diff --git a/.github/actions/after-job/action.yml b/.github/actions/after-job/action.yml
new file mode 100644
index 00000000000..7c8294b02b4
--- /dev/null
+++ b/.github/actions/after-job/action.yml
@@ -0,0 +1,37 @@
+name: 'Post-job actions'
+description: >-
+  Perform generic post-job actions that should be performed for every
+  job.
+inputs:
+  jobname:
+    default: ${{ github.job }}
+runs:
+  using: "composite"
+  steps:
+    - uses: ./.github/actions/collect-logs
+      if: always()
+      with:
+        jobname: ${{ inputs.jobname }}
+
+    - name: "Check that the job didn't change any files"
+      uses: ./.github/actions/git-dirty-check
+
+    - run: make ci/teardown-k3d
+      shell: bash
+
+    # `make clean`
+    - run: make clean
+      shell: bash
+    - name: "Check that `make clean` didn't change any files"
+      uses: ./.github/actions/git-dirty-check
+      # There's no way to test that `make clean` did everything it was
+      # supposed to, since it's a 90% solution for `make clobber`
+
+    # `make clobber`
+    - run: make clobber
+      shell: bash
+    - name: "Check that `make clobber` didn't change any files"
+      uses: ./.github/actions/git-dirty-check
+    - name: "Check that `make clobber` did everything it's supposed to"
+      shell: bash
+      run: $GITHUB_ACTION_PATH/check-clobber.sh
diff --git a/.github/actions/after-job/check-clobber.sh b/.github/actions/after-job/check-clobber.sh
new file mode 100755
index 00000000000..ca24c9cca2a
--- /dev/null
+++ b/.github/actions/after-job/check-clobber.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+#shellcheck disable=SC2016
+
+r=0
+if [[ -n "$(git clean --dry-run -d -x)" ]]; then
+    echo
+    echo 'There are files that `make clobber` did not remove that it should have:'
+    git clean --dry-run -d -x | sed 's/^Would remove /    /'
+    echo
+    r=1
+fi
+if docker image list --format='{{ .Repository }}:{{ .Tag }}' | grep -q '\.local/'; then
+    echo
+    echo 'There are Docker images that `make clobber` did not remove that it should have:'
+    docker image list | grep '\.local/'
+    echo
+    r=1
+fi
+if [[ -n "$(docker container list --all --quiet)" ]]; then
+    echo
+    echo 'There are Docker containers that `make clobber` did not remove:'
+    docker container list --all
+    echo
+    r=1
+fi
+if [[ -n "$(docker volume list --quiet)" ]]; then
+    echo
+    echo 'There are Docker volumes that `make clobber` did not remove:'
+    docker volume list
+    echo
+    r=1
+fi
+exit "$r"
diff --git a/.github/workflows/execute-tests-and-promote.yml b/.github/workflows/execute-tests-and-promote.yml
index 2f8f743792a..425e0bb1ee1 100644
--- a/.github/workflows/execute-tests-and-promote.yml
+++ b/.github/workflows/execute-tests-and-promote.yml
@@ -23,6 +23,7 @@ jobs:
       - shell: bash
         run: |
           make lint
+      - uses: ./.github/actions/after-job
 
   generate: ####################################################################
     runs-on: ubuntu-latest
@@ -59,6 +60,7 @@ jobs:
           make generate
       - uses: ./.github/actions/git-dirty-check
         name: "Check Git not dirty from 'make generate' (again!)"
+      - uses: ./.github/actions/after-job
 
   check-envoy-version: #########################################################
     runs-on: ubuntu-latest
@@ -85,6 +87,7 @@ jobs:
           username: ${{ secrets.GH_DOCKER_BUILD_USERNAME }}
           password: ${{ secrets.GH_DOCKER_BUILD_TOKEN }}
       - run: make check-envoy-version
+      - uses: ./.github/actions/after-job
 
   # Tests ######################################################################
   check-gotest:
@@ -112,10 +115,7 @@ jobs:
           export TEST_XML_DIR=/tmp/test-logs/xml/
           mkdir -p ${TEST_XML_DIR}
           make gotest
-      - uses: ./.github/actions/git-dirty-check
-        name: "Check git not dirty from testing"
-      - uses: ./.github/actions/collect-logs
-        if: always()
+      - uses: ./.github/actions/after-job
   check-pytest:
     runs-on: ubuntu-latest
     env:
@@ -173,10 +173,7 @@ jobs:
             export DEV_REGISTRY=${{ secrets.DEV_REGISTRY }}
             mkdir -p ${TEST_XML_DIR}
             make pytest-${{ matrix.test }}
-      - uses: ./.github/actions/git-dirty-check
-        name: "Check git not dirty from testing"
-      - uses: ./.github/actions/collect-logs
-        if: always()
+      - uses: ./.github/actions/after-job
         with:
           jobname: check-pytest-${{ matrix.test }}
   check-pytest-unit:
@@ -219,10 +216,7 @@ jobs:
             export DEV_REGISTRY=${{ secrets.DEV_REGISTRY }}
             mkdir -p ${TEST_XML_DIR}
             make pytest-${{ matrix.test }}
-      - uses: ./.github/actions/git-dirty-check
-        name: "Check git not dirty from testing"
-      - uses: ./.github/actions/collect-logs
-        if: always()
+      - uses: ./.github/actions/after-job
         with:
           jobname: check-pytest-${{ matrix.test }}
   check-chart:
@@ -257,10 +251,7 @@ jobs:
           export DEV_KUBECONFIG=~/.kube/config
 
