chore(gates): register check-test-tmpdir in the catalog and tooling lane

Wire check:test-tmpdir and check:test-tmpdir:test into check:tooling, register
the test-tmpdir / test-tmpdir-model gates in CHECK_CATALOG + CheckId, and run
both as repo-guards CI steps so the raw-os.tmpdir-in-tests invariant is
enforced and the gate manifest stays complete.

Author: thymikee

.github/workflows/ci.yml

@@ -138,6 +138,16 @@ jobs:
         uses: ./.github/actions/run-gate
         with: { gate: tmpdir-leaks-model }
 
+      # Product test files must create scratch through mkdtempForTest, not os.tmpdir(), so it
+      # lands under the run's redirected TMPDIR and is removed once per run.
+      - name: Fail if a product test reads os.tmpdir() directly
+        uses: ./.github/actions/run-gate
+        with: { gate: test-tmpdir }
+
+      - name: Check the raw-os.tmpdir test-file gate model
+        uses: ./.github/actions/run-gate
+        with: { gate: test-tmpdir-model }
+
       # The selector is fail-open and advisory (GitHub CI stays authoritative),
       # so the gate only guards the derivation model.
       - name: Check affected-selector model

package.json

@@ -160,12 +160,14 @@
     "check:packaged-runner-swift": "node --experimental-strip-types scripts/check-packaged-runner-swift.ts",
     "check:tmpdir-leaks": "node --experimental-strip-types scripts/check-tmpdir-leaks.ts",
     "check:tmpdir-leaks:test": "node --experimental-strip-types scripts/node-test-tmpdir.ts --experimental-strip-types --test scripts/check-tmpdir-leaks-model.test.ts scripts/vitest-tmpdir-global-setup.test.ts scripts/node-test-tmpdir.test.ts scripts/swift-toolchain-tmpdir.test.ts",
+    "check:test-tmpdir": "node --experimental-strip-types scripts/check-test-tmpdir.ts",
+    "check:test-tmpdir:test": "node --experimental-strip-types scripts/node-test-tmpdir.ts --experimental-strip-types --test scripts/check-test-tmpdir-model.test.ts",
     "check:freerange": "fr",
     "check:quick": "pnpm lint && pnpm typecheck",
     "sync:mcp-metadata": "node scripts/sync-mcp-metadata.mjs",
     "check:mcp-metadata": "node scripts/sync-mcp-metadata.mjs --check",
     "version": "pnpm sync:mcp-metadata && git add server.json",
-    "check:tooling": "pnpm format:check && pnpm lint && pnpm typecheck && pnpm check:layering && pnpm depgraph:test && pnpm check:gate-manifest:test && pnpm check:gate-manifest && pnpm check:production-exports && pnpm check:tmpdir-leaks:test && pnpm check:xctest-selection && pnpm check:packaged-runner-swift && pnpm check:mcp-metadata && pnpm build && pnpm check:bundle-owner-files && pnpm check:package",
+    "check:tooling": "pnpm format:check && pnpm lint && pnpm typecheck && pnpm check:layering && pnpm depgraph:test && pnpm check:gate-manifest:test && pnpm check:gate-manifest && pnpm check:production-exports && pnpm check:tmpdir-leaks:test && pnpm check:test-tmpdir:test && pnpm check:test-tmpdir && pnpm check:xctest-selection && pnpm check:packaged-runner-swift && pnpm check:mcp-metadata && pnpm build && pnpm check:bundle-owner-files && pnpm check:package",
     "check:unit": "pnpm test:unit && pnpm check:tmpdir-leaks && pnpm test:smoke",
     "check": "pnpm check:tooling && pnpm check:fallow && pnpm check:unit",
     "prepack": "pnpm check:mcp-metadata && pnpm package:npm",

packages/platform-apple/src/__tests__/tmp-dir.ts

@@ -1,4 +1,3 @@
-import fs from 'node:fs';
 import fsPromises from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -7,8 +6,3 @@ import path from 'node:path';
 export async function mkdtempForTest(prefix: string): Promise<string> {
   return fsPromises.mkdtemp(path.join(os.tmpdir(), prefix));
 }
-
-// fallow-ignore-next-line code-duplication
-export function mkdtempForTestSync(prefix: string): string {
-  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
-}

