ci: move shared scans to GitHub-hosted runners - #9
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![slopzapper[bot]](https://avatars.githubusercontent.com/in/4527847?s=60&v=4){kind=small}
There was a problem hiding this comment.
🟢 Approval recommended
The changes consistently remove Blacksmith runner usage across the shared scan workflow and associated docs/config without leaving remaining references in the repo.
Pull request overview
This PR updates the org-wide shared scan workflow to always run on standard GitHub-hosted Ubuntu 24.04 runners, removing the prior conditional support for the Blacksmith runner label and the corresponding Actionlint configuration exception.
Changes:
- Switch all jobs in the reusable
scan.ymlworkflow toruns-on: ubuntu-24.04. - Remove obsolete documentation describing runner selection based on caller visibility.
- Remove the Actionlint configuration that allowed
blacksmith-*runner labels.
File summaries
| File | Description |
|---|---|
| README.md | Updates documentation to reflect GitHub-hosted Ubuntu runners for all callers. |
| .github/workflows/scan.yml | Removes conditional runner selection and standardizes jobs on ubuntu-24.04. |
| .github/actionlint.yaml | Removes now-unneeded Actionlint allowance for blacksmith-* runner labels. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Problem
Private uinaf repositories still run shared scans on Blacksmith.
Solution
Run every shared scanner on standard GitHub-hosted Ubuntu 24.04 and remove the obsolete custom runner allowance.