fix(ci): fail fast on contaminated self-hosted workspaces

[renecannao]

Summary

• Make self-hosted workspace cleanup explicit, verifiable, and limited to self-hosted runners.
• Restore ownership and write permissions before checkout and after Docker-backed builds, then fail with diagnostics if foreign-owned files remain.
• Propagate CI-builds failure through CI-trigger using gh run watch --exit-status, preventing handoff-dependent workflow runs from starting without artifacts.

Root cause

Docker builds bind-mount the checkout and leave root-owned dependency files on persistent proxysql-ci runners. The previous cleanup suppressed all errors, so the next actions/checkout failed with EACCES. Separately, CI-trigger ignored the watched build result, allowing downstream workflows to start and report misleading missing-artifact failures.

Validation

• YAML parsing passed for both changed workflows.
• Embedded Bash blocks passed bash -n.
• git diff --check passed.

Target branch: GH-Actions.

Summary by CodeRabbit

• CI Improvements
  • Improved automated build cleanup on trusted runners by restoring workspace permissions and verifying cleanup completion.
  • Added clearer diagnostics when workspace cleanup cannot be completed.
  • CI trigger workflows now accurately report whether the associated build completed successfully or failed.

[coderabbitai]

📝 Walkthrough

Walkthrough

The CI workflows now restrict workspace cleanup to trusted self-hosted runners, restore and verify ownership and permissions, and fail with diagnostics when cleanup is incomplete. The trigger workflow now propagates the watched CI-builds run’s exit status.

Changes

CI workflow reliability

Layer / File(s)	Summary
Trusted runner workspace cleanup .github/workflows/ci-builds.yml	Workspace ownership reclamation runs on trusted self-hosted runners, restores ownership and permissions, verifies the workspace, and reports cleanup failures.
CI-builds status propagation .github/workflows/ci-trigger.yml	The trigger watches CI-builds with gh run watch --exit-status and exits with the watched run’s status.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• sysown/proxysql#5595: Related CI workflow chaining preserves the PR commit SHA.
• sysown/proxysql#6001: Related trusted-runner cleanup changes in ci-builds.yml.
• sysown/proxysql#6003: Related self-hosted runner workspace ownership cleanup.

Sequence Diagram(s)

sequenceDiagram
  participant CI-trigger
  participant gh_run_watch
  participant CI-builds
  CI-trigger->>gh_run_watch: Watch CI-builds with --exit-status
  gh_run_watch->>CI-builds: Observe workflow completion
  CI-builds-->>gh_run_watch: Return workflow status
  gh_run_watch-->>CI-trigger: Return exit status
  CI-trigger-->>CI-trigger: Log success or fail with watcher status

Loading

Poem

A rabbit checks the runner’s door,
No чужие files remain on the floor.
Ownership returns, permissions align,
Failed runs now pass their status in line.
Clean workspaces hop through CI bright.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary CI change: fail fast when self-hosted workspaces are contaminated.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/ci-selfhosted-workspace-cleanup

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Code Review ✅ Approved

Explicit workspace cleanup and error propagation for self-hosted CI runners to prevent permission errors and invalid workflow handoffs. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud