ci: move workflows to repository runners

apstenku123 · apstenku123 · commit ada15bc4d5da · 2026-07-13T23:24:54.000+02:00
diff --git a/.github/workflows/ci-self-hosted.yml b/.github/workflows/ci-self-hosted.yml
@@ -36,7 +36,8 @@ jobs:
             tests/test_pack_enriched_rows.py \
             tests/test_streaming_conveyor_progress.py \
             tests/test_process_commits_fail_loud.py \
-            tests/test_repair_packed_document_boundaries.py
+            tests/test_repair_packed_document_boundaries.py \
+            tests/test_workflow_runner_policy.py
           git diff --check
 
   linux-portable:
@@ -62,6 +63,7 @@ jobs:
             tests/test_data_package_imports.py \
             tests/test_streaming_conveyor_progress.py \
             tests/test_process_commits_fail_loud.py \
-            tests/test_repair_packed_document_boundaries.py
+            tests/test_repair_packed_document_boundaries.py \
+            tests/test_workflow_runner_policy.py
           python -m compileall -q scripts tools/clang_indexer
           git diff --check
diff --git a/.github/workflows/e2e-matrix.yml b/.github/workflows/e2e-matrix.yml
@@ -27,11 +27,11 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # On every push/PR: smoke matrix (912 cells, ubuntu, no real MLX
-  # training — backend just verifies). Quick gate, ~10 min.
+  # On every push/PR: smoke matrix (912 cells). The backend imports MLX, so
+  # this runs on the repository's persistent Apple Silicon runner.
   preset-matrix:
-    name: Preset matrix (smoke, ubuntu)
-    runs-on: ubuntu-latest
+    name: Preset matrix (smoke, self-hosted macOS)
+    runs-on: [self-hosted, macOS, ARM64, cppmega-mlx-macos]
     timeout-minutes: 25
     strategy:
       fail-fast: false
@@ -44,16 +44,19 @@ jobs:
           node-version: "22"
           cache: "npm"
           cache-dependency-path: vbgui/package-lock.json
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.13"
+      - name: Bind repository MLX Python
+        run: |
+          python_bin=/Volumes/external/sources/cppmega.mlx/.venv/bin/python
+          test -x "$python_bin"
+          echo "VBGUI_E2E_PYTHON=$python_bin" >> "$GITHUB_ENV"
       - name: Python deps
         run: |
-          python -m pip install --upgrade pip
-          pip install -e ".[gui,parquet,widget]"
-          pip install jsonschema pyarrow tokenizers anywidget
+          "$VBGUI_E2E_PYTHON" -m pip install --upgrade pip
+          "$VBGUI_E2E_PYTHON" -m pip install -e ".[gui,parquet,widget]"
+          "$VBGUI_E2E_PYTHON" -m pip install jsonschema pyarrow tokenizers anywidget
       - name: Generate fixtures
-        run: python tests/fixtures/build_e2e_matrix.py
+        run: |
+          "$VBGUI_E2E_PYTHON" tests/fixtures/build_e2e_matrix.py
       - name: Vbgui install + typecheck
         working-directory: vbgui
         env:
@@ -63,7 +66,7 @@ jobs:
           npm run typecheck
       - name: Playwright browsers
         working-directory: vbgui
-        run: npx playwright install --with-deps chromium
+        run: npx playwright install chromium
       - name: Run preset matrix shard ${{ matrix.shard }}/4
         working-directory: vbgui
         env:
@@ -87,27 +90,31 @@ jobs:
   # Specialised + canvas smoke scenarios — run on every push (lightweight).
   specialised:
     name: Specialised + canvas smoke
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64, cppmega-mlx-macos]
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with: { node-version: "22", cache: "npm",
                 cache-dependency-path: vbgui/package-lock.json }
-      - uses: actions/setup-python@v5
-        with: { python-version: "3.13" }
+      - name: Bind repository MLX Python
+        run: |
+          python_bin=/Volumes/external/sources/cppmega.mlx/.venv/bin/python
+          test -x "$python_bin"
+          echo "VBGUI_E2E_PYTHON=$python_bin" >> "$GITHUB_ENV"
+      - run: |
+          "$VBGUI_E2E_PYTHON" -m pip install --upgrade pip
+          "$VBGUI_E2E_PYTHON" -m pip install -e ".[gui,parquet,widget]"
+          "$VBGUI_E2E_PYTHON" -m pip install jsonschema pyarrow tokenizers anywidget
       - run: |
-          python -m pip install --upgrade pip
-          pip install -e ".[gui,parquet,widget]"
-          pip install jsonschema pyarrow tokenizers anywidget
-      - run: python tests/fixtures/build_e2e_matrix.py
+          "$VBGUI_E2E_PYTHON" tests/fixtures/build_e2e_matrix.py
       - working-directory: vbgui
         env: { NODE_ENV: development }
         run: |
           npm ci
           npm run typecheck
       - working-directory: vbgui
-        run: npx playwright install --with-deps chromium
+        run: npx playwright install chromium
       - working-directory: vbgui
         env: { NODE_ENV: development, CI: "1" }
         run: |
@@ -131,27 +138,31 @@ jobs:
   mini-train-matrix:
     name: Mini-train matrix (macOS, nightly)
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: macos-latest
+    runs-on: [self-hosted, macOS, ARM64, cppmega-mlx-macos]
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with: { node-version: "22", cache: "npm",
                 cache-dependency-path: vbgui/package-lock.json }
-      - uses: actions/setup-python@v5
-        with: { python-version: "3.13" }
+      - name: Bind repository MLX Python
+        run: |
+          python_bin=/Volumes/external/sources/cppmega.mlx/.venv/bin/python
+          test -x "$python_bin"
+          echo "VBGUI_E2E_PYTHON=$python_bin" >> "$GITHUB_ENV"
+      - run: |
+          "$VBGUI_E2E_PYTHON" -m pip install --upgrade pip
+          "$VBGUI_E2E_PYTHON" -m pip install -e ".[gui,parquet,widget]"
+          "$VBGUI_E2E_PYTHON" -m pip install jsonschema pyarrow tokenizers anywidget mlx mlx-lm
       - run: |
-          python -m pip install --upgrade pip
-          pip install -e ".[gui,parquet,widget]"
-          pip install jsonschema pyarrow tokenizers anywidget mlx mlx-lm
-      - run: python tests/fixtures/build_e2e_matrix.py
+          "$VBGUI_E2E_PYTHON" tests/fixtures/build_e2e_matrix.py
       - working-directory: vbgui
         env: { NODE_ENV: development }
         run: |
           npm ci
           npm run typecheck
       - working-directory: vbgui
-        run: npx playwright install --with-deps chromium
+        run: npx playwright install chromium
       - working-directory: vbgui
         env: { NODE_ENV: development, CI: "1" }
         run: |
@@ -172,7 +183,7 @@ jobs:
   matrix-report:
     name: Matrix report
     needs: [preset-matrix, specialised]
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     if: always()
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/gemini-dispatch.yml b/.github/workflows/gemini-dispatch.yml
@@ -26,7 +26,7 @@ jobs:
   debugger:
     if: |-
       ${{ fromJSON(vars.GEMINI_DEBUG || vars.ACTIONS_STEP_DEBUG || false) }}
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     permissions:
       contents: 'read'
     steps:
@@ -58,7 +58,7 @@ jobs:
         startsWith(github.event.comment.body || github.event.review.body || github.event.issue.body, '@gemini-cli') &&
         contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association || github.event.review.author_association || github.event.issue.author_association)
       )
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     permissions:
       contents: 'read'
       issues: 'write'
@@ -190,7 +190,7 @@ jobs:
       - 'plan-execute'
     if: |-
       ${{ always() && !cancelled() && (failure() || needs.dispatch.outputs.command == 'fallthrough') }}
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     permissions:
       contents: 'read'
       issues: 'write'
diff --git a/.github/workflows/gemini-invoke.yml b/.github/workflows/gemini-invoke.yml
@@ -18,7 +18,7 @@ defaults:
 
