ci: route the security dependency-review job off the self-hosted runner pool

[JSONbored]

Summary

• changes, security, and validate in .github/workflows/ci.yml all used the same fork-aware self-hosted/ubuntu-latest runs-on expression as validate-code, even though none of them do any build/test work that benefits from the self-hosted VPS's cached toolchain.
• changes is just actions/checkout + git diff --check + dorny/paths-filter. It runs FIRST and its own output decides whether validate-code needs to run at all, so gating it behind the same contended self-hosted queue it's meant to protect was circular — a busy self-hosted pool delayed even discovering that a doc-only PR needed no heavy job.
• security (actions/dependency-review-action) needs no self-hosted capability — just checkout + a lockfile diff.
• validate only reads needs.*.result and echoes a pass/fail message (2-minute timeout).
• A single same-repo PR was consuming 4 self-hosted runner slots (these three plus validate-code) when only validate-code actually needed one, directly contradicting validate-code's own comment about keeping CI to one runner slot per PR instead of fanning out into competing installs on the same VPS. Observed this firsthand while pushing this batch's other PRs — several sat pending on changes/security for extended periods purely from self-hosted queue contention, exactly the failure mode this fixes.
• Routed all three unconditionally to ubuntu-latest; validate-code keeps the fork-aware self-hosted/ubuntu-latest expression unchanged.
• Updated test/unit/workflow-runner-labels.test.ts, which asserted the exact count (4) of trusted-runner expressions in ci.yml and now expects 1 (validate-code only), plus new assertions that the three routed jobs are unconditionally ubuntu-latest.

Closes #2501. Closes #2507.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally — this is a .github/workflows/**/test/** change with no src/** lines, so it carries no Codecov patch obligation; the updated workflow-structure assertions pass.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — N/A.
• API/OpenAPI/MCP behavior is updated and tested where needed. — N/A.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. — N/A, no UI changes.
• Visible UI changes include a UI Evidence section below — N/A, no UI changes.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• Part of the chore(selfhost): beta-stable release readiness roadmap #1936 self-host beta-stable release readiness batch.
• Touches .github/workflows/**, a guarded path — expect this to be held for owner review rather than auto-merged, which is fine since I'm the repo owner.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-02 09:39:22 UTC}

2 files · 1 AI reviewer · no blockers · readiness 80/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review

Review summary
The change narrows self-hosted runner usage in CI to the build/test job while routing lightweight workflow bookkeeping and dependency review to GitHub-hosted runners. The workflow changes are internally consistent with the existing job graph, and the updated unit test preserves the key invariant that only one fork-aware self-hosted expression remains. The notable maintenance risk is that the new test still inspects YAML with string slicing rather than structured parsing, but it is adequate for this focused runner-label guard.

Nits — 5 non-blocking

• nit: test/unit/workflow-runner-labels.test.ts:24 could fail with a vague substring assertion if the workflow is reorganized, so asserting the section anchors are present before slicing would make failures easier to diagnose.
• nit: test/unit/workflow-runner-labels.test.ts:24 would be more robust if it parsed the workflow YAML and checked job-level `runs-on` values instead of relying on positional string slices.
• test/unit/workflow-runner-labels.test.ts:24: consider extracting a small helper that finds a named job block or parses the workflow so future CI layout changes do not silently weaken these assertions.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2501, #2507
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:XS; 2 linked issues).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 65 registered-repo PR(s), 55 merged, 553 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 65 PR(s), 553 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 65 PR(s), 553 issue(s).
• Related work: Items reference the same linked issue ci: route changes/validate jobs off the self-hosted runner pool #2507. (issue #2507)
• Related work: Items reference the same linked issue ci: route the security dependency-review job off the self-hosted runner pool #2501. (issue #2501)
• Related work: Open PR work references issue ci: route changes/validate jobs off the self-hosted runner pool #2507. (issue #2507)
• Additional title-only matches omitted; title-only overlap does not block.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Review top overlaps.
• Add a concise scope and risk note.
• No action.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.98%. Comparing base (85f0d98) to head (001d3c2).
⚠️ Report is 27 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2575      +/-   ##
==========================================
+ Coverage   95.96%   95.98%   +0.02%     
==========================================
  Files         226      229       +3     
  Lines       25452    25811     +359     
  Branches     9258     9390     +132     
==========================================
+ Hits        24424    24775     +351     
- Misses        417      425       +8     
  Partials      611      611              

see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.