From d61669df4ea332bde509eb8b147161ca0007db49 Mon Sep 17 00:00:00 2001 From: Anthony Ronning <101225832+AnthonyRonning@users.noreply.github.com> Date: Fri, 9 Oct 2026 20:17:38 +0000 Subject: [PATCH] ci: route upgraded Linux jobs to v2 runner pools --- .github/actionlint.yaml | 3 ++- .github/workflows/agent-ci.yml | 2 +- .github/workflows/agent-desktop-build.yml | 2 +- .github/workflows/android-build.yml | 4 ++-- .github/workflows/android-pr-build.yml | 2 +- .github/workflows/auth-pages-build.yml | 2 +- .github/workflows/auth-pages-ci.yml | 2 +- .github/workflows/desktop-build.yml | 6 +++--- .github/workflows/desktop-pr-build.yml | 4 ++-- .github/workflows/frontend-tests.yml | 2 +- .github/workflows/opensecret-eif-release.yml | 2 +- .github/workflows/opensecret-eif.yml | 4 ++-- .github/workflows/pages-preview-build.yml | 2 +- .github/workflows/release.yml | 18 +++++++++--------- .github/workflows/rust-tests.yml | 2 +- .github/workflows/web-build.yml | 6 +++--- scripts/ci/test_opensecret_workflows.py | 8 ++++---- services/opensecret/docs/nitro-deploy.md | 4 ++-- 18 files changed, 38 insertions(+), 37 deletions(-) diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml index 7b3273a38..eab888e53 100644 --- a/.github/actionlint.yaml +++ b/.github/actionlint.yaml @@ -1,4 +1,5 @@ # Custom labels also cover organization-configured GitHub-hosted larger runners. self-hosted-runner: labels: - - ubuntu-24.04-arm64-8core + - ubuntu-latest-8-cores-v2 + - ubuntu-24.04-arm64-8core-v2 diff --git a/.github/workflows/agent-ci.yml b/.github/workflows/agent-ci.yml index 2692a57d3..aed1a74ae 100644 --- a/.github/workflows/agent-ci.yml +++ b/.github/workflows/agent-ci.yml @@ -83,7 +83,7 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-latest, macos-26, windows-latest] + os: [ubuntu-latest-8-cores-v2, macos-26, windows-latest] steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: diff --git a/.github/workflows/agent-desktop-build.yml b/.github/workflows/agent-desktop-build.yml index 92970d59f..010512102 100644 --- a/.github/workflows/agent-desktop-build.yml +++ b/.github/workflows/agent-desktop-build.yml @@ -208,7 +208,7 @@ jobs: name: Linux AppImage (${{ matrix.variant }}) needs: changes if: ${{ always() && !cancelled() && ((github.event_name == 'pull_request' && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false')) || (github.repository == 'MaplePrivacyLabs/Maple' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch'))) }} - runs-on: ubuntu-latest + runs-on: ubuntu-latest-8-cores-v2 timeout-minutes: 120 strategy: fail-fast: false diff --git a/.github/workflows/android-build.yml b/.github/workflows/android-build.yml index c23034de9..44dee451d 100644 --- a/.github/workflows/android-build.yml +++ b/.github/workflows/android-build.yml @@ -18,7 +18,7 @@ jobs: environment: android-signing needs: changes if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.android != 'false') }} - runs-on: ubuntu-latest-8-cores + runs-on: ubuntu-latest-8-cores-v2 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 with: @@ -102,7 +102,7 @@ jobs: verify-android-artifacts: needs: build-android - runs-on: ubuntu-latest-8-cores + runs-on: ubuntu-latest-8-cores-v2 permissions: contents: read steps: diff --git a/.github/workflows/android-pr-build.yml b/.github/workflows/android-pr-build.yml index ff9d24e55..308fef1ff 100644 --- a/.github/workflows/android-pr-build.yml +++ b/.github/workflows/android-pr-build.yml @@ -14,7 +14,7 @@ jobs: build-android: needs: changes if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.android != 'false') }} - runs-on: ubuntu-latest + runs-on: ubuntu-latest-8-cores-v2 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 with: diff --git a/.github/workflows/auth-pages-build.yml b/.github/workflows/auth-pages-build.yml index eb5d68af4..8b94e344a 100644 --- a/.github/workflows/auth-pages-build.yml +++ b/.github/workflows/auth-pages-build.yml @@ -9,7 +9,7 @@ on: jobs: build: if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master' - runs-on: ubuntu-latest + runs-on: ubuntu-latest-8-cores-v2 timeout-minutes: 30 steps: - name: Checkout auth source diff --git a/.github/workflows/auth-pages-ci.yml b/.github/workflows/auth-pages-ci.yml index 667cfb5b6..59c955854 100644 --- a/.github/workflows/auth-pages-ci.yml +++ b/.github/workflows/auth-pages-ci.yml @@ -34,7 +34,7 @@ jobs: github.event_name == 'pull_request' || ((github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/master') - runs-on: ubuntu-latest + runs-on: ubuntu-latest-8-cores-v2 timeout-minutes: 30 env: SOURCE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml index 3f90949b7..2ccf2b3ac 100644 --- a/.github/workflows/desktop-build.yml +++ b/.github/workflows/desktop-build.yml @@ -90,7 +90,7 @@ jobs: environment: desktop-signing needs: changes if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.linux != 'false') }} - runs-on: ubuntu-latest-8-cores + runs-on: ubuntu-latest-8-cores-v2 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 with: @@ -167,7 +167,7 @@ jobs: verify-linux-desktop-artifacts: needs: - build-linux - runs-on: ubuntu-latest-8-cores + runs-on: ubuntu-latest-8-cores-v2 permissions: contents: read steps: @@ -341,7 +341,7 @@ jobs: verify-windows-desktop-artifacts: needs: - build-windows - runs-on: ubuntu-latest-8-cores + runs-on: ubuntu-latest-8-cores-v2 permissions: contents: read steps: diff --git a/.github/workflows/desktop-pr-build.yml b/.github/workflows/desktop-pr-build.yml index 129f42b5b..ee8233972 100644 --- a/.github/workflows/desktop-pr-build.yml +++ b/.github/workflows/desktop-pr-build.yml @@ -96,7 +96,7 @@ jobs: build-linux: needs: changes if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.linux != 'false') }} - runs-on: ubuntu-latest + runs-on: ubuntu-latest-8-cores-v2 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 with: @@ -222,7 +222,7 @@ jobs: verify-windows-artifacts: needs: - build-windows - runs-on: ubuntu-latest + runs-on: ubuntu-latest-8-cores-v2 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 with: diff --git a/.github/workflows/frontend-tests.yml b/.github/workflows/frontend-tests.yml index 50bdbc448..dfc2e7d32 100644 --- a/.github/workflows/frontend-tests.yml +++ b/.github/workflows/frontend-tests.yml @@ -31,7 +31,7 @@ on: jobs: test-frontend: - runs-on: ubuntu-latest + runs-on: ubuntu-latest-8-cores-v2 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 with: diff --git a/.github/workflows/opensecret-eif-release.yml b/.github/workflows/opensecret-eif-release.yml index 8dddf88b0..35d2c314c 100644 --- a/.github/workflows/opensecret-eif-release.yml +++ b/.github/workflows/opensecret-eif-release.yml @@ -39,7 +39,7 @@ jobs: name: Build and attest EIF (${{ inputs.environment }}) # Only the reviewed default branch can produce an approval candidate. if: github.ref == 'refs/heads/master' - runs-on: ubuntu-24.04-arm64-8core + runs-on: ubuntu-24.04-arm64-8core-v2 timeout-minutes: 180 permissions: contents: read diff --git a/.github/workflows/opensecret-eif.yml b/.github/workflows/opensecret-eif.yml index d0b062dae..2b11f8fa8 100644 --- a/.github/workflows/opensecret-eif.yml +++ b/.github/workflows/opensecret-eif.yml @@ -37,7 +37,7 @@ jobs: permissions: contents: read id-token: write - runs-on: ubuntu-24.04-arm64-8core + runs-on: ubuntu-24.04-arm64-8core-v2 timeout-minutes: 180 strategy: fail-fast: false @@ -152,7 +152,7 @@ jobs: permissions: contents: read id-token: write - runs-on: ubuntu-24.04-arm64-8core + runs-on: ubuntu-24.04-arm64-8core-v2 timeout-minutes: 180 strategy: fail-fast: false diff --git a/.github/workflows/pages-preview-build.yml b/.github/workflows/pages-preview-build.yml index 9b8db176b..bb2a44ba2 100644 --- a/.github/workflows/pages-preview-build.yml +++ b/.github/workflows/pages-preview-build.yml @@ -46,7 +46,7 @@ jobs: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) - runs-on: ubuntu-latest + runs-on: ubuntu-latest-8-cores-v2 timeout-minutes: 30 env: SOURCE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e9a0416c0..7a653b541 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -140,7 +140,7 @@ jobs: - platform: macos-26-xlarge nix_shell: ci artifact_prefix: macos - - platform: ubuntu-latest-8-cores + - platform: ubuntu-latest-8-cores-v2 nix_shell: desktop-linux artifact_prefix: linux @@ -172,7 +172,7 @@ jobs: # Ubuntu 24.04 restricts unprivileged user namespaces by default; linuxdeploy/AppImage # packaging uses bubblewrap and otherwise fails with "bwrap: setting up uid map: Permission denied". - name: Allow bubblewrap user namespaces - if: matrix.platform == 'ubuntu-latest-8-cores' + if: matrix.platform == 'ubuntu-latest-8-cores-v2' run: | set -euo pipefail if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then @@ -185,8 +185,8 @@ jobs: - name: Build Tauri desktop app run: nix develop --no-update-lock-file .#${{ matrix.nix_shell }} -c ./scripts/ci/desktop-release.sh env: - APPIMAGE_EXTRACT_AND_RUN: ${{ matrix.platform == 'ubuntu-latest-8-cores' && '1' || '' }} - NO_STRIP: ${{ matrix.platform == 'ubuntu-latest-8-cores' && 'true' || '' }} + APPIMAGE_EXTRACT_AND_RUN: ${{ matrix.platform == 'ubuntu-latest-8-cores-v2' && '1' || '' }} + NO_STRIP: ${{ matrix.platform == 'ubuntu-latest-8-cores-v2' && 'true' || '' }} TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} @@ -382,7 +382,7 @@ jobs: build-android: environment: android-signing needs: classify-app-release - runs-on: ubuntu-latest-8-cores + runs-on: ubuntu-latest-8-cores-v2 permissions: contents: write id-token: write @@ -570,7 +570,7 @@ jobs: build-web: needs: classify-app-release - runs-on: ubuntu-latest-8-cores + runs-on: ubuntu-latest-8-cores-v2 permissions: contents: write id-token: write @@ -764,7 +764,7 @@ jobs: needs: - classify-app-release - build-android - runs-on: ubuntu-latest-8-cores + runs-on: ubuntu-latest-8-cores-v2 permissions: contents: read steps: @@ -795,7 +795,7 @@ jobs: needs: - classify-app-release - build-tauri - runs-on: ubuntu-latest-8-cores + runs-on: ubuntu-latest-8-cores-v2 permissions: contents: read steps: @@ -856,7 +856,7 @@ jobs: needs: - classify-app-release - build-windows - runs-on: ubuntu-latest-8-cores + runs-on: ubuntu-latest-8-cores-v2 permissions: contents: read steps: diff --git a/.github/workflows/rust-tests.yml b/.github/workflows/rust-tests.yml index 5048c2dd4..7424241c2 100644 --- a/.github/workflows/rust-tests.yml +++ b/.github/workflows/rust-tests.yml @@ -43,7 +43,7 @@ on: jobs: rust-tests: - runs-on: ubuntu-latest + runs-on: ubuntu-latest-8-cores-v2 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 with: diff --git a/.github/workflows/web-build.yml b/.github/workflows/web-build.yml