Consumers can point the canonical quality job at a reused self-hosted runner, where Bun and Playwright keep executable user-level caches between commits. Removing GitHub cache uploads does not stop an earlier pull-request revision from poisoning those persistent directories for a later revision.
Evidence
The quality job accepts any CI_RUNNER label and the install steps use Bun's and Playwright's default user-level stores without clearing or job-scoping them. A two-run Bun 1.3.14 probe altered a cached package, removed node_modules, and reran the workflow's frozen install; the altered code was installed successfully. A Playwright 1.61.1 probe reused marker-only browser directories; installation exited 0 without restoring executables. This is reproducible on the pre-fix SHA, so the bounded verification pass must defer it.
Concrete failure
PR revision A passes and then changes the persistent runner user's package or browser cache. Revision B gets a clean checkout but the same HOME, consumes that altered state, and can produce a different verdict from a fresh hosted runner.
Suggested verification
Either enforce ephemeral quality runners or place both stores in freshly cleared job-scoped directories. Prove the contract with two jobs on one reused runner: the first poisons both stores, and the second must download authentic content through the exact workflow commands.
Found while verifying #251.
Consumers can point the canonical quality job at a reused self-hosted runner, where Bun and Playwright keep executable user-level caches between commits. Removing GitHub cache uploads does not stop an earlier pull-request revision from poisoning those persistent directories for a later revision.
Evidence
The quality job accepts any
CI_RUNNERlabel and the install steps use Bun's and Playwright's default user-level stores without clearing or job-scoping them. A two-run Bun 1.3.14 probe altered a cached package, removednode_modules, and reran the workflow's frozen install; the altered code was installed successfully. A Playwright 1.61.1 probe reused marker-only browser directories; installation exited 0 without restoring executables. This is reproducible on the pre-fix SHA, so the bounded verification pass must defer it.Concrete failure
PR revision A passes and then changes the persistent runner user's package or browser cache. Revision B gets a clean checkout but the same HOME, consumes that altered state, and can produce a different verdict from a fresh hosted runner.
Suggested verification
Either enforce ephemeral quality runners or place both stores in freshly cleared job-scoped directories. Prove the contract with two jobs on one reused runner: the first poisons both stores, and the second must download authentic content through the exact workflow commands.
Found while verifying #251.