Skip to content

fix(ci): select the hosted runner explicitly in ci-workflows callers #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rldyourmnd merged 2 commits into from
Aug 10, 2026
Merged

fix(ci): select the hosted runner explicitly in ci-workflows callers #28

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
525434b
fix(ci): select the hosted runner explicitly in ci-workflows callers
rldyourmnd Aug 10, 2026
4f39ef7
docs(agents): record the explicit-runner rule for public callers
rldyourmnd Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .claude/CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,3 +84,15 @@ python3 scripts/validate_instruction_docs.py
python3 scripts/validate_contract.py
python3 scripts/validate_opencode_baseline.py
```

## CI runner selection

This repository is public, so `pull_request` executes untrusted fork code.
Every caller of a `NDDev-it-com/ci-workflows` reusable that exposes a `runner`
input passes `runner: ubuntu-latest` explicitly, and must keep it. Several of
those reusables default `runner` to the estate's self-hosted `amsterdam`
label, and a default is a property of the **pinned commit**, not of this
repository — so dropping the explicit value would let a routine pin bump route
fork PRs onto trusted private infrastructure with no diff here to review. On
any ci-workflows pin bump, diff `inputs.runner.default` between the old and
new commit before merging.
5 changes: 5 additions & 0 deletions .github/workflows/actionlint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,4 +26,9 @@ jobs:
contents: read
uses: NDDev-it-com/ci-workflows/.github/workflows/actionlint.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
with:
# Public repo: pull_request runs untrusted fork code. Pin the hosted runner
# explicitly — several ci-workflows reusables now default `runner` to the
# self-hosted `amsterdam` label, so inheriting the default on a pin bump
# would put fork PRs on trusted private infrastructure.
runner: ubuntu-latest
post_command: python3 scripts/check_action_pins.py .github/workflows
5 changes: 5 additions & 0 deletions .github/workflows/secret-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,4 +23,9 @@ jobs:
contents: read
uses: NDDev-it-com/ci-workflows/.github/workflows/secret-scan.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
with:
# Public repo: pull_request runs untrusted fork code. Pin the hosted runner
# explicitly — several ci-workflows reusables now default `runner` to the
# self-hosted `amsterdam` label, so inheriting the default on a pin bump
# would put fork PRs on trusted private infrastructure.
runner: ubuntu-latest
gitleaks_config_path: .gitleaks.toml
12 changes: 12 additions & 0 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,3 +192,15 @@ python3 scripts/check_baseline_consistency.py
python3 scripts/validate_instruction_docs.py
python3 scripts/validate_mcp_profiles.py
```

## CI runner selection

This repository is public, so `pull_request` executes untrusted fork code.
Every caller of a `NDDev-it-com/ci-workflows` reusable that exposes a `runner`
input passes `runner: ubuntu-latest` explicitly, and must keep it. Several of
those reusables default `runner` to the estate's self-hosted `amsterdam`
label, and a default is a property of the **pinned commit**, not of this
repository — so dropping the explicit value would let a routine pin bump route
fork PRs onto trusted private infrastructure with no diff here to review. On
any ci-workflows pin bump, diff `inputs.runner.default` between the old and
new commit before merging.
Loading