CI started breaking on 11 Jan for no good reason. After some research, it appears that the step to download ChromeDriver now leaves an artefact in the working directory: a license file LICENSE.chromedriver. When Git sees it, it refuses to checkout the code, as the target directory is neither empty nor a Git repository.
To fix this, I have moved the checkout step to run first, before ChromeDriver is downloaded.
Note that the build will still fail due to the bundle audit. After this is merged, I should be able to merge the dependabot PRs and fix that.