 jobs:
   invoke:
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     permissions:
       contents: 'read'
       id-token: 'write'
diff --git a/.github/workflows/gemini-plan-execute.yml b/.github/workflows/gemini-plan-execute.yml
@@ -19,7 +19,7 @@ defaults:
 jobs:
   plan-execute:
     timeout-minutes: 30
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     permissions:
       contents: 'write'
       id-token: 'write'
diff --git a/.github/workflows/gemini-review.yml b/.github/workflows/gemini-review.yml
@@ -18,7 +18,7 @@ defaults:
 
 jobs:
   review:
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     timeout-minutes: 7
     permissions:
       contents: 'read'
diff --git a/.github/workflows/gemini-scheduled-triage.yml b/.github/workflows/gemini-scheduled-triage.yml
@@ -27,7 +27,7 @@ defaults:
 
 jobs:
   triage:
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     timeout-minutes: 7
     permissions:
       contents: 'read'
@@ -136,7 +136,7 @@ jobs:
           prompt: '/gemini-scheduled-triage'
 
   label:
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     needs:
       - 'triage'
     if: |-
diff --git a/.github/workflows/gemini-triage.yml b/.github/workflows/gemini-triage.yml
@@ -18,7 +18,7 @@ defaults:
 
 jobs:
   triage:
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     timeout-minutes: 7
     outputs:
       available_labels: '${{ steps.get_labels.outputs.available_labels }}'
@@ -100,7 +100,7 @@ jobs:
           prompt: '/gemini-triage'
 
   label:
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     needs:
       - 'triage'
     if: |-
diff --git a/.github/workflows/vbgui-pages.yml b/.github/workflows/vbgui-pages.yml
@@ -27,7 +27,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     steps:
       - uses: actions/checkout@v4
 
@@ -75,7 +75,7 @@ jobs:
 
   deploy:
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
diff --git a/tests/test_workflow_runner_policy.py b/tests/test_workflow_runner_policy.py
@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+HOSTED_RUNNER = re.compile(
+    r"^\s*runs-on:\s*.*(?:ubuntu|macos|windows)-latest\s*$",
+    re.MULTILINE,
+)
+
+
+def test_workflows_do_not_use_github_hosted_runners() -> None:
+    violations = []
+    for workflow in sorted((REPO_ROOT / ".github" / "workflows").glob("*.yml")):
+        if HOSTED_RUNNER.search(workflow.read_text(encoding="utf-8")):
+            violations.append(workflow.relative_to(REPO_ROOT).as_posix())
+
+    assert not violations, f"GitHub-hosted runners are forbidden: {violations}"
