ci: move hosted-runner jobs to the VPS verification runner - #47
Conversation
GitHub-hosted runners fail at job start (account billing outage, known class). The repo-scoped hardened runner on netcup-rs2000 is online; route every hosted job at it, mirroring TinyStudio.io #66: no sudo (--with-deps dropped; Playwright OS deps preinstalled on the host) and gitleaks TMPDIR pinned to runner.temp inside the sandbox boundary.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
📝 WalkthroughWalkthroughThe CodeQL analyze and repo-checks jobs now run on the self-hosted ChangesWorkflow runner update
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f13285ff4d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| jobs: | ||
| repo-checks: | ||
| runs-on: ubuntu-latest | ||
| runs-on: [self-hosted, linux, x64, vps-verify] |
There was a problem hiding this comment.
When a forked pull request is approved, the unrestricted pull_request trigger checks out contributor-controlled code and npm run ci executes it on this persistent, repo-scoped VPS. A read-only token and lack of sudo do not isolate the runner account: malicious code can alter user-owned files or leave processes that affect later trusted jobs. Keep untrusted PRs on hosted or disposable runners, or explicitly prevent fork heads from using this runner.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 25: Create actionlint.yaml with a runner-label configuration declaring
vps-verify as a valid custom runner label. Ensure the self-hosted runner
configuration remains associated with all four labels: self-hosted, linux, x64,
and vps-verify.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: fb1d9ef0-6268-4f63-ae51-0ce2d4ab2181
📒 Files selected for processing (2)
.github/workflows/codeql.yml.github/workflows/codex-ci.yml
| if: ${{ github.event.repository.private == false || vars.ENABLE_PRIVATE_CODEQL == '1' }} | ||
| name: analyze javascript-typescript | ||
| runs-on: ubuntu-latest | ||
| runs-on: [self-hosted, linux, x64, vps-verify] |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
config="$(fd -HI -t f '^actionlint\.ya?ml$' . | head -n1 || true)"
if [ -z "$config" ]; then
echo "No actionlint configuration found"
else
rg -n -C3 'vps-verify|self-hosted' "$config" || true
fi
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/codeql.yml .github/workflows/codex-ci.yml
fiRepository: nish3451/tinystudio-in
Length of output: 2048
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/*' | sort
printf '%s\n' '--- runner-label/actionlint references ---'
rg -n -S 'runner-label|actionlint|vps-verify|runs-on' .github . 2>/dev/null | head -n 200
printf '%s\n' '--- workflow context ---'
for f in .github/workflows/codeql.yml .github/workflows/codex-ci.yml; do
if [ -f "$f" ]; then
echo "### $f"
cat -n "$f"
fi
doneRepository: nish3451/tinystudio-in
Length of output: 2301
Add the custom runner label to actionlint.
Create actionlint.yaml with a [runner-label] entry for vps-verify; actionlint currently reports this label in both workflows. Ensure a self-hosted runner has all four labels: self-hosted, linux, x64, and vps-verify.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 25-25: label "vps-verify" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2025-vs2026", "windows-2022", "windows-11-arm", "ubuntu-slim", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xlarge", "macos-latest-large", "macos-26-intel", "macos-26-xlarge", "macos-26-large", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xlarge", "macos-14-large", "macos-14", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 25, Create actionlint.yaml with a
runner-label configuration declaring vps-verify as a valid custom runner label.
Ensure the self-hosted runner configuration remains associated with all four
labels: self-hosted, linux, x64, and vps-verify.
Source: Linters/SAST tools
1 participant
GitHub-hosted jobs die at start (billing outage). The hardened repo-scoped VPS runner is online — this routes every hosted job at it, same shape as TinyStudio.io #66 (no sudo, gitleaks TMPDIR pinned to runner.temp).
Summary by CodeRabbit