Skip to content

Route Dependabot PRs to the self-hosted mac-mini runner - #15

Merged
phillip389 merged 1 commit into
developfrom
feat/dependabot-self-hosted-runner
Oct 20, 2026
Merged

phillip389 merged 1 commit into
developfrom
feat/dependabot-self-hosted-runner

Conversation

@phillip389

Copy link
Copy Markdown
Contributor

Summary

  • A dependabot PR only ever contains a dependency-manifest bump it generated itself, lower-risk than an arbitrary human or fork PR, and that volume was the single biggest source of queued jobs on the shared GitHub-hosted pool.
  • Build & test and CodeQL now route a dependabot-authored PR to the org's self-hosted mac-mini runner instead (registered to a runner group scoped to cfc-core, cloudforge-cli, cloudforge-ministack, cloudforge-localstack). Maven + JDK 25 are installed there. Every other PR keeps using ubuntu-latest as before.
  • Sign and publish to Central stays on its own runner regardless of actor — trusted-deploy step, not moved.
  • ShellCheck now runs from a static binary instead of a container action (Linux-only by GitHub Actions' own platform rules, couldn't run on the self-hosted runner at all) — ships natively for both linux.x86_64 and darwin.aarch64.

Test plan

  • A dependabot PR's Build & test/CodeQL/ShellCheck jobs run on self-hosted, mac-mini and complete successfully.
  • A human-authored PR is unaffected (still ubuntu-latest).

A dependabot PR only ever contains a dependency-manifest bump it generated
itself, lower-risk than an arbitrary human or fork PR, and that volume was
the single biggest source of queued jobs on the shared GitHub-hosted pool.
Build & test and CodeQL now route a dependabot-authored PR to the org's
self-hosted mac-mini runner instead (Maven + JDK 25 installed there); every
other PR is unaffected. Sign and publish to Central stays on its own
runner regardless of actor -- it's a trusted-deploy step, not something to
move for queue relief.

ShellCheck now runs from a static binary instead of a container action:
a container action is Linux-only by GitHub Actions' own platform rules,
which made it unable to run on the self-hosted runner at all. The static
binary ships for both linux.x86_64 and darwin.aarch64, so the same job
works on whichever runner a PR lands on.
@phillip389
phillip389 merged commit e1bbf12 into develop Oct 20, 2026
8 checks passed
@phillip389
phillip389 deleted the feat/dependabot-self-hosted-runner branch October 20, 2026 15:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant