From bedc05f7fc91d286b65ff0808b4d3a81695f9b78 Mon Sep 17 00:00:00 2001 From: Yusuke Watanabe Date: Tue, 14 Jul 2026 15:30:53 +0900 Subject: [PATCH 1/3] ci: the shared workflows themselves must never use a GitHub-hosted runner MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The SSOT was the bug. Four of the six reusable workflows already targeted the Spartan org pool, but `auto-merge-to-develop.yml` (1 job) and `cla.yml` (2 jobs) still declared `runs-on: ubuntu-latest`. Every repo in the ecosystem is about to consume these workflows. Migrating onto them unfixed would have propagated the violation ~68 times and called it "unified" — a violation that LOOKS compliant is worse than 68 honest ones. All three jobs now target the scitex-ai org runner pool ([self-hosted, Linux, X64, spartan-cpu]: spartan-cpu-org-01/-02, spartan-pooled-cpu-01), not per-repo labels — a per-repo label cannot work for 68 consumers, and pooled org-level runners are the standing preference. Operator mandate (2026-07-14): zero GitHub-hosted runners, no exceptions. If Spartan cannot run something, we fix Spartan; we never fall back. Verified: all 6 workflows parse (yaml.safe_load); zero hosted-runner references remain in the repo. --- .github/workflows/auto-merge-to-develop.yml | 5 ++++- .github/workflows/cla.yml | 6 ++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/auto-merge-to-develop.yml b/.github/workflows/auto-merge-to-develop.yml index 57a9d34..cc8d2e4 100644 --- a/.github/workflows/auto-merge-to-develop.yml +++ b/.github/workflows/auto-merge-to-develop.yml @@ -20,7 +20,10 @@ permissions: jobs: automerge: if: ${{ github.event_name == 'workflow_dispatch' || github.event.check_suite.conclusion == 'success' }} - runs-on: ubuntu-latest + # ZERO GitHub-hosted runners (operator mandate 2026-07-14). The org pool + # (scitex-ai: spartan-cpu-org-01/-02, spartan-pooled-cpu-01) serves every + # repo in the org; do NOT use per-repo runner labels here. + runs-on: [self-hosted, Linux, X64, spartan-cpu] steps: - name: merge green PRs targeting develop env: diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 039e47e..6bf8b54 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -45,7 +45,8 @@ permissions: jobs: owner-bypass: if: github.event_name == 'push' && github.actor == inputs.owner_login - runs-on: ubuntu-latest + # ZERO GitHub-hosted runners (operator mandate 2026-07-14). Org pool. + runs-on: [self-hosted, Linux, X64, spartan-cpu] permissions: statuses: write steps: @@ -63,7 +64,8 @@ jobs: CLAssistant: if: github.event_name != 'push' - runs-on: ubuntu-latest + # ZERO GitHub-hosted runners (operator mandate 2026-07-14). Org pool. + runs-on: [self-hosted, Linux, X64, spartan-cpu] steps: - name: CLA Assistant uses: contributor-assistant/github-action@v2.6.1 From 61456865c84454a35437d5ffdaf14e0374e6f657 Mon Sep 17 00:00:00 2001 From: Yusuke Watanabe Date: Tue, 14 Jul 2026 15:51:59 +0900 Subject: [PATCH 2/3] ci: temporary Spartan capability probe (branch-only; deleted before merge) Answers the question that gates moving auto-merge + cla onto Spartan: does the org-pool runner actually have `gh`? Merging that change blind would break PR auto-merge and the CLA check org-wide if it does not. --- .../workflows/zz-spartan-capability-probe.yml | 44 +++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 .github/workflows/zz-spartan-capability-probe.yml diff --git a/.github/workflows/zz-spartan-capability-probe.yml b/.github/workflows/zz-spartan-capability-probe.yml