mandrel-platform 1.0.1 → 1.1.0

package/scripts/check-docs-staleness.test.mjs

@@ -3,16 +3,23 @@
  * check-docs-staleness.test.mjs — node:test suite for the docs-staleness lint
  * (Story #197).
  *
- * Focus: the `expired-placeholder` rule. The rule previously hardcoded the
- * years 2020–2024 (`/expires[:\s]+202[0-4]-\d{2}-\d{2}/i`), so an expiry that
- * lapsed in 2025, 2026, or any later year sailed through the gate — a
- * fail-open. The fix broadens the pattern to any 20xx year and defers the
- * "is it actually in the past?" decision to `isExpiredDate`, so the rule stays
- * correct as the calendar advances and never flags a still-valid future date.
+ * Focus: rule PRECISION — the two ways a staleness rule stops being useful.
  *
- * These tests exercise the year fix directly (`isExpiredDate`) and end-to-end
- * (`lintFile` against a real fixture file), pinning "today" via a fixed clock
- * so they are deterministic.
+ * 1. Fail-open (`expired-placeholder` under-fires). The rule first hardcoded
+ *    the years 2020–2024 (`/expires[:\s]+202[0-4]-\d{2}-\d{2}/i`), so an expiry
+ *    that lapsed in 2025 or later sailed through. The fix broadens to any 20xx
+ *    year and defers "is it actually in the past?" to `isExpiredDate`, so the
+ *    rule stays correct as the calendar advances and never flags a still-valid
+ *    future date. A second instance of the same class: the separator required
+ *    `expires` to be followed directly by `:` or whitespace, which skipped the
+ *    CVE allowlist's own JSON shape (`"expires": "…"`).
+ * 2. Fail-noisy (`quality-yml-ref` over-fires). A plain substring match meant
+ *    the platform's own `pr-quality.yml` matched, so 58 of 59 findings were
+ *    false positives — enough to bury a real error in the same run.
+ *
+ * These tests exercise the date logic directly (`isExpiredDate`), the compiled
+ * patterns, and end-to-end behaviour (`lintFile` against a real fixture file),
+ * pinning "today" via a fixed clock so they are deterministic.
  *
  * Run: node --test scripts/check-docs-staleness.test.mjs
  */
@@ -128,3 +135,101 @@ test('lintFile honours the staleness-ignore suppression comment for the year rul
     },
   );
 });
+
+// ---------------------------------------------------------------------------
+// expired-placeholder — the JSON-quoted shape.
+//
+// Second fail-open of the same class as the 202[0-4] year window: the pattern
+// required `expires` to be followed directly by `:` or whitespace, so the CVE
+// allowlist's own JSON shape (`"expires": "2026-12-31"`, per audit-check.mjs)
+// never matched — `expires"` is neither. Every documented allowlist entry was
+// therefore invisible to the gate, including a lapsed one in
+// docs/runbooks/dependency-update.md.
+// ---------------------------------------------------------------------------
+
+test('expired-placeholder matches the JSON-quoted allowlist shape', () => {
+  const rule = RULES.find((r) => r.id === 'expired-placeholder');
+  for (const line of [
+    '  "expires": "2025-12-31",', // the CVE allowlist's real shape
+    "  'expires': '2025-12-31',", // single-quoted (YAML/JS)
+    '  expires: "2025-12-31"', // quoted value, bare key
+  ]) {
+    rule.pattern.lastIndex = 0;
+    assert.ok(rule.pattern.test(line), `pattern should match ${JSON.stringify(line)}`);
+  }
+});
+
+test('expired-placeholder still matches the unquoted shapes (no regression)', () => {
+  const rule = RULES.find((r) => r.id === 'expired-placeholder');
+  for (const line of [
+    'expires: 2025-01-01',
+    '# CVE-2022-3517 — expires 2025-06-01',
+  ]) {
+    rule.pattern.lastIndex = 0;
+    assert.ok(rule.pattern.test(line), `pattern should match ${JSON.stringify(line)}`);
+  }
+});
+
+test('lintFile flags a lapsed JSON-quoted expiry end-to-end', () => {
+  withTempDoc('Allowlist entry.\n  "expires": "2025-12-31",\nEnd.\n', (file) => {
+    const expired = lintFile(file).filter((f) => f.rule.id === 'expired-placeholder');
+    assert.equal(expired.length, 1);
+    assert.match(expired[0].match, /2025-12-31/);
+  });
+});
+
+test('lintFile does NOT flag a future JSON-quoted expiry', () => {
+  withTempDoc('Allowlist entry.\n  "expires": "2099-12-31",\nEnd.\n', (file) => {
+    const expired = lintFile(file).filter((f) => f.rule.id === 'expired-placeholder');
+    assert.equal(expired.length, 0);
+  });
+});
+
+test('lintFile does NOT flag a placeholder expiry token', () => {
+  // The runbooks intentionally use `<YYYY-MM-DD>` rather than a concrete date,
+  // precisely so an example can never lapse into a finding.
+  withTempDoc('Allowlist entry.\n  "expires": "<YYYY-MM-DD>",\nEnd.\n', (file) => {
+    const expired = lintFile(file).filter((f) => f.rule.id === 'expired-placeholder');
+    assert.equal(expired.length, 0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// quality-yml-ref — bare filename only.
+//
+// The pattern was a plain substring match, so the platform's own
+// `pr-quality.yml` matched: 58 of 59 findings against mandrel-platform's docs
+// were that false positive, burying a real `expired-placeholder` error. The
+// assertion below is on the invariant (a `<prefix>-quality.yml` is a different
+// file) rather than on the single `pr-` spelling that motivated it.
+// ---------------------------------------------------------------------------
+
+test('quality-yml-ref does NOT match a prefixed <prefix>-quality.yml', () => {
+  const rule = RULES.find((r) => r.id === 'quality-yml-ref');
+  assert.ok(rule, 'quality-yml-ref rule must exist');
+  for (const line of [
+    'uses: dsj1984/mandrel-platform/.github/workflows/pr-quality.yml@abc123',
+    'the `pr-quality.yml` reusable workflow',
+    'a consumer that names its caller `ci-quality.yml`',
+    'see my_quality.yml for details',
+  ]) {
+    rule.pattern.lastIndex = 0;
+    assert.equal(
+      rule.pattern.test(line),
+      false,
+      `pattern must not match ${JSON.stringify(line)}`,
+    );
+  }
+});
+
+test('quality-yml-ref still matches a bare quality.yml reference', () => {
+  const rule = RULES.find((r) => r.id === 'quality-yml-ref');
+  for (const line of [
+    "| athportal | `quality.yml` | `quality` |",
+    'the quality.yml workflow was renamed',
+    'quality.yml',
+  ]) {
+    rule.pattern.lastIndex = 0;
+    assert.ok(rule.pattern.test(line), `pattern should match ${JSON.stringify(line)}`);
+  }
+});

