From 6e24718c1f8eb65c190fad0695115d2c3d2aaa34 Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Wed, 22 Jul 2026 19:47:31 +0200
Subject: [PATCH] Isolate backend Docker jobs on ephemeral runners (#322)

## Summary
- Run Docker-producing PHP, Edge Broker, and Edge Gateway jobs on
ephemeral Ubuntu workspaces for both PR and push events.
- Keep the non-Docker Edge Agent and Release Manager gate on the trusted
backend pool.
- Preserve the explicit system-socket selection and fail-closed Docker
access check.

## Root cause
Exact-master run 29942825210 got past Docker access, then later jobs
failed during checkout because an earlier container left
`services/php/logs/error.log` root-owned in the reused self-hosted
workspace. This is workspace contamination, not a product-test failure.
The shallow frontend repair pattern would miss the depth-4 file and
would accumulate undeletable trash directories.

## Verification
- Workflow YAML parse passed.
- `git diff --check` passed.
- PR CI must be green; after merge, exact-master Required CI and the
non-skipped Release Manager gate are mandatory.
---
 .github/workflows/tests.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index f9c2cd30..36fca631 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -19,8 +19,8 @@ concurrency:
 jobs:
   php:
     name: PHP ${{ matrix.suite }} (required)
-    # Pull requests are untrusted and use ephemeral runners; trusted pushes use the local pool.
-    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
+    # Docker jobs use disposable workspaces so root-owned container artifacts cannot poison later checkouts.
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -115,7 +115,7 @@ jobs:
 
   edge-broker:
     name: Edge Broker (required)
-    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
+    runs-on: ubuntu-24.04
     env:
       DOCKER_HOST: unix:///var/run/docker.sock
 
@@ -159,7 +159,7 @@ jobs:
 
   edge-gateway-backend:
     name: Edge Gateway Backend (required)
-    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
+    runs-on: ubuntu-24.04
     env:
       DOCKER_HOST: unix:///var/run/docker.sock
       COMPOSE_FILE: docker-compose.yml:.github/docker-compose.ci.yml