From 1c395c79766cf5ffb4ecdc02567318116c0f68a5 Mon Sep 17 00:00:00 2001 From: Will Wang Date: Mon, 17 Aug 2026 11:06:25 -0700 Subject: [PATCH] ci: keep public repo gates on hosted runners actions-pinned-check declared runs-on: opus-runner-standard and was never assigned a runner in this repo -- every run queued until GitHub cancelled it at 24h. The same gate completes in 8s on ubuntu-latest. A public repo should not target self-hosted runners regardless: a fork PR runs untrusted code, and the gate is shell-only, so a hosted runner is sufficient. check-pr-basics was reading its config through the contents API, which the job cannot reach. The file is in this repo and already checked out, so read it from the working tree instead. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/actions-pinned-check.yml | 8 ++++++-- .github/workflows/check-pr-basic.yml | 4 +++- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/actions-pinned-check.yml b/.github/workflows/actions-pinned-check.yml index 70c3aa5..378f1ba 100644 --- a/.github/workflows/actions-pinned-check.yml +++ b/.github/workflows/actions-pinned-check.yml @@ -13,11 +13,15 @@ on: workflow_dispatch: permissions: - contents: read # actions/checkout needs this to fetch a private repo + contents: read # actions/checkout jobs: check: - runs-on: opus-runner-standard + # This repo is public, so the gate must stay on a hosted runner: a fork PR + # runs untrusted code, and self-hosted runners would execute it on our own + # infrastructure. The check is shell-only and needs nothing a hosted runner + # lacks. https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/manage-access#self-hosted-runner-security-with-public-repositories + runs-on: ubuntu-latest steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: diff --git a/.github/workflows/check-pr-basic.yml b/.github/workflows/check-pr-basic.yml index 0ef97af..6141183 100644 --- a/.github/workflows/check-pr-basic.yml +++ b/.github/workflows/check-pr-basic.yml @@ -22,4 +22,6 @@ jobs: - uses: thehanimo/pr-title-checker@1d8cd483a2b73118406a187f54dca8a9415f1375 # v1.4.2 with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - configuration_path: pull_request_title.json \ No newline at end of file + # The config lives in this repo, so read it off the checkout above + # rather than through the contents API, which this job cannot reach. + local_configuration_path: pull_request_title.json \ No newline at end of file