new file mode 100644 index 0000000..c7ce479 --- /dev/null +++ b/.github/workflows/zz-spartan-capability-probe.yml @@ -0,0 +1,44 @@ +name: zz-spartan-capability-probe + +# TEMPORARY probe (branch-only, deleted before merge). Answers the one +# question that gates moving `auto-merge-to-develop` and `cla` onto Spartan: +# does the Spartan org-pool runner actually have the tools those workflows +# shell out to? Merging that change blind would break PR auto-merge and the +# CLA check across the whole org if `gh` is absent. +# +# Runs only on this branch. Never merged to main. + +on: + push: + branches: [ci/spartan-only-runners] + +jobs: + probe: + runs-on: [self-hosted, Linux, X64, spartan-cpu] + steps: + - name: Which runner am I on + run: | + echo "host=$(hostname)" + echo "runner_name=${RUNNER_NAME:-?}" + echo "pwd=$(pwd)" + + - name: gh CLI present? (REQUIRED by auto-merge + cla) + run: | + if command -v gh >/dev/null 2>&1; then + echo "GH_PRESENT=yes" + echo "GH_PATH=$(command -v gh)" + gh --version + else + echo "GH_PRESENT=no" + echo "::warning::gh CLI is NOT on PATH — auto-merge-to-develop and cla would FAIL on this runner" + fi + + - name: Other tools those workflows assume + run: | + for t in git node bash jq curl; do + if command -v "$t" >/dev/null 2>&1; then + echo "$t=$(command -v $t)" + else + echo "$t=MISSING" + fi + done From b055b0e4bbbcc73fea213e90ba2573ef129a1fed Mon Sep 17 00:00:00 2001 From: Yusuke Watanabe Date: Tue, 14 Jul 2026 15:58:02 +0900 Subject: [PATCH 3/3] ci: remove the temporary Spartan capability probe The probe did its job: a workflow requesting the org pool ([self-hosted, Linux, X64, spartan-cpu]) sat QUEUED for 10+ minutes and was never assigned a runner, while all three org runners reported online + idle. Result recorded on the scitex-hpc card; the probe itself is not merged. --- .../workflows/zz-spartan-capability-probe.yml | 44 ------------------- 1 file changed, 44 deletions(-) delete mode 100644 .github/workflows/zz-spartan-capability-probe.yml diff --git a/.github/workflows/zz-spartan-capability-probe.yml b/.github/workflows/zz-spartan-capability-probe.yml deleted file mode 100644 index c7ce479..0000000 --- a/.github/workflows/zz-spartan-capability-probe.yml +++ /dev/null @@ -1,44 +0,0 @@ -name: zz-spartan-capability-probe - -# TEMPORARY probe (branch-only, deleted before merge). Answers the one -# question that gates moving `auto-merge-to-develop` and `cla` onto Spartan: -# does the Spartan org-pool runner actually have the tools those workflows -# shell out to? Merging that change blind would break PR auto-merge and the -# CLA check across the whole org if `gh` is absent. -# -# Runs only on this branch. Never merged to main. - -on: - push: - branches: [ci/spartan-only-runners] - -jobs: - probe: - runs-on: [self-hosted, Linux, X64, spartan-cpu] - steps: - - name: Which runner am I on - run: | - echo "host=$(hostname)" - echo "runner_name=${RUNNER_NAME:-?}" - echo "pwd=$(pwd)" - - - name: gh CLI present? (REQUIRED by auto-merge + cla) - run: | - if command -v gh >/dev/null 2>&1; then - echo "GH_PRESENT=yes" - echo "GH_PATH=$(command -v gh)" - gh --version - else - echo "GH_PRESENT=no" - echo "::warning::gh CLI is NOT on PATH — auto-merge-to-develop and cla would FAIL on this runner" - fi - - - name: Other tools those workflows assume - run: | - for t in git node bash jq curl; do - if command -v "$t" >/dev/null 2>&1; then - echo "$t=$(command -v $t)" - else - echo "$t=MISSING" - fi - done