A main-push SDK Java run failed its 'ubuntu-latest / Java 21' leg in the
Checkout step before any test ran (run 37423974280). The leg runs on the
shared self-hosted ECS pool, whose reused workspace accumulates residue
from earlier jobs: ci.yml's incident history records review/autofix
leftovers (.qwen, .qwen.root-orig, review worktrees and branches) failing
actions/checkout's clean, and a runner-user-owned tree failing every
later git call with 'detected dubious ownership' (#12648). sdk-java.yml's
pool-routed jobs carried only the bare ownership restore, without the two
countermeasures ci.yml grew for exactly these failures.
Port both, byte-identical to the pinned ci.yml copies, to the three
pool-routed jobs (test, flyway-migrations, daemon-e2e): the
safe.directory trust joins the restore step, and the stale-.qwen sweep
(with its quarantine ladder and review worktree/branch cleanup) runs
between restore and checkout, gated to self-hosted so the hosted
macOS/Windows legs stay untouched.
The sdk-java workflow suite pins the restore -> sweep -> checkout order
in all three jobs and pins both step bodies byte-identical to ci.yml's,
so the copies cannot drift; mutation-probed by stashing the workflow
change (all 9 new pins red) and restoring it (green). The size baseline
records the copied recipe's growth in the same commit, per the ratchet.
Co-authored-by: 易良 <[email protected]>
