ci(ts): move all workflows to ubuntu-latest (LAB-3503) - #122
Conversation
cachekit-ts is public and forkable but every job ran on the org-shared, privileged self-hosted ARC pool (runs-on: cachekit / cachekit-lean) gated only by an in-workflow fork-guard ternary, a control a fork PR can simply delete since it runs the fork's own copy of the workflow. Ray ratified moving all public lanes off the pool onto GitHub-hosted ubuntu-latest (LAB-1161 stage 1, option a+c); the real server-side control (scoping the runner group away from public repos) is staged behind this as stage 2. - Collapse every fork-guard runs-on ternary in ci.yml/build-wasm.yml to a literal ubuntu-latest; fix build-native.yml matrix generator and test job matrix to stop emitting cachekit-lean; delete now-dead self-hosted- only steps and stale comments. - Add a self-hosted-drift-guard job (ci.yml) that fails CI if any runs-on/matrix runner value in .github/workflows/ still names cachekit/cachekit-lean/self-hosted, maintainer drift protection, not a fork-PR control (documented as such; that's stage 2's job). - Add hosted caching (cache: pnpm, Swatinem/rust-cache) since the pool's warm hostPath cache disappears on ephemeral GitHub-hosted runners. - Extract .github/actions/setup-pnpm-node as a composite action for the 10 identical Install-pnpm/Setup-Node call sites this change touched. Reviewed by expert panel (bug-hunter-supreme, security-specialist, code-craftsman, catchphrase-agent): fixed the drift guard's case- sensitivity gap, documented its remaining heuristic limits, dropped a low- value rust-cache step from the rarely-run build-wasm.yml, and collapsed a vestigial single-value matrix axis in build-native.yml test job.
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueNo actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (4)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour. WalkthroughThe PR adds a shared pnpm and Node.js action, moves workflows to Ubuntu-hosted runners, adds Rust caching, and introduces a guard that detects self-hosted runner references before CI reports success. ChangesCI standardisation
Priority: ➖ Normal Estimated code review effort: 3 (Moderate) | ~25 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to The hosted-runner migration and drift guard have no identified merge-blocking risk. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Kody Review CompleteGreat news! 🎉 Keep up the excellent work! 🚀 Kody Guide: Usage and ConfigurationInteracting with Kody
Current Kody ConfigurationReview OptionsThe following review options are enabled or disabled:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
![kodus-27b[bot]](https://avatars.githubusercontent.com/u/223823690?s=60&v=4){kind=small}
…3503) Comment-only, plus one step name. The drift-guard rationale named org runner settings that do not belong in a public repository; the public reason is simply that a public, forkable repo runs only on GitHub-hosted runners. No behaviour change.
7210b33
1 participant
Summary
This PR migrates all CI/CD workflows from self-hosted runners (
cachekit-lean,cachekit) to GitHub-hostedubuntu-latestrunners across the TypeScript repository.Key Changes
Runner Migration
cachekit-lean,cachekit) withubuntu-latestinci.yml,build-native.yml, andbuild-wasm.yml.github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'cachekit-lean'), since all jobs now uniformly useubuntu-latest.RUSTUP_HOME/CARGO_HOMEpaths, which were only needed for the locked-down self-hosted pods.New Composite Action
.github/actions/setup-pnpm-node/action.ymlthat installs pnpm and Node.js (with pnpm store caching) in the correct order. This consolidates the repeated pnpm + Node.js setup steps that previously appeared in every job.Rust Build Caching
Swatinem/rust-cachesteps to the native build and workers jobs to cache Rust build artifacts. This compensates for the loss of persistent state that the self-hosted runners previously provided.Drift Guard
self-hosted-drift-guardjob that scans.github/workflows/for any lingering self-hosted runner references (cachekit/self-hosted) and fails the build if found. This prevents accidental reintroduction of self-hosted runners on main/push. The job is wired into theci-successgate.Build Matrix Updates
build-native.yml, thex86_64-unknown-linux-gnutarget now builds onubuntu-latestinstead ofcachekit-lean, and the test matrix was simplified to remove the OS dimension.Why
This migration removes the dependency on self-hosted infrastructure, simplifying the CI configuration (no more fork/internal branching logic or manual Rust path setup) while adding explicit build caching and a drift guard to maintain performance and prevent regressions.