Split-trust runner model: self-hosted for trusted triggers, GitHub-hosted for PRs - #1541
Merged
Merged
Conversation
JayVDZ
marked this pull request as ready for review
August 26, 2026 13:25
JayVDZ
enabled auto-merge (squash)
August 26, 2026 13:25
Rework of the all-workflows self-hosted switch. pull_request-triggered jobs (CI, CodeQL, changelog-lint) return to GitHub-hosted runners because fork PRs execute untrusted code; push/tag/schedule-triggered jobs (main builds, CodeQL scheduled scans, bench-sync, release) use the self-hosted runner. CI and CodeQL select the runner per-event with a runs-on expression. claude.yml returns to GitHub-hosted and gains an author_association gate so only owners, members and collaborators can trigger it. docs, publish-api-reference and regenerate-nuget-lock-files revert to GitHub-hosted unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
JayVDZ
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves trusted-trigger workflows to the self-hosted runner while keeping every workflow an outsider can trigger on GitHub-hosted VMs. Reworked from the original all-workflows switch: on a public repository,
pull_requestjobs execute code from anyone's fork, so they must never reach our infrastructure.Runner assignment
mainmain+ PRubuntu-latestubuntu-latest, otherwise self-hostedpull_request_target/ light push jobsubuntu-latest(reverted, no diff vsmain)ubuntu-latest(comment-triggered = untrusted), plus a newauthor_associationgate so only owners/members/collaborators can trigger itRequired org configuration (before merge is useful)
The runner group must:
TetronIO/JIM/.github/workflows/ci.yml@refs/heads/main,.../release.yml@refs/tags/*. This is the enforcement layer: a fork PR that rewritesruns-onstill cannot be assigned the runner, because its workflow runs from the PR merge ref, notmain.Also recommended: Settings → Actions → require approval for workflow runs from all outside collaborators.
Runner prerequisites
Docker engine and generous disk (release image builds; CI
services:containers on push events).Docs: n/a - CI/CD infrastructure change, no user-facing behaviour.
🤖 Generated with Claude Code