ci: adopt the public-repository runner posture#348
Conversation
The repository went public, and the runner policy component forbids the local-runner selector on public repositories (fork-PR exposure: workflow code from forks must never route to self-hosted workers). Declare visibility public with selfHostedCi false in .github/runner-policy.json, remove every select-runner call, and pin all lanes to GitHub-hosted ubuntu-24.04 (free on public repositories). Co-authored-by: Claude Fable 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2a3c7ec9dd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Closing as superseded by #349 (same seven-file public-posture conversion, currently green with review threads resolved), which additionally folds in #345's synced runner-policy contracts — required for the policy engine to pass at the 90f1c54 pins — and rewrites docs/CI-RUNNER-ROUTING.md for the new posture. Consolidating to one PR to avoid a merge race on the same files. |
Summary
The repository is now public. The runner-policy component forbids the local-runner selector on public repositories, so the previously green
Runner policycheck now fails on every PR (repository visibility evidence is public, but .github/runner-policy.json declares private), blocking the merge queue (#343 and everything after it)..github/runner-policy.json:visibility: public,selfHostedCi: false(schema-forced pair)select-runnerselector jobs and route every lane to GitHub-hostedubuntu-24.04(free on public repositories); reviewed reusables keep an explicitrunner:input per the policy's runner-target contractVerified locally:
node .github/standards/runner-policy/runner-policy.mjs --root . --repository-visibility publicpasses;actionlintclean.Security posture: fork PRs can no longer reach self-hosted workers by construction (no selector in any workflow); org fork-PR approval policy is
all_external_contributors.No linked issue
Related
🤖 Generated with Claude Code