package/scripts/job-cleanup-hook.test.mjs

@@ -0,0 +1,234 @@
+#!/usr/bin/env node
+/**
+ * job-cleanup-hook.test.mjs — node:test suite for the ACTIONS_RUNNER_HOOK_JOB_STARTED
+ * hook shipped at `templates/runner/job-cleanup.sh` (Story #345).
+ *
+ * The hook runs INSIDE the job's clock on every job of every persistent
+ * self-hosted runner, so its cost is charged to `Set up runner` and a slow
+ * hook kills jobs against their own `timeout-minutes`. Issue #343 is exactly
+ * that failure: the hook enumerated the shared OS temp root, which had reached
+ * 841,690 entries on the swarm-os host, and `Set up runner` reached 5m29s.
+ *
+ * The load-bearing property this suite pins is therefore a NEGATIVE one — the
+ * hook must never read the shared temp root — and it is asserted two ways,
+ * because neither alone is sufficient:
+ *
+ *   1. Behaviourally: a decoy shared temp root is planted with entries that
+ *      match the old sweep's patterns, and the hook must leave every one of
+ *      them alone. This catches a sweep that still deletes there.
+ *   2. Structurally: the script text must contain no enumeration rooted at the
+ *      shared temp root. This catches a sweep that reads the directory but
+ *      happens to delete nothing — the exact shape of the #343 stall, which
+ *      was pure cost with no observable effect.
+ *
+ * A wall-clock assertion was deliberately NOT used for (2): the cost is a
+ * function of host churn, so on a clean dev machine a full enumeration of a
+ * small decoy root is fast and would pass. Timing here would be a test that
+ * only fails on the machine that least needs it.
+ *
+ * The suite executes the real script with env fixtures, following the
+ * `scripts/resolve-diff-range.test.mjs` precedent for shell-under-test.
+ *
+ * Run: node --test scripts/job-cleanup-hook.test.mjs
+ */
+
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, readdirSync, rmSync, chmodSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { test, after } from "node:test";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const SCRIPT = join(HERE, "..", "templates", "runner", "job-cleanup.sh");
+
+/** Sandboxes created by the suite, torn down in `after`. */
+const SANDBOXES = [];
+
+after(() => {
+  for (const dir of SANDBOXES) {
+    // Restore any permissions the unwritable-temp case removed, or the
+    // recursive delete cannot descend.
+    try {
+      chmodSync(join(dir, "runner", "_work", "_temp"), 0o755);
+    } catch {
+      /* not every sandbox has one */
+    }
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+/**
+ * Build a sandbox holding a synthetic runner root and a decoy shared temp root.
+ *
+ * @param {{ sharedEntries?: number }} [opts]
+ * @returns {{ root: string, runnerDir: string, runnerTmp: string, sharedTmp: string }}
+ */
+function makeSandbox({ sharedEntries = 0 } = {}) {
+  const root = mkdtempSync(join(tmpdir(), "job-cleanup-test-"));
+  SANDBOXES.push(root);
+
+  const runnerDir = join(root, "runner");
+  const runnerTmp = join(runnerDir, "_work", "_temp");
+  const sharedTmp = join(root, "shared-tmp");
+  mkdirSync(runnerTmp, { recursive: true });
+  mkdirSync(join(runnerDir, "_work", "_tool"), { recursive: true });
+  mkdirSync(sharedTmp, { recursive: true });
+
+  // The decoy shared root carries entries matching BOTH the retired sweep's
+  // patterns and the current runner-scoped ones, so a sweep that kept the old
+  // root or reused the new globs against it is caught either way.
+  writeFileSync(join(sharedTmp, "gitleaks.tmp"), "decoy");
+  mkdirSync(join(sharedTmp, "gitleaks-8.30.1"), { recursive: true });
+  mkdirSync(join(sharedTmp, "gitleaks.AbCdEf"), { recursive: true });
+  mkdirSync(join(sharedTmp, "osv-scanner.AbCdEf"), { recursive: true });
+  for (let i = 0; i < sharedEntries; i += 1) {
+    writeFileSync(join(sharedTmp, `unrelated-${i}.tmp`), "x");
+  }
+
+  return { root, runnerDir, runnerTmp, sharedTmp };
+}
+
+/**
+ * Run the hook against a sandbox.
+ *
+ * @param {{ runnerDir: string, sharedTmp: string }} sandbox
+ * @returns {{ status: number, stdout: string }}
+ */
+function runHook({ runnerDir, sharedTmp }) {
+  try {
+    const stdout = execFileSync("bash", [SCRIPT], {
+      encoding: "utf8",
+      env: { ...process.env, RUNNER_DIR: runnerDir, TMPDIR: sharedTmp },
+      timeout: 60_000,
+    });
+    return { status: 0, stdout };
+  } catch (err) {
+    return { status: err.status ?? 1, stdout: err.stdout ?? "" };
+  }
+}
+
+test("removes this runner's own stale tool-download and pnpm-shim leftovers", () => {
+  const sandbox = makeSandbox();
+  const { runnerTmp } = sandbox;
+
+  // Every artifact the platform's actions now extract into runner.temp.
+  const owned = [
+    join(runnerTmp, "pnpm"),
+    join(runnerTmp, "setup-pnpm"),
+    join(runnerTmp, "gitleaks.AbCdEf"),
