ci: migrate 12 of 24 workflow jobs to smithy self-hosted runners (#97)

rust-cpu     rivet-validate, validate, benchmark, self-optimization
               (ci.yml); fuzz (fuzz.yml); test-shared, test-workspace,
               integration-test, check-api-stability (validate-shared.yml)
  light        format (ci.yml); coverage (fuzz.yml);
               verify-architecture (validate-shared.yml)
  lean-mem     (none)

Stays on ubuntu-latest:
  - clippy            sudo apt-get install z3 (not on smithy)
  - test              matrix spans macOS + Windows
  - build             matrix spans macOS + Windows
  - coverage          sudo rm -rf to free disk space
  - verify            sudo apt-get install z3 (not on smithy)
  - wasm-build        sudo mkdir/tar to install wasi-sdk into /opt
  - rocq-proofs       Nix + Bazel (out of scope per playbook)
  - differential      sudo apt-get install binaryen (not on smithy)
  - build-native      matrix spans macOS + Windows (release.yml)
  - build-wasm        sudo for wasi-sdk install (release.yml)
  - release           sudo mv for oras + Cosign OIDC keyless (release.yml)
  - format-and-lint   sudo apt-get install z3 (validate-shared.yml)

No new workarounds beyond those already documented in
smithy/docs/migration-playbook.md. All migrated jobs are clean
runs-on: changes only.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: avrabe

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ env:
 jobs:
   rivet-validate:
     name: Rivet Artifact Traceability
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, rust-cpu]
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -35,7 +35,7 @@ jobs:
 
   format:
     name: Format
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, light]
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -46,6 +46,8 @@ jobs:
 
   clippy:
     name: Clippy
+    # Stays on ubuntu-latest: requires `sudo apt-get install z3`; Z3 is not
+    # provisioned on smithy hosts. Migrate once smithy ships z3 in toolchains.
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -62,6 +64,7 @@ jobs:
 
   test:
     name: Test
+    # Stays on ubuntu-latest: matrix spans macOS + Windows; smithy is Linux-only.
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -76,6 +79,7 @@ jobs:
 
   build:
     name: Build
+    # Stays on ubuntu-latest: matrix spans macOS + Windows; smithy is Linux-only.
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -96,7 +100,7 @@ jobs:
 
   validate:
     name: Validate WebAssembly Output
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, rust-cpu]
     needs: build
     steps:
       - uses: actions/checkout@v4
@@ -165,6 +169,9 @@ jobs:
 
   coverage:
     name: Code Coverage
+    # Stays on ubuntu-latest: uses `sudo rm -rf` to free disk space on the
+    # GitHub-hosted image. Could migrate by dropping the free-disk step
+    # (smithy has plenty of disk via lv_runners) but leaving as-is for now.
     runs-on: ubuntu-latest
     steps:
       - name: Free disk space
@@ -192,7 +199,7 @@ jobs:
 
   benchmark:
     name: Benchmarks
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, rust-cpu]
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -206,6 +213,8 @@ jobs:
 
   verify:
     name: Z3 Verification Build
+    # Stays on ubuntu-latest: requires `sudo apt-get install z3`; Z3 is not
+    # provisioned on smithy hosts. Migrate once smithy ships z3.
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -264,6 +273,8 @@ jobs:
 
   wasm-build:
     name: WASM Build (wasm32-wasip2 with Z3)
+    # Stays on ubuntu-latest: installs wasi-sdk into /opt with sudo mkdir/tar.
+    # Could migrate by extracting into $HOME, but skipping until needed.
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -302,7 +313,7 @@ jobs:
 
   self-optimization:
     name: Self-Optimization Test
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, rust-cpu]
     needs: [build, wasm-build]
     steps:
       - uses: actions/checkout@v4
@@ -349,6 +360,8 @@ jobs:
 
   rocq-proofs:
     name: Rocq Formal Proofs
+    # Stays on ubuntu-latest: requires Nix + Bazel; both are out-of-scope for
+    # smithy phase 1 (see migration playbook "What's currently out of scope").
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
@@ -370,6 +383,8 @@ jobs:
 
   differential:
     name: Differential Testing (vs wasm-opt)
+    # Stays on ubuntu-latest: requires `sudo apt-get install binaryen`;
+    # binaryen/wasm-opt is not provisioned on smithy hosts.
     runs-on: ubuntu-latest
     needs: [build]
     steps:

.github/workflows/fuzz.yml

@@ -35,7 +35,7 @@ env:
 jobs:
   fuzz:
     name: Fuzz ${{ matrix.target }}
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, rust-cpu]
     strategy:
       fail-fast: false
       matrix:
@@ -105,7 +105,7 @@ jobs:
 
   coverage:
     name: Fuzzing coverage report
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, light]
     needs: fuzz
     if: always()
 

.github/workflows/release.yml

@@ -21,6 +21,7 @@ env:
 jobs:
   build-native:
     name: Build Native (${{ matrix.os }})
+    # Stays on ubuntu-latest: matrix spans macOS + Windows; smithy is Linux-only.
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -75,6 +76,7 @@ jobs:
 
   build-wasm:
     name: Build WASM (wasm32-wasip2)
+    # Stays on ubuntu-latest: installs wasi-sdk into /opt with sudo mkdir/tar.
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -110,6 +112,8 @@ jobs:
   release:
     name: Create Release
     needs: [build-native, build-wasm]
+    # Stays on ubuntu-latest: uses `sudo mv` for oras install plus Cosign
+    # OIDC keyless signing tied to GitHub-hosted runner identity.
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/validate-shared.yml

@@ -13,7 +13,7 @@ on:
 jobs:
   test-shared:
     name: Test loom-shared
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, rust-cpu]
 
     steps:
       - name: Checkout code
@@ -56,7 +56,7 @@ jobs:
 
   test-workspace:
     name: Test Full Workspace
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, rust-cpu]
     needs: test-shared
 
     steps:
@@ -100,7 +100,7 @@ jobs:
 
   integration-test:
     name: Integration Testing
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, rust-cpu]
     needs: test-workspace
 
     steps:
@@ -149,7 +149,7 @@ jobs:
 
   check-api-stability:
     name: Check API Stability
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, rust-cpu]
 
     steps:
       - name: Checkout code
@@ -172,6 +172,8 @@ jobs:
 
   format-and-lint:
     name: Format and Lint
+    # Stays on ubuntu-latest: clippy step requires `sudo apt-get install z3`;
+    # Z3 is not provisioned on smithy hosts.
     runs-on: ubuntu-latest
 
     steps:
@@ -196,7 +198,7 @@ jobs:
 
   verify-architecture:
     name: Verify Architecture
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, light]
 
     steps:
       - name: Checkout code