hosted, web] @@ -292,3 +300,11 @@ jobs: claude_args: | --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Read,Glob,Grep" + + # Self-hosted-runner workspace cleanup. Composite action; the upstream + # already wraps its own logic in `if: ${{ always() && ... }}`, but the + # outer step also needs `if: always()` so it runs even after a prior + # step fails. + - name: Clean self-hosted runner workspace + if: always() + uses: atos-actions/clean-self-hosted-runner@c6ce136031329a4435508e02b3f97fd85353f744 # v1.4.34 -- cgit v1.2.3