           make test-chart
-      - uses: ./.github/actions/git-dirty-check
-        name: "Check git not dirty from testing"
-      - uses: ./.github/actions/collect-logs
-        if: always()
+      - uses: ./.github/actions/after-job
 
   build: #######################################################################
     runs-on: ubuntu-latest
@@ -293,8 +284,7 @@ jobs:
         shell: bash
         run: |
           make push-dev
-      - uses: ./.github/actions/git-dirty-check
-        name: "Check git not dirty (from make push + make push-dev)"
+      - uses: ./.github/actions/after-job
 
   ##############################################################################
   pass:
diff --git a/.github/workflows/promote-ga.yml b/.github/workflows/promote-ga.yml
index 680810e20c7..5ac24c3027f 100644
--- a/.github/workflows/promote-ga.yml
+++ b/.github/workflows/promote-ga.yml
@@ -29,6 +29,7 @@ jobs:
       - name: "make release/promote-oss/to-ga"
         run: |
           make release/promote-oss/to-ga
+      - uses: ./.github/actions/end-job
       - name: Slack notification
         if: always()
         uses: edge/simple-slack-notify@master
@@ -44,6 +45,7 @@ jobs:
              { "title": "Branch", "value": "${env.GITHUB_REF}", "short": true },
              { "title": "Action URL", "value": "${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}"}
             ]
+      - uses: ./.github/actions/after-job
   create-gh-release:
     runs-on: ubuntu-latest
     needs: [promote-to-ga]
@@ -78,3 +80,4 @@ jobs:
              { "title": "Branch", "value": "${env.GITHUB_REF}", "short": true },
              { "title": "Action URL", "value": "${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}"}
             ]
+      - uses: ./.github/actions/after-job
diff --git a/.github/workflows/promote-rc.yml b/.github/workflows/promote-rc.yml
index 18b1b18932a..c08a8ca1b99 100644
--- a/.github/workflows/promote-rc.yml
+++ b/.github/workflows/promote-rc.yml
@@ -52,3 +52,4 @@ jobs:
              { "title": "Branch", "value": "${env.GITHUB_REF}", "short": true },
              { "title": "Action URL", "value": "${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}"}
             ]
+      - uses: ./.github/actions/after-job
diff --git a/.github/workflows/publish-chart.yml b/.github/workflows/publish-chart.yml
index 23e2a21acb6..48530f9979b 100644
--- a/.github/workflows/publish-chart.yml
+++ b/.github/workflows/publish-chart.yml
@@ -38,6 +38,7 @@ jobs:
              { "title": "Branch", "value": "${env.GITHUB_REF}", "short": true },
              { "title": "Action URL", "value": "${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}"}
             ]
+      - uses: ./.github/actions/after-job
   chart-create-gh-release:
     if: ${{ ! contains(github.ref, '-') }}
     runs-on: ubuntu-latest
@@ -73,3 +74,4 @@ jobs:
              { "title": "Branch", "value": "${env.GITHUB_REF}", "short": true },
              { "title": "Action URL", "value": "${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}"}
             ]
+      - uses: ./.github/actions/after-job
diff --git a/.github/workflows/repatriate.yml b/.github/workflows/repatriate.yml
index ac02c13240d..dd140f25ef9 100644
--- a/.github/workflows/repatriate.yml
+++ b/.github/workflows/repatriate.yml
@@ -73,3 +73,4 @@ jobs:
             [{ "title": "Repository", "value": "${{ github.repository }}", "short": true },
              { "title": "Branch", "value": "${{ github.ref }}", "short": true},
              { "title": "Pull Request", "value": "${{ steps.step-create-pr.outputs.pr_url }}"}]
+      - uses: ./.github/actions/after-job
diff --git a/build-aux/ci.mk b/build-aux/ci.mk
index 06a2d8713ca..02c63097479 100644
--- a/build-aux/ci.mk
+++ b/build-aux/ci.mk
@@ -11,3 +11,7 @@ ci/setup-k3d: $(tools/k3d) $(tools/kubectl)
 	while ! $(tools/kubectl) get serviceaccount default >/dev/null; do sleep 1; done
 	$(tools/kubectl) version
 .PHONY: ci/setup-k3d
+
+ci/teardown-k3d: $(tools/k3d)
+	$(tools/k3d) cluster delete || true
+.PHONY: ci/teardown-k3d