From 333ab5e4217c08399ea5a92593ad8f1e35ba2126 Mon Sep 17 00:00:00 2001 From: echobt <154886644+echobt@users.noreply.github.com> Date: Tue, 20 Oct 2026 12:15:39 +0000 Subject: [PATCH 1/3] perf(ci): run ci, python-images and approve-image-update on Blacksmith Only runs-on changes; steps, the Trivy HIGH/CRITICAL gate, actions and job names are unchanged. ci jobs and approve-image-update use blacksmith-4vcpu-ubuntu-2404, python-images (build plus two Trivy scans) uses blacksmith-8vcpu-ubuntu-2404. Both labels started in about 10 s in a canary on CortexLM/hypertrain (run 39420280084). The hypertrain twin-run cancellation does not apply here: ci.yml has no workflow_call and is not called by images.yml, and every recent main-push ci run succeeded. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/approve-image-update.yml | 2 +- .github/workflows/ci.yml | 4 ++-- .github/workflows/images.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/approve-image-update.yml b/.github/workflows/approve-image-update.yml index a0b6f4ce1..b1b6ba976 100644 --- a/.github/workflows/approve-image-update.yml +++ b/.github/workflows/approve-image-update.yml @@ -34,7 +34,7 @@ jobs: verify: name: verify operator-approved runtime digest environment: production - runs-on: ubuntu-24.04 + runs-on: blacksmith-4vcpu-ubuntu-2404 timeout-minutes: 10 steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f9c71b8e0..43c003ca5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ env: jobs: quality: name: lint, types, wheel and deployment contracts - runs-on: ubuntu-24.04 + runs-on: blacksmith-4vcpu-ubuntu-2404 timeout-minutes: 15 steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 @@ -110,7 +110,7 @@ jobs: tests: name: tests (Python ${{ matrix.python }}) - runs-on: ubuntu-24.04 + runs-on: blacksmith-4vcpu-ubuntu-2404 timeout-minutes: 20 strategy: fail-fast: false diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index 38be7edcb..05e885241 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -18,7 +18,7 @@ env: jobs: publish: - runs-on: ubuntu-24.04 + runs-on: blacksmith-8vcpu-ubuntu-2404 timeout-minutes: 45 permissions: actions: read From b97f39208a734ec6c55ce8f0b07267a614b1b097 Mon Sep 17 00:00:00 2001 From: echobt <154886644+echobt@users.noreply.github.com> Date: Tue, 20 Oct 2026 14:35:28 +0000 Subject: [PATCH 2/3] fix(ci): keep the provenance-producing publish job on a GitHub-hosted runner A Blacksmith runner is recorded in the build provenance as runnerEnvironment=self-hosted. images.yml (alias verification) and approve-image-update.yml both call `gh attestation verify --deny-self-hosted-runners`, so an image published from a Blacksmith runner would be rejected by our own verifiers (CodeRabbit finding on #321). The existing attestations show runnerEnvironment=github-hosted. ci and approve-image-update stay on Blacksmith; only the publish job, which creates the attestation, returns to ubuntu-24.04. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/images.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index 05e885241..37aeb0844 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -18,7 +18,10 @@ env: jobs: publish: - runs-on: blacksmith-8vcpu-ubuntu-2404 + # GitHub-hosted on purpose: this job produces the build provenance, and a Blacksmith runner is + # recorded as runnerEnvironment=self-hosted, which `gh attestation verify + # --deny-self-hosted-runners` (this workflow and approve-image-update.yml) rejects. + runs-on: ubuntu-24.04 timeout-minutes: 45 permissions: actions: read From 4e47aa9889df6aaaff994e90eaa7a172ce40f755 Mon Sep 17 00:00:00 2001 From: echobt <154886644+echobt@users.noreply.github.com> Date: Tue, 20 Oct 2026 14:41:59 +0000 Subject: [PATCH 3/3] fix(ci): keep approve-image-update on a GitHub-hosted runner approve-image-update is the security gate for new runtime digests (environment production, gh attestation verify with --deny-self-hosted-runners, Trivy). It only verifies, so it does not affect provenance, but it reads GITHUB_TOKEN and decides an approval; a third-party runner adds trust for no gain, since the job is dominated by docker pull and Trivy, not CPU (independent review, minor M4). The file is restored to main, so this PR no longer touches it. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/approve-image-update.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/approve-image-update.yml b/.github/workflows/approve-image-update.yml index b1b6ba976..a0b6f4ce1 100644 --- a/.github/workflows/approve-image-update.yml +++ b/.github/workflows/approve-image-update.yml @@ -34,7 +34,7 @@ jobs: verify: name: verify operator-approved runtime digest environment: production - runs-on: blacksmith-4vcpu-ubuntu-2404 + runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4