ci: isolate digest artifacts on self-hosted runners (#102)

Build and publish used /tmp/digests, which persists on evoo-ci hosts.
Uploading /tmp/digests/* picked up stale digest markers from earlier runs,
so the manifest step saw 13 digests instead of one amd64 image.

Use RUNNER_TEMP for recording, uploading, and assembling digests so each
job only sees its own architecture marker.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>

.github/workflows/publish-server-image.yml

@@ -161,16 +161,19 @@ jobs:
           provenance: mode=max
           sbom: true
       - name: Record the architecture digest
+        id: digest
         env:
           DIGEST: ${{ steps.build.outputs.digest }}
         run: |
           set -euo pipefail
-          mkdir -p /tmp/digests
-          touch "/tmp/digests/${DIGEST#sha256:}"
+          digest_dir="${RUNNER_TEMP}/digest"
+          mkdir -p "$digest_dir"
+          touch "${digest_dir}/${DIGEST#sha256:}"
+          echo "dir=${digest_dir}" >> "$GITHUB_OUTPUT"
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: digest-${{ matrix.name }}-${{ matrix.arch }}
-          path: /tmp/digests/*
+          path: ${{ steps.digest.outputs.dir }}/*
           if-no-files-found: error
           retention-days: 1
 
@@ -193,10 +196,13 @@ jobs:
           - name: updater
           - name: computer
     steps:
+      - name: Prepare an isolated digest directory
+        id: digest_dir
+        run: echo "path=${RUNNER_TEMP}/digests" >> "$GITHUB_OUTPUT"
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           pattern: digest-${{ matrix.name }}-*
-          path: /tmp/digests
+          path: ${{ steps.digest_dir.outputs.path }}
           merge-multiple: true
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       - name: Log in to GHCR
@@ -223,7 +229,7 @@ jobs:
             type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}
       - name: Assemble and verify the manifest
         id: manifest
-        working-directory: /tmp/digests
+        working-directory: ${{ steps.digest_dir.outputs.path }}
         env:
           IMAGE: ghcr.io/${{ steps.ns.outputs.repo }}/${{ matrix.name }}
           TAGS: ${{ steps.meta.outputs.tags }}

infra/updater/src/publish-workflow.test.ts

@@ -43,6 +43,11 @@ describe("server image publish workflow", () => {
     expect(workflowText).toContain("actions/attest-build-provenance@");
   });
 
+  it("stores digest markers under RUNNER_TEMP so self-hosted runners do not leak stale files", () => {
+    expect(workflowText).not.toContain("/tmp/digests");
+    expect(workflowText).toContain("RUNNER_TEMP");
+  });
+
   it("names every image under the lowercase repository namespace", () => {
     expect(workflowText).not.toContain("ghcr.io/${{ github.repository }}");
     const references =