chore(ci): add CI_PROVIDER toggle between Blacksmith and GitHub-hosted runners

[TheodoreSpeaks]

Summary

• Adds a CI_PROVIDER repo variable that switches all CI between Blacksmith and GitHub-hosted runners. Unset = Blacksmith, so current behavior is unchanged until deliberately flipped
• Repo variable rather than a committed value on purpose: during a Blacksmith outage there's no working CI to merge a switchover commit through, and the variable takes effect on the next run with nothing to land
• Two new composite actions branch internally on the provider — .github/actions/cache-mount (stickydisk vs actions/cache) and .github/actions/docker-build (Blacksmith builder vs docker/setup-buildx-action + docker/build-push-action)
• All 16 Blacksmith runner labels became expressions across ci.yml, test-build.yml, migrations.yml, docs-embeddings.yml, and the three publish workflows. ARM maps to ubuntu-24.04-arm

To flip: gh variable set CI_PROVIDER --body github / gh variable delete CI_PROVIDER

Notes

• The GitHub cache branch appends github.run_id to the key and restores by prefix. actions/cache skips its save step on an exact key hit, which would otherwise freeze each cache at whatever the first run wrote — this reproduces sticky-disk's rolling behavior
• provenance: false / sbom: false moved into the composite instead of being repeated per call site. They're load-bearing: attestation manifests break the imagetools create retagging that promote-images and create-ghcr-manifests depend on
• docker-build absorbs the separate "Set up Docker Buildx" step, so each build site went from two steps to one
• Fork-isolation key scoping carries over unchanged to both backends
• GitHub mode is a break-glass fallback, not a peer — 4 vCPU with no free 8-core tier, 10 GB repo cache quota shared across the three mounts, cold image layers. Documented in the ci.yml header comment along with the flip instructions
• Fails fast by design: a bare useblacksmith/* step added outside the two composites hard-errors in GitHub mode rather than silently degrading. No fallback shims

Type of Change

• Chore (CI infrastructure)

Testing

• actionlint clean across all workflows. Confirmed it validates the composite wiring by checking it catches a deliberate bad input name at every call site
• yq parses all 8 workflows + both action files
• bun run lint:check passes (19/19 tasks)
• bun run check:api-validation:strict passes
• Verified no upload-artifact/download-artifact anywhere, so every inter-job handoff is a registry tag or a plain string output — a run that straddles a provider flip still promotes a coherent image set

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 21, 2026 7:34pm

[cursor]

PR Summary

Medium Risk
Touches deploy-path image builds, migrations, and cache behavior; misaligned runs-on vs composite provider would hard-fail, but default behavior is unchanged and GitHub mode is documented as slower break-glass only.

Overview
Introduces a CI_PROVIDER repository variable so CI can run on Blacksmith (default when unset) or GitHub-hosted runners without merging a switchover commit—flip via gh variable set CI_PROVIDER --body github.

runs-on across ci.yml, test-build.yml, migrations.yml, docs-embeddings.yml, and publish workflows now use the same predicate; ARM jobs map to ubuntu-24.04-arm in GitHub mode. cache-mount and docker-build composite actions branch on provider: stickydisk vs actions/cache (with run_id suffix + prefix restore-keys for rolling caches), and Blacksmith build-push vs standard buildx (no GHA layer cache on fallback; provenance/sbom off in the composite for imagetools retagging). Image build jobs call ./.github/actions/docker-build instead of inline useblacksmith/* steps; test/build jobs replace direct stickydisk steps with cache-mount.

^{Reviewed by Cursor Bugbot for commit 031d1ad. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds a repository-level switch between Blacksmith and GitHub-hosted CI. The main changes are:

• Provider-aware runner selection across CI, migration, documentation, and publishing workflows.
• Composite actions for provider-specific caching and Docker builds.
• GitHub-hosted ARM runner support and safe fallback for unrecognized provider values.

Confidence Score: 5/5

This looks safe to merge.

• The corrected predicate sends unrecognized provider values to GitHub-hosted runners.
• Runner selection and composite-action branches use the same provider conditions.
• No blocking issues remain in the updated code.

Important Files Changed

Filename	Overview
.github/actions/cache-mount/action.yml	Adds provider-specific selection between Blacksmith sticky disks and GitHub Actions cache.
.github/actions/docker-build/action.yml	Adds provider-specific Docker builder setup and image publishing.
.github/workflows/ci.yml	Adds provider-aware runners and routes image builds through the Docker composite action.
.github/workflows/test-build.yml	Adds provider-aware runners and routes build caches through the cache composite action.
.github/workflows/docs-embeddings.yml	Adds provider-aware runner selection for documentation embeddings.
.github/workflows/migrations.yml	Adds provider-aware runner selection for database migrations.
.github/workflows/publish-cli.yml	Adds provider-aware runner selection for CLI publishing.
.github/workflows/publish-python-sdk.yml	Adds provider-aware runner selection for Python SDK publishing.
.github/workflows/publish-ts-sdk.yml	Adds provider-aware runner selection for TypeScript SDK publishing.

_{Reviews (2): Last reviewed commit: "chore(ci): fail unrecognized CI_PROVIDER..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 031d1ad. Configure here.}