Merge pull request 'fix(digest): digest 暂存改 mktemp（PLAT-014 二段，v5 前置）' (#3 ) from task/PLAT-014-digest-mktemp into main

fix(digest): digest 汇总文件改 mktemp（PLAT-014 二段：宿主非 root 撞容器 chown 后的 workspace）
run 924 build 红根因：容器 install chown -R node:node workspace → 宿主 digest 步 mkdir -p .tmp-ci EACCES（897 时代 runner 为 root 故绿；治理后必红）。修法：digest/manifest 暂存文件改宿主 mktemp 目录（runner 自建 tmp 可写），两处 digest 步（verify/script 路径）同修。合并后打 v5。
2026-08-31 13:41:00 +00:00 · 2026-08-31 21:35:12 +08:00 · 2026-08-31 13:05:17 +00:00 · 2026-08-31 20:52:23 +08:00 · 2026-08-30 22:00:15 +08:00 · 2026-08-29 13:38:20 +00:00
4 changed files with 243 additions and 77 deletions
@@ -1,38 +0,0 @@
-# Unified checkout for host-mode jobs (build-docker): mu-ref/actions-checkout
-# (local JS-action mirror) with the Caddy CA and a HEAD==SHA guard.
-#
-# Requirements (verified 2026-08-27 on Gitea 1.27.2): the runner host must
-# have a node runtime for JS actions (tn does), and the action repos must be
-# anonymously readable (public). NOT usable from container jobs whose image
-# lacks node — those callers keep a host `git clone` step instead.
-name: reusable-checkout
-
-on:
-  workflow_call:
-    inputs:
-      fetch-depth:
-        required: false
-        type: number
-        default: 1
-      verify-sha:
-        required: false
-        type: boolean
-        default: true
-        description: "Fail unless the checked-out HEAD equals the triggering commit"
-
-jobs:
-  checkout:
-    runs-on: build-docker
-    steps:
-      - name: checkout (mu-ref/actions-checkout)
-        uses: https://git.moneywood.site/mu-ref/actions-checkout@v4
-        env:
-          GIT_SSL_CAINFO: /usr/local/share/ca-certificates/caddy-root-ca.crt
-        with:
-          fetch-depth: ${{ inputs.fetch-depth }}
-
-      - name: verify HEAD equals triggering commit
-        if: inputs.verify-sha
-        run: |
-          set -eu
-          test "$(git rev-parse HEAD)" = "${GITHUB_SHA}"
@@ -3,15 +3,17 @@
 # P1-7 verification status (2026-08-27, Gitea 1.27.2):
 #   - reusable workflow calls verified working (1.27.2 probe + this workflow's
 #     selftest caller: .gitea/workflows/selftest.yml)
-#   - checkout uses host git clone (NOT mu-ref/actions-checkout): act_runner
-#     runs JS actions with a host node runtime, which tn does not install —
-#     the JS-action path is unavailable for host jobs until node is installed
-#     on the runner host (coordination review fallback decision)
-#   - no actions/cache layer for the same reason; the persistent /data/cache/ci
-#     directory is the primary (and only) cache layer
+#   - checkout via mu-ref/actions-checkout@v4 (JS action) + explicit
+#     HEAD==SHA postcondition: tn has a host node runtime (v22, installed
+#     2026-08-27). v3 restores the P1-10 JS path — the 2026-08-27 12:07
+#     consolidation had based this repo on the P1-7 host-clone fallback
+#     lineage and dropped the completed migration (est/Est-Infra@57cc9f7);
+#     the action repo must stay PUBLIC (act clones it anonymously)
+#   - no actions/cache layer; the persistent /data/cache/ci directory is
+#     the primary (and only) cache layer
 #
 # Conventions proven on the business-repo pipelines:
-#   - runs-on: build-docker (host job, root) + docker run for the toolchain
+#   - runs-on: build-docker (host job, NON-ROOT user gitea-runner) + docker run for the toolchain
