ci: run CI on GitHub-hosted runners

[Quick104]

Problem

Silo's private Linux runners are being taken offline while they are rebuilt. Member PRs and default-branch builds in this repository target those runners by label, so with the runners gone those jobs would queue indefinitely. This moves them to GitHub-hosted runners.

Approach

The calling workflow passes self_hosted: false to the reusable workflow, so every job takes the hosted branch of its runs-on expression, which non-member PRs already use. The reusable workflow keeps its self-hosted support for later.

Validation

actionlint passes on the changed workflow files. This PR's own CI run uses hosted runners.

AI Disclosure

• Harness: Claude Code (in T3 Code)
• Tool(s): Claude Code
• Model(s): claude-opus-5-5
• Involvement: Fully AI-generated; the maintainer set scope. Human review of the diff is pending.
• Adversarial review: n/a

🤖 Generated with Claude Code

Note

Run CI on GitHub-hosted runners

Sets the self_hosted input to literal false in ci.yml. This replaces a conditional expression that checked repository, event, actor, and branch to decide when to use self-hosted runners.

^{Macroscope summarized 0edd043.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 91ab8a3b-1324-404f-9e58-6f3d92b7cf7f

📥 Commits

Reviewing files that changed from the base of the PR and between a346cb4 and 0edd043.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The CI workflow now sets self_hosted to false for all events. The previous conditions that enabled self-hosted runners have been removed.

Changes

CI runner configuration

Layer / File(s)	Summary
Set the runner option .github/workflows/ci.yml	The workflow now sets self_hosted to false unconditionally.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 0edd0

CI events use GitHub-hosted runners as intended. No merge-blocking risk is established by the reviewed change.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 0edd0

The change uses the existing hosted-runner path without increasing declared permissions or passing additional secrets. No introduced security flaw was demonstrated. Runner-specific credentials, network access, and the effective workflow version at execution remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed exposure is repository CI execution on hosted infrastructure for previously self-hosted-eligible events. The inspected change does not grant broader token authority or access to a deployment environment; runner-local credentials and network exposure cannot be determined from these files.

Security Findings and Attack Paths

• inferred — Pull-request-controlled source reaches the Go execution steps. Previously ineligible pull requests already followed the hosted path, while false removes private-runner eligibility for this caller. No expanded attacker-controlled execution authority was demonstrated by the comparison.

Trust Boundaries and Controls

• observed — The reusable workflow requires both self_hosted and its repository/event/member eligibility expression before selecting private runner labels. The caller's false input disables that branch without removing the centralized checks for other callers.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description explains the runner change, its purpose, implementation, and validation. It directly matches the changeset.
Title check	✅ Passed	The title clearly and concisely identifies the main change: running CI on GitHub-hosted runners.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[silo-kody]

Silo Kody — review complete

Review finished. Check the inline comments for findings and verify each suggestion against the code and tests.

Reviewing changes in Silo

• Include the related issue, expected behavior, and validation steps in the PR description.
• For API changes, describe the effect on Apple and Android clients and Jellyfin compatibility.
• For plugin changes, identify the affected SDK contract, plugin, and catalog entry.
• Follow this repository's AGENTS.md and CONTRIBUTING.md.
• Request another review with @kody start-review in a PR comment.
• React with 👍 or 👎 to give feedback on individual suggestions.

Review settings

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	❌