fix(ci): route release pipeline Linux jobs to the ECS runner pool

.github/workflows/.size-baseline

@@ -46,7 +46,7 @@
 22037 release-sdk-python.yml
 19094 release-sdk.yml
 14546 release-vscode-companion.yml
-39291 release.yml
+45677 release.yml
 43717 repo-hygiene.yml
 1079 scorecard-monthly.yml
 10691 sdk-java.yml

.github/workflows/release.yml

@@ -41,7 +41,10 @@ on:
 jobs:
   prepare:
     name: 'Prepare Release Metadata'
-    runs-on: 'ubuntu-latest'
+    # Route to the ECS self-hosted pool like the review/CI lanes; the
+    # MAINTAINER_ECS_RUNNER_DISABLED repo variable restores the hosted
+    # ubuntu-latest fallback without a code change.
+    runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
     if: |-
       ${{ github.repository == 'QwenLM/qwen-code' }}
     permissions:
@@ -56,6 +59,22 @@ jobs:
       is_dry_run: '${{ steps.vars.outputs.is_dry_run }}'
 
     steps:
+      # Shared ECS runners can retain root-owned files from an earlier
+      # containerized job. Restore the reusable workspace before checkout.
+      - name: 'Restore workspace ownership'
+        run: |-
+          set -uo pipefail
+          RUNNER_UID="$(id -u)"
+          RUNNER_GID="$(id -g)"
+          if [ "$RUNNER_UID" != "0" ]; then
+            chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace ownership; checkout may fail on leftover root-owned files"
+          fi
+          chmod -R u+rwX "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chmod -R u+rwX "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace write permissions; checkout may fail on leftover read-only files"
+          # Release jobs do not need cross-job workspace reuse. Remove every
+          # persisted entry, including planted .git config/hooks/attributes,
+          # before actions/checkout runs with release credentials.
+          find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +
+
       - name: 'Checkout'
         uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
         with:
@@ -145,7 +164,10 @@ jobs:
 
   quality:
     name: 'Quality Checks'
-    runs-on: 'ubuntu-latest'
+    # Route to the ECS self-hosted pool like the review/CI lanes; the
+    # MAINTAINER_ECS_RUNNER_DISABLED repo variable restores the hosted
+    # ubuntu-latest fallback without a code change.
+    runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
     needs: 'prepare'
     if: |-
       ${{ github.event.inputs.force_skip_tests != 'true' }}
@@ -157,6 +179,22 @@ jobs:
       OPENAI_MODEL: '${{ secrets.OPENAI_MODEL }}'
 
     steps:
+      # Shared ECS runners can retain root-owned files from an earlier
+      # containerized job. Restore the reusable workspace before checkout.
+      - name: 'Restore workspace ownership'
+        run: |-
+          set -uo pipefail
+          RUNNER_UID="$(id -u)"
+          RUNNER_GID="$(id -g)"
+          if [ "$RUNNER_UID" != "0" ]; then
+            chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace ownership; checkout may fail on leftover root-owned files"
+          fi
+          chmod -R u+rwX "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chmod -R u+rwX "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace write permissions; checkout may fail on leftover read-only files"
+          # Release jobs do not need cross-job workspace reuse. Remove every
+          # persisted entry, including planted .git config/hooks/attributes,
+          # before actions/checkout runs with release credentials.
+          find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +
+
       - name: 'Checkout'
         uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
         with:
@@ -207,7 +245,10 @@ jobs:
 
   integration_none:
     name: 'Integration Tests (No Sandbox)'
-    runs-on: 'ubuntu-latest'
+    # Route to the ECS self-hosted pool like the review/CI lanes; the
+    # MAINTAINER_ECS_RUNNER_DISABLED repo variable restores the hosted
+    # ubuntu-latest fallback without a code change.
+    runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
     needs: 'prepare'
     if: |-
       ${{ github.event.inputs.force_skip_tests != 'true' }}
@@ -219,6 +260,22 @@ jobs:
       OPENAI_MODEL: '${{ secrets.OPENAI_MODEL }}'
 
     steps:
+      # Shared ECS runners can retain root-owned files from an earlier
+      # containerized job. Restore the reusable workspace before checkout.
+      - name: 'Restore workspace ownership'
+        run: |-
+          set -uo pipefail
+          RUNNER_UID="$(id -u)"
+          RUNNER_GID="$(id -g)"
+          if [ "$RUNNER_UID" != "0" ]; then
+            chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace ownership; checkout may fail on leftover root-owned files"
+          fi
+          chmod -R u+rwX "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chmod -R u+rwX "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace write permissions; checkout may fail on leftover read-only files"
+          # Release jobs do not need cross-job workspace reuse. Remove every
+          # persisted entry, including planted .git config/hooks/attributes,
+          # before actions/checkout runs with release credentials.
+          find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +
+
       - name: 'Checkout'
         uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
         with:
@@ -258,7 +315,10 @@ jobs:
 
   integration_docker:
     name: 'Integration Tests (Docker)'
-    runs-on: 'ubuntu-latest'
+    # Route to the ECS self-hosted pool like the review/CI lanes; the
+    # MAINTAINER_ECS_RUNNER_DISABLED repo variable restores the hosted
+    # ubuntu-latest fallback without a code change.
+    runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
     needs: 'prepare'
     if: |-
       ${{ github.event.inputs.force_skip_tests != 'true' }}
@@ -270,6 +330,29 @@ jobs:
       OPENAI_MODEL: '${{ secrets.OPENAI_MODEL }}'
 
