[CI] Upload only test logs from the Windows validation jobs

.github/workflows/Validation.Tests.Matrix.Job.yml

@@ -25,6 +25,8 @@ jobs:
       has_macos: ${{ steps.matrix.outputs.has_macos }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Resolve test combinations
         id: matrix
@@ -41,6 +43,8 @@ jobs:
     timeout-minutes: 180
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Download ${{ matrix.target }} artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -83,7 +87,8 @@ jobs:
           & ./scripts/ci/run_backend_validation_tests.ps1 `
             -Backend '${{ matrix.backend }}' `
             -BinaryDirectory (Join-Path $env:GITHUB_WORKSPACE 'artifacts\bin') `
-            -Architecture '${{ matrix.architecture }}' *>&1 |
+            -Architecture '${{ matrix.architecture }}' `
+            -TempDirectory (Join-Path $env:RUNNER_TEMP 'mxc-test-temp') *>&1 |
             Tee-Object -FilePath (Join-Path $env:RUNNER_TEMP 'mxc-ci.log') -Append
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
@@ -92,11 +97,14 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: logs-${{ inputs.plan }}-${{ matrix.os }}-${{ matrix.architecture }}-${{ matrix.backend }}-${{ github.run_attempt }}
-          # The dispatcher points TEMP here, so suite logs and scratch trees are
-          # collected without enumerating each one. Exclude bulk binaries that
-          # tooling also drops in TEMP; they dwarf the logs and aid no triage.
+          # The run step points the suites' TEMP at mxc-test-temp, so suite
+          # logs and scratch trees are collected without enumerating each one;
+          # runner.temp itself is shared with the runner and the actions.
+          # Exclude bulk binaries that tooling also drops in TEMP; they dwarf
+          # the logs and aid no triage.
           path: |
-            ${{ runner.temp }}
+            ${{ runner.temp }}/mxc-test-temp
+            ${{ runner.temp }}/mxc-ci.log
             !${{ runner.temp }}/**/*.vhd
             !${{ runner.temp }}/**/*.vhdx
             !${{ runner.temp }}/**/*.tar
@@ -120,6 +128,8 @@ jobs:
     timeout-minutes: 180
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Download ${{ matrix.target }} artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -183,6 +193,8 @@ jobs:
     timeout-minutes: 180
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Download ${{ matrix.target }} artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

docs/development/build-and-test/ci-validation-infrastructure.md

@@ -38,7 +38,7 @@ the individual local test scripts are documented in
 | `scripts/ci/prepare-windows-host.ps1` | Per-backend Windows host preparation / prerequisite assertions, plus the `winget` repair and the workload-tooling install. Runs in Windows PowerShell, because it installs the `pwsh` the steps after it use. |
 | `scripts/ci/prepare-linux-host.sh` | Per-backend Linux package install and service startup (distro-aware), plus the workload-interpreter inventory. |
 | `scripts/ci/prepare-macos-host.sh` | Per-backend macOS host preparation / prerequisite assertions. |
-| `scripts/ci/run_backend_validation_tests.ps1` | Windows dispatcher: backend id → existing backend suite. Also points `TEMP` at `$RUNNER_TEMP` so logs get collected. |
+| `scripts/ci/run_backend_validation_tests.ps1` | Windows dispatcher: backend id → existing backend suite. Also points `TEMP` at the directory CI passes as `-TempDirectory`, so logs get collected. |
 | `scripts/ci/run_backend_validation_tests.sh` | Linux/macOS dispatcher: backend id → existing backend suite. |
 
 ### Flow
@@ -440,21 +440,21 @@ Every job uploads its logs whether it passed or failed, as
 
 The catch is that `$env:TEMP` is not `$RUNNER_TEMP`. The Windows suites write their
 scratch trees, transcripts, and results files under the user's temp directory
-(`C:\Users\<user>\AppData\Local\Temp`), but `upload-artifact` reads
+(`C:\Users\<user>\AppData\Local\Temp`), but `upload-artifact` reads from
 `${{ runner.temp }}` (`C:\a\_work\_temp`). Anything left in the former is simply
 never collected, which is why the artifact used to arrive nearly empty.
 
-So `run_backend_validation_tests.ps1` points `TEMP` and `TMP` at `$RUNNER_TEMP` before
-it dispatches. Parameter defaults, `[System.IO.Path]::GetTempPath()`, and child
-processes all read those variables, so everything temp-rooted lands in the
-upload directory without CI having to know a single filename.
+So the Windows run step passes `-TempDirectory $RUNNER_TEMP/mxc-test-temp` to
+`run_backend_validation_tests.ps1`, which points `TEMP` and `TMP` there before it
+dispatches. Parameter defaults, `[System.IO.Path]::GetTempPath()`, and child
+processes all read those variables, so everything temp-rooted lands in the upload
+directory without CI having to know a single filename. The upload takes that folder
+and `mxc-ci.log`, not all of `$RUNNER_TEMP`, which the runner and the job's actions
+also use.
 
 Linux and macOS need none of this — those suites log to stdout, and the run
 step tees that into `$RUNNER_TEMP/mxc-ci.log`.
 
-The IsolationSession test bundle downloads under `artifacts/bin`, outside
-`$RUNNER_TEMP`, so it is not uploaded again with the logs.
-
 ## Runbook
 
 Always finish with a local resolve, which runs the full catalog validation:

scripts/ci/run_backend_validation_tests.ps1

@@ -23,7 +23,9 @@ param(
 
     [Parameter(Mandatory)]
     [ValidateSet('x64', 'arm64')]
-    [string]$Architecture
+    [string]$Architecture,
+
+    [string]$TempDirectory
 )
 
 $ErrorActionPreference = 'Stop'
@@ -48,20 +50,15 @@ function Assert-File {
 # artifact and copy it afterwards, point TEMP at the upload directory for the
 # duration of the run: parameter defaults, .NET GetTempPath(), and child
 # processes all follow it, so anything temp-rooted lands where CI collects it.
-#
-# The suites' scratch-root guards compare against $env:TEMP, so they stay
-# satisfied — this redirects what TEMP means rather than pointing a path
-# outside it.
-function Redirect-TempToRunnerTemp {
-    if (-not $env:RUNNER_TEMP) {
+# CI passes the upload directory as -TempDirectory.
+function Redirect-Temp {
+    if (-not $TempDirectory) {
         return
     }
-    if (-not (Test-Path -LiteralPath $env:RUNNER_TEMP)) {
-        New-Item -ItemType Directory -Force -Path $env:RUNNER_TEMP | Out-Null
-    }
-    $env:TEMP = $env:RUNNER_TEMP
-    $env:TMP  = $env:RUNNER_TEMP
-    Write-Host "Redirected TEMP to $env:RUNNER_TEMP so test logs are collected."
+    $directory = (New-Item -ItemType Directory -Force -Path $TempDirectory).FullName
+    $env:TEMP = $directory
+    $env:TMP  = $directory
+    Write-Host "Redirected TEMP to $directory so test logs are collected."
 }
 
 function Invoke-TestScript {
@@ -353,7 +350,7 @@ function Invoke-IsolationSessionSuites {
     }
 }
 
-Redirect-TempToRunnerTemp
+Redirect-Temp
 
 switch ($Backend) {
     'process' { Invoke-ProcessContainerTests }