Elections tooling builds must start from clean machines each run to avoid leftover credentials and packages. What CI environment approach fits?

Elections tooling builds that must start from clean machines each run should use task runners that provision ephemeral clean environments per pipeline job. Ephemeral runners (or containers/VMs torn down after each job) prevent leftover credentials, packages, and working trees from contaminating the next build. For elections-related automation, that isolation reduces drift and residual secret exposure across highly sensitive pipelines.

Reusing one permanent unclean workstation forever fails by concept: persistent disks accumulate credentials, old packages, and unreviewed state. Asking volunteers to build artifacts on home PCs without runners fails chain-of-custody, reproducibility, and security baseline control. Disabling environment provisioning so jobs share whatever disk state remains intentionally preserves contamination—the opposite of clean-per-run.

Exam caveat: ephemeral does not remove the need for hardened runner images and secret injection controls; it addresses residual state between jobs. Also keep build provenance: volunteer home builds are not equivalent to governed CI runners.

Operational check: configure elections pipelines on ephemeral runners with clean images, inject secrets at runtime rather than baking them into the AMI, destroy workspace after each job, prohibit long-lived shared workstations for official artifacts, and verify consecutive jobs cannot read prior job credential files.