From 651bf2165b71fdc5e0bf1ebafe1d7f39effbb133 Mon Sep 17 00:00:00 2001
From: Altay <altay@hey.com>
Date: Tue, 8 Sep 2026 10:04:08 +0300
Subject: [PATCH] ci: move shared scans to GitHub-hosted runners

---
 .github/actionlint.yaml    |  3 ---
 .github/workflows/scan.yml | 10 ++++------
 README.md                  |  3 +--
 3 files changed, 5 insertions(+), 11 deletions(-)
 delete mode 100644 .github/actionlint.yaml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
deleted file mode 100644
index 8641cab..0000000
--- a/.github/actionlint.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-self-hosted-runner:
-  labels:
-    - blacksmith-*
diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
index 91cf29b..b4be642 100644
--- a/.github/workflows/scan.yml
+++ b/.github/workflows/scan.yml
@@ -6,8 +6,6 @@
 # is a promise the registry can break, and each of these containers gets the
 # whole repository, one of them with a token.
 
-# The github context belongs to the caller, including in reusable workflows.
-# Public repositories use GitHub-hosted runners; private callers keep Blacksmith.
 name: Scan
 
 on:
@@ -28,7 +26,7 @@ permissions:
 jobs:
   gitleaks:
     name: Gitleaks
-    runs-on: ${{ github.event.repository.private && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -43,7 +41,7 @@ jobs:
 
   trufflehog:
     name: TruffleHog
-    runs-on: ${{ github.event.repository.private && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -58,7 +56,7 @@ jobs:
 
   actionlint:
     name: Actionlint
-    runs-on: ${{ github.event.repository.private && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -72,7 +70,7 @@ jobs:
 
   zizmor:
     name: Zizmor
-    runs-on: ${{ github.event.repository.private && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/README.md b/README.md
index cc973c5..66e45e9 100644
--- a/README.md
+++ b/README.md
@@ -7,8 +7,7 @@ Fallback community-health files for repositories owned by uinaf.
 Repository-local files take precedence when a project needs more specific
 security, contribution, or pull-request guidance.
 
-The shared scan uses GitHub-hosted runners for public callers and Blacksmith
-for private callers. Runner selection follows the calling repository’s visibility.
+The shared scan uses standard GitHub-hosted Ubuntu runners for every caller.
 
 Renovate uses the shared organization preset and tracks the four scanner image
 tags and digests in `scan.yml`. Digest-only updates remain manual under that