+    join(runnerTmp, "osv-scanner.AbCdEf"),
+    join(runnerTmp, "semgrep.AbCdEf"),
+  ];
+  for (const dir of owned) {
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, "leftover"), "stale");
+  }
+  writeFileSync(join(runnerTmp, "gh-api-err.AbCdEf"), "stale");
+
+  const { status } = runHook(sandbox);
+  assert.equal(status, 0, "the hook must never fail a job");
+
+  for (const dir of owned) {
+    assert.equal(existsSync(dir), false, `runner-owned leftover not swept: ${dir}`);
+  }
+  assert.equal(existsSync(join(runnerTmp, "gh-api-err.AbCdEf")), false);
+});
+
+test("leaves the shared temp root untouched", () => {
+  // The decoy is deliberately SMALL. An earlier draft planted 5,000 entries to
+  // evoke the 841,690 seen on the swarm-os host, but that bought no signal: the
+  // assertion below is on effect (nothing deleted), which is count-independent,
+  // and the companion structural test — not a stopwatch — is what pins the
+  // cost property. Planting alone cost ~87s on a dev Mac whose endpoint
+  // security scans every write (~17ms/file), which would have made this the
+  // slowest test in the suite by two orders of magnitude, and a flaky one.
+  //
+  // What actually matters is pattern COVERAGE, and makeSandbox plants every
+  // shape — both the retired sweep's names and the current runner-scoped
+  // globs — so a sweep pointed back at the shared root is caught by the first
+  // entry it would match.
+  const sandbox = makeSandbox({ sharedEntries: 20 });
+  const { sharedTmp } = sandbox;
+
+  const before = readdirSync(sharedTmp).sort();
+  const { status } = runHook(sandbox);
+
+  assert.equal(status, 0);
+  assert.deepEqual(
+    readdirSync(sharedTmp).sort(),
+    before,
+    "the hook deleted from the shared temp root — it must only sweep runner-owned paths",
+  );
+});
+
+test("the script text contains no enumeration rooted at the shared temp root", () => {
+  const source = readFileSync(SCRIPT, "utf8");
+
+  // Assert the PROPERTY (the hook cannot reach the shared root at all), not
+  // one syntactic form of violating it. Pinning a specific `find "${TMP…"`
+  // shape would miss an unbraced `$TMPDIR`, an `ls | grep`, a `for f in
+  // "${TMP}"/…` loop, or a renamed intermediate variable — all of which
+  // reintroduce the unbounded read this Story removed.
+  //
+  // Every one of those must name the shared root to reach it, and the hook has
+  // no legitimate use for it: RUNNER_TMP derives from RUNNER_DIR. So the
+  // absence of the name is both necessary and sufficient, and it stays a true
+  // invariant rather than a regex chasing syntax.
+  //
+  // Comments are stripped first: the header documents the #343 incident by
+  // name, and that prose is the reason the next maintainer will not re-add the
+  // sweep. Asserting over raw text would force the fix to delete its own
+  // rationale.
+  const code = source
+    .split("\n")
+    .filter((line) => !/^\s*#/.test(line))
+    .join("\n");
+
+  assert.equal(
+    /TMPDIR/.test(code),
+    false,
+    "the hook references the shared temp root — its cost must scale with runner-owned state only",
+  );
+
+  // Second half of the property: no directory enumeration, anywhere. Naming
+  // the shared root is one way to reintroduce unbounded cost; a `find` rooted
+  // at an intermediate variable is another, and it would not have to mention
+  // TMPDIR on the same line. The hook has no legitimate need to enumerate —
+  // it addresses known paths under RUNNER_TMP directly — so the absence of
+  // `find` is a stronger and more durable invariant than any pattern match
+  // over its arguments.
+  assert.equal(
+    /\bfind\b/.test(code),
+    false,
+    "the hook enumerates a directory — address known runner-owned paths directly instead",
+  );
+
+  // The age gate existed solely to make deleting from the SHARED root safe.
+  // Runner-scoped paths are unreachable by a co-resident runner, so a
+  // surviving knob would be dead configuration the runbook still promises.
+  assert.equal(
+    source.includes("JOB_CLEANUP_STALE_MINUTES"),
+    false,
+    "the retired age-gate knob is still referenced",
+  );
+});
+
+test("exits 0 when the runner directory does not exist", () => {
+  const sandbox = makeSandbox();
+  const { status } = runHook({
+    runnerDir: join(sandbox.root, "no-such-runner"),
+    sharedTmp: sandbox.sharedTmp,
+  });
+  assert.equal(status, 0, "a missing runner root must degrade to a no-op, never fail the job");
+});
+
+test("exits 0 when the runner temp is unwritable", () => {
+  const sandbox = makeSandbox();
+  mkdirSync(join(sandbox.runnerTmp, "gitleaks.AbCdEf"), { recursive: true });
+  chmodSync(sandbox.runnerTmp, 0o500);
+
+  const { status } = runHook(sandbox);
+  assert.equal(status, 0, "an unwritable runner temp must not fail the job");
+});

