BUILD-11553: Avoid workspace pollution in CI actions

[matemoln]

Summary

Keep the GitHub workspace checkout clean by moving ephemeral CI state out of the repository tree. This prevents downstream steps (e.g. Docker image tagging in gitar) from behaving differently when the working tree is polluted with untracked files or directories.

• get-build-number: write build_number.txt to ${RUNNER_TEMP} instead of the workspace; update cache paths and shell specs accordingly
• config-npm / build-npm / build-yarn: use jf npm-config --global so .jfrog/projects/ is created under the runner home, not the workspace
• config-npm / build-npm / build-yarn: remove transient .actions/ symlinks after local composite action references are consumed (only symlinks created by the action; rmdir if empty)

Why

Blocks gitar/actions/runs/27045793684: image tagging logic behaves differently when the workspace is clean vs polluted.

Test plan

• ShellSpec: config-npm, build-npm, build-yarn, get-build-number
• Verify npm/yarn install and publish still resolve/deploy correctly in dummy-repo CI: https://github.com/SonarSource/sonar-dummy-js/actions/runs/27240536197/job/80443233244
• Confirm gitar build is unblocked with a clean workspace after consuming updated actions

[hashicorp-vault-sonar-prod]

BUILD-11553

[Copilot]

Pull request overview

This PR updates the get-build-number composite action and its ShellSpec tests to store the cached build_number.txt under RUNNER_TEMP (instead of the workspace checkout), preventing ephemeral cache state from modifying the repository tree during workflow runs.

Changes:

• Update the action to write/read the build number file via a BUILD_NUMBER_FILE path pointing to ${RUNNER_TEMP}/build_number.txt.
• Update the underlying get_build_number.sh script to use BUILD_NUMBER_FILE / RUNNER_TEMP for its cache file location.
• Adjust ShellSpec tests to set RUNNER_TEMP and assert the cache file is created in the temp directory.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
spec/get_build_number_spec.sh	Sets RUNNER_TEMP in tests and updates assertions to expect the cache file in temp.
get-build-number/get_build_number.sh	Uses BUILD_NUMBER_FILE / RUNNER_TEMP to determine where to write the cache file.
get-build-number/action.yml	Exports BUILD_NUMBER_FILE into the composite action environment and updates cache/read/write steps to use it.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[julien-carsique-sonarsource]

This looks as good improvement.
However, the motivation for it is unclear: "working tree is polluted with untracked files or directories". There are many other files and directories created by the build. If they are breaking Gitar tagging behavior, then the fix should live in Gitar with running a git clean.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[matemoln]

This looks as good improvement. However, the motivation for it is unclear: "working tree is polluted with untracked files or directories". There are many other files and directories created by the build. If they are breaking Gitar tagging behavior, then the fix should live in Gitar with running a git clean.

There are many other files and directories created by the build, but that is expected and they have entries in the .gitignore for those. I agree that the tagging behaviour is a bit too strict, I'll check if git clean is needed.

[gitar-bot]

Code Review ✅ Approved

Moves ephemeral CI state for NPM, Yarn, and build number generation to runner-specific directories to prevent workspace pollution. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}