From 99eb4fa63f5e9b79b0d94e1573e5933b80c9c3d8 Mon Sep 17 00:00:00 2001
From: Altay <altay@hey.com>
Date: Sat, 5 Sep 2026 19:49:13 +0300
Subject: [PATCH] ci: use GitHub-hosted runners for public workflows

---
 .github/actionlint.yaml               | 3 ---
 .github/workflows/actions-lint.yml    | 4 ++--
 .github/workflows/release.yml         | 2 +-
 .github/workflows/secrets.yml         | 4 ++--
 .github/workflows/skills-contract.yml | 2 +-
 .github/workflows/verify.yml          | 2 +-
 docs/releasing.md                     | 4 ++--
 7 files changed, 9 insertions(+), 12 deletions(-)
 delete mode 100644 .github/actionlint.yaml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
deleted file mode 100644
index 8641cab..0000000
--- a/.github/actionlint.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-self-hosted-runner:
-  labels:
-    - blacksmith-*
diff --git a/.github/workflows/actions-lint.yml b/.github/workflows/actions-lint.yml
index 66d1e07..d2332f7 100644
--- a/.github/workflows/actions-lint.yml
+++ b/.github/workflows/actions-lint.yml
@@ -23,7 +23,7 @@ concurrency:
 
 jobs:
   actionlint:
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -34,7 +34,7 @@ jobs:
           docker run --rm -v "$PWD:/repo" --workdir /repo rhysd/actionlint:1.7.12 -color
 
   zizmor:
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b3075a0..b92d9a8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ permissions: {}
 jobs:
   verify:
     if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       contents: read
diff --git a/.github/workflows/secrets.yml b/.github/workflows/secrets.yml
index c63c623..a9cd2fa 100644
--- a/.github/workflows/secrets.yml
+++ b/.github/workflows/secrets.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   gitleaks:
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -26,7 +26,7 @@ jobs:
             detect --source /repo --redact --no-banner --log-level error
 
   trufflehog:
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/skills-contract.yml b/.github/workflows/skills-contract.yml
index b44c946..eacd27d 100644
--- a/.github/workflows/skills-contract.yml
+++ b/.github/workflows/skills-contract.yml
@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   smoke:
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index d713954..c875530 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   verify:
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/docs/releasing.md b/docs/releasing.md
index 475548b..0a01579 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -68,8 +68,8 @@ can create protected release tags but cannot bypass the default-branch rule.
 
 - The release job runs only after verification and secret scanning pass. PRs
   run the same gates with read-only permissions and no environment access.
-- Verification runs on Blacksmith. The release job runs on GitHub-hosted Linux
-  because npm provenance rejects self-hosted runner attestations.
+- All workflows use standard GitHub-hosted Linux runners. Verification uses
+  Ubuntu 24.04; publishing retains `ubuntu-latest` for npm provenance.
 - Publish concurrency is non-cancellable (queued, never killed mid-publish).
 - `prepack` runs the full verify gate (which rebuilds a clean `dist/`)
   before any tarball is produced. The gate stages the effective version the