ci: move ubuntu-latest jobs to VPS verification runners - #64
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
📝 WalkthroughWalkthroughThe CI verification and secret-scan workflows now run on the self-hosted ChangesCI runner migration
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c97c728b34
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| jobs: | ||
| verify: | ||
| runs-on: ubuntu-latest | ||
| runs-on: [self-hosted, linux, x64, vps-verify] |
There was a problem hiding this comment.
Because this job still runs on pull_request, it checks out PR-controlled content and executes it through npm ci and npm test on the repo-scoped VPS. A malicious contributor can change package lifecycle/test scripts to compromise the persistent runner host, then retain access to later trusted jobs or other resources available from that VPS. Keep untrusted PR jobs on GitHub-hosted runners, or use an isolated ephemeral runner that is destroyed after each job and reserve this VPS label for trusted branches.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 10: Add vps-verify to the actionlint runner-label allowlist in the
repository’s .github/actionlint.yaml configuration, preserving the existing
allowed labels. Verify the online runner exposes all four labels and supports
Node 24, Chromium installation, npm network access, and the Wrangler dry run.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 50d81044-0f8d-4ee0-88ec-6396c3d116ab
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/secret-scan.yml
| jobs: | ||
| verify: | ||
| runs-on: ubuntu-latest | ||
| runs-on: [self-hosted, linux, x64, vps-verify] |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n 'runs-on|vps-verify' .github/workflows/ci.yml .github/workflows/secret-scan.yml
config_files="$(fd -HI -t f -g 'actionlint.yaml' -g 'actionlint.yml' . || true)"
if [[ -z "$config_files" ]]; then
echo "No actionlint configuration found" >&2
else
while IFS= read -r file; do
rg -n 'vps-verify|runner-label' "$file"
done <<< "$config_files"
fi
repo="$(gh repo view --json nameWithOwner --jq '.nameWithOwner')"
matches="$(
gh api "repos/${repo}/actions/runners" --paginate --jq '
.runners[]
| select(.status == "online")
| ([.labels[].name] | sort) as $labels
| select(($labels | index("self-hosted")) != null)
| select(($labels | index("linux")) != null)
| select(($labels | index("x64")) != null)
| select(($labels | index("vps-verify")) != null)
| {name, busy, labels: $labels}
'
)"
test -n "$matches"
printf '%s\n' "$matches"Repository: nish3451/TinyStudio.io
Length of output: 476
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- workflow files ---'
for file in .github/workflows/ci.yml .github/workflows/secret-scan.yml; do
if [[ -f "$file" ]]; then
echo "--- $file ---"
cat -n "$file"
fi
done
printf '%s\n' '--- actionlint configuration candidates ---'
find . -maxdepth 4 -type f \( -iname 'actionlint.yaml' -o -iname 'actionlint.yml' -o -iname '.actionlint.yaml' -o -iname '.actionlint.yml' \) -print
printf '%s\n' '--- runner-label references ---'
rg -n -i 'actionlint|runner-label|vps-verify|runs-on' .github . 2>/dev/null | head -200 || true
printf '%s\n' '--- available actionlint ---'
if command -v actionlint >/dev/null 2>&1; then
actionlint -version
else
echo 'actionlint is not installed'
fiRepository: nish3451/TinyStudio.io
Length of output: 2419
🌐 Web query:
actionlint custom self-hosted runner label unknown allowlist configuration
💡 Result:
To resolve "unknown runner label" errors in actionlint for self-hosted runners, you must define your custom labels in a configuration file, typically named.github/actionlint.yaml [1][2][3]. When actionlint encounters a runner label that is not a standard GitHub-hosted label or a predefined self-hosted runner preset, it flags the label as unknown [4][2]. To fix this, create or update the.github/actionlint.yaml file in your repository with the following structure [1][5]: self-hosted-runner: labels: - your-custom-label-1 - your-custom-label-2 Actionlint supports glob syntax (using path.Match) within this labels list, allowing you to match multiple labels using patterns if needed [1][6]. Alternatively, if you cannot define the labels in a configuration file, you can ignore the errors via the command line or within the config file's paths section using regular expressions [7][8][6]. Using the command line: actionlint -ignore 'label ".+" is unknown' Using the configuration file (.github/actionlint.yaml): paths:.github/workflows/*.yaml: ignore: - 'label ".+" is unknown' The configuration file approach is generally recommended as it specifically whitelists your custom runner environment without suppressing other potential label-related errors [3][5].
Citations:
- 1: https://github.com/rhysd/actionlint/blob/main/docs/config.md
- 2: https://github.com/rhysd/actionlint/blob/main/README.md
- 3: https://github.com/akin-ozer/cc-devops-skills/blob/main/devops-skills-plugin/skills/github-actions-validator/references/runners.md
- 4: https://github.com/rhysd/actionlint/blob/main/rule_runner_label.go
- 5: [CI] Add issue/PR pytest command workflow fla-org/flash-linear-attention#843
- 6: https://github.com/rhysd/actionlint/blob/v1.7.12/docs/config.md
- 7: https://github.com/rhysd/actionlint/blob/v1.7.11/docs/usage.md
- 8: https://github.com/rhysd/actionlint/blob/main/docs/usage.md
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- actionlint output ---'
actionlint .github/workflows/ci.yml .github/workflows/secret-scan.yml || true
printf '%s\n' '--- project toolchain and browser requirements ---'
for file in package.json package-lock.json .nvmrc .node-version README.md; do
if [[ -f "$file" ]]; then
echo "--- $file ---"
rg -n -i 'node|npm|playwright|chromium|wrangler|engine|browser|render-blocking' "$file" | head -160 || true
fi
done
printf '%s\n' '--- workflow and runner documentation ---'
rg -n -i 'runner|self-hosted|vps-verify|node 24|chromium|wrangler|npm ci|playwright' \
--glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' . | head -240 || trueRepository: nish3451/TinyStudio.io
Length of output: 23822
Add an actionlint allowlist for vps-verify.
Both workflows fail actionlint because vps-verify is unknown. Add it to .github/actionlint.yaml. Confirm that an online runner has all four labels and supports Node 24, Chromium installation, npm network access, and the Wrangler dry run.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 10-10: label "vps-verify" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2025-vs2026", "windows-2022", "windows-11-arm", "ubuntu-slim", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xlarge", "macos-latest-large", "macos-26-intel", "macos-26-xlarge", "macos-26-large", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xlarge", "macos-14-large", "macos-14", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 10, Add vps-verify to the actionlint
runner-label allowlist in the repository’s .github/actionlint.yaml
configuration, preserving the existing allowed labels. Verify the online runner
exposes all four labels and supports Node 24, Chromium installation, npm network
access, and the Wrangler dry run.
Source: Linters/SAST tools
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
Corrective revert of the fleet auto-merge of #64; restores the explicit do-not-merge state.
1 participant
Summary
Validation
Merge note
Merge once GitHub billing is fixed. The runners are already online, so checks will run immediately after.