.github/workflows: Migrate workflows to Blacksmith runners (#1286)

* Migrate workflows to Blacksmith

* ci: pin Node 22 before bun install so better-sqlite3 builds on Blacksmith runners

The format, lint, typecheck, and desktop-smoke jobs relied on the runner's
default Node. On blacksmith-4vcpu-ubuntu-2404 that is v20.20.0, where
better-sqlite3's node-gyp fallback (no prebuilt binary matched for the
runner) crashes: node-gyp's undici calls webidl.markAsUncloneable, which
only exists in Node 22.10+. Pin Node 22 before `bun install`, matching the
existing test/e2e jobs that hit the same issue.

Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>

* ci: pin Node 22 for bun install in preview and pkg-pr-new Blacksmith jobs

Same better-sqlite3 node-gyp failure as the CI workflow: on
blacksmith-4vcpu-ubuntu-2404 the default node is v20.20.0, where
better-sqlite3's node-gyp fallback crashes (undici's webidl.markAsUncloneable
needs Node 22.10+). Pin Node 22 before `bun install` in preview.yml's deploy
job and pkg-pr-new.yml's publish job. The pkg-pr-new build-preview-binary
matrix job stays on GitHub-hosted runners and is unaffected.

Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>

---------

Co-authored-by: blacksmith-sh[bot] <157653362+blacksmith-sh[bot]@users.noreply.github.com>
Co-authored-by: RhysSullivan <rhys@rhyssullivan.com>
Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>

Author: 3 people

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ concurrency:
 jobs:
   format:
     name: Format
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 
@@ -29,13 +29,20 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-bun-1.3.11-
 
+      # No prebuilt better-sqlite3 binary matches this runner, so `bun install`
+      # builds it from source via node-gyp, whose undici needs Node 22.10+
+      # (webidl.markAsUncloneable). Pin the same runtime the test/e2e jobs use.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - run: bun install --frozen-lockfile
 
       - run: bun run format:check
 
   lint:
     name: Lint
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 
@@ -51,13 +58,20 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-bun-1.3.11-
 
+      # No prebuilt better-sqlite3 binary matches this runner, so `bun install`
+      # builds it from source via node-gyp, whose undici needs Node 22.10+
+      # (webidl.markAsUncloneable). Pin the same runtime the test/e2e jobs use.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - run: bun install --frozen-lockfile
 
       - run: bun run lint
 
   typecheck:
     name: Typecheck
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 
@@ -73,13 +87,20 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-bun-1.3.11-
 
+      # No prebuilt better-sqlite3 binary matches this runner, so `bun install`
+      # builds it from source via node-gyp, whose undici needs Node 22.10+
+      # (webidl.markAsUncloneable). Pin the same runtime the test/e2e jobs use.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - run: bun install --frozen-lockfile
 
       - run: bun run typecheck
 
   test:
     name: Test
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     env:
       TURBO_TEST_CONCURRENCY: 3
     steps:
@@ -130,7 +151,7 @@ jobs:
           - { target: cloud, shard: 7/8, shard-name: 7of8 }
           - { target: cloud, shard: 8/8, shard-name: 8of8 }
           - target: selfhost
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
@@ -191,7 +212,7 @@ jobs:
     # Skipped on pull_request: the local scenario boots a real `executor web`
     # plus a browser and is currently flaky on PRs. Still runs on push to main.
     if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
@@ -244,7 +265,7 @@ jobs:
 
   desktop-smoke:
     name: Desktop smoke build
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 
@@ -260,6 +281,13 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-bun-1.3.11-
 
+      # No prebuilt better-sqlite3 binary matches this runner, so `bun install`
+      # builds it from source via node-gyp, whose undici needs Node 22.10+
+      # (webidl.markAsUncloneable). Pin the same runtime the test/e2e jobs use.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - run: bun install --frozen-lockfile
 
       - name: Build web app
@@ -277,19 +305,17 @@ jobs:
 
   selfhost-docker-smoke:
     name: Self-host Docker image
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@v1
 
       - name: Build self-host image
-        uses: docker/build-push-action@v6
+        uses: useblacksmith/build-push-action@v2
         with:
           context: .
           file: apps/host-selfhost/Dockerfile
           push: false
           tags: executor-selfhost:ci
-          cache-from: type=gha
-          cache-to: type=gha,mode=max

.github/workflows/pkg-pr-new.yml

@@ -64,7 +64,7 @@ jobs:
   publish:
     name: Publish
     needs: build-preview-binary
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: read
       pull-requests: write
@@ -77,6 +77,13 @@ jobs:
         with:
           bun-version: 1.3.11
 
+      # No prebuilt better-sqlite3 binary matches this runner, so `bun install`
+      # builds it from source via node-gyp, whose undici needs Node 22.10+
+      # (webidl.markAsUncloneable). Pin the same runtime the CI jobs use.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - run: bun install --frozen-lockfile
 
       - name: Build executor preview wrapper

.github/workflows/preview-sweep.yml

@@ -19,7 +19,7 @@ permissions:
 jobs:
   sweep:
     name: Destroy previews for closed PRs
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/preview.yml

@@ -27,14 +27,21 @@ jobs:
   deploy:
     name: Deploy preview
     if: github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.11
 
+      # No prebuilt better-sqlite3 binary matches this runner, so `bun install`
+      # builds it from source via node-gyp, whose undici needs Node 22.10+
+      # (webidl.markAsUncloneable). Pin the same runtime the CI jobs use.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
       - run: bun install --frozen-lockfile
 
       - name: Deploy
@@ -82,7 +89,7 @@ jobs:
   teardown:
     name: Tear down preview
     if: github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/publish-desktop.yml

@@ -177,7 +177,7 @@ jobs:
 
   release:
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: write
 

.github/workflows/publish-executor-package.yml

@@ -21,7 +21,7 @@ concurrency:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       actions: write
       contents: write

.github/workflows/publish-selfhost-docker.yml

@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: read
       packages: write
@@ -86,8 +86,8 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@v1
 
       - name: Log in to GHCR
         uses: docker/login-action@v3
@@ -97,7 +97,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push self-host image
-        uses: docker/build-push-action@v6
+        uses: useblacksmith/build-push-action@v2
         with:
           context: .
           file: apps/host-selfhost/Dockerfile

.github/workflows/release.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       actions: write
       contents: write