chore(ci): take fork-reachable jobs off the self-hosted runners (ENG-2017)

.github/workflows/build_deploy_dev.yml

@@ -23,7 +23,7 @@ jobs:
 
   changes:
     name: Filter changed files
-    runs-on: mdb-dev
+    runs-on: ubuntu-latest
     outputs:
       not-docs: ${{ steps.filter.outputs.not-docs }}
     steps:
@@ -78,6 +78,7 @@ jobs:
           push-cache: false
 
   scan-keycloak:
+    if: ${{ !github.event.pull_request.head.repo.fork }}
     runs-on: mdb-dev
     needs: [ build ]
     name: Scan cloud-cpu image
@@ -139,11 +140,22 @@ jobs:
   # This is a collection point for all of the matrix tests above so we can have a single required job
   tests_completed:
     name: All Tests Succeeded
-    needs: [run_unit_tests, run_integration_tests, changes]
-    runs-on: mdb-dev
+    needs: [run_unit_tests, run_integration_tests, changes, get-deploy-labels]
+    runs-on: ubuntu-latest
     if: always()
     steps:
+      # A skipped `run_integration_tests` means two different things. With no
+      # deploy label there was nothing to run them against, which is fine. A
+      # deploy that failed also leaves them skipped, which is not. Reading
+      # `!= 'success'` treated both the same, so this job failed on every
+      # first-party pull request that carried no deploy label and its red said
+      # nothing. Gate on whether anything was actually deployed instead.
       - name: fail if tests failed or didnt run
-        if: ${{ (needs.run_unit_tests.result != 'success' || (needs.run_integration_tests.result != 'success' && !github.event.pull_request.head.repo.fork)) && needs.changes.outputs.not-docs == 'true' }}
+        if: >-
+          ${{ needs.changes.outputs.not-docs == 'true'
+              && (needs.run_unit_tests.result != 'success'
+                  || (needs.get-deploy-labels.outputs.deploy-envs != '[]'
+                      && !github.event.pull_request.head.repo.fork
+                      && needs.run_integration_tests.result != 'success')) }}
         run: exit 1
       - run: echo "Tests ran successfully"

.github/workflows/cla.yml

@@ -1,7 +1,7 @@
 name: "MindsDB CLA Assistant"
 
 permissions:
-  actions: write
+  actions: read
   contents: write
   pull-requests: write
   statuses: write
@@ -14,15 +14,6 @@ on:
 
 jobs:
   CLAssistant:
-    runs-on: mdb-dev
-    steps:
-      - name: "CLA Assistant"
-        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
-        uses: contributor-assistant/github-action@v2.6.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          path-to-signatures: 'assets/contributions-agreement/signatures/cla.json'
-          path-to-document: 'https://github.com/mindsdb/mindsdb/blob/main/assets/contributions-agreement/individual-contributor.md'
-          branch: 'cla'
-          allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, tmichaeldb, dusvyat, hamishfagg, MinuraPunchihewa, martyna-mindsdb, dylanketterer, ala12326571
+    uses: mindsdb/github-actions/.github/workflows/cla-assistant.yml@main
+    with:
+      path-to-document: 'https://github.com/mindsdb/mindshub/blob/main/assets/contributions-agreement/individual-contributor.md'

.github/workflows/tests_unit.yml

@@ -47,7 +47,7 @@ jobs:
   # Run all of our static code checks here
   code_checking:
     name: Run static code checks
-    runs-on: mdb-dev
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -57,8 +57,7 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@v5
         with:
-          cache-local-path: "/home/runner/_work/_tool/uv-local-cache" # Place cache in the tool dir because we mount this in our runnners
-          prune-cache: false # We want to save all cache because it's in the mount^
+          enable-cache: true
           python-version: ${{ vars.CI_PYTHON_VERSION || '3.11' }} # Default to 3.11 where vars aren't available (PRs from forks)
       # Checks the codebase for print() statements and fails if any are found
       # We should be using loggers instead
@@ -86,7 +85,7 @@ jobs:
   # Creates a matrix of environments to test against using matrix_includes.json
   matrix_prep:
     name: Prepare matrix
-    runs-on: mdb-dev
+    runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
@@ -97,6 +96,35 @@ jobs:
         uses: JoshuaTheMiller/conditional-build-matrix@v2.0.1
         with:
           filter: "[?runOnBranch==`${{ github.ref }}` || runOnBranch==`always`]"
+      # matrix_includes.json is read from the pull request's own checkout, so on
+      # a fork PR the contributor chooses these labels. The jobs below feed them
+      # straight into `runs-on`, which is how a fork would put its own code on a
+      # pod inside our clusters without touching a workflow file.
+      - name: Reject runner labels that are not GitHub-hosted
+        env:
+          MATRIX: ${{ steps.set-matrix.outputs.matrix }}
+        run: |
+          set -euo pipefail
+          # tostring and the array branch matter: `runs-on` also accepts a list
+          # of labels, and an entry with no `runs_on` at all reads as null. Both
+          # have to reach the comparison as strings rather than crashing jq,
+          # which would report nothing.
+          BAD=$(jq -r '
+            [(.include // [])[].runs_on]
+            | map(if type == "array" then .[] else . end)
+            | map(tostring)
+            # An allowlist, not a denylist of our own labels, so a label nobody
+            # has thought of yet fails rather than passes. Adding a new
+            # GitHub-hosted image to matrix_includes.json means adding it here
+            # too, and the error below says which label was rejected.
+            - ["ubuntu-latest","ubuntu-24.04","ubuntu-22.04","windows-latest","macos-latest"]
+            | unique | join(", ")
+          ' <<< "$MATRIX")
+          # Expect: empty, so every matrix entry names a GitHub-hosted runner
+          if [ -n "$BAD" ]; then
+            echo "::error::matrix_includes.json asks for runner labels that are not GitHub-hosted: $BAD"
+            exit 1
+          fi
 
   check_install:
     name: Check pip installation