WIP: chore: Make the security-scan log path safe per job #55

Closed

ahmad wants to merge 1 commit from feature/33-per-job-log-path into main

ahmad commented

2026-09-07 15:44:41 +00:00

Owner

Issue

Refs #33 (Closes on the final head)

Problem

The action writes a fixed /tmp/security-scan.log; whether that is safe depends on the runner's filesystem model, which is untested — exactly the reason the issue exists.

Solution

Evidence first: this WIP opens with a temporary probe in validate that prints runner.temp, RUNNER_TEMP, the job's container identity and /tmp's mount — the runner answers criteria 1 and 2 in its own log. The path change follows the evidence and the probe commit is dropped before the PR leaves WIP.

Review notes

Hold review until the probe is gone and the real change is in place.

Risks and trade-offs

None while WIP; the probe writes one marker file to the job's /tmp.

### Issue Refs #33 (Closes on the final head) ### Problem The action writes a fixed /tmp/security-scan.log; whether that is safe depends on the runner's filesystem model, which is untested — exactly the reason the issue exists. ### Solution Evidence first: this WIP opens with a temporary probe in validate that prints runner.temp, RUNNER_TEMP, the job's container identity and /tmp's mount — the runner answers criteria 1 and 2 in its own log. The path change follows the evidence and the probe commit is dropped before the PR leaves WIP. ### Review notes Hold review until the probe is gone and the real change is in place. ### Risks and trade-offs None while WIP; the probe writes one marker file to the job's /tmp.

ahmad added 1 commit

2026-09-07 15:44:42 +00:00

chore: Probe the runner temp model (temporary)

PR / validate (pull_request) Successful in 19s

Details

5dcb557c33

Refs #33

ahmad commented

2026-09-07 16:13:56 +00:00

Author

Owner

Closing unmerged: the probe this PR existed to run answered the question — /tmp is per-job on this runner and runner.temp expands to /tmp exactly, so no path change is warranted. Findings recorded on #33.

ahmad closed this pull request

2026-09-07 16:13:57 +00:00