ci: move static build and backend deploy jobs to self-hosted-k8s

[lebedevdsl]

Moves the remaining GitHub-hosted jobs of the two shared workflows onto the in-cluster self-hosted-k8s runners. These fed the paid minutes of admin, elabel, producer, importer and backend-v2 (about 3,300 min in August).

deploy-static-website.yaml

• preview-policy, build-preview, build-production → self-hosted-k8s. The build jobs run in the ci-runner image, pinned by digest like the deploy jobs. All pins updated to the new digest 8c907c4a…, which adds ruby (the manifest validator is a Ruby heredoc) and the argocd CLI.
• pnpm/action-setup and actions/setup-node steps are unchanged; the trusted pnpm version pin stays in force.

deploy-backend.yaml

• deploy → self-hosted-k8s in ci-runner:latest; the imajeetyadav/argocd-cli step is dropped because the CLI is now in the image (v3.2.1).
• build-fork stays on ubuntu-latest on purpose: it is the guard that keeps fork PR code off the cluster runners.

Requires ci-runner image build 1a7c7c2 (done, digest above).

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 0a678c94-a8d1-482f-a730-e6d73fdce607

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

4 issues found across 2 files

Confidence score: 2/5

• deploy-static-website.yaml moves secret-bearing PR builds onto the cluster runner, where checkout, dependency lifecycle scripts, and pnpm build execute outside the isolated GitHub-hosted VM; retain the isolation or otherwise establish an equivalent security boundary.
• deploy-backend.yaml uses mutable ci-runner:latest while exposing ARGO_API_KEY, so the executed image can change without workflow review; pin the approved image digest as in the static workflow.
• deploy-static-website.yaml moves preview-policy, build-preview, and build-production across the enforced runner boundary, causing .github/tests/deploy-static-job-boundaries.test.rb to fail in validate-static-deploy.yaml; update the workflow or the boundary policy together.
• preview-policy in deploy-static-website.yaml runs gh api without a container on self-hosted-k8s, so it may lack the expected CI image and required tooling; run it in the approved container or verify the ARC base image provides gh.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/deploy-backend.yaml">

<violation number="1" location=".github/workflows/deploy-backend.yaml:259">
P1: This deploy job now runs with `ARGO_API_KEY`, but `ci-runner:latest` can change between runs or matrix jobs without a workflow review. Pin the approved image digest, as the static workflow does.</violation>
</file>

<file name=".github/workflows/deploy-static-website.yaml">

<violation number="1" location=".github/workflows/deploy-static-website.yaml:68">
P2: preview-policy's only step calls `gh api`, but the job now runs on `self-hosted-k8s` with no `container`, so it executes in the ARC runner pod's base image rather than the ci-runner container the other moved jobs use. ubuntu-latest shipped the `gh` CLI; nothing in the repo confirms the pod image has it. This job is the trust gate for the whole preview pipeline (its `trusted` output feeds build-preview and deploy-preview), so a missing `gh` fails the step and blocks every preview. Confirm `gh` and `bash` exist in the runner pod image, or run the job in the same ci-runner container as the other moved jobs.</violation>

<violation number="2" location=".github/workflows/deploy-static-website.yaml:68">
P1: Moving preview-policy, build-preview, and build-production to self-hosted-k8s breaks the enforced boundary test .github/tests/deploy-static-job-boundaries.test.rb, and it runs in validate-static-deploy.yaml on every PR touching this workflow. Lines 17, 40 and 153 abort unless runs-on == "ubuntu-latest", and lines 41/154 abort if the job defines a container. CI will fail on this PR. Update the test assertions (and drop the now-invalid "must not use a self-hosted container" checks) in the same change.</violation>

<violation number="3" location=".github/workflows/deploy-static-website.yaml:68">
P1: Custom agent: **Flag Security Vulnerabilities**

This moves a secret-bearing PR build from an isolated GitHub-hosted VM into the cluster runner. The checkout, dependency lifecycle scripts, and `pnpm build` can execute repository or dependency code that may exfiltrate `NPM_TOKEN` or reach cluster resources; keep this build on an isolated runner or enforce and document pod isolation, disabled ServiceAccount token mounting, and restrictive network policy.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: This deploy job now runs with ARGO_API_KEY, but ci-runner:latest can change between runs or matrix jobs without a workflow review. Pin the approved image digest, as the static workflow does.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/deploy-backend.yaml, line 259:

