ci: use github-hosted runners for public repo security#2625
Merged
Conversation
Public repositories accept pull requests from untrusted contributors. A workflow that executes PR-author code on self-hosted or managed runner infrastructure exposes that infrastructure — secrets, network position, cached credentials, neighbouring jobs — to whoever opened the PR. Switch all jobs in build-and-test.yml from runs-on.com (4cpu-linux-x64) to GitHub-hosted ubuntu-latest. GitHub-hosted runners are ephemeral, network-isolated, and discarded after each job, which is the only safe execution environment for untrusted code from forks. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
timdawborn
approved these changes
May 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira: APE-2041
Summary
Switches all jobs in
.github/workflows/build-and-test.ymlfrom runs-on.com (4cpu-linux-x64) to GitHub-hostedubuntu-latest.This repo is public, so workflows can be triggered by PRs from untrusted contributors. Executing PR-author code on managed/self-hosted runner infrastructure exposes that infrastructure — secrets, network position, cached credentials, neighbouring jobs — to whoever opened the PR. GitHub-hosted runners are ephemeral, network-isolated, and discarded after each job, which is the correct execution environment for untrusted code.
The capacity drop is minimal:
ubuntu-latestprovides 4 vCPU for public repos, matching the previous4cpu-linux-x64configuration.This change is consistent with the org policy update in
ai-global-context(deployment.md→ "Exception: public repositories must use GitHub-hosted runners").Test plan
test-node-{18,20,22,24}×shard-{1..4}) completes within reasonable timetest-summary-publish,lint-checkjobs succeedpublishjob (release-only — won't run on this PR)🤖 Generated with Claude Code