package/templates/runbooks/runner-provisioning.md

@@ -150,9 +150,18 @@ with the runner root's absolute path. The resulting file wires:
 
 - `ACTIONS_RUNNER_HOOK_JOB_STARTED=<RUNNER_DIR>/job-cleanup.sh` — the
   job-start hook. It reaps orphaned pnpm/node processes parented to **this**
-  runner's work tree, clears stale runner-scoped pnpm installs, and
-  age-gate-sweeps shared-`$TMPDIR` gitleaks leftovers. It never fails a job
-  (always exits 0) and never touches another runner's state.
+  runner's work tree, clears stale runner-scoped pnpm installs, and removes
+  leftover tool-download dirs from `<RUNNER_DIR>/_work/_temp`. It never fails
+  a job (always exits 0) and never touches another runner's state.
+
+  **Every path it reads is runner-scoped, and that is load-bearing** (issue
+  #343). The hook runs inside the *job's* clock, so its cost is charged to
+  `Set up runner` and counts against the job's own `timeout-minutes`. An
+  earlier version swept the host-shared OS temp root; on a host where that
+  directory had grown to ~840k entries, `Set up runner` reached 5m29s and
+  jobs were killed before their first real step — surfacing as `cancelled`
+  on unrelated diffs. If you add a sweep to this hook, root it at
+  `_work/_temp`, never at `$TMPDIR`.
 - `RUNNER_TOOL_CACHE=<RUNNER_DIR>/_work/_tool` and
   `AGENT_TOOLSDIRECTORY=<RUNNER_DIR>/_work/_tool` — runner-scoped tool cache
   (two env names, one dir; some actions read the legacy name).

package/templates/runner/.env.example

@@ -19,8 +19,14 @@ LANG=en_US.UTF-8
 
 # Job-start hygiene hook. Runs templates/runner/job-cleanup.sh (installed
 # into the runner root) before every job: reaps orphaned pnpm/node processes
-# from THIS runner's work tree and clears stale install/temp artifacts.
-# The hook is runner-scoped and never fails the job (always exits 0).
+# from THIS runner's work tree and clears stale install/temp artifacts from
+# `_work/_temp`. The hook is runner-scoped and never fails the job (always
+# exits 0).
+#
+# Runner-scoped means CHEAP as well as safe: the hook runs inside the job's
+# clock, so anything it reads is billed to `Set up runner` and counts against
+# the job's `timeout-minutes`. It touches only this runner's own paths, so its
+# cost never becomes a function of host-wide temp churn (issue #343).
 ACTIONS_RUNNER_HOOK_JOB_STARTED=<RUNNER_DIR>/job-cleanup.sh
 
 # Runner-scoped tool cache. Without this, actions/setup-node & friends

package/templates/runner/job-cleanup.sh

@@ -10,8 +10,8 @@
 #
 #   - an orphaned `pnpm`/`node` process (e.g. a hung install or lint) still
 #     mutating the pnpm shim install, corrupting the pnpm CLI for the next job;
-#   - leftover `gitleaks.tmp` / `gitleaks-*` artifacts in the shared $TMPDIR
-#     blocking the next gitleaks download.
+#   - leftover tool-download temp dirs (gitleaks, OSV-scanner, the semgrep
+#     venv) accumulating in the runner's own job temp.
 #
 # Running this before every job gives each job a clean slate ("fresh per job"
 # without the cost of re-registering an ephemeral runner).
@@ -35,9 +35,36 @@
