feat(docker-release-split): default the legs to the EKS/ARC runner scale sets

.github/workflows/docker-release-split.yml

@@ -46,10 +46,13 @@ name: Docker Release (split)
 # docker-release.yml for validation builds. Callers with single-platform
 # images should also stay on docker-release.yml — split buys nothing there.
 #
-# Runners: amd64 defaults to a GitHub-hosted runner. arm64 defaults to
-# ubuntu-24.04-arm, which is FREE ONLY FOR PUBLIC REPOS — private repos must
-# pass their own label (org larger runners, or the self-hosted EKS/ARC runner
-# labels) via `arm64-runner`.
+# Runners: the legs default to the org's self-hosted EKS/ARC runner scale
+# sets — pinpredict-dev (amd64) and pinpredict-dev-arm64 (arm64). With ARC
+# the scale set name IS the runs-on label (scale sets take no extra labels).
+# Same-VPC to ECR, so image pushes and registry-cache traffic stay local.
+# Pass amd64-runner/arm64-runner to override — e.g. GitHub-hosted
+# ubuntu-24.04 / ubuntu-24.04-arm (arm64 standard runners work in private
+# repos since 2026-01, at 2 vCPU).
 
 on:
   workflow_call:
@@ -75,15 +78,15 @@ on:
         type: number
         default: 4
       amd64-runner:
-        description: "runs-on label for the linux/amd64 leg."
+        description: "runs-on label for the linux/amd64 leg. Defaults to the EKS/ARC amd64 scale set."
         required: false
         type: string
-        default: "ubuntu-24.04"
+        default: "pinpredict-dev"
       arm64-runner:
-        description: "runs-on label for the linux/arm64 leg. The default is free for PUBLIC repos only — private repos pass an org larger-runner or self-hosted (EKS/ARC) label."
+        description: "runs-on label for the linux/arm64 leg. Defaults to the EKS/ARC arm64 scale set."
         required: false
         type: string
-        default: "ubuntu-24.04-arm"
+        default: "pinpredict-dev-arm64"
       cache:
         description: "Layer-cache backend: gha (per-platform scope), registry (<REGISTRY>/<repo>/buildcache:<platform> — repo must exist), or none."
         required: false

README.md

@@ -11,7 +11,7 @@ Why `.github` and not a dedicated `github-actions` repo: `.github` is *the* GitH
 | File | Purpose |
 |---|---|
 | `docker-release.yml` | Image build + release via [stevedore](https://github.com/blairham/stevedore), driven by the caller repo's `.stevedore.yaml` — **no `matrix` input**. Single job by design (pinpredict/.github#39): one runner + one BuildKit, so a build-once Dockerfile compiles once for every image. Version = highest `X.Y.Z` tag in the ECR repo + 1 (ECR is the version record — platform-gitops#1201, resolved by stevedore); advances the `refs/releases/image/<id>` marker refs. No git tags or GitHub Releases. Optional `only` accepts comma-separated image ids or `all` for manual release pickers. Exports `STEVEDORE_CACHE_FROM/TO` (one `type=gha` scope) for configs that opt into layer caching. Notifies Dispatch once per **pushed** image from stevedore's release summary (`no-push` builds notify nothing). Optional `private-modules: true` mints a short-lived read-only `pinpredict-argocd` App token and exposes it as `GH_PRIVATE_TOKEN`, which the caller's `.stevedore.yaml` wires to a BuildKit `--secret` (`secrets: [{id: gh_token, env: GH_PRIVATE_TOKEN}]`) so a Dockerfile can `go mod download` a private pinpredict module (e.g. `github.com/pinpredict/ppkit`) without vendoring — the Docker analogue of `setup-go`'s `private-modules`; default false. Existing callers are pinned to `@pre-stevedore` (the frozen matrix implementation, which carried the same `private-modules` BuildKit-secret input) — see the tagging exception below. |
-| `docker-release-split.yml` | Multi-arch variant of `docker-release.yml` for repos whose images list several `platforms:` — one **native-arch leg per platform, in parallel**, no QEMU (stevedore >= v0.0.10 split/merge, blairham/stevedore#15). A `plan` job pins the release set and versions once; each leg runs `release --only … --split <platform>` on a runner of that arch, building **all** planned images on one BuildKit (the #39 build-once property, kept per platform) and pushing per-arch images untagged by digest; a `merge` job stitches the digests into tagged manifest lists, runs the release tail, advances marker refs, and notifies Dispatch. Merge refuses to publish while any platform lacks a digest, so a failed leg can't ship a partial image. `cache: gha` exports one scope per platform; `cache: registry` uses `<REGISTRY>/<repo>/buildcache:<platform>` (repo must exist — best for heavy build stages like trading's .NET compile). `arm64-runner` must be set by private repos (the default `ubuntu-24.04-arm` is free for public repos only; pass the org larger-runner or EKS/ARC label). No `no-push` — validation builds stay on `docker-release.yml`. |
+| `docker-release-split.yml` | Multi-arch variant of `docker-release.yml` for repos whose images list several `platforms:` — one **native-arch leg per platform, in parallel**, no QEMU (stevedore >= v0.0.10 split/merge, blairham/stevedore#15). A `plan` job pins the release set and versions once; each leg runs `release --only … --split <platform>` on a runner of that arch, building **all** planned images on one BuildKit (the #39 build-once property, kept per platform) and pushing per-arch images untagged by digest; a `merge` job stitches the digests into tagged manifest lists, runs the release tail, advances marker refs, and notifies Dispatch. Merge refuses to publish while any platform lacks a digest, so a failed leg can't ship a partial image. `cache: gha` exports one scope per platform; `cache: registry` uses `<REGISTRY>/<repo>/buildcache:<platform>` (repo must exist — best for heavy build stages like trading's .NET compile). Legs default to the EKS/ARC runner scale sets — `pinpredict-dev` (amd64) and `pinpredict-dev-arm64` (arm64); the scale set name is the `runs-on` label, and `amd64-runner`/`arm64-runner` override it (e.g. GitHub-hosted `ubuntu-24.04`/`ubuntu-24.04-arm`). No `no-push` — validation builds stay on `docker-release.yml`. |
 | `chart-release.yml` | Auto-discovers `charts/*/`, skips charts unchanged since their `refs/releases/chart/<name>` marker ref, resolves the next version from the ECR OCI repo, packages, pushes (+ `X.Y.Z-<sha7>` provenance alias), advances the marker, notifies Dispatch. No git tags or GitHub Releases. Optional `only` accepts comma-separated chart names for a targeted manual release. |
 | `tag-config.yml` | Tags merges to main that touch `.platform/services/<svc>.yaml` with `vX.Y.Z+<svc>` (per-service Kargo `<svc>-config` Warehouse freight), then dispatches `service-config-tag` to platform-gitops so missing pointer files get seeded. |
 | `actionlint.yml` | Lints GitHub Actions workflow YAML with [`actionlint`](https://github.com/rhysd/actionlint) at a pinned version. Self-runs on this repo when PRs/pushes touch `.github/workflows/**` or `actions/**/action.yml`; callers reuse it via `uses: pinpredict/.github/.github/workflows/actionlint.yml@main`. |