ci: move workflows to self-hosted Air/Mini/EVO runners

Replace GitHub-hosted ubuntu-latest and macos-26 runners with org
self-hosted labels so PR/push CI is not blocked by Actions spending
limits. Linux jobs use [self-hosted, Linux, X64, evo]; macOS jobs use
[self-hosted, macOS, ARM64]. Multi-arch image arm64 builds run on macOS
ARM64 runners; Windows desktop releases still use windows-2022 when
Authenticode signing is configured.

Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   lint:
     name: Lint
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     steps:
       - uses: actions/checkout@v5
         with:
@@ -29,7 +29,7 @@ jobs:
 
   check:
     name: Typecheck
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     steps:
       - uses: actions/checkout@v5
         with:
@@ -47,7 +47,7 @@ jobs:
 
   build:
     name: Production builds
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v5
@@ -76,7 +76,7 @@ jobs:
 
   test:
     name: Unit tests
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     steps:
       - uses: actions/checkout@v5
         with:
@@ -94,7 +94,7 @@ jobs:
 
   test-integration:
     name: Postgres journeys
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v5
@@ -118,7 +118,7 @@ jobs:
     name: Publish compatible mobile update
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: [lint, check, build, test, test-integration, test-e2e]
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     timeout-minutes: 20
     concurrency:
       group: mobile-production-update
@@ -271,7 +271,7 @@ jobs:
       github.ref == 'refs/heads/main' &&
       vars.PRODUCTION_DEPLOY_ENABLED == 'true'
     needs: [lint, check, build, test, test-integration, test-e2e]
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     timeout-minutes: 30
     concurrency:
       group: production

.github/workflows/desktop-macos-screenshot.yml

@@ -25,7 +25,7 @@ concurrency:
 jobs:
   screenshot:
     name: macOS setup screenshot
-    runs-on: macos-26
+    runs-on: [self-hosted, macOS, ARM64]
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v5

.github/workflows/mobile-android-screenshots.yml

@@ -13,7 +13,7 @@ concurrency:
 jobs:
   screenshots:
     name: Capture Android UI
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     timeout-minutes: 45
     services:
       postgres:

.github/workflows/playwright.yml

@@ -53,7 +53,7 @@ permissions:
 jobs:
   playwright:
     name: Web E2E
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     timeout-minutes: 20
     concurrency:
       group: ${{ inputs.publish_report && 'playwright-publication' || format('playwright-{0}', github.run_id) }}
@@ -72,8 +72,8 @@ jobs:
           key: ${{ runner.os }}-playwright-${{ hashFiles('pnpm-lock.yaml') }}
       - name: Install Chromium
         timeout-minutes: 5
-        # Skip --with-deps: GitHub ubuntu-latest already has Chromium's OS libraries,
+        # Skip --with-deps when the EVO runner already has Chromium's OS libraries.
-        # and apt-get against azure.archive.ubuntu.com can stall until the job timeout.
+        # Re-enable --with-deps after provisioning a fresh self-hosted runner.
         run: pnpm --filter @rakazo/web exec playwright install chromium
       - name: Validate E2B credentials
         if: inputs.sandbox_provider == 'e2b'

.github/workflows/publish-playwright-report.yml

@@ -24,7 +24,7 @@ jobs:
       (github.event.workflow_run.event == 'pull_request' ||
        (github.event.workflow_run.event == 'push' &&
         github.event.workflow_run.head_branch == 'main'))
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     timeout-minutes: 10
     steps:
       # workflow_run has repository secrets. Always use trusted default-branch code here;

.github/workflows/publish-server-image.yml

@@ -36,7 +36,7 @@ jobs:
   installer-smoke:
     name: Compose installer smokes
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     timeout-minutes: 5
     permissions:
       contents: read
@@ -49,7 +49,7 @@ jobs:
   validate:
     name: Validate ${{ matrix.name }} image
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     timeout-minutes: 90
     permissions:
       contents: read
@@ -93,8 +93,9 @@ jobs:
     name: Build ${{ matrix.name }} ${{ matrix.arch }}
     if: github.event_name != 'pull_request'
     # Each architecture builds natively on its own runner and pushes by digest only.
-    # No QEMU: GitHub hosts native arm64 runners, and emulated arm64 took hours for the
+    # amd64 on EVO; arm64 on macOS ARM64 (Air/Mini) because there is no Linux/arm64 runner.
-    # desktop-sized computer image. See docs/self-host.md (Published images and tags).
+    # No QEMU: emulated arm64 took hours for the desktop-sized computer image.
+    # See docs/self-host.md (Published images and tags).
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 90
     permissions:
@@ -118,9 +119,9 @@ jobs:
             dockerfile: infra/sandboxes/computer/Dockerfile
             context: infra/sandboxes/computer
           - arch: amd64
-            runner: ubuntu-latest
+            runner: [self-hosted, Linux, X64, evo]
           - arch: arm64
-            runner: ubuntu-24.04-arm
+            runner: [self-hosted, macOS, ARM64]
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
@@ -171,7 +172,7 @@ jobs:
     name: Publish ${{ matrix.name }} image
     if: github.event_name != 'pull_request'
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     timeout-minutes: 15
     permissions:
       contents: read

.github/workflows/release-desktop.yml

@@ -17,7 +17,7 @@ concurrency:
 jobs:
   validate:
     name: Validate stable release
-    runs-on: ubuntu-24.04
+    runs-on: [self-hosted, Linux, X64, evo]
     outputs:
       tag: ${{ steps.release.outputs.tag }}
       version: ${{ steps.release.outputs.version }}
@@ -93,9 +93,13 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          include='[{"os":"macos-26","artifact":"macos"},{"os":"ubuntu-24.04","artifact":"linux"}]'
+          include='[
+            {"labels":["self-hosted","macOS","ARM64"],"artifact":"macos"},
+            {"labels":["self-hosted","Linux","X64","evo"],"artifact":"linux"}
+          ]'
           if [[ "$WINDOWS_SIGNING" == "true" ]]; then
-            include="$(jq -c '. + [{"os":"windows-2022","artifact":"windows"}]' <<<"$include")"
+            # No self-hosted Windows runner; Authenticode builds still use GitHub-hosted billing.
+            include="$(jq -c '. + [{"labels":"windows-2022","artifact":"windows"}]' <<<"$include")"
           fi
           echo "include=$include" >> "$GITHUB_OUTPUT"
           echo "windows=$WINDOWS_SIGNING" >> "$GITHUB_OUTPUT"
@@ -103,7 +107,7 @@ jobs:
   build:
     name: Build signed ${{ matrix.artifact }} artifacts
     needs: validate
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.labels }}
     timeout-minutes: 60
     strategy:
       fail-fast: false
@@ -261,7 +265,7 @@ jobs:
   publish:
     name: Attest and publish complete release
     needs: [validate, build]
-    runs-on: ubuntu-24.04
+    runs-on: [self-hosted, Linux, X64, evo]
     timeout-minutes: 15
     permissions:
       actions: read

.github/workflows/topology-verification.yml

@@ -9,7 +9,7 @@ permissions:
 jobs:
   topology:
     name: Production topology smoke
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, evo]
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5