Skip to content

ci: move hosted-runner jobs to the VPS verification runner #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nish3451 merged 1 commit into from
Aug 10, 2026
Merged

ci: move hosted-runner jobs to the VPS verification runner #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ jobs:
analyze:
if: ${{ github.event.repository.private == false || vars.ENABLE_PRIVATE_CODEQL == '1' }}
name: analyze javascript-typescript
runs-on: ubuntu-latest
runs-on: [self-hosted, linux, x64, vps-verify]

@coderabbitai coderabbitai Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

config="$(fd -HI -t f '^actionlint\.ya?ml$' . | head -n1 || true)"
if [ -z "$config" ]; then
  echo "No actionlint configuration found"
else
  rg -n -C3 'vps-verify|self-hosted' "$config" || true
fi

if command -v actionlint >/dev/null 2>&1; then
  actionlint .github/workflows/codeql.yml .github/workflows/codex-ci.yml
fi

Repository: nish3451/tinystudio-in

Length of output: 2048

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/*' | sort

printf '%s\n' '--- runner-label/actionlint references ---'
rg -n -S 'runner-label|actionlint|vps-verify|runs-on' .github . 2>/dev/null | head -n 200

printf '%s\n' '--- workflow context ---'
for f in .github/workflows/codeql.yml .github/workflows/codex-ci.yml; do
  if [ -f "$f" ]; then
    echo "### $f"
    cat -n "$f"
  fi
done

Repository: nish3451/tinystudio-in

Length of output: 2301

Add the custom runner label to actionlint.

Create actionlint.yaml with a [runner-label] entry for vps-verify; actionlint currently reports this label in both workflows. Ensure a self-hosted runner has all four labels: self-hosted, linux, x64, and vps-verify.

🧰 Tools
🪛 actionlint (1.7.12)

[error] 25-25: label "vps-verify" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2025-vs2026", "windows-2022", "windows-11-arm", "ubuntu-slim", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xlarge", "macos-latest-large", "macos-26-intel", "macos-26-xlarge", "macos-26-large", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xlarge", "macos-14-large", "macos-14", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file

(runner-label)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codeql.yml at line 25, Create actionlint.yaml with a
runner-label configuration declaring vps-verify as a valid custom runner label.
Ensure the self-hosted runner configuration remains associated with all four
labels: self-hosted, linux, x64, and vps-verify.

Source: Linters/SAST tools

steps:
- uses: actions/checkout@v7
- uses: github/codeql-action/init@v4
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/codex-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ concurrency:

jobs:
repo-checks:
runs-on: ubuntu-latest
runs-on: [self-hosted, linux, x64, vps-verify]

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep forked pull requests off the self-hosted runner

When a forked pull request is approved, the unrestricted pull_request trigger checks out contributor-controlled code and npm run ci executes it on this persistent, repo-scoped VPS. A read-only token and lack of sudo do not isolate the runner account: malicious code can alter user-owned files or leave processes that affect later trusted jobs. Keep untrusted PRs on hosted or disposable runners, or explicitly prevent fork heads from using this runner.

Useful? React with 👍 / 👎.

steps:
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
Expand Down