security: stop uploading raw Droid runtime artifacts

action.yml

@@ -353,23 +353,3 @@ runs:
         TRACK_PROGRESS: ${{ inputs.track_progress }}
         AUTOMATIC_REVIEW: ${{ inputs.automatic_review }}
         AUTOMATIC_SECURITY_REVIEW: ${{ inputs.automatic_security_review }}
-
-    - name: Collect .factory debug files
-      if: always() && steps.prepare.outputs.contains_trigger == 'true'
-      shell: bash
-      run: |
-        if [ -d "$HOME/.factory" ]; then
-          cp -r "$HOME/.factory" "${{ runner.temp }}/.factory"
-        fi
-
-    - name: Upload debug artifacts
-      if: always() && steps.prepare.outputs.contains_trigger == 'true'
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-      with:
-        name: droid-review-debug-${{ github.run_id }}
-        path: |
-          ${{ runner.temp }}/.factory/**
-          ${{ runner.temp }}/droid-prompts/**
-        include-hidden-files: true
-        if-no-files-found: ignore
-        retention-days: 7

test/action-yml.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const actionYml = readFileSync(
+  join(import.meta.dir, "..", "action.yml"),
+  "utf8",
+);
+
+describe("action.yml debug artifact invariants", () => {
+  it("loads the Droid composite action metadata", () => {
+    expect(actionYml.length).toBeGreaterThan(0);
+    expect(actionYml).toContain("runs:");
+    expect(actionYml).toContain('using: "composite"');
+  });
+
+  it("does not copy raw Factory runtime state", () => {
+    expect(actionYml).not.toContain("Collect .factory debug files");
+    expect(actionYml).not.toMatch(/cp\s+-[rR]\s+["']?\$HOME\/?\.factory/);
+  });
+
+  it("does not upload raw prompt or Factory runtime trees directly", () => {
+    expect(actionYml).not.toContain("Upload debug artifacts");
+    expect(actionYml).not.toMatch(
+      /\$\{\{\s*runner\.temp\s*\}\}\/\.factory(?:\/\*\*)?/,
+    );
+    expect(actionYml).not.toMatch(
+      /\$\{\{\s*runner\.temp\s*\}\}\/droid-prompts\/\*\*/,
+    );
+    expect(actionYml).not.toMatch(
+      /name:\s*droid-review-debug-\$\{\{\s*github\.run_id\s*\}/,
+    );
+  });
+
+  it("does not enable hidden-file uploads for raw Droid runtime artifacts", () => {
+    expect(actionYml).not.toMatch(
+      /include-hidden-files:\s*true[\s\S]{0,500}(?:\.factory|droid-prompts)/,
+    );
+    expect(actionYml).not.toMatch(
+      /(?:\.factory|droid-prompts)[\s\S]{0,500}include-hidden-files:\s*true/,
+    );
+  });
+});