Fix GCP operator runner path initialization

.github/workflows/gcp-iap-operator.yml

@@ -36,8 +36,6 @@ env:
   CLONE_SERVICE_ACCOUNT: sa-teleo-iap-clone-operator@teleo-501523.iam.gserviceaccount.com
   EXPECTED_WORKFLOW_REF: living-ip/teleo-infrastructure/.github/workflows/gcp-iap-operator.yml@refs/heads/main
   DISPATCHER_VERSION: teleo-gcp-iap-operator-v1
-  BUNDLE_DIR: ${{ runner.temp }}/gcp-iap-operator-bundle
-  RESULT_DIR: ${{ runner.temp }}/gcp-iap-operator-result
 
 jobs:
   operate:
@@ -48,6 +46,15 @@ jobs:
       - name: Check out the dispatched main revision
         uses: actions/checkout@v4
 
+      - name: Initialize runner-local paths
+        id: paths
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ -n "${RUNNER_TEMP:-}" ]] || exit 2
+          printf 'BUNDLE_DIR=%s\n' "${RUNNER_TEMP}/gcp-iap-operator-bundle" >> "${GITHUB_ENV}"
+          printf 'RESULT_DIR=%s\n' "${RUNNER_TEMP}/gcp-iap-operator-result" >> "${GITHUB_ENV}"
+
       - name: Validate fixed inputs and select identity
         id: validate
         shell: bash

tests/test_gcp_iap_operator_access.py

@@ -139,6 +139,20 @@ def test_workflow_uses_wif_official_actions_and_sanitized_short_retention() -> N
     assert validate_index < auth_index
 
 
+def test_workflow_initializes_runner_paths_at_step_runtime() -> None:
+    workflow = load_workflow()
+    assert "BUNDLE_DIR" not in workflow["env"]
+    assert "RESULT_DIR" not in workflow["env"]
+    steps = workflow["jobs"]["operate"]["steps"]
+    paths_index = next(i for i, step in enumerate(steps) if step.get("id") == "paths")
+    validate_index = next(i for i, step in enumerate(steps) if step.get("id") == "validate")
+    paths_source = steps[paths_index]["run"]
+    assert paths_index < validate_index
+    assert '"${RUNNER_TEMP}/gcp-iap-operator-bundle" >> "${GITHUB_ENV}"' in paths_source
+    assert '"${RUNNER_TEMP}/gcp-iap-operator-result" >> "${GITHUB_ENV}"' in paths_source
+    assert "runner.temp" not in WORKFLOW.read_text(encoding="utf-8")
+
+
 def test_workflow_builds_exact_main_bundle_from_tracked_files_and_hashes() -> None:
     source = WORKFLOW.read_text(encoding="utf-8")