Skip to content

Run selftest pull requests on GitHub-hosted runners #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cshuttle merged 1 commit into from
Oct 3, 2026
Merged

Run selftest pull requests on GitHub-hosted runners #72

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions .github/workflows/selftest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
# CI for this repo itself. It is the supply-chain root for every cshuttle/* repo
# (the reusable workflows here + the shared Lefthook config in lefthook/), so a
# bad edit breaks them all — validate before it merges. See issue #4.
#
# Pull requests run on GitHub-hosted runners; pushes stay on arc-workflows.
# This repo is PUBLIC, so a pull_request run can carry a stranger's code from a
# fork, and the arc-workflows runner is a pod on the production cluster with
# sudo (cshuttle/Monitoring#1285). Nothing here needs the LAN — every job is
# apt, a GitHub release download, or a local check — so the hosted runner
# tests exactly the same thing. Hosted minutes are free on a public repo, so
# the estate's zero-ubuntu-latest billing rule does not apply. A push can only
# come from someone with write access, which is why it keeps the ARC runner.
name: selftest

on:
Expand All @@ -12,7 +21,7 @@ permissions:

jobs:
lefthook-config:
runs-on: arc-workflows
runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-latest' || 'arc-workflows' }}
env:
LEFTHOOK_VERSION: 2.1.9
steps:
Expand All @@ -39,7 +48,7 @@ jobs:
( cd "$tmp" && lefthook validate )

actionlint:
runs-on: arc-workflows
runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-latest' || 'arc-workflows' }}
env:
ACTIONLINT_VERSION: 1.7.12
steps:
Expand All @@ -53,7 +62,7 @@ jobs:
./actionlint -shellcheck= -color

komodo-pin:
runs-on: arc-workflows
runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-latest' || 'arc-workflows' }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- name: unit-test the komodo-pin script
Expand All @@ -65,7 +74,7 @@ jobs:
run: python3 tests/test_komodo_pin.py

playwright-pin:
runs-on: arc-workflows
runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-latest' || 'arc-workflows' }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- name: renovate annotation and lockstep upstream agree
Expand All @@ -82,7 +91,7 @@ jobs:
[ -n "$ann" ] && [ "$ann" = "$const" ] || { echo "renovate annotation and lockstep upstream disagree in $wf"; exit 1; }

shellcheck:
runs-on: arc-workflows
runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-latest' || 'arc-workflows' }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- name: shellcheck shared scripts
Expand Down
Loading