[WomB0ComB0]

Routes this repo's safe CI/bot jobs to the self-hosted runner via the standard USE_SELF_HOSTED toggle (GitHub-hosted runners are billing-blocked).

Files toggled:

• ci.yml (2 jobs)
• conventional-title-labeler.yml (1 job)
• dependency-licences.yml (1 job)
• label-sync.yml (1 job)
• labeler.yml (1 job)
• pr-size-labeler.yml (1 job)

Safety: only lines that were exactly runs-on: ubuntu-latest were changed — build/test/lint/docs/gate/bot jobs that need only public HTTPS. Release/publish/deploy/CodeQL/Docker-publish/Windows/matrix/agentic workflows were left hosted (needs-care or cannot-move on a Linux/non-root/egress-restricted runner). Merge on green — no --admin.

Note: the rust job here delegates to the SHA-pinned .github/rust-ci reusable, so its runner moves via the .github PR + a SHA bump — not via this file. This PR toggles only the repo's own hardcoded jobs + bots.

[github-actions]

Audit Summary

The changes correctly implement conditional routing to self-hosted runners using the USE_SELF_HOSTED repository variable. The logic used (runs-on: ${{ vars.USE_SELF_HOSTED == true && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}) is sound and provides a safe fallback to GitHub-hosted runners when the variable is not set.

Security Observations

• Self-hosted Runner Risks: Since this is a public repository, using self-hosted runners for pull_request events can be risky as it allows code from forks to execute on your infrastructure. Ensure that the zima runners are properly isolated and ephemeral, or consider restricting self-hosted runners to internal PRs only.

Logic & Consistency Issues

• Oversight in ci.yml: The rust job in .github/workflows/ci.yml was not updated to use the self-hosted runner. As this is likely the most resource-intensive job (running tests, clippy, and fmt), it should probably be routed to the self-hosted infrastructure as well to maximize the benefit of this change.
• Missing Workflows: Other workflows like .github/workflows/security.yml and several maintenance workflows still default to ubuntu-latest. While some are automatically generated, manual consistency across the primary CI/CD pipelines is recommended.

Hardware Label

• Runner Labels: The zima label is used across all updated workflows. Confirm that all self-hosted runners in the pool are correctly tagged with this specific label to avoid job stickiness or scheduling failures.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

Generated by ai-auditor for issue #83 · ◷