@norskvideo/ctl-dev-kit 0.1.77 → 0.1.78

package/conventions/build-docs.yml

@@ -56,9 +56,27 @@ jobs:
           docker run --rm --user 0:0 -v "$tt":/t alpine sh \
             -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
 
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
 
       - name: Write the Norsk license (from the org secret)
         env:
@@ -113,7 +131,7 @@ jobs:
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
-            # clean:false persists node_modules between runs for speed, but a
+            # Belt-and-braces now that the checkout cleans: a persisted node_modules
             # workspace dep whose version moved leaves stale copies that
             # --frozen-lockfile does not reliably relink, so a new export is "not
             # found". Nuke EVERY node_modules — including nested per-workspace ones

package/conventions/build-image.yml

@@ -66,9 +66,27 @@ jobs:
       # publish job gates on this output instead of on PUBLISH_IMAGE directly.
       publish: ${{ steps.gen.outputs.publish }}
     steps:
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - id: gen
         run: |
           label="$(date -u +%Y-%m-%d)-$(git rev-parse --short=8 HEAD)"
@@ -91,13 +109,27 @@ jobs:
             arch: arm64
     runs-on: ${{ matrix.runner }}
     steps:
-      # clean: false -- the integration suite (shared pool) leaves root-owned
-      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
-      # (EACCES). This job never needs them; skip the clean so it doesn't choke on
-      # another workflow's leftovers.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
 
       - name: Build product image (copy-only, via the dev-kit driver, native ${{ matrix.arch }})
         run: |
@@ -133,9 +165,27 @@ jobs:
     if: ${{ needs.label.outputs.publish == 'true' && !inputs.dry_run }}
     runs-on: x64
     steps:
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
 
       - name: Log in to Docker Hub
         uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
@@ -166,9 +216,27 @@ jobs:
     if: ${{ !cancelled() }}
     runs-on: x64
     steps:
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/conventions/checks.yml

@@ -30,22 +30,36 @@ jobs:
   drift:
     runs-on: x64
     steps:
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
-      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
-      # (EACCES). These jobs never need those files; skip the clean so an innocent
-      # bystander checkout doesn't choke on another workflow's leftovers.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - name: Shared-conventions drift-check (Workstream I)
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
-            # clean:false persists node_modules between runs, and a frozen install
-            # will NOT relink a dep/workspace whose pinned version moved -- e.g. a
-            # dev-kit bump leaves a stale node_modules/@norskvideo/ctl-dev-kit, so
-            # check:drift would run the OLD checker against the new canonical. Nuke
-            # every node_modules first so the pinned versions are what actually run.
+            # Belt-and-braces now that the checkout cleans: a persisted
+            # node_modules would defeat a frozen install, which does NOT relink a
+            # dep whose pinned version moved (a dev-kit bump leaves a stale
+            # node_modules/@norskvideo/ctl-dev-kit, so check:drift would run the
+            # OLD checker against the new canonical). Cheap when already gone.
             find . -name node_modules -type d -prune -exec rm -rf {} + 2>/dev/null || true
             bun install --frozen-lockfile
             bun run check:drift
@@ -54,22 +68,36 @@ jobs:
   quality:
     runs-on: x64
     steps:
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
-      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
-      # (EACCES). These jobs never need those files; skip the clean so an innocent
-      # bystander checkout doesn't choke on another workflow's leftovers.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - name: Lint + typecheck + unit tests
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
-            # clean:false persists node_modules between runs, and a frozen install
-            # will NOT relink a dep/workspace whose pinned version moved -- e.g. a
-            # dev-kit bump leaves a stale node_modules/@norskvideo/ctl-dev-kit, so
-            # check:drift would run the OLD checker against the new canonical. Nuke
-            # every node_modules first so the pinned versions are what actually run.
+            # Belt-and-braces now that the checkout cleans: a persisted
+            # node_modules would defeat a frozen install, which does NOT relink a
+            # dep whose pinned version moved (a dev-kit bump leaves a stale
+            # node_modules/@norskvideo/ctl-dev-kit, so check:drift would run the
+            # OLD checker against the new canonical). Cheap when already gone.
             find . -name node_modules -type d -prune -exec rm -rf {} + 2>/dev/null || true
             bun install --frozen-lockfile
             bun run lint
@@ -132,13 +160,27 @@ jobs:
     if: ${{ !cancelled() && github.event_name == 'push' }}
     runs-on: x64
     steps:
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
-      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
-      # (EACCES). These jobs never need those files; skip the clean so an innocent
-      # bystander checkout doesn't choke on another workflow's leftovers.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/conventions/publish-docs.yml

@@ -55,9 +55,27 @@ jobs:
           docker run --rm --user 0:0 -v "$tt":/t alpine sh \
             -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
 
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
 
       - name: Write the Norsk license (from the org secret)
         env:
@@ -112,7 +130,7 @@ jobs:
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
-            # clean:false persists node_modules between runs for speed, but a
+            # Belt-and-braces now that the checkout cleans: a persisted node_modules
             # workspace dep whose version moved leaves stale copies that
             # --frozen-lockfile does not reliably relink, so a new export is "not
             # found". Nuke EVERY node_modules — including nested per-workspace ones

package/conventions/smoke.yml

@@ -66,7 +66,7 @@ jobs:
 
