From 08ab75b7fc030c221133feefa619ea8cee887bc6 Mon Sep 17 00:00:00 2001
From: David Symons <david.symons@stfc.ac.uk>
Date: Tue, 14 Jul 2026 13:51:06 +0100
Subject: [PATCH] Update the permissions, use custom image, update name of
 runner set

---
 ...and-prepare-release-reusable-workflow.yaml | 27 +++++++++++--------
 .../dev-build-cm-reusable-workflow.yaml       | 15 +++++++----
 .../dev-build-reusable-workflow.yaml          | 11 +++++---
 3 files changed, 34 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/build-and-prepare-release-reusable-workflow.yaml b/.github/workflows/build-and-prepare-release-reusable-workflow.yaml
index a28723c..f7ece1e 100644
--- a/.github/workflows/build-and-prepare-release-reusable-workflow.yaml
+++ b/.github/workflows/build-and-prepare-release-reusable-workflow.yaml
@@ -63,10 +63,15 @@ on:
       workflow-token:
         required: true
 
+permissions:
+  packages: read
+  contents: read
+  pull-requests: read
+
 jobs:
   build_and_push:
     name: Build and Push Container
-    runs-on: isisbusapps-proxmox-dind
+    runs-on: fase-self-hosted-dind
     timeout-minutes: 30
     permissions:
       packages: write
@@ -115,8 +120,8 @@ jobs:
 
   update_gitops:
     name: Update GitOps Repository
-    runs-on: isisbusapps-proxmox
-    container: ghcr.io/catthehacker/ubuntu:act-24.04
+    runs-on: fase-self-hosted
+    container: ghcr.io/isisbusapps/fase-gh-runner-container:latest
     timeout-minutes: 10
     needs: build_and_push
     outputs:
@@ -178,8 +183,8 @@ jobs:
 
   trigger_pr:
     name: Trigger PR Creation
-    runs-on: isisbusapps-proxmox
-    container: ghcr.io/catthehacker/ubuntu:act-24.04
+    runs-on: fase-self-hosted
+    container: ghcr.io/isisbusapps/fase-gh-runner-container:latest
     timeout-minutes: 5
     needs: update_gitops
     steps:
@@ -197,8 +202,8 @@ jobs:
 
   create_tags:
     name: Create Git Tags
-    runs-on: isisbusapps-proxmox
-    container: ghcr.io/catthehacker/ubuntu:act-24.04
+    runs-on: fase-self-hosted
+    container: ghcr.io/isisbusapps/fase-gh-runner-container:latest
     timeout-minutes: 5
     needs: build_and_push
     permissions:
@@ -216,8 +221,8 @@ jobs:
 
   create_release:
     name: Create GitHub Pre-Release
-    runs-on: isisbusapps-proxmox
-    container: ghcr.io/catthehacker/ubuntu:act-24.04
+    runs-on: fase-self-hosted
+    container: ghcr.io/isisbusapps/fase-gh-runner-container:latest
     timeout-minutes: 10
     needs: create_tags
     permissions:
@@ -249,8 +254,8 @@ jobs:
 
   open_hotfix_pr:
     name: Open Hotfix PR
-    runs-on: isisbusapps-proxmox
-    container: ghcr.io/catthehacker/ubuntu:act-24.04
+    runs-on: fase-self-hosted
+    container: ghcr.io/isisbusapps/fase-gh-runner-container:latest
     timeout-minutes: 5
     needs: create_tags
     if: inputs.is-hotfix
diff --git a/.github/workflows/dev-build-cm-reusable-workflow.yaml b/.github/workflows/dev-build-cm-reusable-workflow.yaml
index f776277..261d1f0 100644
--- a/.github/workflows/dev-build-cm-reusable-workflow.yaml
+++ b/.github/workflows/dev-build-cm-reusable-workflow.yaml
@@ -20,10 +20,10 @@ on:
         type: string
         default: 'isisbusapps/gitops'
       runner_label:
-        description: 'isisbusapps-proxmox runner label to target e.g. isisbusapps-proxmox or k8s-prod-runner)'
+        description: 'fase-self-hosted runner label to target e.g. fase-self-hosted or k8s-prod-runner)'
         type: string
         required: false
-        default: 'isisbusapps-proxmox' 
+        default: 'fase-self-hosted' 
     secrets:
       workflow-token:
         description: 'PAT with repo+workflow scope for the GitOps repo'
@@ -37,11 +37,16 @@ on:
         description: 'The .data key the file was stored under'
         value: ${{ jobs.generate-configmap.outputs.data_key_used }}     
 
+permissions:
+  packages: read
+  contents: read
+  pull-requests: read
+
 jobs:
   generate-configmap:
     name: Generate & Commit ConfigMap
     runs-on: ${{ inputs.runner_label }}
-    container: ghcr.io/catthehacker/ubuntu:act-24.04    
+    container: ghcr.io/isisbusapps/fase-gh-runner-container:latest    
     timeout-minutes: 30
     permissions:
       packages: write
@@ -104,8 +109,8 @@ jobs:
 
   update_gitops:
     name: Update GitOps Repository
-    runs-on: ghcr.io/catthehacker/ubuntu:act-24.04
-    container: ghcr.io/catthehacker/ubuntu:act-24.04
+    runs-on: fase-self-hosted
+    container: ghcr.io/isisbusapps/fase-gh-runner-container:latest
     timeout-minutes: 10
     needs: generate-configmap
     if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
diff --git a/.github/workflows/dev-build-reusable-workflow.yaml b/.github/workflows/dev-build-reusable-workflow.yaml
index f299173..f4cfa1d 100644
--- a/.github/workflows/dev-build-reusable-workflow.yaml
+++ b/.github/workflows/dev-build-reusable-workflow.yaml
@@ -55,10 +55,15 @@ on:
         description: 'PAT with repo+workflow scope for the GitOps repo'
         required: true
 
+permissions:
+  packages: read
+  contents: read
+  pull-requests: read
+
 jobs:
   build_and_push:
     name: Build and Push Container
-    runs-on: isisbusapps-proxmox-dind
+    runs-on: fase-self-hosted-dind
     timeout-minutes: 30
     permissions:
       packages: write
@@ -107,8 +112,8 @@ jobs:
 
   update_gitops:
     name: Update GitOps Repository
-    runs-on: isisbusapps-proxmox
-    container: ghcr.io/catthehacker/ubuntu:act-24.04
+    runs-on: fase-self-hosted
+    container: ghcr.io/isisbusapps/fase-gh-runner-container:latest
     timeout-minutes: 10
     needs: build_and_push
     if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'