From 538ea9b3389c8118dc858a4e765000f791345b30 Mon Sep 17 00:00:00 2001 From: Jonathan Haas Date: Thu, 30 Jul 2026 10:32:06 -0700 Subject: [PATCH 1/4] fix(ci): default reusable workflows onto evalops-private-ci Blacksmith is retired and ubuntu-latest is billing-blocked for private org repos. Callers that omit runner_label were still landing on those defaults (Codex Rails historically blacksmith-4vcpu-ubuntu-2404, then ubuntu-latest). Point the reusable defaults at owned private-CI ARC. --- .github/workflows/agent-authorship-label.yml | 2 +- .github/workflows/codex-rails-check.yml | 6 +++--- .github/workflows/review-thread-guard.yml | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/agent-authorship-label.yml b/.github/workflows/agent-authorship-label.yml index d9c6112..401c957 100644 --- a/.github/workflows/agent-authorship-label.yml +++ b/.github/workflows/agent-authorship-label.yml @@ -19,7 +19,7 @@ on: description: "Runner label used for the label job" required: false type: string - default: ubuntu-latest + default: evalops-private-ci helper_ref: description: "evalops/.github ref used to checkout helper scripts" required: false diff --git a/.github/workflows/codex-rails-check.yml b/.github/workflows/codex-rails-check.yml index 089ae87..d96c794 100644 --- a/.github/workflows/codex-rails-check.yml +++ b/.github/workflows/codex-rails-check.yml @@ -27,17 +27,17 @@ on: type: boolean default: false runner_label: - description: "Runner label used for the validation job" + description: "Runner label used for the validation job (owned private-CI ARC; never blacksmith-* or ubuntu-latest)" required: false type: string - default: ubuntu-latest + default: evalops-private-ci permissions: contents: read jobs: validate: - runs-on: ${{ inputs.runner_label || 'ubuntu-latest' }} + runs-on: ${{ inputs.runner_label || 'evalops-private-ci' }} timeout-minutes: 10 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 diff --git a/.github/workflows/review-thread-guard.yml b/.github/workflows/review-thread-guard.yml index fcef288..aa6cf5d 100644 --- a/.github/workflows/review-thread-guard.yml +++ b/.github/workflows/review-thread-guard.yml @@ -20,10 +20,10 @@ on: default: "high" type: string runner_label: - description: "Runner label used for the validation job" + description: "Runner label used for the validation job (owned private-CI ARC; never blacksmith-* or ubuntu-latest)" required: false type: string - default: ubuntu-latest + default: evalops-private-ci guard_ref: description: "evalops/.github ref to checkout for guard scripts" required: false @@ -68,7 +68,7 @@ permissions: jobs: unresolved-review-threads: - runs-on: ${{ inputs.runner_label || 'ubuntu-latest' }} + runs-on: ${{ inputs.runner_label || 'evalops-private-ci' }} timeout-minutes: 5 steps: - uses: actions/checkout@v5 From 239d718774549ab596f17f6ae9e965a5a4616098 Mon Sep 17 00:00:00 2001 From: Jonathan Haas Date: Thu, 30 Jul 2026 10:37:18 -0700 Subject: [PATCH 2/4] fix(ci): scrub retired runner-class names from reusable defaults Keep descriptions free of blacksmith and billing-blocked hosted labels so downstream inventory gates do not flag comment text. --- .github/workflows/agent-authorship-label.yml | 2 +- .github/workflows/codex-rails-check.yml | 2 +- .github/workflows/review-thread-guard.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/agent-authorship-label.yml b/.github/workflows/agent-authorship-label.yml index 401c957..844ce66 100644 --- a/.github/workflows/agent-authorship-label.yml +++ b/.github/workflows/agent-authorship-label.yml @@ -16,7 +16,7 @@ on: type: boolean default: false runner_label: - description: "Runner label used for the label job" + description: "Runner label used for the label job (owned private-CI ARC only)" required: false type: string default: evalops-private-ci diff --git a/.github/workflows/codex-rails-check.yml b/.github/workflows/codex-rails-check.yml index d96c794..e062cbd 100644 --- a/.github/workflows/codex-rails-check.yml +++ b/.github/workflows/codex-rails-check.yml @@ -27,7 +27,7 @@ on: type: boolean default: false runner_label: - description: "Runner label used for the validation job (owned private-CI ARC; never blacksmith-* or ubuntu-latest)" + description: "Runner label used for the validation job (owned private-CI ARC only)" required: false type: string default: evalops-private-ci diff --git a/.github/workflows/review-thread-guard.yml b/.github/workflows/review-thread-guard.yml index aa6cf5d..ddd8156 100644 --- a/.github/workflows/review-thread-guard.yml +++ b/.github/workflows/review-thread-guard.yml @@ -20,7 +20,7 @@ on: default: "high" type: string runner_label: - description: "Runner label used for the validation job (owned private-CI ARC; never blacksmith-* or ubuntu-latest)" + description: "Runner label used for the validation job (owned private-CI ARC only)" required: false type: string default: evalops-private-ci From 1b53820ce6596966a907db6b4770d4cb8f1b5ba0 Mon Sep 17 00:00:00 2001 From: Jonathan Haas Date: Thu, 30 Jul 2026 10:46:35 -0700 Subject: [PATCH 3/4] ci: re-trigger after private-ci-arc allowlist expansion From 2b07d8f606ac1e3652ca7c8c92fd4b039aa4620c Mon Sep 17 00:00:00 2001 From: Jonathan Haas Date: Thu, 30 Jul 2026 11:02:22 -0700 Subject: [PATCH 4/4] ci: re-trigger validate after private-ci capacity frees