ci: fix pinact usage

Signed-off-by: Patrick Stephens <pat@telemetryforge.io>

Author: patrick-stephens

.github/workflows/AGENTS.md

@@ -39,7 +39,6 @@ These labels on a PR enable additional jobs in `pr-build.yaml`:
 | `build-windows` | Builds Windows packages |
 | `build-macos` | Builds macOS packages |
 | `build-packages` | Builds all packages (linux + windows + macos) |
-| `build-self-hosted` | Uses self-hosted runners instead of Namespace runners |
 
 ## Composite Actions
 
@@ -145,15 +144,14 @@ env:
   LINUX_AMD_RUNNER: ${{ vars.LINUX_AMD_RUNNER || 'namespace-profile-ubuntu-latest' }}
   LINUX_AMD_LARGE_RUNNER: ${{ vars.LINUX_AMD_LARGE_RUNNER || 'namespace-profile-ubuntu-latest-4cpu-16gb' }}
   LINUX_ARM_RUNNER: ${{ vars.LINUX_ARM_RUNNER || 'namespace-profile-ubuntu-latest-arm' }}
+  LINUX_S390X_RUNNER: ${{ vars.LINUX_S390X_RUNNER || 'ubuntu-24.04-s390x' }}
 ```
 
 Then reference them in jobs:
 ```yaml
 runs-on: ${{ env.LINUX_AMD_RUNNER }}
 ```
 
-The `self-ubuntu-latest` label for self-hosted runners is always referenced as a literal string (it is not configurable via repo variables).
-
 **Note:** Keep runner label selection local to reusable (`call-*`) workflows to avoid caller/reusable propagation issues.
 
 ## Build Configuration

.github/workflows/README.md

@@ -165,7 +165,7 @@ The main CI/CD pipeline is split across three workflow files based on trigger co
 2. **build-image** - Builds multi-architecture container images (UBI and Debian-based)
 3. **build-linux** - Builds Linux packages for all release targets
 4. **build-windows** - Builds Windows packages
-5. **build-macos** - Builds macOS packages (currently disabled with `if: false`)
+5. **build-macos** - Builds macOS packages
 6. **test-containers** - Runs container tests including BATS and Kubernetes tests
 7. **test-packages** - Tests Linux packages on target distributions
 8. **staging-upload** - Signs packages (via `sign-packages` action) and uploads to GCS staging
@@ -187,7 +187,7 @@ The main CI/CD pipeline is split across three workflow files based on trigger co
 2. **build-image** - Builds multi-architecture container images (UBI and Debian-based)
 3. **build-linux** - Builds Linux packages for all release targets
 4. **build-windows** - Builds Windows packages
-5. **build-macos** - Builds macOS packages (currently disabled with `if: false`)
+5. **build-macos** - Builds macOS packages
 6. **copy-common-images** - Promotes release images to standard locations
 7. **release** - Creates GitHub release with signed artefacts, SBOMs, and uploads to GCS
 8. **update-docs** - Updates documentation with new version mappings
@@ -333,7 +333,7 @@ The main CI/CD pipeline is split across three workflow files based on trigger co
 
 - Automatic tag creation based on schedule
 - Different versioning for LTS (25.10.x) and mainline (vYY.M.W)
-- Finds last successful "Build and test" workflow run
+- Finds last successful "Branch Build and Test" workflow run
 - Validates tag doesn't already exist
 - Uses PAT to trigger downstream workflows
 - Dry-run support for testing
@@ -416,6 +416,8 @@ The main CI/CD pipeline is split across three workflow files based on trigger co
 - `linux-targets` - JSON array of Linux build targets (full set for PRs, reduced set for staging/releases)
 - `version` - The build version (from Dockerfile or git tag)
 - `oss-version` - The OSS (Fluent Bit) version from source/oss_version.txt
+- `ubi-image-base` - Canonical UBI image base (`ghcr.io/telemetryforge/agent/ubi`)
+- `debian-image-base` - Canonical Debian image base (`ghcr.io/telemetryforge/agent/debian`)
 
 **Usage Examples:**
 
@@ -471,10 +473,11 @@ get-metadata:
 
