chore(ci): migrate Linux jobs to self-hosted runner#46
Conversation
Route Linux jobs to the new nvideablackwell-AgentSuite-2404 self-hosted runner registered to this repo (Ubuntu 24.04 LTS inside WSL on new-box, RTX 5070 host). Windows and macOS jobs remain on github-hosted runners since we have no self-hosted runner for those. Saves the bulk of github-hosted minutes for this repo's CI.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3458b3ac82
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| jobs: | ||
| unit-integration-golden: | ||
| runs-on: ubuntu-latest | ||
| runs-on: [self-hosted, linux, x64] |
There was a problem hiding this comment.
Keep untrusted PR jobs off the self-hosted runner
This workflow still runs on pull_request, so forked PRs can execute arbitrary submitted code (pip install -e .[dev], pytest, scripts) on the persistent self-hosted host instead of an ephemeral GitHub VM. GitHub's self-hosted runner docs warn that public-repo forks can run dangerous code on the runner machine (https://docs.github.com/en/actions/hosting-your-own-runners/adding-self-hosted-runners), and this repo is advertised for public GitHub installation in the README, so PR validation should stay on GitHub-hosted runners or be gated to trusted events before routing to self-hosted.
Useful? React with 👍 / 👎.
Migrates Linux jobs to runs-on: [self-hosted, linux, x64], targeting the new self-hosted runner registered to this repo (
nvideablackwell-AgentSuite-2404). Windows-latest / macos-latest jobs preserved (no self-hosted runner for those OSes).Runner host: WSL Ubuntu 24.04 LTS on new-box (NvideaBlackwell, RTX 5070).
Pattern follows CivicSuite/civicsuite#133 (merged a9bb54a, full CI green on self-hosted).