<comment>This deploy job now runs with `ARGO_API_KEY`, but `ci-runner:latest` can change between runs or matrix jobs without a workflow review. Pin the approved image digest, as the static workflow does.</comment>

<file context>
@@ -252,7 +252,11 @@ jobs:
+    # ci-runner ships the argocd CLI (v3.2.1) and jq; nothing is downloaded
+    # through NAT per run.
+    container:
+      image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner:latest
     needs: build
     if: >-
</file context>

Suggested change

	image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner:latest
	image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:8c907c4a13a14ec89617bfadb60a090abc358f91d9b888552ce91205be35a52a

[cubic-dev-ai]

P1: Moving preview-policy, build-preview, and build-production to self-hosted-k8s breaks the enforced boundary test .github/tests/deploy-static-job-boundaries.test.rb, and it runs in validate-static-deploy.yaml on every PR touching this workflow. Lines 17, 40 and 153 abort unless runs-on == "ubuntu-latest", and lines 41/154 abort if the job defines a container. CI will fail on this PR. Update the test assertions (and drop the now-invalid "must not use a self-hosted container" checks) in the same change.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/deploy-static-website.yaml, line 68:

<comment>Moving preview-policy, build-preview, and build-production to self-hosted-k8s breaks the enforced boundary test .github/tests/deploy-static-job-boundaries.test.rb, and it runs in validate-static-deploy.yaml on every PR touching this workflow. Lines 17, 40 and 153 abort unless runs-on == "ubuntu-latest", and lines 41/154 abort if the job defines a container. CI will fail on this PR. Update the test assertions (and drop the now-invalid "must not use a self-hosted container" checks) in the same change.</comment>

<file context>
@@ -64,7 +64,8 @@ env:
   preview-policy:
-    runs-on: ubuntu-latest
+    # Shell-only policy evaluation; runs in the ARC runner pod itself.
+    runs-on: self-hosted-k8s
     permissions:
       contents: read
</file context>

[cubic-dev-ai]

P1: Custom agent: Flag Security Vulnerabilities

This moves a secret-bearing PR build from an isolated GitHub-hosted VM into the cluster runner. The checkout, dependency lifecycle scripts, and pnpm build can execute repository or dependency code that may exfiltrate NPM_TOKEN or reach cluster resources; keep this build on an isolated runner or enforce and document pod isolation, disabled ServiceAccount token mounting, and restrictive network policy.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/deploy-static-website.yaml, line 68:

<comment>This moves a secret-bearing PR build from an isolated GitHub-hosted VM into the cluster runner. The checkout, dependency lifecycle scripts, and `pnpm build` can execute repository or dependency code that may exfiltrate `NPM_TOKEN` or reach cluster resources; keep this build on an isolated runner or enforce and document pod isolation, disabled ServiceAccount token mounting, and restrictive network policy.</comment>

<file context>
@@ -64,7 +64,8 @@ env:
   preview-policy:
-    runs-on: ubuntu-latest
+    # Shell-only policy evaluation; runs in the ARC runner pod itself.
+    runs-on: self-hosted-k8s
     permissions:
       contents: read
</file context>

[cubic-dev-ai]

P2: preview-policy's only step calls gh api, but the job now runs on self-hosted-k8s with no container, so it executes in the ARC runner pod's base image rather than the ci-runner container the other moved jobs use. ubuntu-latest shipped the gh CLI; nothing in the repo confirms the pod image has it. This job is the trust gate for the whole preview pipeline (its trusted output feeds build-preview and deploy-preview), so a missing gh fails the step and blocks every preview. Confirm gh and bash exist in the runner pod image, or run the job in the same ci-runner container as the other moved jobs.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/deploy-static-website.yaml, line 68:

<comment>preview-policy's only step calls `gh api`, but the job now runs on `self-hosted-k8s` with no `container`, so it executes in the ARC runner pod's base image rather than the ci-runner container the other moved jobs use. ubuntu-latest shipped the `gh` CLI; nothing in the repo confirms the pod image has it. This job is the trust gate for the whole preview pipeline (its `trusted` output feeds build-preview and deploy-preview), so a missing `gh` fails the step and blocks every preview. Confirm `gh` and `bash` exist in the runner pod image, or run the job in the same ci-runner container as the other moved jobs.</comment>

<file context>
@@ -64,7 +64,8 @@ env:
   preview-policy:
-    runs-on: ubuntu-latest
+    # Shell-only policy evaluation; runs in the ARC runner pod itself.
+    runs-on: self-hosted-k8s
     permissions:
       contents: read
</file context>