     steps:
+      # Shared ECS runners can retain root-owned files from an earlier
+      # containerized job. Restore the reusable workspace before checkout.
+      - name: 'Restore workspace ownership'
+        run: |-
+          set -uo pipefail
+          RUNNER_UID="$(id -u)"
+          RUNNER_GID="$(id -g)"
+          if [ "$RUNNER_UID" != "0" ]; then
+            chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace ownership; checkout may fail on leftover root-owned files"
+          fi
+          chmod -R u+rwX "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chmod -R u+rwX "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace write permissions; checkout may fail on leftover read-only files"
+          # Release jobs do not need cross-job workspace reuse. Remove every
+          # persisted entry, including planted .git config/hooks/attributes,
+          # before actions/checkout runs with release credentials.
+          find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +
+
+      - name: 'Check docker daemon'
+        run: |-
+          if ! docker info > /dev/null 2>&1; then
+            echo "::error::docker daemon is not reachable on this runner; docker integration tests cannot run."
+            exit 1
+          fi
+
       - name: 'Checkout'
         uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
         with:
@@ -327,7 +410,10 @@ jobs:
 
   publish:
     name: 'Publish Release'
-    runs-on: 'ubuntu-latest'
+    # Route to the ECS self-hosted pool like the review/CI lanes; the
+    # MAINTAINER_ECS_RUNNER_DISABLED repo variable restores the hosted
+    # ubuntu-latest fallback without a code change.
+    runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
     needs:
       - 'prepare'
       - 'quality'
@@ -384,6 +470,22 @@ jobs:
       pull-requests: 'write'
 
     steps:
+      # Shared ECS runners can retain root-owned files from an earlier
+      # containerized job. Restore the reusable workspace before checkout.
+      - name: 'Restore workspace ownership'
+        run: |-
+          set -uo pipefail
+          RUNNER_UID="$(id -u)"
+          RUNNER_GID="$(id -g)"
+          if [ "$RUNNER_UID" != "0" ]; then
+            chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace ownership; checkout may fail on leftover root-owned files"
+          fi
+          chmod -R u+rwX "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chmod -R u+rwX "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace write permissions; checkout may fail on leftover read-only files"
+          # Release jobs do not need cross-job workspace reuse. Remove every
+          # persisted entry, including planted .git config/hooks/attributes,
+          # before actions/checkout runs with release credentials.
+          find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +
+
       - name: 'Checkout'
         uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
         with:
@@ -747,7 +849,10 @@ jobs:
 
   notify_failure:
     name: 'Notify Release Failure'
-    runs-on: 'ubuntu-latest'
+    # Route to the ECS self-hosted pool like the review/CI lanes; the
+    # MAINTAINER_ECS_RUNNER_DISABLED repo variable restores the hosted
+    # ubuntu-latest fallback without a code change.
+    runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
     needs:
       - 'prepare'
       - 'quality'

scripts/tests/release-workflow.test.js

@@ -9,8 +9,10 @@ import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { describe, expect, it } from 'vitest';
+import { parse } from 'yaml';
 
 const workflow = readFileSync('.github/workflows/release.yml', 'utf8');
+const releaseYaml = parse(workflow);
 const cuaReleaseWorkflow = readFileSync(
   '.github/workflows/cd-cua-driver.yml',
   'utf8',
@@ -80,6 +82,54 @@ describe('CUA release workflow', () => {
 });
 
 describe('release workflow', () => {
+  it('cleans every shared ECS workspace before checkout', () => {
+    const checkoutJobs = Object.entries(releaseYaml.jobs).filter(([, job]) =>
+      (job.steps ?? []).some((step) =>
+        String(step.uses ?? '').includes('actions/checkout'),
+      ),
+    );
+    const cleanupCopies = [];
+
+    expect(checkoutJobs.map(([id]) => id)).toEqual([
+      'prepare',
+      'quality',
+      'integration_none',
+      'integration_docker',
+      'publish',
+    ]);
+    for (const [id, job] of checkoutJobs) {
+      const checkoutIndex = job.steps.findIndex((step) =>
+        String(step.uses ?? '').includes('actions/checkout'),
+      );
+      const restoreIndex = job.steps.findIndex(
+        (step) => step.name === 'Restore workspace ownership',
+      );
+      const cleanup = job.steps[restoreIndex]?.run;
+      expect(restoreIndex, id).toBeGreaterThanOrEqual(0);
+      expect(restoreIndex, id).toBeLessThan(checkoutIndex);
+      expect(cleanup, id).toContain(
+        'find "$GITHUB_WORKSPACE" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +',
+      );
+      cleanupCopies.push(cleanup);
+    }
+    for (const copy of cleanupCopies.slice(1)) {
+      expect(copy).toBe(cleanupCopies[0]);
+    }
+  });
+
+  it('checks docker availability before the docker checkout', () => {
+    const steps = releaseYaml.jobs.integration_docker.steps;
+    const preflightIndex = steps.findIndex(
+      (step) => step.name === 'Check docker daemon',
+    );
+    const checkoutIndex = steps.findIndex((step) =>
+      String(step.uses ?? '').includes('actions/checkout'),
+    );
+    expect(preflightIndex).toBeGreaterThanOrEqual(0);
+    expect(preflightIndex).toBeLessThan(checkoutIndex);
+    expect(steps[preflightIndex].run).toContain('docker info');
+  });
+
   it('fires the fleet-moving npm-published dispatch on stable releases only', () => {
     // This gate is the sole protection keeping a nightly/preview/dry-run
     // release from moving the ECS fleet; the triggered update workflow