 #   - CA: GIT_SSL_CAINFO (host git) + SSL_CERT_FILE/NODE_EXTRA_CA_CERTS (container;
 #     helper images have their apt/apk sources baked in, so replacing the public
 #     trust store is safe here — see playbook pitfall 13)
@@ -44,7 +46,27 @@ on:
        required: false
        type: string
        default: /data/cache/ci/quality
-        description: "Persistent host-side cache dir (pnpm store, tools, browsers)"
+        description: "Host-side cache dir (pnpm store, tools, browsers)"
+      cache-mode:
+        required: false
+        type: string
+        default: fixed
+        description: "fixed: one shared persistent dir. per-run: fresh mktemp child per run + always() cleanup (for scripts with from-zero guards on commit-keyed tool caches)"
+      mount-docker-socket:
+        required: false
+        type: string
+        default: ""
+        description: "Non-empty (e.g. 'yes') mounts /var/run/docker.sock into the toolchain containers (boolean inputs are NOT passed reliably through workflow_call with:)"
+      commit-env-name:
+        required: false
+        type: string
+        default: ""
+        description: "Env var name that receives the triggering commit SHA inside the containers (e.g. EST_GIT_COMMIT); empty disables"
+      extra-env:
+        required: false
+        type: string
+        default: ""
+        description: "Multiline KEY=VALUE extra env for the toolchain containers (values must not contain spaces; caller-side expressions are NOT evaluated)"
    secrets:
      REGISTRY_PASSWORD:
        required: false
@@ -53,18 +75,14 @@ jobs:
  quality:
    runs-on: build-docker
    steps:
-      - name: checkout (host git; JS actions need a host node runtime)
+      - name: checkout (mu-ref/actions-checkout; tn host node runs JS actions)
+        uses: https://git.moneywood.site/mu-ref/actions-checkout@v4
        env:
-          CI_ACTOR: ${{ github.actor }}
-          CI_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GIT_SSL_CAINFO: /usr/local/share/ca-certificates/caddy-root-ca.crt
+
+      - name: verify HEAD equals triggering commit
        run: |
          set -eu
-          export GIT_SSL_CAINFO=/usr/local/share/ca-certificates/caddy-root-ca.crt
-          git config --global credential.helper \
-            '!f() { echo "username=${CI_ACTOR}"; echo "password=${CI_TOKEN}"; }; f'
-          git config --global --add safe.directory '*'
-          timeout 120 git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
-            "https://git.moneywood.site/${GITHUB_REPOSITORY}.git" .
          test "$(git rev-parse HEAD)" = "${GITHUB_SHA}"

      - name: authenticate to gitea registry (private helper image pulls)
@@ -80,21 +98,64 @@ jobs:
      - name: prepare cache dir (dirs 0777, files untouched)
        run: |
          set -eu
-          mkdir -p "${{ inputs.cache-dir }}"
-          chmod 0777 "${{ inputs.cache-dir }}"
-          find "${{ inputs.cache-dir }}" -mindepth 1 -maxdepth 1 -type d -exec chmod 0777 {} + 2>/dev/null || true
+          cache_root="${{ inputs.cache-dir }}"
+          mkdir -p "$cache_root"
+          chmod 0777 "$cache_root"
+          if [ "${{ inputs.cache-mode }}" = "per-run" ]; then
+            cache_dir="$(mktemp -d "$cache_root/run-XXXXXXXX")"
+          else
+            cache_dir="$cache_root"
+          fi
+          chmod 0777 "$cache_dir"
+          find "$cache_dir" -mindepth 1 -maxdepth 1 -type d -exec chmod 0777 {} + 2>/dev/null || true
+          printf 'TOOL_CACHE_DIR=%s\n' "$cache_dir" >>"$GITHUB_ENV"

