PR #1326 CI failed in two places:
- The vulnerability-db job stopped on `unable to create listing temp file:
open /tmp/grype-db-listing…: permission denied`. The repository runs the
engines as `docker run --user <uid>:<gid>`, and the Grype and Syft images
set no User and WorkingDir /tmp, which only root may write. The dry-run
mirror scan failed the same way: 156 Syft errors and the Grype database.
Every engine now gets TMPDIR pointing at its writable /work mount.
- Every workspace job died in `make system-purge`: `git clean -fdX` could
not remove build/vulnerability-db, because the job bound that directory
as its own mount inside the mounted checkout. On GitHub the workspace job
now keeps its databases under ${RUNNER_TEMP}, outside the checkout; act
keeps the shared host directory.
Part of #1324
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5.5
3531b95de0