ci: Make Linux CI runners configurable and split macOS legs into disable-able workflows. - #2445
Open
jackluo923 wants to merge 2 commits into
Open
ci: Make Linux CI runners configurable and split macOS legs into disable-able workflows.#2445jackluo923 wants to merge 2 commits into
jackluo923 wants to merge 2 commits into
Conversation
…-able workflows Replace hard-coded self-hosted runner selectors with 4 repo vars GH_RUNNER_LINUX_[HEAVY|LIGHT]_[X64|ARM64]. Every Linux runs-on is `fromJSON(vars.X || '["<github-hosted>"]')`, so unset vars (upstream before config, or any fork) fall back to GitHub-hosted unchanged; no more repository_owner special-casing. The vars are named GH_RUNNER_LINUX_* (the LINUX segment scopes them to Linux legs; macOS is never overridden) and the HEAVY values include a "docker" label so artifact-build routes to the DinD-capable runners. The 4 macOS+Linux matrix workflows (clp-uv-checks, clp-lint, clp-docs, clp-s-generated-code-checks) are split into Linux-only originals plus new *-macos.yaml siblings, each gated by `if: vars.GH_DISABLE_MACOS != 'true'` so a fork without macOS capacity can skip every macOS job via one repo var (job-level if can't see the matrix context, hence the split). clp-core-build-macos gets the same gate. A skipped required check counts as success for branch protection; the var is opt-out (unset = macOS runs, so upstream and forks are unaffected). package-image is split into package-image-amd64 + package-image-arm64 (arm64 main-only via a plain if:); each depends only on its own arch's deps image (the old single matrix needed both), and package-image-multiarch-manifest still gates the release tag on both arches. Categorization by core-benefit: HEAVY_X64 = artifact-build x86 + clp-docs-generated-code-checks (release Rust codegen); HEAVY_ARM64 = package-image-arm64; LIGHT_X64 = lint/docs/s-gen/uv-checks/helm/pr-title/rust-checks; LIGHT_ARM64 = arm64 deps-images (network-bound). rust-checks stays on LIGHT_X64 because tests:rust-all starts LocalStack on 127.0.0.1, broken on self-hosted runners. Validated: yamllint clean; actionlint only the pre-existing SC2046 chown warnings on the runner-images#6775 workaround step.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
WalkthroughThe pull request configures GitHub Actions runner selection, separates amd64 and arm64 artifact packaging, and adds macOS workflows for documentation, linting, generated-code checks, and uv validation. ChangesArtifact build architecture flow
Linux and macOS workflow execution
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant DependencyImageJobs
participant PackageImageAmd64
participant PackageImageArm64
participant MultiArchManifest
DependencyImageJobs->>PackageImageAmd64: provide amd64 dependency image
DependencyImageJobs->>PackageImageArm64: provide arm64 dependency image
PackageImageAmd64->>MultiArchManifest: complete amd64 package image
PackageImageArm64->>MultiArchManifest: complete arm64 package image
MultiArchManifest->>MultiArchManifest: publish multi-architecture manifest
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/clp-artifact-build.yaml:
- Around line 785-787: Update the conditions controlling package-image-arm64 and
package-image-multiarch-manifest so successful, non-cancelled release-tag refs
(refs/tags/<release>) are permitted alongside the existing main-branch path;
apply this change at both .github/workflows/clp-artifact-build.yaml lines
785-787 and 830-834, preserving the existing exclusions for cancelled or failed
runs.
- Around line 752-780: The package-image-amd64 job currently exposes
GITHUB_TOKEN to the pull-request-controlled clp-build-runtime-image action.
Remove the image_registry_username and image_registry_password inputs from this
PR job, configure its permissions as read-only, and retain registry credentials
only in the trusted main-only publish job while preserving the runtime image
build behavior.
In @.github/workflows/clp-docs-macos.yaml:
- Around line 16-25: Restrict the documentation workflow permissions to
contents: read and update the actions/checkout step to set persist-credentials
to false. Apply these changes to the workflow containing the build-macos job,
preserving its existing LFS and recursive submodule settings.
In @.github/workflows/clp-lint-macos.yaml:
- Around line 22-24: Add top-level permissions restricting contents to read in
.github/workflows/clp-lint-macos.yaml,
.github/workflows/clp-s-generated-code-checks-macos.yaml, and
.github/workflows/clp-uv-checks-macos.yaml; in each workflow’s checkout step,
set persist-credentials to false while preserving recursive submodule checkout.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: f20dfe61-dd22-4b0a-8ded-1efed1f0c46a
📒 Files selected for processing (14)
.github/workflows/clp-artifact-build.yaml.github/workflows/clp-core-build-macos.yaml.github/workflows/clp-docs-generated-code-checks.yaml.github/workflows/clp-docs-macos.yaml.github/workflows/clp-docs.yaml.github/workflows/clp-lint-macos.yaml.github/workflows/clp-lint.yaml.github/workflows/clp-package-helm.yaml.github/workflows/clp-pr-title-checks.yaml.github/workflows/clp-rust-checks.yaml.github/workflows/clp-s-generated-code-checks-macos.yaml.github/workflows/clp-s-generated-code-checks.yaml.github/workflows/clp-uv-checks-macos.yaml.github/workflows/clp-uv-checks.yaml
3 tasks
jackluo923
changed the title
…flows.
Applies the repository's existing hardening idiom to the four macOS workflows added by this branch: a workflow-level `permissions: {}` deny-all, a job-level `contents: "read"` grant for checkout, and `persist-credentials: false` so the token is not left in `.git/config` for subsequent steps.
jackluo923
force-pushed
the
ci-configurable-runners
branch
from
August 3, 2026 00:25
27dad11 to
dbe5341
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Replaces the hard-coded
github.repository_owner == 'y-scope'runner selector with four repository variablesGH_RUNNER_LINUX_[HEAVY|LIGHT]_[X64|ARM64], so any repo with self-hosted capacity can opt in without forking the workflows. Unset variables fall back to the previous GitHub-hosted runners, so behavior is unchanged for forks and for upstream before configuration.*-macos.yamlsiblings, each gated byif: vars.GH_DISABLE_MACOS != 'true'(opt-out: unset = macOS runs).clp-core-build-macosgets the same gate.package-imageis split intopackage-image-amd64+package-image-arm64(arm64 main-only);package-image-multiarch-manifeststill gates the release tag on both arches.Status: WIP — opened as draft while the upstream run validates self-hosted routing.
Checklist
Validation performed
SC2046warnings on thechownrunner-images workaround step).clp-artifact-buildandclp-core-build-macosstill running — to be confirmed once complete.Summary by CodeRabbit
New Features
Improvements