packages/platform-harmonyos/src/__tests__/tmp-dir.ts

@@ -1,5 +1,4 @@
 import fs from 'node:fs';
-import fsPromises from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
@@ -10,12 +9,6 @@ import path from 'node:path';
  * individual tests never need their own afterEach/afterAll for this.
  */
 // fallow-ignore-next-line code-duplication
-export async function mkdtempForTest(prefix: string): Promise<string> {
-  return fsPromises.mkdtemp(path.join(os.tmpdir(), prefix));
-}
-
-/** Sync counterpart of {@link mkdtempForTest}, for setup code that can't await. */
-// fallow-ignore-next-line code-duplication
 export function mkdtempForTestSync(prefix: string): string {
   return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
 }

packages/provider-webdriver/src/tmp-dir.fixtures.ts

@@ -1,4 +1,3 @@
-import fs from 'node:fs';
 import fsPromises from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -13,9 +12,3 @@ import path from 'node:path';
 export async function mkdtempForTest(prefix: string): Promise<string> {
   return fsPromises.mkdtemp(path.join(os.tmpdir(), prefix));
 }
-
-/** Sync counterpart of {@link mkdtempForTest}, for setup code that can't await. */
-// fallow-ignore-next-line code-duplication
-export function mkdtempForTestSync(prefix: string): string {
-  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
-}

packages/replay-test/src/tmp-dir.fixtures.ts

@@ -1,5 +1,4 @@
 import fs from 'node:fs';
-import fsPromises from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
@@ -10,12 +9,6 @@ import path from 'node:path';
  * individual tests never need their own afterEach/afterAll for this.
  */
 // fallow-ignore-next-line code-duplication
-export async function mkdtempForTest(prefix: string): Promise<string> {
-  return fsPromises.mkdtemp(path.join(os.tmpdir(), prefix));
-}
-
-/** Sync counterpart of {@link mkdtempForTest}, for setup code that can't await. */
-// fallow-ignore-next-line code-duplication
 export function mkdtempForTestSync(prefix: string): string {
   return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
 }

scripts/check-affected/checks.ts

@@ -103,6 +103,8 @@ export const CHECK_CATALOG: readonly CheckSpec[] = [
   gate('depgraph', 'Dependency graph report model', 'depgraph:test'),
   gate('tmpdir-leaks', 'Leaked test tmpdir detector', 'check:tmpdir-leaks'),
   gate('tmpdir-leaks-model', 'TMPDIR redirection model', 'check:tmpdir-leaks:test'),
+  gate('test-tmpdir', 'Raw os.tmpdir() in product tests', 'check:test-tmpdir'),
+  gate('test-tmpdir-model', 'Raw-os.tmpdir test-file gate model', 'check:test-tmpdir:test'),
   gate('coverage-model', 'Changed-line coverage model', 'check:coverage-changed:test'),
   gate('wire-compat-model', 'Wire-compat rules model', 'check:daemon-wire-compat:test'),
   gate('production-exports', 'Production-unused exports', 'check:production-exports'),

scripts/check-affected/model.ts

@@ -63,6 +63,8 @@ export type CheckId =
   | 'depgraph'
   | 'tmpdir-leaks'
   | 'tmpdir-leaks-model'
+  | 'test-tmpdir'
+  | 'test-tmpdir-model'
   | 'coverage-model'
   | 'wire-compat-model'
   | 'production-exports'
@@ -129,6 +131,8 @@ export const ALL_CHECKS: readonly CheckId[] = [
   'depgraph',
   'tmpdir-leaks',
   'tmpdir-leaks-model',
+  'test-tmpdir',
+  'test-tmpdir-model',
   'coverage-model',
   'wire-compat-model',
   'production-exports',

scripts/check-test-tmpdir-model.ts

@@ -59,7 +59,7 @@ export function isTestFile(file: string): boolean {
 }
 
 /** Every tracked test file under the scanned roots, repo-root-relative. */
-export function listTrackedTestFiles(repoRoot: string): string[] {
+function listTrackedTestFiles(repoRoot: string): string[] {
   const out = execFileSync('git', ['ls-files', '-z', '--', ...TEST_SOURCE_PATHSPECS], {
     cwd: repoRoot,
     encoding: 'utf8',