ci: move workflows to repository runners

Author: apstenku123

.github/workflows/ci-self-hosted.yml

@@ -36,7 +36,8 @@ jobs:
             tests/test_pack_enriched_rows.py \
             tests/test_streaming_conveyor_progress.py \
             tests/test_process_commits_fail_loud.py \
-            tests/test_repair_packed_document_boundaries.py
+            tests/test_repair_packed_document_boundaries.py \
+            tests/test_workflow_runner_policy.py
           git diff --check
 
   linux-portable:
@@ -62,6 +63,7 @@ jobs:
             tests/test_data_package_imports.py \
             tests/test_streaming_conveyor_progress.py \
             tests/test_process_commits_fail_loud.py \
-            tests/test_repair_packed_document_boundaries.py
+            tests/test_repair_packed_document_boundaries.py \
+            tests/test_workflow_runner_policy.py
           python -m compileall -q scripts tools/clang_indexer
           git diff --check

.github/workflows/e2e-matrix.yml

@@ -27,11 +27,11 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # On every push/PR: smoke matrix (912 cells, ubuntu, no real MLX
-  # training — backend just verifies). Quick gate, ~10 min.
+  # On every push/PR: smoke matrix (912 cells). The backend imports MLX, so
+  # this runs on the repository's persistent Apple Silicon runner.
   preset-matrix:
-    name: Preset matrix (smoke, ubuntu)
-    runs-on: ubuntu-latest
+    name: Preset matrix (smoke, self-hosted macOS)
+    runs-on: [self-hosted, macOS, ARM64, cppmega-mlx-macos]
     timeout-minutes: 25
     strategy:
       fail-fast: false
@@ -47,6 +47,8 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.13"
+      - name: Bind E2E backend to the selected Python
+        run: echo "VBGUI_E2E_PYTHON=$(command -v python)" >> "$GITHUB_ENV"
       - name: Python deps
         run: |
           python -m pip install --upgrade pip
@@ -63,7 +65,7 @@ jobs:
           npm run typecheck
       - name: Playwright browsers
         working-directory: vbgui
-        run: npx playwright install --with-deps chromium
+        run: npx playwright install chromium
       - name: Run preset matrix shard ${{ matrix.shard }}/4
         working-directory: vbgui
         env:
@@ -87,7 +89,7 @@ jobs:
   # Specialised + canvas smoke scenarios — run on every push (lightweight).
   specialised:
     name: Specialised + canvas smoke
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64, cppmega-mlx-macos]
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
@@ -96,6 +98,8 @@ jobs:
                 cache-dependency-path: vbgui/package-lock.json }
       - uses: actions/setup-python@v5
         with: { python-version: "3.13" }
+      - name: Bind E2E backend to the selected Python
+        run: echo "VBGUI_E2E_PYTHON=$(command -v python)" >> "$GITHUB_ENV"
       - run: |
           python -m pip install --upgrade pip
           pip install -e ".[gui,parquet,widget]"
@@ -107,7 +111,7 @@ jobs:
           npm ci
           npm run typecheck
       - working-directory: vbgui
-        run: npx playwright install --with-deps chromium
+        run: npx playwright install chromium
       - working-directory: vbgui
         env: { NODE_ENV: development, CI: "1" }
         run: |
@@ -131,7 +135,7 @@ jobs:
   mini-train-matrix:
     name: Mini-train matrix (macOS, nightly)
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: macos-latest
+    runs-on: [self-hosted, macOS, ARM64, cppmega-mlx-macos]
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
@@ -140,6 +144,8 @@ jobs:
                 cache-dependency-path: vbgui/package-lock.json }
       - uses: actions/setup-python@v5
         with: { python-version: "3.13" }
+      - name: Bind E2E backend to the selected Python
+        run: echo "VBGUI_E2E_PYTHON=$(command -v python)" >> "$GITHUB_ENV"
       - run: |
           python -m pip install --upgrade pip
           pip install -e ".[gui,parquet,widget]"
@@ -151,7 +157,7 @@ jobs:
           npm ci
           npm run typecheck
       - working-directory: vbgui
-        run: npx playwright install --with-deps chromium
+        run: npx playwright install chromium
       - working-directory: vbgui
         env: { NODE_ENV: development, CI: "1" }
         run: |
@@ -172,7 +178,7 @@ jobs:
   matrix-report:
     name: Matrix report
     needs: [preset-matrix, specialised]
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     if: always()
     steps:
       - uses: actions/checkout@v4

