ci: choose shared scan runners by caller visibility - #6
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟢 Approval recommended
The runner-selection change is consistent with the stated goal and is applied uniformly across all scan jobs without altering permissions, triggers, or tool pins.
Pull request overview
This PR updates the shared reusable scan workflow to select runners based on the calling repository’s visibility, ensuring public repositories use GitHub-hosted runners while private repositories continue using the existing Blacksmith runner.
Changes:
- Documented runner selection behavior in the repository README.
- Updated all scan jobs to dynamically choose
runs-onbased ongithub.event.repository.privatefor the calling repo.
File summaries
| File | Description |
|---|---|
| README.md | Documents the public-vs-private runner selection behavior for the shared scan. |
| .github/workflows/scan.yml | Switches each scan job’s runner to GitHub-hosted for public callers and Blacksmith for private callers using a conditional runs-on expression. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![slopzapper[bot]](https://avatars.githubusercontent.com/in/4527847?s=60&v=4){kind=small}
Problem
The shared scan currently sends public repositories to Blacksmith. Public repositories should use GitHub-hosted runners, while private repositories may retain Blacksmith.
Solution
Choose the runner from the calling repository’s visibility. Public callers use standard Ubuntu 24.04; private callers keep the existing Blacksmith runner. Scan jobs and their permissions, triggers, and pinned tools remain the same.