      # install and quality run in ONE container: toolchains installed by the
      # install command (global pnpm, local bins) must still be on PATH for the
      # quality command — two `docker run --rm` invocations would not share
      # anything but the workspace and /cache mounts.
      - name: install and quality (containerized toolchain)
+        env:
+          COMMIT_ENV_NAME: ${{ inputs.commit-env-name }}
        run: |
          set -eu
+          mount_args=""
+          if [ -n "${{ inputs.mount-docker-socket }}" ]; then
+            mount_args="-v /var/run/docker.sock:/var/run/docker.sock"
+          fi
+          env_args=""
+          if [ -n "${COMMIT_ENV_NAME}" ]; then
+            env_args="${env_args} -e ${COMMIT_ENV_NAME}=${GITHUB_SHA}"
+          fi
+          while IFS= read -r line; do
+            [ -n "$line" ] && env_args="${env_args} -e $line"
+          done <<EOF
+          ${{ inputs.extra-env }}
+          EOF
+          # shellcheck disable=SC2086
          docker run --rm --add-host npm.cache.est:172.17.0.1 \
+            $mount_args \
            -v "$PWD:${{ inputs.workspace }}" -w "${{ inputs.workspace }}" \
-            -v "${{ inputs.cache-dir }}:/cache" -e TMPDIR=/cache \
+            -v "${TOOL_CACHE_DIR}:/cache" -e TMPDIR=/cache \
            -v /usr/local/share/ca-certificates/est-bundle.crt:/ca/est-bundle.crt:ro \
            -e SSL_CERT_FILE=/ca/est-bundle.crt \
            -e NODE_EXTRA_CA_CERTS=/ca/est-bundle.crt \
+            $env_args \
            "${{ inputs.node-image }}" sh -euxc '${{ inputs.install-command }} && ${{ inputs.quality-command }}'
+
+      # PLAT-014: the helper container writes root-owned files (tsx workers,
+      # playwright, compile caches) into the per-run cache mount; the host job
+      # runs as non-root gitea-runner since the 2026-08-30 runner governance,
+      # so a host-side rm -rf fails with EACCES and reds the job (playbook #18
+      # family). Clean as container root using the image this job already
+      # pulled, then rmdir the host-created directory itself.
+      - name: cleanup per-run cache dir (container root)
+        if: always() && inputs.cache-mode == 'per-run'
+        run: |
+          set -eu
+          [ -n "${TOOL_CACHE_DIR:-}" ] || exit 0
+          docker run --rm \
+            -v "${TOOL_CACHE_DIR}":/cleanup-root \
+            "${{ inputs.node-image }}" \
+            find /cleanup-root -mindepth 1 -delete
+          rmdir "${TOOL_CACHE_DIR}"
@@ -3,8 +3,9 @@
 # P1-7 verification status (2026-08-27, Gitea 1.27.2):
 #   - reusable workflow calls verified working (selftest caller:
 #     .gitea/workflows/selftest.yml)
-#   - checkout uses host git clone (JS actions need a host node runtime that
-#     tn does not install — see reusable/node-quality.yml header)
+#   - checkout via mu-ref/actions-checkout@v4 + HEAD==SHA postcondition
+#     (tn host node v22; v3 restoration history in reusable/node-quality.yml
+#     header; the action repo must stay PUBLIC — act clones it anonymously)
 #   - registry identity is the triggering actor (github.actor), credentials
 #     flow exclusively through the REGISTRY_PASSWORD secret (no hardcoded
 #     usernames — coordination review pitfall 21)
@@ -31,9 +32,10 @@ on:
        type: string
        description: "Digest-pinned helper image with node + docker CLI + verifier tooling"
      image-matrix:
-        required: true
+        required: false
        type: string
-        description: "Multiline matrix: service|dockerfile|target per line"
+        default: ""
+        description: "Multiline matrix: service|dockerfile|target per line (required for the built-in loop; script mode uses it only for the digest summary)"
      platform:
        required: false
        type: string
@@ -62,6 +64,41 @@ on:
        required: false
        type: string
        default: git.moneywood.site
+      build-command:
+        required: false
+        type: string
+        default: ""
+        description: "Script mode: run this command inside the helper container (full mounts: sock/docker-config/buildx/CA/cache + envs) instead of the built-in matrix loop"
+      install-command:
+        required: false
+        type: string
+        default: ""
+        description: "Script mode only: runs in the SAME container before build-command (toolchains installed here must survive to the build phase)"
+      cache-dir:
+        required: false
+        type: string
+        default: /data/cache/ci/build
+        description: "Script mode: host-side cache dir mounted at /cache"
+      cache-mode:
+        required: false
+        type: string
+        default: fixed
+        description: "fixed | per-run (per-run = fresh mktemp child + always() cleanup; for from-zero tool caches)"
+      commit-env-name:
+        required: false
+        type: string
+        default: ""
+        description: "Script mode: env var receiving the commit SHA inside the container (e.g. EST_GIT_COMMIT)"
+      extra-env:
+        required: false
+        type: string
+        default: ""
+        description: "Script mode: multiline KEY=VALUE extra env (no spaces in values; expressions NOT evaluated)"
+      workspace:
+        required: false
+        type: string
+        default: /workspace
+        description: "Script mode: workspace mount point inside the container"
    secrets:
      REGISTRY_PASSWORD:
        required: true
@@ -70,18 +107,14 @@ jobs:
  build:
    runs-on: build-docker
    steps:
-      - name: checkout (host git; JS actions need a host node runtime)
+      - name: checkout (mu-ref/actions-checkout; tn host node runs JS actions)
+        uses: https://git.moneywood.site/mu-ref/actions-checkout@v4
        env:
-          CI_ACTOR: ${{ github.actor }}
-          CI_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GIT_SSL_CAINFO: /usr/local/share/ca-certificates/caddy-root-ca.crt
+
+      - name: verify HEAD equals triggering commit
        run: |
          set -eu
-          export GIT_SSL_CAINFO=/usr/local/share/ca-certificates/caddy-root-ca.crt
-          git config --global credential.helper \
-            '!f() { echo "username=${CI_ACTOR}"; echo "password=${CI_TOKEN}"; }; f'
-          git config --global --add safe.directory '*'
-          timeout 120 git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
-            "https://git.moneywood.site/${GITHUB_REPOSITORY}.git" .
          test "$(git rev-parse HEAD)" = "${GITHUB_SHA}"

      - name: authenticate to gitea registry
@@ -92,7 +125,60 @@ jobs:
          printf '%s' "${REGISTRY_PASSWORD}" \
            | docker login "${{ inputs.registry-host }}" -u "${{ github.actor }}" --password-stdin

+      - name: prepare script-mode cache dir
+        if: inputs.build-command != ''
+        run: |
+          set -eu
+          cache_root="${{ inputs.cache-dir }}"
+          mkdir -p "$cache_root"
+          chmod 0777 "$cache_root"
+          if [ "${{ inputs.cache-mode }}" = "per-run" ]; then
+            cache_dir="$(mktemp -d "$cache_root/run-XXXXXXXX")"
+          else
+            cache_dir="$cache_root"
+          fi
+          chmod 0777 "$cache_dir"
+          find "$cache_dir" -mindepth 1 -maxdepth 1 -type d -exec chmod 0777 {} + 2>/dev/null || true
+          printf 'TOOL_CACHE_DIR=%s\n' "$cache_dir" >>"$GITHUB_ENV"
+
+      - name: run build script (script mode)
+        if: inputs.build-command != ''
+        env:
+          REGISTRY_AUTH_USER: ${{ github.actor }}
+          REGISTRY_AUTH_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+          COMMIT_ENV_NAME: ${{ inputs.commit-env-name }}
+        run: |
+          set -eu
+          mount_args="-v /var/run/docker.sock:/var/run/docker.sock"
+          if [ -f "$HOME/.docker/config.json" ]; then
+            mount_args="$mount_args -v $HOME/.docker/config.json:/root/.docker/config.json:ro"
+          fi
+          if [ -f /usr/libexec/docker/cli-plugins/docker-buildx ]; then
+            mount_args="$mount_args -v /usr/libexec/docker/cli-plugins/docker-buildx:/root/.docker/cli-plugins/docker-buildx:ro"
+          fi
+          env_args=""
+          if [ -n "${COMMIT_ENV_NAME}" ]; then
+            env_args="${env_args} -e ${COMMIT_ENV_NAME}=${GITHUB_SHA}"
+          fi
+          env_args="${env_args} -e REGISTRY_AUTH_USER -e REGISTRY_AUTH_PASSWORD"
