Migrate to thin GitHub runners and NativeLink Cloud staging (remote cache + BES, dark)

[MarcusSorealheis]

Description

We are returning to a place where we evaluate the mirror of our production environment (Staging) continuously in GitHub.

I believe we may need to update the CONTRIBUTING.md docs to help ensure that others are able to access the speeds up introduced here.

Type of change

Please delete options that aren't relevant.

• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

How Has This Been Tested?

YAML validated on all touched workflows. the composite action's script exercised locally across all four input modes (read/write/exec-guard/no-key no-op). config groups verified to parse and expand under Bazel 9.1.1.

bazel test //... run locally and remotely.

Checklist

• Updated documentation if needed
• Tests added/amended
• bazel test //... passes locally
• PR is contained in a single commit, using git amend see some docs

---

This change is 

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nativelink	Ready	Preview, Comment	Jul 19, 2026 11:49pm
nativelink-aidm	Ready	Preview, Comment	Jul 19, 2026 11:49pm

[MarcusSorealheis]

I took some measurements for posterity to represent my dilligence. It's slower now becuase the cache on is readonly from PRs. All subsuequent PRs should be fast. I will run another measurement after and add it to this chart in a subsequent PR.

Lane	cache OFF (22:04 UTC)	cache ON (22:48 UTC)
Bazel Native	4.3 min	5.0 min
Sanitizers	11.7 min	13.2 min
Nix	21.3 min	21.0 min
Local Remote Execution	9.1 min	8.9 min

Cache ON is marginally slower here because the cache is cold and PR runs are read-only (~10–20% pure-miss lookup overhead). Warm numbers arrive after the first post-merge push to main populates the cache.

[corcillo]

Changes made look better now thanks

[MarcusSorealheis]

after merge:

Lane	Pre-migration median (main)	Bootstrap push (00:01, 300 rps)	syn v3 merge push (08:44, 2500 rps)	Read
Bazel Native	8.9 min	29.8 min	11.7 min	~+2–3 min write overhead on a full-invalidation push
Sanitizers	11.8 min	14.0 min	14.0 min	same story
Nix	32.1 min (range 21–48)	26.9 min	19.4 min	clear win: −40% vs median, on an invalidating merge
Local Remote Execution	~11–12 min	22.3 min	18.0 min	regression (+6 min), this is likely due to macOS upload time; watching