Summary

• Adds a CI_PROVIDER repo variable that switches all CI between Blacksmith and GitHub-hosted runners. Unset = Blacksmith, so current behavior is unchanged until deliberately flipped
• Repo variable rather than a committed value on purpose: during a Blacksmith outage there's no working CI to merge a switchover commit through, and the variable takes effect on the next run with nothing to land
• Two new composite actions branch internally on the provider — .github/actions/cache-mount (stickydisk vs actions/cache) and .github/actions/docker-build (Blacksmith builder vs docker/setup-buildx-action + docker/build-push-action)
• All 16 Blacksmith runner labels became expressions across ci.yml, test-build.yml, migrations.yml, docs-embeddings.yml, and the three publish workflows. ARM maps to ubuntu-24.04-arm

To flip: gh variable set CI_PROVIDER --body github / gh variable delete CI_PROVIDER

Notes

• The GitHub cache branch appends github.run_id to the key and restores by prefix. actions/cache skips its save step on an exact key hit, which would otherwise freeze each cache at whatever the first run wrote — this reproduces sticky-disk's rolling behavior
• provenance: false / sbom: false moved into the composite instead of being repeated per call site. They're load-bearing: attestation manifests break the imagetools create retagging that promote-images and create-ghcr-manifests depend on
• docker-build absorbs the separate "Set up Docker Buildx" step, so each build site went from two steps to one
• Fork-isolation key scoping carries over unchanged to both backends
• GitHub mode is a break-glass fallback, not a peer — 4 vCPU with no free 8-core tier, 10 GB repo cache quota shared across the three mounts, cold image layers. Documented in the ci.yml header comment along with the flip instructions
• Fails fast by design: a bare useblacksmith/* step added outside the two composites hard-errors in GitHub mode rather than silently degrading. No fallback shims

Type of Change

• Chore (CI infrastructure)

Testing

• actionlint clean across all workflows. Confirmed it validates the composite wiring by checking it catches a deliberate bad input name at every call site
• yq parses all 8 workflows + both action files
• bun run lint:check passes (19/19 tasks)
• bun run check:api-validation:strict passes
• Verified no upload-artifact/download-artifact anywhere, so every inter-job handoff is a registry tag or a plain string output — a run that straddles a provider flip still promotes a coherent image set

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)