 #      own work tree (`<RUNNER_DIR>/_work/...`). Every path below derives
 #      from RUNNER_DIR, which is unique per runner, so a co-resident
 #      runner's processes and files are never matched.
-#   3. Age-gates cleanup of the genuinely shared $TMPDIR gitleaks artifacts,
-#      so a fresh (in-flight) download owned by a concurrent job is never
-#      deleted — only stale leftovers are.
+#   3. NEVER READS the shared OS temp root, either. Reading is not free: the
+#      hook runs inside the JOB's clock, so any cost here is charged to
+#      `Set up runner` and counts against the job's own `timeout-minutes`.
+#      $TMPDIR is unbounded and shared with every other process on the host,
+#      so a sweep rooted there costs a function of how much UNRELATED junk
+#      the host has accumulated — see the incident note below.
+#
+# ── WHY THE SHARED-$TMPDIR SWEEP IS GONE (issue #343) ───────────────────────
+#
+# This hook used to age-gate two `find "$TMPDIR" -maxdepth 1 -name …` sweeps
+# for `gitleaks.tmp` / `gitleaks-*`. `-maxdepth 1 -name <literal>` is a FULL
+# directory enumeration for what is really an existence check, so its cost
+# scaled with host churn. On the swarm-os runner host $TMPDIR reached 841,690
+# entries; one scan measured 42s, the hook ran two of them, and up to 16
+# co-resident runners ran it concurrently. `Set up runner` reached 5m29s, and
+# every job whose `timeout-minutes` sat at or below that was killed before its
+# first real step — surfacing as `cancelled` on an innocent diff.
+#
+# It was also a no-op: the platform's actions extract via `mktemp -d`, so
+# nothing ever created `gitleaks.tmp` or `gitleaks-*`. The sweep paid an
+# unbounded cost hunting names that never existed, while the dirs the actions
+# DID leave went unswept.
+#
+# The fix is ownership, not tuning: every platform action now extracts into
+# `${RUNNER_TEMP}` (== RUNNER_TMP below), which is unique per runner. A
+# co-resident runner's in-flight download is therefore unreachable from here
+# by construction — which is what retired the age gate outright (along with
+# the stale-minutes env knob that tuned it), rather than merely shrinking its
+# blast radius. Keep it that way: a sweep added here MUST be rooted at
+# RUNNER_TMP.
 #
 # ── PARAMETERIZATION ────────────────────────────────────────────────────────
 #
@@ -48,11 +75,8 @@
 #                  runner root, next to config.sh / run.sh). Override via env
 #                  only if you install the hook elsewhere.
 #   RUNNER_TMP   — the runner's per-runner job temp (`runner.temp`), always
-#                  `${RUNNER_DIR}/_work/_temp`.
-#   JOB_CLEANUP_STALE_MINUTES
-#                — age threshold (minutes) for the shared-$TMPDIR gitleaks
-#                  sweep. Default 60. Artifacts younger than this are assumed
-#                  in-flight and left alone.
+#                  `${RUNNER_DIR}/_work/_temp`. Every path this hook touches
+#                  lives under it.
 #
 # Configured via `ACTIONS_RUNNER_HOOK_JOB_STARTED=<RUNNER_DIR>/job-cleanup.sh`
 # in the runner's `.env` (see .env.example in this directory).
@@ -64,8 +88,6 @@ set +e
 RUNNER_DIR="${RUNNER_DIR:-$(cd "$(dirname "$0")" && pwd)}"
 RUNNER_WORK="${RUNNER_DIR}/_work"
 RUNNER_TMP="${RUNNER_WORK}/_temp"
-TMP="${TMPDIR:-/tmp}"
-STALE_MINUTES="${JOB_CLEANUP_STALE_MINUTES:-60}"
 
