ci: migrate workflows to tenki

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ env:
 jobs:
   lint-and-typecheck:
     name: Lint & Type Check
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-small-2c-4g
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -35,7 +35,7 @@ jobs:
 
   unit-tests:
     name: Unit Tests & Coverage
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-small-2c-4g
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -57,7 +57,7 @@ jobs:
 
   e2e-tests:
     name: E2E Integration Tests
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-small-2c-4g
     services:
       postgres:
         image: postgres:16-alpine
@@ -72,7 +72,6 @@ jobs:
           --health-interval 10s
           --health-timeout 5s
           --health-retries 5
-
       redis:
         image: redis:7-alpine
         ports:
@@ -82,7 +81,6 @@ jobs:
           --health-interval 10s
           --health-timeout 5s
           --health-retries 5
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -114,7 +112,7 @@ jobs:
   build-and-scan:
     name: Build & Security Scan
     needs: [lint-and-typecheck, unit-tests, e2e-tests]
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-small-2c-4g
     permissions:
       contents: read
       packages: write
@@ -180,4 +178,4 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-to: type=gha,mode=max

.github/workflows/deploy.yml

@@ -28,7 +28,7 @@ env:
 jobs:
   determine-env:
     name: Determine Target Environment
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-small-2c-4g
     outputs:
       target_env: ${{ steps.env-set.outputs.target_env }}
       image_tag: ${{ steps.env-set.outputs.image_tag }}
@@ -60,7 +60,7 @@ jobs:
   deploy:
     name: Deploy & Migrate
     needs: determine-env
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-small-2c-4g
     environment:
       name: ${{ needs.determine-env.outputs.target_env }}
 
@@ -128,4 +128,4 @@ jobs:
         run: |
           ENV="${{ needs.determine-env.outputs.target_env }}"
           echo "Deployment failed! Rolling back Helm release..."
-          helm rollback hwala-core -n "hwala-${ENV}"
+          helm rollback hwala-core -n "hwala-${ENV}"

.github/workflows/security.yml

@@ -4,11 +4,10 @@ on:
   schedule:
     - cron: '0 0 * * 0' # Every Sunday at midnight UTC
   workflow_dispatch:
-
 jobs:
   npm-audit:
     name: NPM Dependency Audit
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-small-2c-4g
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -23,7 +22,7 @@ jobs:
 
   codeql-sast:
     name: CodeQL Static Analysis (SAST)
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-small-2c-4g
     permissions:
       actions: read
       contents: read
@@ -45,7 +44,7 @@ jobs:
 
   container-cve-scan:
     name: Container CVE Vulnerability Scan
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-small-2c-4g
     permissions:
       security-events: write
 
@@ -69,4 +68,4 @@ jobs:
         if: always()
         with:
           sarif_file: 'trivy-security-audit.sarif'
-          category: 'weekly-trivy-scan'
+          category: 'weekly-trivy-scan'