chore(ci): migrate Linux jobs to self-hosted runner#28
Conversation
Route Linux jobs to the new nvideablackwell-AgentSuiteLocal-2404 self-hosted runner registered to this repo (Ubuntu 24.04 LTS inside WSL on new-box, RTX 5070 host). Windows and macOS jobs remain on github-hosted runners since we have no self-hosted runner for those. Saves the bulk of github-hosted minutes for this repo's CI.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2247ea9cc8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| lint: | ||
| name: Lint | ||
| runs-on: ubuntu-latest | ||
| runs-on: [self-hosted, linux, x64] |
There was a problem hiding this comment.
Keep untrusted PRs off persistent self-hosted runners
For pull_request events targeting main, this job now checks out and runs code from the PR on a persistent self-hosted Linux runner. In a public/contributor PR context, that gives arbitrary PR code access to the runner host, its caches, and anything left behind for later jobs; this is especially risky because release.yml also uses the same generic self-hosted label for jobs with contents: write. Keep PR-triggered Linux jobs on GitHub-hosted runners, or restrict self-hosted execution to trusted push/tag events or an ephemeral isolated runner pool.
Useful? React with 👍 / 👎.
Migrates Linux jobs to runs-on: [self-hosted, linux, x64], targeting the new self-hosted runner registered to this repo (
nvideablackwell-AgentSuiteLocal-2404). Windows-latest / macos-latest jobs preserved (no self-hosted runner for those OSes).Runner host: WSL Ubuntu 24.04 LTS on new-box (NvideaBlackwell, RTX 5070).
Pattern follows CivicSuite/civicsuite#133 (merged a9bb54a, full CI green on self-hosted).