diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
index f7805e9f0e4..a68e3fcfa11 100644
--- a/.github/workflows/build_and_test.yml
+++ b/.github/workflows/build_and_test.yml
@@ -369,10 +369,12 @@ jobs:
         CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
     - name: 'Cleanup build folder'
+      if: always()
       run: |
-        pwd
-        echo "cleaning ${GITHUB_WORKSPACE}"
-        ls -la ./
-        rm -rf ./* ./.*|| true
-        echo "expecting ${GITHUB_WORKSPACE} to be empty"
-        ls -la ./
+        set -euxo pipefail
+        docker run --rm \
+          -v "${GITHUB_WORKSPACE}:/tmp/geos" \
+          alpine:3.20 \
+          sh -lc 'rm -rf /tmp/geos/* /tmp/geos/.[!.]* /tmp/geos/..?* || true'
+
+
diff --git a/.github/workflows/ci_tests.yml b/.github/workflows/ci_tests.yml
index 08bdcaa0f9c..622294f4bbf 100644
--- a/.github/workflows/ci_tests.yml
+++ b/.github/workflows/ci_tests.yml
@@ -54,18 +54,21 @@ jobs:
     steps:
     - name: Check that the PR is not a draft (cancel rest of jobs otherwise)
       id: extract_pr_info
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
       run: |
-        if [[ ${{github.event_name}} == 'pull_request' ]]; then 
-          # We do not rely on the `github.event.pull_request.labels` information since it's cached at the job.
-          # Changing labels or assignee in the PR would not allow to simply re-run the job with a different outcome.
-          pr_json=$(curl -H "Accept: application/vnd.github+json" https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.number }})
-          
-          # We stop the workflow if the pr is draft
-          draft_status=$(echo ${pr_json} | jq '.draft')
+        set -euo pipefail
+
+        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+          draft_status=$( curl -fsSL -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${GITHUB_TOKEN}" "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.number }}" | jq -r '.draft')
+
           echo "Draft status of PR is ${draft_status}."
-          if [[ $draft_status == true ]]; then exit 1 ; fi
+          if [[ "${draft_status}" == "true" ]]; then
+            exit 1
+          fi
         fi
 
+
         
     # The TPL tag is contained in the codespaces configuration to avoid duplications.
     - name: Checkout .devcontainer/devcontainer.json
diff --git a/scripts/ci_build_and_test_in_container.sh b/scripts/ci_build_and_test_in_container.sh
index 2fea08d275f..3fd609dc476 100755
--- a/scripts/ci_build_and_test_in_container.sh
+++ b/scripts/ci_build_and_test_in_container.sh
@@ -152,6 +152,19 @@ if [[ -z "${GEOS_SRC_DIR}" ]]; then
   exit 1
 fi
 
+
+cleanup() {
+  echo "Container cleanup..."
+  rm -rf "${GEOS_SRC_DIR}/src/docs/sphinx/datastructure" || true
+
+  if [[ -n "${HOST_UID:-}" && -n "${HOST_GID:-}" ]]; then
+    chown -R "${HOST_UID}:${HOST_GID}" "${GEOS_SRC_DIR}" || true
+  fi
+}
+trap cleanup EXIT
+
+
+
 if [[ -z "${GEOS_DIR}" ]]; then
   echo "Installation folder undefined. Set to default value '/dev/null'. You can define it using '--install-dir-basename'."
   GEOS_DIR=/dev/null
@@ -207,7 +220,7 @@ echo "Using ${NPROC} cores."
 if [[ "${RUN_INTEGRATED_TESTS}" = true ]]; then
   echo "Running the integrated tests has been requested."
   # We install the python environment required by ATS to run the integrated tests.
-  or_die apt-get update
+  #or_die apt-get update
   or_die apt-get install -y virtualenv python3-dev python-is-python3
   ATS_PYTHON_HOME=/tmp/run_integrated_tests_virtualenv
   or_die virtualenv ${ATS_PYTHON_HOME}
@@ -369,10 +382,6 @@ or_die cmake --build . --target clean
 or_die cd ${GEOS_SRC_DIR}/inputFiles
 find . -name *.pyc | xargs rm -f
 
-# Clean the rst files
-echo "Cleaning the rst files..."
-or_die rm -rf ${GEOS_SRC_DIR}/src/docs/sphinx/datastructure
-
 # If we're here, either everything went OK or we have to deal with the integrated tests manually.
 if [[ ! -z "${INTEGRATED_TEST_EXIT_STATUS+x}" ]]; then
   echo "Exiting the build process with exit status ${INTEGRATED_TEST_EXIT_STATUS} from the integrated tests."