+          while IFS= read -r line; do
+            [ -n "$line" ] && env_args="${env_args} -e $line"
+          done <<EOF
+          ${{ inputs.extra-env }}
+          EOF
+          # shellcheck disable=SC2086
+          docker run --rm --add-host npm.cache.est:172.17.0.1 \
+            $mount_args \
+            -v "$PWD:${{ inputs.workspace }}" -w "${{ inputs.workspace }}" \
+            -v "${TOOL_CACHE_DIR}:/cache" -e TMPDIR=/cache \
+            -v /usr/local/share/ca-certificates/est-bundle.crt:/ca/est-bundle.crt:ro \
+            -e SSL_CERT_FILE=/ca/est-bundle.crt \
+            -e NODE_EXTRA_CA_CERTS=/ca/est-bundle.crt \
+            $env_args \
+            "${{ inputs.node-image }}" sh -euxc '${{ inputs.install-command }} && ${{ inputs.build-command }}'
+
      - name: build push and verify image matrix
+        if: inputs.build-command == ''
        env:
          REGISTRY_AUTH_USER: ${{ github.actor }}
          REGISTRY_AUTH_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
@@ -102,12 +188,16 @@ jobs:
          VERIFY_COMMAND: ${{ inputs.verify-command }}
          CACHE_REGISTRY_REF: ${{ inputs.cache-registry-ref }}
          REVISION_ARG_NAME: ${{ inputs.revision-arg-name }}
+          IMAGE_MATRIX: ${{ inputs.image-matrix }}
        run: |
          set -eu
          IMAGE_TAG="git-${GITHUB_SHA}"
          printf '%s' "${GITHUB_SHA}" | grep -Eq '^[0-9a-f]{40}$'
-          mkdir -p .tmp-ci
-          digest_file=".tmp-ci/digests.txt"
+          # PLAT-014: the containerized install chowns the workspace to the
+          # helper's node user, so a host-side mkdir in $PWD fails with EACCES
+          # on the non-root runner. Keep host-written scratch in mktemp space.
+          digest_dir="$(mktemp -d)"
+          digest_file="$digest_dir/digests.txt"
          : >"$digest_file"
          cache_args=""
          if [ -n "${CACHE_REGISTRY_REF}" ]; then
@@ -137,6 +227,10 @@ jobs:
          done <<EOF
          ${{ inputs.build-args }}
          EOF
+          if [ -z "${IMAGE_MATRIX:-}" ]; then
+            echo "image-matrix is required for the built-in loop (or use build-command script mode)" >&2
+            exit 64
+          fi
          if [ -n "${REVISION_ARG_NAME}" ]; then
            build_args="${build_args} --build-arg ${REVISION_ARG_NAME}=${GITHUB_SHA}"
          fi
@@ -157,7 +251,7 @@ jobs:
              --provenance=mode=max \
              --sbom=true \
              --push .
-            manifest_file=".tmp-ci/index-${service}.json"
+            manifest_file="${digest_dir}/index-${service}.json"
            docker buildx imagetools inspect "${image}" --raw >"$manifest_file"
            if [ -n "${VERIFY_COMMAND}" ]; then
              # VERIFY_COMMAND carries its own interpreter (e.g. "node x.mjs"
@@ -185,3 +279,44 @@ jobs:
            echo '```'
          } >>"${GITHUB_STEP_SUMMARY:-/dev/stdout}"
          cat "$digest_file"
+
+      - name: digest summary (script mode)
+        if: inputs.build-command != '' && inputs.image-matrix != ''
+        env:
+          IMAGE_ROOT: ${{ inputs.image-root }}
+        run: |
+          set -eu
+          image_tag="git-${GITHUB_SHA}"
+          digest_dir="$(mktemp -d)"
+          digest_file="${digest_dir}/digests-script.txt"
+          : >"$digest_file"
+          while IFS='|' read -r service dockerfile target; do
+            [ -n "${service:-}" ] || continue
+            index_digest=$(docker buildx imagetools inspect "${IMAGE_ROOT}/${service}:${image_tag}" | awk '/^Digest:/{print $2}')
+            printf '%s|%s|%s\n' "$service" "$image_tag" "$index_digest" >>"$digest_file"
+          done <<'IMAGES'
+          ${{ inputs.image-matrix }}
+          IMAGES
+          {
+            echo "## V4 fresh image digests"
+            echo
+            echo "revision: ${GITHUB_SHA}"
+            echo
+            echo '```'
+            cat "$digest_file"
+            echo '```'
+          } >>"${GITHUB_STEP_SUMMARY:-/dev/stdout}"
+          cat "$digest_file"
+
+      # PLAT-014: same ownership fix as node-quality — see the comment there
+      # (host non-root runner cannot rm container-root-owned cache files).
