docs: runner routing by visibility, $80 cost envelope, AI-findings billing - #52
Merged
Merged
Conversation
…lling Three gaps this closes, all found while auditing the live estate: - No documented rule for which repositories run where. Private minutes are metered and public ones are not, so the cost-optimal routing is private -> self-hosted, public -> GitHub-hosted. Adds that rule plus the reason a self-hosted runner on a public repo is a security defect rather than a saving, and records that this library is itself public and must never route to self-hosted. - Two runner settings are invisible to workflow files. CodeQL default setup and Code Quality scans are scheduled by GitHub, not by a workflow, and each has its own runner control. Missing either leaves a repository burning metered minutes while every caller claims otherwise. - AI findings were undocumented. They are metered separately from the Code Quality licence with no included allowance (discountAmount is 0.00 on every line, $0.01/credit); one repository burned 774.9 credits in ~12 days, roughly twice the licence that covers the whole organization. A product budget cannot fence this off because the licence needs headroom under the same SKU, so the per-repository switch is the only real control. Also corrects a stale claim: sha_pinning_required is now true at both org and enterprise level, not false. Adds the private self-hosted caller example and registers it with the catalog validator. validate_all.py: 18/18 OK.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes three documentation gaps found while auditing the live estate.
Runner routing was undocumented
Private-repository minutes are metered; public ones are free and unlimited. The cost-optimal routing is therefore the opposite of "use our own hardware everywhere":
docs/05-runners.mdgains aRouting by visibilitysection carrying that rule, the fork-PR RCE reasoning, and an explicit statement that this repository is public and must never route itself to self-hosted or ship a self-hosted default inexamples/.Two runner settings no workflow file can reach
CodeQL default setup and Code Quality scans are scheduled by GitHub, not by a workflow. Each has its own runner control. Miss either and the repository keeps burning metered minutes while every caller says otherwise — documented with the exact API call and UI path.
AI findings were undocumented, and they are the expensive part
docs/16-code-quality.mdgains anAI findingssection. They are metered separately from the $10 licence with no included allowance — every billing line showsdiscountAmount: 0.00, at $0.01/credit. One repository burned 774.9 credits in ~12 days, about $19/month, nearly twice the licence that covers the whole organization.Also recorded: a product budget cannot fence this off, because the budget must leave headroom for the licence accruing under the same SKU. The per-repository switch is the only real control. And where CodeQL finds no supported language the switch is absent entirely — a stronger guarantee than "off", and not something to fix.
Correction
sha_pinning_requiredis true at both org and enterprise level. The doc claimedfalseand listed it under "what this estate does not have".Added
examples/nddev/security-private-selfhosted.yml— same coverage as the existing nddev suite with every job pinned to the self-hosted fleet, registered with the catalog validator.validate_all.py: 18/18 OK. Docs-only plus one validator allow-list entry; no reusable workflow behaviour changes.