Skip to content

ci: switch to self-hosted runners #351

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
intel352 wants to merge 2 commits into from
Closed

ci: switch to self-hosted runners #351

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
88b16f3
ci: switch CI jobs to self-hosted Linux runner
intel352 Mar 21, 2026
1e84f66
ci: retrigger after enabling public repo runners
intel352 Mar 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ env:
jobs:
test:
name: Test (Go ${{ matrix.go-version }})
runs-on: ubuntu-latest
runs-on: [self-hosted, Linux, X64]
Copy link

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Switching this job to a self-hosted runner means the workflow (including pull_request runs) will execute arbitrary PR code on your own machine. If PRs can come from untrusted contributors (or even just non-admins), this is a high-risk escalation compared to GitHub-hosted runners; consider gating self-hosted usage (e.g., only on push/protected branches, or with an if: condition that restricts to trusted actors/branches) or keeping PRs on GitHub-hosted runners.

Suggested change
runs-on: [self-hosted, Linux, X64]
runs-on: [self-hosted, Linux, X64]
if: github.event_name == 'push'

Copilot uses AI. Check for mistakes.
permissions:
contents: read
packages: read
Expand Down Expand Up @@ -67,7 +67,7 @@ jobs:

lint:
name: Lint
runs-on: ubuntu-latest
runs-on: [self-hosted, Linux, X64]
Copy link

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Switching this job to a self-hosted runner means the workflow (including pull_request runs) will execute arbitrary PR code on your own machine. If PRs can come from untrusted contributors (or even just non-admins), this is a high-risk escalation compared to GitHub-hosted runners; consider gating self-hosted usage (e.g., only on push/protected branches, or with an if: condition that restricts to trusted actors/branches) or keeping PRs on GitHub-hosted runners.

Copilot uses AI. Check for mistakes.
permissions:
contents: read
packages: read
Expand Down Expand Up @@ -104,7 +104,7 @@ jobs:

build:
name: Build
runs-on: ubuntu-latest
runs-on: [self-hosted, Linux, X64]
Copy link

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Switching this job to a self-hosted runner means the workflow (including pull_request runs) will execute arbitrary PR code on your own machine. If PRs can come from untrusted contributors (or even just non-admins), this is a high-risk escalation compared to GitHub-hosted runners; consider gating self-hosted usage (e.g., only on push/protected branches, or with an if: condition that restricts to trusted actors/branches) or keeping PRs on GitHub-hosted runners.

Copilot uses AI. Check for mistakes.
permissions:
contents: read
packages: read
Expand Down Expand Up @@ -153,7 +153,7 @@ jobs:

ui-test:
name: UI Tests
runs-on: ubuntu-latest
runs-on: [self-hosted, Linux, X64]
Copy link

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Switching this job to a self-hosted runner means the workflow (including pull_request runs) will execute arbitrary PR code on your own machine. If PRs can come from untrusted contributors (or even just non-admins), this is a high-risk escalation compared to GitHub-hosted runners; consider gating self-hosted usage (e.g., only on push/protected branches, or with an if: condition that restricts to trusted actors/branches) or keeping PRs on GitHub-hosted runners.

Copilot uses AI. Check for mistakes.
permissions:
contents: read
packages: read
Expand Down Expand Up @@ -190,7 +190,7 @@ jobs:
# 3. Engine loading (can BuildFromConfig produce a working engine?)
example-configs:
name: Validate Example Configs
Copy link

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Switching this job to a self-hosted runner means the workflow (including pull_request runs) will execute arbitrary PR code on your own machine. If PRs can come from untrusted contributors (or even just non-admins), this is a high-risk escalation compared to GitHub-hosted runners; consider gating self-hosted usage (e.g., only on push/protected branches, or with an if: condition that restricts to trusted actors/branches) or keeping PRs on GitHub-hosted runners.

Suggested change
name: Validate Example Configs
name: Validate Example Configs
if: github.event_name == 'push'

Copilot uses AI. Check for mistakes.
runs-on: ubuntu-latest
runs-on: [self-hosted, Linux, X64]
permissions:
contents: read
packages: read
Expand Down
Loading