.github/workflows/gemini-dispatch.yml

@@ -26,7 +26,7 @@ jobs:
   debugger:
     if: |-
       ${{ fromJSON(vars.GEMINI_DEBUG || vars.ACTIONS_STEP_DEBUG || false) }}
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     permissions:
       contents: 'read'
     steps:
@@ -58,7 +58,7 @@ jobs:
         startsWith(github.event.comment.body || github.event.review.body || github.event.issue.body, '@gemini-cli') &&
         contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association || github.event.review.author_association || github.event.issue.author_association)
       )
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     permissions:
       contents: 'read'
       issues: 'write'
@@ -190,7 +190,7 @@ jobs:
       - 'plan-execute'
     if: |-
       ${{ always() && !cancelled() && (failure() || needs.dispatch.outputs.command == 'fallthrough') }}
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     permissions:
       contents: 'read'
       issues: 'write'

.github/workflows/gemini-invoke.yml

@@ -18,7 +18,7 @@ defaults:
 
 jobs:
   invoke:
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     permissions:
       contents: 'read'
       id-token: 'write'

.github/workflows/gemini-plan-execute.yml

@@ -19,7 +19,7 @@ defaults:
 jobs:
   plan-execute:
     timeout-minutes: 30
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     permissions:
       contents: 'write'
       id-token: 'write'

.github/workflows/gemini-review.yml

@@ -18,7 +18,7 @@ defaults:
 
 jobs:
   review:
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     timeout-minutes: 7
     permissions:
       contents: 'read'

.github/workflows/gemini-scheduled-triage.yml

@@ -27,7 +27,7 @@ defaults:
 
 jobs:
   triage:
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     timeout-minutes: 7
     permissions:
       contents: 'read'
@@ -136,7 +136,7 @@ jobs:
           prompt: '/gemini-scheduled-triage'
 
   label:
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     needs:
       - 'triage'
     if: |-

.github/workflows/gemini-triage.yml

@@ -18,7 +18,7 @@ defaults:
 
 jobs:
   triage:
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     timeout-minutes: 7
     outputs:
       available_labels: '${{ steps.get_labels.outputs.available_labels }}'
@@ -100,7 +100,7 @@ jobs:
           prompt: '/gemini-triage'
 
   label:
-    runs-on: 'ubuntu-latest'
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     needs:
       - 'triage'
     if: |-

.github/workflows/vbgui-pages.yml

@@ -27,7 +27,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     steps:
       - uses: actions/checkout@v4
 
@@ -75,7 +75,7 @@ jobs:
 
   deploy:
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, cppmega-mlx]
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

tests/test_workflow_runner_policy.py

@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+HOSTED_RUNNER = re.compile(
+    r"^\s*runs-on:\s*.*(?:ubuntu|macos|windows)-latest\s*$",
+    re.MULTILINE,
+)
+
+
+def test_workflows_do_not_use_github_hosted_runners() -> None:
+    violations = []
+    for workflow in sorted((REPO_ROOT / ".github" / "workflows").glob("*.yml")):
+        if HOSTED_RUNNER.search(workflow.read_text(encoding="utf-8")):
+            violations.append(workflow.relative_to(REPO_ROOT).as_posix())
+
+    assert not violations, f"GitHub-hosted runners are forbidden: {violations}"