ci(runner-policy): declare public visibility, hosted-only CI#346
ci(runner-policy): declare public visibility, hosted-only CI#346kyle-sexton wants to merge 1 commit into
Conversation
Repository is now public. Public repos get free unlimited GitHub-hosted runners and must not route to the self-hosted fleet, so declare visibility=public and selfHostedCi=false. Aligns the local runner-policy declaration with actual visibility so the runner-policy lane passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XXUE3ozzde4Y2sbUbMxzuS
|
Claude finished @kyle-sexton's task in 41s —— View job PR Review
Review:
|
| Field | Before | After |
|---|---|---|
visibility |
"private" |
"public" |
selfHostedCi |
true |
false |
Assessment: ✅ Correct and approved
The change is straightforward and accurate:
visibility: "public"— correctly reflects that the repository has been made public.selfHostedCi: false— correct for two reasons: (1) public repos receive free unlimited GitHub-hosted runners so self-hosted is unnecessary, and (2) this is actually a security improvement — self-hosted runners on public repos are a known attack vector because fork PRs can execute arbitrary code on your own infrastructure. Opting out is the right default.- The
exceptions: {}object is unchanged and appropriate — no runner-routing exceptions are needed. - No other fields require changes;
schemaVersionandrepositoryOwnerremain correct.
No issues found. The diff is minimal, the PR description clearly explains the motivation, and the change aligns the policy declaration with actual repository state.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0abf57aadc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "visibility": "public", | ||
| "selfHostedCi": false, |
There was a problem hiding this comment.
With this configuration, the runner-policy validation lane will fail on every CI run: its routingEnabled condition is false for a public repository, and it emits public-self-hosted-routing for each selector and selector-output job. The existing selectors in .github/workflows/ci.yml (and the other workflow files) remain in place, so runner-policy fails and the ci-status gateway turns red. Replace those selector-based runs-on paths with the approved hosted runner configuration as part of this change.
Useful? React with 👍 / 👎.
|
Superseded by #348: flipping the policy declaration alone leaves every workflow calling the forbidden local-runner selector, so the Runner policy check still fails (public-self-hosted-routing — see this PR's own check results). #348 carries this same declaration change plus the selector removal across all six workflows, verified against the policy checker locally. Recommend closing this one. |
Pull request was closed
Repository is now public. Public repos get free unlimited GitHub-hosted runners and must not route to the self-hosted fleet.
Declare
visibility: publicandselfHostedCi: falsein the local runner-policy declaration so it matches actual visibility and theci-statusrunner-policy lane passes.