[kkroo]

Summary

Move credential-free Linux jobs to the existing ARC default pool:

• packaging.yml: static binary smoke and goreleaser snapshot validation
• static-binary.yml: Linux static binary build
• soak.yml: local loopback soak test

The packaging Docker job and release workflow remain on hosted runners because they use Docker, registry publishing, GitHub release permissions, and keyless OIDC signing.

Validation

• actionlint with custom default runner label configuration
• git diff --check

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex. Nested CLI lenses applied directly inside the review pod.
Reviewed head: 311c924

Critical Issues (0)

Important Issues (1)

• [gstack/review + native-codex] .github/workflows/packaging.yml:48 — the diff moves the docker job to default and leaves goreleaser (:187) on ubuntu-latest. That is the reverse of what the PR description says ("goreleaser snapshot validation" moves; "the packaging Docker job … remain[s] on hosted runners because they use Docker, registry publishing"). docker is the job that, on every push, reads HARBOR_USERNAME/HARBOR_PASSWORD, runs docker login, and on main/v* pushes registry.blockcast.net/blockcast/go-amt/blockcast-shreds. So this change puts the secrets-bearing publish lane on the self-hosted pool, which the description explicitly says it should not do, while the credential-free goreleaser lane stays hosted.
  • If the description is right: revert :48 to ubuntu-latest and set :187 to default. Confirm the ARC default image ships file, which the "Release binary is static" step at the end of goreleaser relies on.
  • If the move is intentional: update the description and confirm that running a Harbor-push lane on default is acceptable. Org precedent exists (frr, trafficcontrol run docker/build-push-action on default), so this is a scope/intent question, not a capability one.

Suggestions (1)

• [pr-review-toolkit:code] .github/workflows/soak.yml:45 — the soak job on default depends on python3 (scripts/assert_rss_plateau.py), curl and /proc/<pid>/status. It is workflow_dispatch-only, so this PR's CI will not exercise it. Do one manual dispatch before relying on it, or note in the description that it has not been run on ARC yet.

Strengths

• Small, mechanical diff. Keeping release and the OIDC-signing paths on hosted runners is the right boundary.
• The smoke and static-binary moves are genuinely credential-free: go build plus a shell smoke test, with no secrets and no registry access.

Recommended Action

1. Address Important issues this cycle.
2. Consider Suggestions opportunistically.

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex. Nested CLI lenses applied directly inside the review pod.
Reviewed head: 653ae99

Looks good. The job swap from the previous head is corrected, and the diff now matches the description.

Prior Findings Dispositioned (1)

• prior:311c924 important 1 — fixed — .github/workflows/packaging.yml:50 — docker (the Harbor login/push lane, which reads HARBOR_USERNAME/HARBOR_PASSWORD at :130-131) stays on ubuntu-latest, and there is an explanatory comment at :48-49. The credential-free goreleaser job is the one that moved to default, at :189. A goreleaser check-run at this head completed success on default, so the file dependency in "Release binary is static" (:213-214) is available on the ARC image.

Critical Issues (0)

Important Issues (0)

Suggestions (1)

• [pr-review-toolkit:code] .github/workflows/soak.yml:45 — the soak job is workflow_dispatch-only, so this PR's CI does not run it on default. It depends on python3, curl and /proc/<pid>/status. Dispatch it once on this branch before you rely on it.

Strengths

• The hosted/ARC boundary is now exact. Jobs that touch secrets, Docker, registries or OIDC stay hosted; pure go build and smoke jobs move.
• The comment on docker explains why this one job is an exception, so a later sweep is unlikely to move it by mistake.

Recommended Action

1. No blocking changes requested.
2. Merge once the remaining required CI checks finish green.