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
 
       # A containerised runner (docker-outside-of-docker) reaches host-published
       # ports via the host-gateway alias and can join norsk-net for direct reach;
@@ -238,9 +238,20 @@ jobs:
     if: ${{ !cancelled() && github.event_name != 'repository_dispatch' }}
     runs-on: x64
     steps:
+      # Same reason as the first checkout in this file: clear root-owned leftovers
+      # from a root container so the checkout below can clean properly. Best-effort
+      # by construction -- no docker, no test-temp, or a failed run all fall through.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/conventions/sync-ctl-packages.yml

@@ -41,16 +41,28 @@ jobs:
   sync:
     runs-on: x64
     steps:
-      # CI_DISPATCH_TOKEN, not the automatic GITHUB_TOKEN: a PR opened by
-      # GITHUB_TOKEN raises no workflow runs, so the product's own build, smoke
-      # and integration would never execute against the new pins -- which is the
-      # entire reason for opening it. clean: false for the same reason as the
-      # other shared jobs: the suites leave root-owned bind-mount dirs under
-      # test-temp/ that a non-root git clean cannot remove.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
           token: ${{ secrets.CI_DISPATCH_TOKEN }}
-          clean: false
+          clean: true
 
       - name: Resolve the newest published ctl-* packages and rewrite the pins
         id: bump

package/conventions/sync-dev-kit.yml

@@ -43,21 +43,28 @@ jobs:
   sync:
     runs-on: x64
     steps:
-      # Check out with CI_DISPATCH_TOKEN, not the automatic GITHUB_TOKEN: this job
-      # pushes re-synced copies, and the dev-kit single-sources the shared
-      # .github/workflows/ files -- so a sync can rewrite a workflow file, and
-      # GITHUB_TOKEN is categorically barred from pushing under .github/workflows/
-      # (no permissions: key unlocks it). CI_DISPATCH_TOKEN carries the fine-grained
-      # Workflows:write permission, so its push is allowed. The checkout credential
-      # is what both the green push:main and the red branch push authenticate with.
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
-      # bind-mount dirs under test-temp/ a non-root git clean can't remove
-      # (EACCES); this job never needs them. `git add -A` below still ignores
-      # them (test-temp is gitignored), so the sync commit stays clean.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
           token: ${{ secrets.CI_DISPATCH_TOKEN }}
-          clean: false
+          clean: true
 
       - name: Resolve the newest published dev-kit and bump the pin
         id: sync
@@ -194,11 +201,27 @@ jobs:
     if: ${{ !cancelled() }}
     runs-on: x64
     steps:
-      # clean: false -- see the sync job; avoid a git-clean EACCES on integration's
-      # root-owned test-temp leftovers on the shared x64 pool.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/conventions/upgrade-latest.yml

@@ -45,18 +45,28 @@ jobs:
       changed: ${{ steps.bump.outputs.changed }}
       summary: ${{ steps.bump.outputs.summary }}
     steps:
-      # Check out with CI_DISPATCH_TOKEN, not the automatic GITHUB_TOKEN: the
-      # checkout credential is what the push to main below authenticates with,
-      # and only a PAT push triggers the push-driven workflows that validate the
-      # new pins (see the header). Same arrangement as sync-dev-kit.yml.
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
-      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
-      # (EACCES). These jobs never need those files; skip the clean so an innocent
-      # bystander checkout doesn't choke on another workflow's leftovers.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
           token: ${{ secrets.CI_DISPATCH_TOKEN }}
-          clean: false
+          clean: true
 
       - name: Resolve the nightly channel and rewrite the coupled pins
         id: bump
@@ -313,13 +323,27 @@ jobs:
     if: ${{ !cancelled() }}
     runs-on: x64
     steps:
-      # clean: false -- the integration suite (shared x64 pool) leaves root-owned
-      # bind-mount dirs under test-temp/ that a non-root git clean can't remove
-      # (EACCES). These jobs never need those files; skip the clean so an innocent
-      # bystander checkout doesn't choke on another workflow's leftovers.
+      # Root-owned leftovers under test-temp/ are what `clean: false` used to route
+      # around: the integration suite bind-mounts host dirs into containers, and a
+      # non-root git clean then EACCESes on what they wrote -- taking down whatever
+      # innocent job checked out next. Skipping the clean cured that symptom and
+      # caused another: every gitignored artifact survived between runs, so a test
+      # could pass on build output an earlier job left behind and go red the first
+      # time it landed on a cold runner (probe, 2026-09-01). Clear the leftovers
+      # from a root container FIRST, and the checkout can clean properly again.
+      # Best-effort by construction: no docker, no test-temp, or a failed run all
+      # fall through without failing the job.
+      - name: Clear stale root-owned test-temp (pre-checkout)
+        run: |
+          set -uo pipefail
+          tt="$GITHUB_WORKSPACE/test-temp"
+          [ -d "$tt" ] || exit 0
+          docker run --rm --user 0:0 -v "$tt":/t alpine sh \
+            -c 'rm -rf /t/* /t/.[!.]* 2>/dev/null || true' || rm -rf "$tt"/* 2>/dev/null || true
+
       - uses: actions/checkout@v5
         with:
-          clean: false
+          clean: true
       - id: meta
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.77",
+  "version": "0.1.78",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",