From a657983895cc7bc9280bfe45f0ce539772d106e2 Mon Sep 17 00:00:00 2001
From: Altay <altay@hey.com>
Date: Sat, 5 Sep 2026 19:37:02 +0300
Subject: [PATCH] ci: choose shared scan runners by caller visibility

---
 .github/workflows/scan.yml | 10 ++++++----
 README.md                  |  3 +++
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
index e02122d..e08c2f7 100644
--- a/.github/workflows/scan.yml
+++ b/.github/workflows/scan.yml
@@ -6,6 +6,8 @@
 # is a promise the registry can break, and each of these containers gets the
 # whole repository, one of them with a token.
 
+# The github context belongs to the caller, including in reusable workflows.
+# Public repositories use GitHub-hosted runners; private callers keep Blacksmith.
 name: Scan
 
 on:
@@ -26,7 +28,7 @@ permissions:
 jobs:
   gitleaks:
     name: Gitleaks
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ${{ github.event.repository.private && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -41,7 +43,7 @@ jobs:
 
   trufflehog:
     name: TruffleHog
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ${{ github.event.repository.private && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -56,7 +58,7 @@ jobs:
 
   actionlint:
     name: Actionlint
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ${{ github.event.repository.private && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -70,7 +72,7 @@ jobs:
 
   zizmor:
     name: Zizmor
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ${{ github.event.repository.private && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/README.md b/README.md
index 56179d6..8f74275 100644
--- a/README.md
+++ b/README.md
@@ -7,6 +7,9 @@ Fallback community-health files for repositories owned by uinaf.
 Repository-local files take precedence when a project needs more specific
 security, contribution, or pull-request guidance.
 
+The shared scan uses GitHub-hosted runners for public callers and Blacksmith
+for private callers. Runner selection follows the calling repository’s visibility.
+
 ## Verify
 
 Run changed workflow checks locally with `mise run verify`. Before handoff, run