 **Jobs:**
 
-1. **build-ubi-single-arch-container-images** - Matrix-calls single-arch builds for UBI across selected platforms
-2. **build-debian-single-arch-container-images** - Matrix-calls single-arch builds for Debian across selected platforms
-3. **build-ubi-container-image-manifest-and-sign** - Invokes reusable manifest+sign workflow for UBI image
-4. **build-debian-container-image-manifest-and-sign** - Invokes reusable manifest+sign workflow for Debian image
+1. **resolve-image-bases** - Reuses metadata workflow outputs for canonical UBI and Debian image base names
+2. **build-ubi-single-arch-container-images** - Matrix-calls single-arch builds for UBI across selected platforms
+3. **build-debian-single-arch-container-images** - Matrix-calls single-arch builds for Debian across selected platforms
+4. **build-ubi-container-image-manifest-and-sign** - Invokes reusable manifest+sign workflow for UBI image
+5. **build-debian-container-image-manifest-and-sign** - Invokes reusable manifest+sign workflow for Debian image
 
 **Outputs:**
 
@@ -483,6 +486,7 @@ get-metadata:
 **Key Features:**
 
 - Multi-architecture support (AMD64, ARM64, s390x)
+- Canonical image base names sourced from metadata outputs
 - Separate UBI and Debian build chains so each manifest/sign job depends only on its own image digests
 - Explicit per-image manifest/sign calls (no matrix in orchestration layer)
 - Image signing with Cosign (key-based and OIDC)
@@ -858,15 +862,15 @@ sequenceDiagram
     BranchBuild->>BranchBuild: get-meta (release linux targets)
     BranchBuild->>BranchBuild: build-image (default platforms)
     BranchBuild->>Registry: Push signed multi-arch images
-    BranchBuild->>BranchBuild: build-linux + build-windows (+ build-macos if enabled)
+    BranchBuild->>BranchBuild: build-linux + build-windows + build-macos
     BranchBuild->>BranchBuild: test-containers + test-packages
     BranchBuild->>BranchBuild: staging-upload (sign packages)
     BranchBuild->>GCS: Upload staging artifacts
     BranchBuild->>BranchBuild: tests-complete
   else Tagged release context
     Tag->>RelBuild: Trigger release pipeline
     RelBuild->>RelBuild: get-meta (version from tag)
-    RelBuild->>RelBuild: build-image + build-linux + build-windows (+ build-macos if enabled)
+    RelBuild->>RelBuild: build-image + build-linux + build-windows + build-macos
     RelBuild->>Registry: copy-common-images
     RelBuild->>RelBuild: release job (SBOM, schema, tarballs, signing)
     RelBuild->>GCS: Upload release artifacts
@@ -880,12 +884,14 @@ sequenceDiagram
 sequenceDiagram
   participant Caller as Calling Workflow
   participant Multi as call-build-containers
+  participant Meta as call-get-metadata
   participant SingleUBI as call-build-container-single-arch (UBI)
   participant SingleDeb as call-build-container-single-arch (Debian)
   participant PerImage as call-build-container-manifest-and-sign
     participant Registry as GHCR
 
   Caller->>Multi: with version/ref/platforms/nightly-build-info
+  Multi->>Meta: Resolve canonical image base names
 
   par For each UBI platform
     Multi->>SingleUBI: Invoke single-arch reusable workflow
@@ -936,15 +942,15 @@ sequenceDiagram
     BuildLinux->>Artifacts: Upload package artifacts
     Branch->>TestPkgs: Test release linux target matrix
   else Tagged release context
-    Release->>BuildLinux: Build release linux targets
+    BranchBuild->>BranchBuild: build-linux + build-windows + build-macos
     BuildLinux->>Artifacts: Upload package artifacts
     Note over Release,TestPkgs: release-build.yaml does not run package tests
   end
 ```
 
