Move Linux CI jobs to self-hosted runner - #17
Conversation
Target ubuntu-latest jobs in test and release workflows at [self-hosted, Linux, X64] so they run on the registered runner. Co-authored-by: Allan Ditzel <aditzel@users.noreply.github.com>
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Summary by CodeRabbit
WalkthroughGitHub Actions test and release jobs now run on self-hosted Linux x64 runners instead of ChangesRunner migration
Estimated code review effort: 1 (Trivial) | ~2 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit a325701. Configure here.
|
|
||
| release: | ||
| runs-on: ubuntu-latest | ||
| runs-on: [self-hosted, Linux, X64] |
There was a problem hiding this comment.
Release publish breaks on self-hosted
High Severity
The release job now runs on a self-hosted runner while still requiring npm OIDC trusted publishing and provenance (id-token: write, NPM_CONFIG_PROVENANCE, npm publish --provenance, and publishConfig.provenance). npm only accepts those from GitHub-hosted runners, so publishes fail with an E422 unsupported runner_environment error and releases stop shipping.
Reviewed by Cursor Bugbot for commit a325701. Configure here.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a325701d18
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| release: | ||
| runs-on: ubuntu-latest | ||
| runs-on: [self-hosted, Linux, X64] |
There was a problem hiding this comment.
The release job has id-token: write but no npm token, so both the recovery npm publish and semantic-release rely on npm trusted publishing. npm's trusted-publishing requirements specify GitHub-hosted runners and state that self-hosted runners are unsupported; therefore any release that needs to publish a new package version will fail after this runner change. Keep this job on a GitHub-hosted runner or introduce a supported authentication path.
Useful? React with 👍 / 👎.
| jobs: | ||
| test: | ||
| runs-on: ubuntu-latest | ||
| runs-on: [self-hosted, Linux, X64] |
There was a problem hiding this comment.
For pull requests, this job checks out contributor-controlled code and executes its build and tests on the self-hosted machine. If this repository accepts outside PRs and the runner is persistent or reused, an approved malicious PR can compromise the runner, retain credentials or persistence, and later intercept the write and OIDC tokens used by the release workflow sharing these labels. Use a GitHub-hosted runner for pull_request events or an isolated, ephemeral runner pool that cannot service privileged workflows.
Useful? React with 👍 / 👎.
2 participants
Summary
[self-hosted, Linux, X64]).testandvalidate-implementationin.github/workflows/test.yml.testandreleasein.github/workflows/release.yml.Notes
junie.ymlunchanged (reusable workflow call only; no localruns-on).Test plan
self-hosted,Linux,X64.