index 5bca81fc2..92900b9d4 100644 --- a/.github/workflows/web-build.yml +++ b/.github/workflows/web-build.yml @@ -32,7 +32,7 @@ on: jobs: build-web: if: github.event_name == 'pull_request' - runs-on: ubuntu-latest + runs-on: ubuntu-latest-8-cores-v2 steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 with: @@ -66,7 +66,7 @@ jobs: build-web-master: if: github.event_name == 'push' - runs-on: ubuntu-latest + runs-on: ubuntu-latest-8-cores-v2 permissions: contents: read id-token: write @@ -116,7 +116,7 @@ jobs: verify-web-master-artifact: if: github.event_name == 'push' needs: build-web-master - runs-on: ubuntu-latest + runs-on: ubuntu-latest-8-cores-v2 permissions: contents: read steps: diff --git a/scripts/ci/test_opensecret_workflows.py b/scripts/ci/test_opensecret_workflows.py index c189039dd..e81f1e9ab 100644 --- a/scripts/ci/test_opensecret_workflows.py +++ b/scripts/ci/test_opensecret_workflows.py @@ -89,9 +89,9 @@ def test_jobs_are_hosted_with_read_only_contents_and_scoped_oidc(self): expected_runner = "ubuntu-latest" if name == "opensecret-eif.yml": expected_runner = { - "eif-candidate": "ubuntu-24.04-arm64-8core", + "eif-candidate": "ubuntu-24.04-arm64-8core-v2", "eif": "ubuntu-24.04-arm", - "eif-trusted": "ubuntu-24.04-arm64-8core", + "eif-trusted": "ubuntu-24.04-arm64-8core-v2", }[job_name] elif (name, job_name) == ("opensecret-ci.yml", "helpers"): expected_runner = "ubuntu-24.04-arm" @@ -114,7 +114,7 @@ def test_custom_hosted_runner_is_registered_for_workflow_lint(self): check=True, capture_output=True, text=True, ) self.assertEqual(json.loads(result.stdout), { - "self-hosted-runner": {"labels": ["ubuntu-24.04-arm64-8core"]}, + "self-hosted-runner": {"labels": ["ubuntu-latest-8-cores-v2", "ubuntu-24.04-arm64-8core-v2"]}, }) def test_ordinary_backend_ci_does_not_publish_or_build_eifs(self): @@ -416,7 +416,7 @@ def test_release_is_manual_and_never_creates_a_release_or_tag(self): def test_build_job_is_the_trusted_read_only_builder(self): job = workflow(self.NAME)["jobs"]["build"] self.assertEqual(job["if"], "github.ref == 'refs/heads/master'") - self.assertEqual(job["runs-on"], "ubuntu-24.04-arm64-8core") + self.assertEqual(job["runs-on"], "ubuntu-24.04-arm64-8core-v2") self.assertEqual(job["timeout-minutes"], 180) self.assertEqual(job["permissions"], {"contents": "read", "id-token": "write", "attestations": "write"}) self.assertNotIn("environment", job) diff --git a/services/opensecret/docs/nitro-deploy.md b/services/opensecret/docs/nitro-deploy.md index 4c882e814..50b512daf 100644 --- a/services/opensecret/docs/nitro-deploy.md +++ b/services/opensecret/docs/nitro-deploy.md @@ -109,10 +109,10 @@ reports an EIF input or approval JSON edit, as routed to the respective job. This intentionally trusts same-repository PR code to write the FlakeHub cache; it does not grant signing or deployment authority. Trusted jobs use the organization-configured GitHub-hosted runner -`ubuntu-24.04-arm64-8core` (Ubuntu 24.04 ARM64, 8 CPU, 32 GB RAM) and allow +`ubuntu-24.04-arm64-8core-v2` (Ubuntu 24.04 ARM64, 8 CPU, 32 GB RAM) and allow 180 minutes for cold kernel builds. Its runner group must allow the public Maple repository, with capacity for both dev/prod jobs. The existing -`ubuntu-latest-8-cores` runner is x86-64, not a substitute. Unprivileged jobs +`ubuntu-latest-8-cores-v2` runner is x86-64, not a substitute. Unprivileged jobs retain the standard `ubuntu-24.04-arm` runner and their 90-minute limit. The trusted job also explicitly enables the GitHub cache and `diff-store: true`,