Run CI on GitHub's hosted runners - #825
Merged
Merged
Conversation
Standard hosted runners are free and unmetered for public repositories, so there is nothing to gain by pointing this repository at the lab runners, and something real to lose: SHIELD has 66 forks, and a fork pull request on a self-hosted runner runs a stranger's code on our own hardware. Moving to ubuntu-latest drops the machinery the lab runners needed. The golang container, the bind-mounted module and build caches, the system-level safe.directory write, and the GOMAXPROCS cap all existed to work around a persistent shared host, and a fresh hosted runner has none of those problems.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Standard GitHub-hosted runners are free and unmetered for public repositories, and
shieldproject/shieldis public. Pointing CI at them costs nothing and removes the reason to attach lab runners to a repository with 66 forks, where a fork pull request would otherwise run a stranger's code on our own hardware.The jobs themselves are unchanged: lint, test, build, plugin-tests, and security, with the same commands and the same pinned actions. What goes away is the machinery that only existed to survive a persistent shared host — the
golangcontainer, the bind-mounted module and build caches, the system-levelsafe.directorywrite, and theGOMAXPROCS: 2cap.actions/setup-gohandles the toolchain and its own caching on a fresh runner.This is also the first run of the workflow that can actually execute, since no runner was ever attached to this org. Everything it gates on passed locally on develop: gofmt clean,
go vetclean, the race suite green across all nine packages, the vendored build fine,govulncheckfinding nothing reachable, andtrivyexiting zero.