From 0ebf438b4ccd9be181162af93b1b261bfa990078 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 21 Sep 2026 17:45:03 +0000 Subject: [PATCH] ci: move workflows to self-hosted Air/Mini/EVO runners Replace GitHub-hosted ubuntu-latest and macos-26 runners with org self-hosted labels so PR/push CI is not blocked by Actions spending limits. Linux jobs use [self-hosted, Linux, X64, evo]; macOS jobs use [self-hosted, macOS, ARM64]. Multi-arch image arm64 builds run on macOS ARM64 runners; Windows desktop releases still use windows-2022 when Authenticode signing is configured. Co-authored-by: cynarAI --- .github/workflows/ci.yml | 14 +++++++------- .github/workflows/desktop-macos-screenshot.yml | 2 +- .github/workflows/mobile-android-screenshots.yml | 2 +- .github/workflows/playwright.yml | 6 +++--- .github/workflows/publish-playwright-report.yml | 2 +- .github/workflows/publish-server-image.yml | 15 ++++++++------- .github/workflows/release-desktop.yml | 14 +++++++++----- .github/workflows/topology-verification.yml | 2 +- 8 files changed, 31 insertions(+), 26 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 27b79e6..59315bb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,7 @@ concurrency: jobs: lint: name: Lint - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] steps: - uses: actions/checkout@v5 with: @@ -29,7 +29,7 @@ jobs: check: name: Typecheck - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] steps: - uses: actions/checkout@v5 with: @@ -47,7 +47,7 @@ jobs: build: name: Production builds - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] timeout-minutes: 10 steps: - uses: actions/checkout@v5 @@ -76,7 +76,7 @@ jobs: test: name: Unit tests - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] steps: - uses: actions/checkout@v5 with: @@ -94,7 +94,7 @@ jobs: test-integration: name: Postgres journeys - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] timeout-minutes: 10 steps: - uses: actions/checkout@v5 @@ -118,7 +118,7 @@ jobs: name: Publish compatible mobile update if: github.event_name == 'push' && github.ref == 'refs/heads/main' needs: [lint, check, build, test, test-integration, test-e2e] - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] timeout-minutes: 20 concurrency: group: mobile-production-update @@ -271,7 +271,7 @@ jobs: github.ref == 'refs/heads/main' && vars.PRODUCTION_DEPLOY_ENABLED == 'true' needs: [lint, check, build, test, test-integration, test-e2e] - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] timeout-minutes: 30 concurrency: group: production diff --git a/.github/workflows/desktop-macos-screenshot.yml b/.github/workflows/desktop-macos-screenshot.yml index 529e8ed..049a095 100644 --- a/.github/workflows/desktop-macos-screenshot.yml +++ b/.github/workflows/desktop-macos-screenshot.yml @@ -25,7 +25,7 @@ concurrency: jobs: screenshot: name: macOS setup screenshot - runs-on: macos-26 + runs-on: [self-hosted, macOS, ARM64] timeout-minutes: 20 steps: - uses: actions/checkout@v5 diff --git a/.github/workflows/mobile-android-screenshots.yml b/.github/workflows/mobile-android-screenshots.yml index d6db223..885b79b 100644 --- a/.github/workflows/mobile-android-screenshots.yml +++ b/.github/workflows/mobile-android-screenshots.yml @@ -13,7 +13,7 @@ concurrency: jobs: screenshots: name: Capture Android UI - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] timeout-minutes: 45 services: postgres: diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml index e6848d8..b9d538b 100644 --- a/.github/workflows/playwright.yml +++ b/.github/workflows/playwright.yml @@ -53,7 +53,7 @@ permissions: jobs: playwright: name: Web E2E - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] timeout-minutes: 20 concurrency: group: ${{ inputs.publish_report && 'playwright-publication' || format('playwright-{0}', github.run_id) }} @@ -72,8 +72,8 @@ jobs: key: ${{ runner.os }}-playwright-${{ hashFiles('pnpm-lock.yaml') }} - name: Install Chromium timeout-minutes: 5 - # Skip --with-deps: GitHub ubuntu-latest already has Chromium's OS libraries, - # and apt-get against azure.archive.ubuntu.com can stall until the job timeout. + # Skip --with-deps when the EVO runner already has Chromium's OS libraries. + # Re-enable --with-deps after provisioning a fresh self-hosted runner. run: pnpm --filter @rakazo/web exec playwright install chromium - name: Validate E2B credentials if: inputs.sandbox_provider == 'e2b' diff --git a/.github/workflows/publish-playwright-report.yml b/.github/workflows/publish-playwright-report.yml index 273b208..91772dd 100644 --- a/.github/workflows/publish-playwright-report.yml +++ b/.github/workflows/publish-playwright-report.yml @@ -24,7 +24,7 @@ jobs: (github.event.workflow_run.event == 'pull_request' || (github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main')) - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] timeout-minutes: 10 steps: # workflow_run has repository secrets. Always use trusted default-branch code here; diff --git a/.github/workflows/publish-server-image.yml b/.github/workflows/publish-server-image.yml index 5df6c59..f6a1969 100644 --- a/.github/workflows/publish-server-image.yml +++ b/.github/workflows/publish-server-image.yml @@ -36,7 +36,7 @@ jobs: installer-smoke: name: Compose installer smokes if: github.event_name == 'pull_request' - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] timeout-minutes: 5 permissions: contents: read @@ -49,7 +49,7 @@ jobs: validate: name: Validate ${{ matrix.name }} image if: github.event_name == 'pull_request' - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] timeout-minutes: 90 permissions: contents: read @@ -93,8 +93,9 @@ jobs: name: Build ${{ matrix.name }} ${{ matrix.arch }} if: github.event_name != 'pull_request' # Each architecture builds natively on its own runner and pushes by digest only. - # No QEMU: GitHub hosts native arm64 runners, and emulated arm64 took hours for the - # desktop-sized computer image. See docs/self-host.md (Published images and tags). + # amd64 on EVO; arm64 on macOS ARM64 (Air/Mini) because there is no Linux/arm64 runner. + # No QEMU: emulated arm64 took hours for the desktop-sized computer image. + # See docs/self-host.md (Published images and tags). runs-on: ${{ matrix.runner }} timeout-minutes: 90 permissions: @@ -118,9 +119,9 @@ jobs: dockerfile: infra/sandboxes/computer/Dockerfile context: infra/sandboxes/computer - arch: amd64 - runner: ubuntu-latest + runner: [self-hosted, Linux, X64, evo] - arch: arm64 - runner: ubuntu-24.04-arm + runner: [self-hosted, macOS, ARM64] steps: - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: @@ -171,7 +172,7 @@ jobs: name: Publish ${{ matrix.name }} image if: github.event_name != 'pull_request' needs: build - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] timeout-minutes: 15 permissions: contents: read diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml index 99e3c0e..db31e45 100644 --- a/.github/workflows/release-desktop.yml +++ b/.github/workflows/release-desktop.yml @@ -17,7 +17,7 @@ concurrency: jobs: validate: name: Validate stable release - runs-on: ubuntu-24.04 + runs-on: [self-hosted, Linux, X64, evo] outputs: tag: ${{ steps.release.outputs.tag }} version: ${{ steps.release.outputs.version }} @@ -93,9 +93,13 @@ jobs: shell: bash run: | set -euo pipefail - include='[{"os":"macos-26","artifact":"macos"},{"os":"ubuntu-24.04","artifact":"linux"}]' + include='[ + {"labels":["self-hosted","macOS","ARM64"],"artifact":"macos"}, + {"labels":["self-hosted","Linux","X64","evo"],"artifact":"linux"} + ]' if [[ "$WINDOWS_SIGNING" == "true" ]]; then - include="$(jq -c '. + [{"os":"windows-2022","artifact":"windows"}]' <<<"$include")" + # No self-hosted Windows runner; Authenticode builds still use GitHub-hosted billing. + include="$(jq -c '. + [{"labels":"windows-2022","artifact":"windows"}]' <<<"$include")" fi echo "include=$include" >> "$GITHUB_OUTPUT" echo "windows=$WINDOWS_SIGNING" >> "$GITHUB_OUTPUT" @@ -103,7 +107,7 @@ jobs: build: name: Build signed ${{ matrix.artifact }} artifacts needs: validate - runs-on: ${{ matrix.os }} + runs-on: ${{ matrix.labels }} timeout-minutes: 60 strategy: fail-fast: false @@ -261,7 +265,7 @@ jobs: publish: name: Attest and publish complete release needs: [validate, build] - runs-on: ubuntu-24.04 + runs-on: [self-hosted, Linux, X64, evo] timeout-minutes: 15 permissions: actions: read diff --git a/.github/workflows/topology-verification.yml b/.github/workflows/topology-verification.yml index a1aa876..a79efd5 100644 --- a/.github/workflows/topology-verification.yml +++ b/.github/workflows/topology-verification.yml @@ -9,7 +9,7 @@ permissions: jobs: topology: name: Production topology smoke - runs-on: ubuntu-latest + runs-on: [self-hosted, Linux, X64, evo] timeout-minutes: 30 steps: - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5