ci: use GitHub-hosted runners for public workflows - #32
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![slopzapper[bot]](https://avatars.githubusercontent.com/in/4527847?s=60&v=4){kind=small}
There was a problem hiding this comment.
🟢 Approval recommended
The changes consistently migrate all affected jobs to GitHub-hosted runners and remove now-unused lint configuration without introducing functional workflow or release-contract inconsistencies.
Pull request overview
This PR updates the repository’s public CI workflows to exclusively use GitHub-hosted runners (primarily Ubuntu 24.04), removing the remaining Blacksmith runner selections and cleaning up now-unneeded actionlint configuration. It also updates release documentation to reflect the new runner strategy while preserving the existing publishing runner behavior required for npm provenance.
Changes:
- Switch seven workflow jobs from Blacksmith runner labels to GitHub-hosted
ubuntu-24.04. - Remove the unused
.github/actionlint.yamlself-hosted runner allowlist. - Update
docs/releasing.mdto reflect runner choices (Ubuntu 24.04 for verification,ubuntu-latestretained for publishing provenance).
File summaries
| File | Description |
|---|---|
| docs/releasing.md | Updates release guard-rails documentation to match the new GitHub-hosted runner policy. |
| .github/workflows/verify.yml | Moves PR verification to ubuntu-24.04. |
| .github/workflows/skills-contract.yml | Moves the scheduled skills contract smoke job to ubuntu-24.04. |
| .github/workflows/secrets.yml | Moves both secret scanning jobs (gitleaks, trufflehog) to ubuntu-24.04. |
| .github/workflows/release.yml | Moves the pre-release verify job to ubuntu-24.04 while keeping the publish job on ubuntu-latest. |
| .github/workflows/actions-lint.yml | Moves actionlint and zizmor workflow-lint jobs to ubuntu-24.04. |
| .github/actionlint.yaml | Removes the Blacksmith self-hosted runner label allowlist since it’s no longer needed. |
Review details
- Files reviewed: 7/7 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Problem
Public workflow jobs still selected Blacksmith runners.
Solution
Move seven jobs to standard GitHub-hosted Ubuntu 24.04, including both repository-owned secret scanners. Remove the unused Blacksmith actionlint allowlist and update release documentation. Publishing keeps its existing GitHub-hosted runner and release contract.
Proof
Actionlint and zizmor pass locally. The existing pre-commit hook passed the full verification gate: 165 tests, 91.48% line coverage, and the installed-tarball smoke. This
ci:change should produce no package release when the existing post-merge workflow evaluates it.