From 55a01b423496370aaa6951361755e6048457a337 Mon Sep 17 00:00:00 2001
From: Phillip <phillip@cloudforgeci.com>
Date: Tue, 20 Oct 2026 11:32:05 -0400
Subject: [PATCH] Route Dependabot PRs to the self-hosted mac-mini runner

A dependabot PR only ever contains a dependency-manifest bump it generated
itself, lower-risk than an arbitrary human or fork PR, and that volume was
the single biggest source of queued jobs on the shared GitHub-hosted pool.
Build & test and CodeQL now route a dependabot-authored PR to the org's
self-hosted mac-mini runner instead (Maven + JDK 25 installed there); every
other PR is unaffected. Sign and publish to Central stays on its own
runner regardless of actor -- it's a trusted-deploy step, not something to
move for queue relief.

ShellCheck now runs from a static binary instead of a container action:
a container action is Linux-only by GitHub Actions' own platform rules,
which made it unable to run on the self-hosted runner at all. The static
binary ships for both linux.x86_64 and darwin.aarch64, so the same job
works on whichever runner a PR lands on.
---
 .github/workflows/codeql-analysis.yml  |  4 +++-
 .github/workflows/publish-snapshot.yml |  8 +++++++-
 .github/workflows/shellcheck.yml       | 28 ++++++++++++++++++++++----
 3 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 30754b6..7fdb8b1 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -12,7 +12,9 @@ on:
 jobs:
   analyze:
     name: Analyze Code
-    runs-on: ubuntu-latest
+    # See publish-snapshot.yml's build-test job for why dependabot PRs route to the self-hosted
+    # runner.
+    runs-on: ${{ github.actor == 'dependabot[bot]' && fromJSON('["self-hosted", "mac-mini"]') || 'ubuntu-latest' }}
     timeout-minutes: 360
 
     permissions:
diff --git a/.github/workflows/publish-snapshot.yml b/.github/workflows/publish-snapshot.yml
index cd1f449..a043431 100644
--- a/.github/workflows/publish-snapshot.yml
+++ b/.github/workflows/publish-snapshot.yml
@@ -27,7 +27,13 @@ on:
 jobs:
   build-test:
     name: Build & test
-    runs-on: ubuntu-latest
+    # A dependabot PR routes to the org's self-hosted mac-mini runner instead of the shared
+    # GitHub-hosted pool -- a dependabot PR only ever contains a dependency-manifest bump it
+    # generated itself, lower-risk than an arbitrary human or fork PR, and that volume was the
+    # single biggest source of queued jobs. Needs Maven + JDK 25 on the runner; both are
+    # installed there. The publish job below stays on ubuntu-latest regardless of actor -- it's a
+    # trusted-deploy step (Central Portal credentials), not something to move for queue relief.
+    runs-on: ${{ github.actor == 'dependabot[bot]' && fromJSON('["self-hosted", "mac-mini"]') || 'ubuntu-latest' }}
     timeout-minutes: 30
     steps:
       - name: Checkout code
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index f1a3100..8960ecb 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -3,6 +3,12 @@ name: ShellCheck
 # Lints every tracked shell script for bug patterns (unquoted expansions, unset variable use,
 # command-injection-shaped constructs) -- CodeQL doesn't cover Shell, so this is the only static
 # analysis these scripts get.
+#
+# Downloads the static shellcheck binary directly rather than using a Docker container action:
+# a container action is Linux-only by GitHub Actions' own platform rules, which would make this
+# job unable to run on the self-hosted mac-mini runner at all. The static binary ships for both
+# linux.x86_64 (GitHub-hosted) and darwin.aarch64 (the mac-mini, native Apple Silicon), so the
+# same job works on whichever runner a PR lands on.
 
 on:
   push:
@@ -17,15 +23,29 @@ permissions:
 jobs:
   shellcheck:
     name: ShellCheck
-    runs-on: ubuntu-latest
+    # See codeql-analysis.yml's analyze job for why dependabot PRs route to the self-hosted
+    # runner.
+    runs-on: ${{ github.actor == 'dependabot[bot]' && fromJSON('["self-hosted", "mac-mini"]') || 'ubuntu-latest' }}
+    env:
+      SHELLCHECK_VERSION: v0.11.0
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Install ShellCheck
+        run: |
+          case "$(uname -s)-$(uname -m)" in
+            Linux-x86_64) PLATFORM=linux.x86_64 ;;
+            Darwin-arm64) PLATFORM=darwin.aarch64 ;;
+            *) echo "::error::Unsupported platform $(uname -s)-$(uname -m) for shellcheck $SHELLCHECK_VERSION"; exit 1 ;;
+          esac
+          curl -fsSL "https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/shellcheck-${SHELLCHECK_VERSION}.${PLATFORM}.tar.xz" \
+            | tar -xJ -C /tmp
+          echo "/tmp/shellcheck-${SHELLCHECK_VERSION}" >> "$GITHUB_PATH"
+
       - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@2.0.0
-        with:
+        run: |
           # error only: these scripts have never been linted before and carry a pre-existing
           # tail of style warnings (SC2155, SC2034, SC2046...) that aren't worth blocking a PR
           # over. Syntax and logic errors still fail the check.
-          severity: error
+          git ls-files '*.sh' | xargs shellcheck --severity=error