 # 1) Reap orphaned pnpm/node processes from prior jobs — scoped to THIS
 #    runner's work tree only. The patterns target executable paths INSIDE the
@@ -85,13 +107,20 @@ pkill -9 -f "${RUNNER_WORK}/_tool/[^ ]*node_modules" 2>/dev/null
 rm -rf "${RUNNER_TMP}/pnpm"       2>/dev/null
 rm -rf "${RUNNER_TMP}/setup-pnpm" 2>/dev/null
 
-# 3) Sweep stale gitleaks artifacts from the SHARED $TMPDIR. Because this
-#    location is shared by every runner on the host, deletion is age-gated:
-#    only artifacts older than STALE_MINUTES are removed, so a concurrent
-#    runner's in-flight download is never deleted mid-job.
-find "${TMP}" -maxdepth 1 -name 'gitleaks.tmp' -mmin "+${STALE_MINUTES}" \
-  -exec rm -f  {} + 2>/dev/null
-find "${TMP}" -maxdepth 1 -name 'gitleaks-*'   -mmin "+${STALE_MINUTES}" \
-  -exec rm -rf {} + 2>/dev/null
+# 3) Remove this runner's own leftover tool-download temp dirs. The platform's
+#    composite actions and workflows create these via
+#    `mktemp -d "${RUNNER_TEMP}/<tool>.XXXXXX"`, so every one of them is
+#    runner-scoped and a co-resident runner's in-flight download is
+#    unreachable here — no age gate is needed (see the issue #343 note above).
+#
+#    Globbing is what keeps this bounded: the shell expands these against
+#    RUNNER_TMP alone, so the cost is a function of THIS runner's leftovers,
+#    never of host-wide churn. Do not replace it with a `find` over a parent.
+#    A glob that matches nothing stays literal, and `rm -rf` on a nonexistent
+#    path is silent — hence the nullglob-free form plus 2>/dev/null.
+rm -rf "${RUNNER_TMP}"/gitleaks.*    2>/dev/null
+rm -rf "${RUNNER_TMP}"/osv-scanner.* 2>/dev/null
+rm -rf "${RUNNER_TMP}"/semgrep.*     2>/dev/null
+rm -f  "${RUNNER_TMP}"/gh-api-err.*  2>/dev/null
 
 exit 0