Skip to content

ci: use GitHub-hosted ubuntu-latest runners #274

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
GeiserX merged 1 commit into from
Jun 23, 2026
Merged

ci: use GitHub-hosted ubuntu-latest runners #274

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 2 additions & 12 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,17 +60,12 @@ jobs:
# Self-hosted Linux/X64 runner (Docker container on the maintainer's infra) — keeps CI off paid
# GitHub-hosted minutes. The inherited `build_test`/`arch_independent` matrices target other
# self-hosted labels (`linux-x86_64-16cpu`, …) that don't exist here and stay owner-gated.
runs-on: [self-hosted, Linux, X64]
runs-on: ubuntu-latest
# Skip on tag pushes: this lane verifies code, and `publish` (which fires on tags) deliberately
# does NOT depend on it, so re-running the full build+test on every release tag gates nothing.
# SECURITY: this runs on a self-hosted runner with Docker-socket access. Never let a PR from a
# FORK execute here (arbitrary code on the maintainer's infra = host-compromise path) — only same
# -repo branches (which a maintainer already controls) and direct pushes run on the self-hosted
# box. Fork PRs simply skip this lane.
if: >-
${{ !startsWith(github.ref, 'refs/tags/')
&& (github.event_name != 'pull_request'
|| github.event.pull_request.head.repo.full_name == github.repository) }}
# A hung cargo step shouldn't pin the self-hosted runner indefinitely; cap it.
timeout-minutes: 60
env:
Expand Down Expand Up @@ -273,12 +268,7 @@ jobs:
# static musl and is the entire thing this lane exists to avoid.
musl_static:
name: musl static (${{ matrix.target.triple }})
runs-on: [self-hosted, Linux, X64]
# SECURITY: same as `hosted_test` — never run a FORK PR's code on the self-hosted (Docker-socket)
# runner. Same-repo branches and direct pushes only; fork PRs skip this lane.
if: >-
${{ github.event_name != 'pull_request'
|| github.event.pull_request.head.repo.full_name == github.repository }}
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
Expand Down