ci: run Docker builds on a self-hosted 1ES runner pool

[benhillis]

Move the build job off ubuntu-latest onto the dedicated 1ES Hosted Pool openvmm-deps-gh-amd-westus2 (image ubuntu2404-amd64). Both x86_64 and aarch64 share the AMD pool; aarch64 still cross-compiles via QEMU.

Fixes the recurring No space left on device flakes from the GitHub-hosted runners (e.g. run 25928571548) and gives us a project-owned scheduling pool.

Also a nice speedup — D32a has 32 vCPUs vs ubuntu-latest's 4, and build I/O lands on a local 1.2TB SSD:

arch	old (ubuntu-latest, avg of 3 runs)	new (1ES Standard_D32a)	speedup
x86_64	~36 min	9 min 20 s	~3.9×
aarch64	~43 min	15 min 34 s	~2.8×

The workflow grew an Install Docker Engine step because the 1ES image doesn't ship Docker. The OS disk is small (~80GB) so the storage paths are pre-symlinked to /mnt (~1.2TB resource SSD); without that, Docker 29's containerd snapshotter fills the OS disk and the runner agent gets killed mid-build with no log capture.

Future improvement: bake Docker (and the /mnt storage layout) directly into the 1ES image so the install step can be dropped entirely.

cgmanifest and release stay on ubuntu-latest (small jobs, no benefit).

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Moves Docker build jobs to Microsoft 1ES self-hosted runners to increase disk/CPU headroom and reduce flakiness from ubuntu-latest limitations.

Changes:

• Switch build job from ubuntu-latest to the 1ES hosted pool openvmm-deps-gh-amd-westus2 with ubuntu2404-amd64.
• Add job-level permissions to enable OIDC (id-token: write) for 1ES.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

.github/workflows/build.yml:51

• The PR description calls out aarch64 continuing to build under QEMU, but this change removes the conditional docker/setup-qemu-action step and doesn't add an equivalent binfmt/QEMU setup. If aarch64 is still expected to run on an amd64 runner, please add QEMU/binfmt setup back; if the intent is native arm64 runners, consider updating the description (and potentially the --platform value) to reflect the new execution model.

      - name: Install Docker Engine
        uses: docker/setup-docker-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

.github/workflows/build.yml:62

• Making the Docker socket world-writable (chmod 666) allows any process/user on the runner to gain root via Docker. Prefer adding the runner user to the docker group (and keeping the socket at 660), or keep using sudo docker ... in the steps that need it and avoid broadening socket permissions.

          # Allow the runner user (and other actions like setup-qemu-action)
          # to talk to dockerd without sudo.
          sudo chmod 666 /var/run/docker.sock
          docker info --format 'Docker Root Dir: {{.DockerRootDir}} / Storage Driver: {{.Driver}}'