 ### Auto Release Flow
 
-```mermaid
+    RelBuild->>RelBuild: build-image + build-linux + build-windows + build-macos
 sequenceDiagram
     participant Cron as Scheduled Trigger
   participant Manual as workflow_dispatch
@@ -1126,7 +1132,6 @@ The workflows support different runner types:
 - `namespace-profile-ubuntu-latest` - Namespace runners (4 vCPU, 8GB RAM)
 - `namespace-profile-ubuntu-latest-4cpu-16gb` - Larger Namespace runners
 - `namespace-profile-ubuntu-latest-arm` - ARM64 Namespace runners
-- `self-ubuntu-latest` - Self-hosted runners (when labeled)
 - `macos-15` - macOS Apple Silicon
 - `macos-15-intel` - macOS Intel
 - `windows-2025` - Windows Server 2025
@@ -1156,7 +1161,6 @@ Required secrets for workflows:
    - `build-linux` - Build Linux packages only
    - `build-windows` - Build Windows packages only
    - `build-macos` - Build macOS packages only
-   - `build-self-hosted` - Use self-hosted runners
 
 2. **Testing** - All changes should pass:
    - Unit tests with sanitizers

.github/workflows/call-build-containers.yaml

@@ -50,8 +50,7 @@ permissions:
   contents: read
 
 jobs:
-
-  # Required as reusable workflow calls cannot reference env variables from the calling workflow but can use outputs from dependent jobs. 
+  # Required as reusable workflow calls cannot reference env variables from the calling workflow but can use outputs from dependent jobs.
   # Instead we use the call-get-metadata.yaml workflow to resolve the canonical image base names and then pass them to the single-arch build jobs.
   resolve-image-bases:
     name: Resolve image base names

.github/workflows/call-get-metadata.yaml

@@ -35,10 +35,10 @@ on:
         value: ${{ jobs.get-metadata.outputs.oss-version }}
       ubi-image-base:
         description: The canonical base name for UBI container images.
-        value: 'ghcr.io/telemetryforge/agent/ubi'
+        value: "ghcr.io/telemetryforge/agent/ubi"
       debian-image-base:
         description: The canonical base name for Debian container images.
-        value: 'ghcr.io/telemetryforge/agent/debian'
+        value: "ghcr.io/telemetryforge/agent/debian"
 
 env:
   # Set once from repo variable or override here for testing

.github/workflows/release-build.yaml

@@ -137,7 +137,7 @@ jobs:
         run: mkdir -p output
         shell: bash
 
-      # Once https://github.com/rhysd/actionlint/issues/693 is resolved we should do these in parallel to speed up the release process. 
+      # Once https://github.com/rhysd/actionlint/issues/693 is resolved we should do these in parallel to speed up the release process.
       # For now we do them sequentially to avoid actionlint errors.
       - name: Sign packages
         # Only sign if at least one package build produced artefacts
@@ -299,7 +299,7 @@ jobs:
       pull-requests: write
       id-token: write
     name: Update documentation on release
-    uses: telemetryforge/documentation/.github/workflows/call-add-mapping-version.yaml@694143c942c2481eb49ccbaa99f9b6c13d25d84e
+    uses: telemetryforge/documentation/.github/workflows/call-add-mapping-version.yaml@main
     with:
       agent-version: ${{ needs.get-meta.outputs.version }}
       oss-version: ${{ needs.get-meta.outputs.oss-version }}

.pinact.yaml

@@ -7,3 +7,7 @@ files:
   - pattern: .github/actions/*/action.yml
   - pattern: .github/actions/*/action.yaml
   # Ignore everything else, e.g. actions in vendored libs under source
+
+ignore_actions:
+  - name: telemetryforge/.*
+    ref: main