+      - name: cleanup per-run cache dir (container root)
+        if: always() && inputs.build-command != '' && inputs.cache-mode == 'per-run'
+        run: |
+          set -eu
+          [ -n "${TOOL_CACHE_DIR:-}" ] || exit 0
+          docker run --rm \
+            -v "${TOOL_CACHE_DIR}":/cleanup-root \
+            "${{ inputs.node-image }}" \
+            find /cleanup-root -mindepth 1 -delete
+          rmdir "${TOOL_CACHE_DIR}"
@@ -7,8 +7,7 @@

 | 路径 | 用途 |
 |---|---|
-| `.gitea/workflows/reusable/checkout.yml` | 统一 checkout（mu-ref/actions-checkout + CA + HEAD==SHA 守卫；host job 专用） |
-| `.gitea/workflows/reusable/node-quality.yml` | node 质量门（digest helper、持久缓存、rank 源序） |
+| `.gitea/workflows/reusable/node-quality.yml` | node 质量门（digest helper、持久缓存、rank 源序、actions-checkout checkout） |
 | `.gitea/workflows/reusable/oci-build-push-verify.yml` | 镜像构建+推送+verify-command 校验链 |
 | `tools/ci/source-policy.sh` | 唯一选源实现（公司级 canonical） |
 | `tools/ci/helper/REGISTER.md` | ci-node-* helper 镜像 digest 注册 |
@@ -34,4 +33,13 @@ jobs:
 ## 迁移与同步

 - 2026-08-27 定稿：曾按初版决策试建 est/ci-workflows，因 est org 私有闸门不可跨仓调用而删除（用户改批 mu-ref 宿主）；同日自 est/Est-Infra 上移 tools/ci。
+- 2026-08-31 v4（PLAT-014，Issue #75）：per-run 缓存清理步改容器 root 执行（node-image `find /cleanup-root -mindepth 1 -delete` + 宿主 `rmdir`）——08-30 非 root runner 治理后宿主 rm 撞容器 root 属主文件必 EACCES（坑 #18 同族，Seabed run 917 两次复现）；v3 保持不动，per-run 调用方（est/Seabed）应升 @v4，fixed 模式调用方（est/Reef）无清理步可留 @v3。
+- 2026-08-29 v3：模板 checkout 恢复 mu-ref/actions-checkout@v4（JS action）+ HEAD==SHA postcondition——P1-10 的 JS 迁移（est/Est-Infra@57cc9f7，08-27 09:39）在 08-27 12:07 上移建仓时被回退为 P1-7 host-clone fallback 血统，v3 恢复并经 Seabed 私仓探针验证；无调用方的孤儿模板 `reusable/checkout.yml` 删除（reusable 不可嵌套调用，其守卫已内联进两个模板）。
 - helper Dockerfile 的可复现 bake 与 ops 巡检脚本仍属项目级（Est-Infra / gitea-host-setup）。
+
+## Runner contract（2026-08-30 定死）
+
+- **唯一 runner：TN `tn-build-runner`（gitea-runner v3.3.1，注册号 est org 范围）**；TS 只承载 Gitea/Registry，无任何 runner；0.6.1/act_runner 已全部清除，禁止回潮。
+- 服务：TN `gitea-runner.service`，**非 root 用户 `gitea-runner`**（docker 组，host docker socket 经组权限），capacity=1，工作区 `/data/ci-workspace`，缓存 `/data/actcache` 与 `/data/cache/ci`。
+- Labels（均 host 模式）：`build-docker`（存量 workflow 兼容）与 `est-tn-v3`（新 workflow 请用这个带版本的）。
+- 注册令牌：注册完成后即重置；凭据 `/opt/act-runner/.runner` 0600，目录 0700。
Author	SHA1	Message	Date
dsh-mulm	ff92951038	Merge pull request 'fix(digest): digest 暂存改 mktemp（PLAT-014 二段，v5 前置）' (#3 ) from task/PLAT-014-digest-mktemp into main	2026-08-31 13:41:00 +00:00
