From 5a5215502526ced4f9deb66d8dd01ac3d4e8324a Mon Sep 17 00:00:00 2001 From: James Yong Date: Tue, 28 Jul 2026 12:16:38 -0700 Subject: [PATCH] fix(ci): keep the release train on GitHub-hosted runners MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Blacksmith migration (#178) blanket-moved every ubuntu-latest job, including the four publishing workflows. npm rejects sigstore provenance minted anywhere but GitHub-hosted runners, so the truffle-v0.7.10 release died at both npm publish steps ("Unsupported GitHub Actions runner environment: self-hosted") after all binaries had built, and release-please then stopped at its build gate — nothing reached npm or crates.io, and the release is still a draft. Revert the six release-path workflows (release-please, release-preflight, release-sidecar, release-cli's siblings napi-build, release-npm, publish-crates) to ubuntu-latest and pin the constraint in comments on each publish job so the next runner migration can't silently reintroduce it. CI/test workflows keep their Blacksmith runners — the speed matters there and nothing in them mints provenance. Co-Authored-By: Claude Fable 5 --- .github/workflows/napi-build.yml | 5 ++++- .github/workflows/publish-crates.yml | 5 ++++- .github/workflows/release-npm.yml | 5 ++++- .github/workflows/release-please.yml | 4 +++- .github/workflows/release-preflight.yml | 2 +- .github/workflows/release-sidecar.yml | 9 ++++++--- 6 files changed, 22 insertions(+), 8 deletions(-) diff --git a/.github/workflows/napi-build.yml b/.github/workflows/napi-build.yml index db61dee..34e312d 100644 --- a/.github/workflows/napi-build.yml +++ b/.github/workflows/napi-build.yml @@ -157,7 +157,10 @@ jobs: publish: name: Publish to npm needs: [test] - runs-on: blacksmith-4vcpu-ubuntu-2404 + # GitHub-hosted required: npm/crates OIDC trusted publishing and sigstore + # provenance reject self-hosted-class runners (incl. Blacksmith) — a runner + # migration here is what killed the truffle-v0.7.10 release. + runs-on: ubuntu-latest permissions: contents: read id-token: write diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml index 2883b2d..9545af5 100644 --- a/.github/workflows/publish-crates.yml +++ b/.github/workflows/publish-crates.yml @@ -21,7 +21,10 @@ jobs: publish: name: Publish crates needs: preflight - runs-on: blacksmith-4vcpu-ubuntu-2404 + # GitHub-hosted required: npm/crates OIDC trusted publishing and sigstore + # provenance reject self-hosted-class runners (incl. Blacksmith) — a runner + # migration here is what killed the truffle-v0.7.10 release. + runs-on: ubuntu-latest environment: release env: # cargo publish verifies packaged crates by compiling them. The GitHub diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml index f6df584..b26a31b 100644 --- a/.github/workflows/release-npm.yml +++ b/.github/workflows/release-npm.yml @@ -21,7 +21,10 @@ jobs: publish: name: Publish @vibecook/truffle needs: preflight - runs-on: blacksmith-4vcpu-ubuntu-2404 + # GitHub-hosted required: npm/crates OIDC trusted publishing and sigstore + # provenance reject self-hosted-class runners (incl. Blacksmith) — a runner + # migration here is what killed the truffle-v0.7.10 release. + runs-on: ubuntu-latest permissions: # Draft assets are hidden from read-only workflow tokens. contents: write diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index b0ccb8f..e364bb1 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -17,7 +17,9 @@ concurrency: jobs: release-please: - runs-on: blacksmith-4vcpu-ubuntu-2404 + # The whole release train stays on GitHub-hosted runners — see the + # provenance notes on the publish jobs it gates and dispatches. + runs-on: ubuntu-latest timeout-minutes: 120 outputs: release_created: ${{ steps.release.outputs.release_created }} diff --git a/.github/workflows/release-preflight.yml b/.github/workflows/release-preflight.yml index 05e82b3..05007d9 100644 --- a/.github/workflows/release-preflight.yml +++ b/.github/workflows/release-preflight.yml @@ -14,7 +14,7 @@ permissions: jobs: verify: name: Verify release source - runs-on: blacksmith-4vcpu-ubuntu-2404 + runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5 with: diff --git a/.github/workflows/release-sidecar.yml b/.github/workflows/release-sidecar.yml index 2dcc72a..7d7c4d1 100644 --- a/.github/workflows/release-sidecar.yml +++ b/.github/workflows/release-sidecar.yml @@ -101,7 +101,10 @@ jobs: name: Publish sidecar packages to npm if: startsWith(github.ref, 'refs/tags/') needs: build - runs-on: blacksmith-4vcpu-ubuntu-2404 + # GitHub-hosted required: npm/crates OIDC trusted publishing and sigstore + # provenance reject self-hosted-class runners (incl. Blacksmith) — a runner + # migration here is what killed the truffle-v0.7.10 release. + runs-on: ubuntu-latest permissions: contents: read id-token: write @@ -174,7 +177,7 @@ jobs: name: Pin sidecar checksums needs: build if: startsWith(github.ref, 'refs/tags/') - runs-on: blacksmith-4vcpu-ubuntu-2404 + runs-on: ubuntu-latest permissions: contents: write steps: @@ -223,7 +226,7 @@ jobs: name: Publish checksum-bound packages needs: [publish-npm, checksums] if: startsWith(github.ref, 'refs/tags/') - runs-on: blacksmith-4vcpu-ubuntu-2404 + runs-on: ubuntu-latest permissions: actions: write contents: read