feat: add runs-on input to all reusable workflows, default to homelab-runners

All reusable workflows now accept a runs-on input parameter so callers
can specify their runner. Defaults to homelab-runners to avoid consuming
paid GitHub Actions minutes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: samuelho-dev

.github/workflows/docker-build-push.yml

@@ -67,6 +67,11 @@ on:
         required: false
         type: boolean
         default: false
+      runs-on:
+        description: 'Runner label to execute the job on'
+        required: false
+        type: string
+        default: 'homelab-runners'
     secrets:
       registry-username:
         description: 'Registry username'
@@ -95,7 +100,7 @@ permissions:
 jobs:
   build:
     name: Build & Push Docker Image
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runs-on }}
     timeout-minutes: 30
     outputs:
       digest: ${{ steps.build.outputs.digest }}

.github/workflows/gitleaks-scan.yml

@@ -38,6 +38,11 @@ on:
         required: false
         type: string
         default: 'info'
+      runs-on:
+        description: 'Runner label to execute the job on'
+        required: false
+        type: string
+        default: 'homelab-runners'
     outputs:
       findings-count:
         description: 'Number of secrets found'
@@ -53,7 +58,7 @@ permissions:
 jobs:
   scan:
     name: Gitleaks Secret Scan
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runs-on }}
     timeout-minutes: 10
     outputs:
       findings: ${{ steps.count.outputs.findings }}

.github/workflows/helm-publish.yml

@@ -42,6 +42,11 @@ on:
         required: false
         type: boolean
         default: true
+      runs-on:
+        description: 'Runner label to execute the job on'
+        required: false
+        type: string
+        default: 'homelab-runners'
     secrets:
       registry-username:
         description: 'Registry username (defaults to github.actor)'
@@ -74,7 +79,7 @@ permissions:
 jobs:
   publish:
     name: Package & Publish Chart
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runs-on }}
     timeout-minutes: 15
     outputs:
       version: ${{ steps.chart-info.outputs.version }}

.github/workflows/sbom-generate.yml

@@ -38,6 +38,11 @@ on:
         required: false
         type: boolean
         default: true
+      runs-on:
+        description: 'Runner label to execute the job on'
+        required: false
+        type: string
+        default: 'homelab-runners'
     secrets:
       registry-username:
         description: 'Registry username (for private images)'
@@ -61,7 +66,7 @@ permissions:
 jobs:
   generate:
     name: Generate SBOM
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runs-on }}
     timeout-minutes: 15
     outputs:
       sbom-path: ${{ inputs.output-file }}

.github/workflows/sync-main-to-dev.yml

@@ -23,6 +23,11 @@ on:
         required: false
         type: string
         default: 'automated,sync'
+      runs-on:
+        description: 'Runner label to execute the job on'
+        required: false
+        type: string
+        default: 'homelab-runners'
     secrets:
       token:
         description: 'GitHub token with repo write access (falls back to GITHUB_TOKEN)'
@@ -42,7 +47,7 @@ permissions:
 jobs:
   sync:
     name: Sync ${{ inputs.source-branch }} to ${{ inputs.target-branch }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runs-on }}
     timeout-minutes: 10
     outputs:
       result: ${{ steps.result.outputs.result }}

.github/workflows/test.yaml

@@ -15,7 +15,7 @@ on:
 jobs:
   test-workflow-outputs:
     name: Test Docker Workflow Outputs
-    runs-on: ubuntu-latest
+    runs-on: homelab-runners
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/trivy-scan.yml

@@ -48,6 +48,11 @@ on:
         required: false
         type: string
         default: '10m'
+      runs-on:
+        description: 'Runner label to execute the job on'
+        required: false
+        type: string
+        default: 'homelab-runners'
     outputs:
       findings-count:
         description: 'Number of security findings'
@@ -63,7 +68,7 @@ permissions:
 jobs:
   scan:
     name: Trivy Security Scan
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runs-on }}
     timeout-minutes: 15
     outputs:
       findings: ${{ steps.scan.outputs.findings }}