zcode_mulm	4d9a785ec5	fix(digest): digest 汇总文件改 mktemp（PLAT-014 二段：宿主非 root 撞容器 chown 后的 workspace） run 924 build 红根因：容器 install chown -R node:node workspace → 宿主 digest 步 mkdir -p .tmp-ci EACCES（897 时代 runner 为 root 故绿；治理后必红）。修法：digest/manifest 暂存文件改宿主 mktemp 目录（runner 自建 tmp 可写），两处 digest 步（verify/script 路径）同修。合并后打 v5。	2026-08-31 21:35:12 +08:00
dsh-mulm	973ed6cb99	Merge pull request 'fix(cleanup): per-run 缓存清理改容器 root 执行（PLAT-014，升 v4 前置）' (#2 ) from task/PLAT-014-per-run-cleanup-root into main	2026-08-31 13:05:17 +00:00
zcode_mulm	e2b81e7ee6	fix(cleanup): per-run 缓存清理改容器 root 执行（PLAT-014，坑 #18 同族）宿主 08-30 治理后为非 root gitea-runner，rm 容器 root 属主缓存文件必 EACCES （Seabed run 917 两 attempt 测试全绿、清理步必死）。复用 job 已拉的 node-image find -mindepth 1 -delete + 宿主 rmdir 自建目录。v3 不动；合并后打 v4， per-run 调用方（Seabed）升 @v4，fixed 调用方（Reef）可留 @v3。	2026-08-31 20:52:23 +08:00
钱木	0e132f63af	runner contract: TN-only tn-build-runner v3.3.1 (non-root, capacity=1); templates note non-root user	2026-08-30 22:00:15 +08:00
zcode_mulm	12b01c6cc5	Merge pull request 'templates v3: checkout back on actions-checkout@v4 + drop orphan reusable/checkout.yml' (#1 ) from task/v3-checkout-actions-checkout into main	2026-08-29 13:38:20 +00:00
zcode_mulm	ff3dd6ce12	templates v3: checkout back on mu-ref/actions-checkout@v4 + drop orphan reusable/checkout.yml P1-10 completed the JS-action checkout migration on 2026-08-27 09:39 (est/Est-Infra@57cc9f7) after tn gained a host node runtime (v22). The 12:07 consolidation founded this repo on the P1-7 host-clone fallback lineage instead, deleting the migrated copies at 12:25 — live pipelines have run host git clone with stale 'tn does not install node' headers ever since. v3 restores the JS path in both templates, keeps the fallback's HEAD==SHA assertion as an explicit postcondition step (guard is not downgraded), and deletes reusable/checkout.yml which had zero callers (reusable workflows cannot nest; its guard now lives inline). Verified by a Seabed task-branch probe run before tagging v3 (coordination task M1-423, issue #32).	2026-08-29 21:31:41 +08:00
zcode_mulm	1be2f0f072	templates: boolean inputs are not passed reliably through workflow_call with: — switch toggles to string form (mount-docker-socket / verify-sha)	2026-08-27 12:51:10 +08:00
zcode_mulm	7d8d9d8a2a	模板 v2：script 模式与通用件 - oci：build-command 脚本模式（install+build 同容器；全套挂载 sock/docker-config/buildx/CA/cache；commit-env-name 注入；extra-env； digest summary 复用 image-matrix；image-matrix 改可选） - 两模板：cache-mode fixed\|per-run（per-run = mktemp 子目录 + always() 清理，满足 from-zero 工具缓存契约）、mount-docker-socket、commit-env-name - 呼应 P1-9：中性变量注入由模板承担（EST_GIT_COMMIT 等）	2026-08-27 12:47:39 +08:00