From aca9fcc94910f2da9ac83a880ebe1345dd297200 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Przemys=C5=82aw=20K=C5=82ys?= Date: Mon, 9 Feb 2026 08:38:20 +0100 Subject: [PATCH 1/4] CI: prefer self-hosted runners while repo is private --- .github/workflows/claude-code-review.yml | 5 +++-- .github/workflows/review-intelligencex.yml | 5 +++-- .github/workflows/test-dotnet.yml | 11 +++++++---- 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 743448b13..997776b03 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -18,8 +18,9 @@ jobs: # github.event.pull_request.user.login == 'new-developer' || # github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' - # Prefer GitHub-hosted runners for PR checks to avoid blocking when self-hosted runners are unavailable. - runs-on: ubuntu-latest + # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. + # When public, use GitHub-hosted runners by default. + runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }} permissions: contents: read pull-requests: write diff --git a/.github/workflows/review-intelligencex.yml b/.github/workflows/review-intelligencex.yml index b76b186a1..31e9458c0 100644 --- a/.github/workflows/review-intelligencex.yml +++ b/.github/workflows/review-intelligencex.yml @@ -17,8 +17,9 @@ on: jobs: # INTELLIGENCEX:BEGIN review: - # Prefer GitHub-hosted runners for PR checks to avoid blocking when self-hosted runners are unavailable. - runs-on: ${{ fromJSON(github.event_name == 'pull_request' && '["ubuntu-latest"]' || '["self-hosted","ubuntu"]') }} + # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. + # When public, use GitHub-hosted runners by default. + runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }} permissions: contents: read pull-requests: write diff --git a/.github/workflows/test-dotnet.yml b/.github/workflows/test-dotnet.yml index 90a4feeac..4e31ced35 100644 --- a/.github/workflows/test-dotnet.yml +++ b/.github/workflows/test-dotnet.yml @@ -21,8 +21,8 @@ env: jobs: test-windows: name: 'Windows' - # Use self-hosted runners for private repos (avoid GitHub-hosted costs). - # When the repo becomes public, switch to GitHub-hosted runners automatically. + # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. + # When public, use GitHub-hosted runners by default. runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","windows"]' || '["windows-latest"]') }} timeout-minutes: 20 steps: @@ -74,8 +74,9 @@ jobs: test-ubuntu: name: 'Ubuntu' - # Prefer GitHub-hosted runners for PR checks to avoid blocking when self-hosted runners are unavailable. - runs-on: ${{ fromJSON(github.event_name == 'pull_request' && '["ubuntu-latest"]' || (github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]')) }} + # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. + # When public, use GitHub-hosted runners by default. + runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }} timeout-minutes: 20 steps: - name: Checkout code @@ -119,6 +120,8 @@ jobs: test-macos: name: 'macOS' + # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. + # When public, use GitHub-hosted runners by default. runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","macos"]' || '["macos-latest"]') }} timeout-minutes: 20 steps: From 7dee209082d9e359230b432691b7f4a8825fa8f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Przemys=C5=82aw=20K=C5=82ys?= Date: Mon, 9 Feb 2026 08:40:33 +0100 Subject: [PATCH 2/4] CI: add CodeQL workflow for self-hosted runners --- .github/workflows/codeql.yml | 45 ++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 000000000..ea30ee464 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,45 @@ +name: CodeQL + +on: + push: + branches: [master] + pull_request: + workflow_dispatch: + +permissions: + contents: read + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. + # When public, use GitHub-hosted runners by default. + runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }} + permissions: + actions: read + contents: read + security-events: write + strategy: + fail-fast: false + matrix: + language: [csharp, javascript-typescript, python] + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Setup .NET + if: matrix.language == 'csharp' + uses: actions/setup-dotnet@v4 + with: + dotnet-version: 8.0.x + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 From 62a970f632f2db7c43612201c6dd4d29d7754e7f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Przemys=C5=82aw=20K=C5=82ys?= Date: Mon, 9 Feb 2026 08:42:49 +0100 Subject: [PATCH 3/4] CI: use self-hosted linux label for private repo --- .github/workflows/claude-code-review.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/review-intelligencex.yml | 2 +- .github/workflows/test-dotnet.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 997776b03..6a02e79d9 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -20,7 +20,7 @@ jobs: # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. # When public, use GitHub-hosted runners by default. - runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }} + runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","linux"]' || '["ubuntu-latest"]') }} permissions: contents: read pull-requests: write diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ea30ee464..598331e85 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -14,7 +14,7 @@ jobs: name: Analyze (${{ matrix.language }}) # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. # When public, use GitHub-hosted runners by default. - runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }} + runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","linux"]' || '["ubuntu-latest"]') }} permissions: actions: read contents: read diff --git a/.github/workflows/review-intelligencex.yml b/.github/workflows/review-intelligencex.yml index 31e9458c0..87ae237d4 100644 --- a/.github/workflows/review-intelligencex.yml +++ b/.github/workflows/review-intelligencex.yml @@ -19,7 +19,7 @@ jobs: review: # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. # When public, use GitHub-hosted runners by default. - runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }} + runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","linux"]' || '["ubuntu-latest"]') }} permissions: contents: read pull-requests: write diff --git a/.github/workflows/test-dotnet.yml b/.github/workflows/test-dotnet.yml index 4e31ced35..ee0eda46a 100644 --- a/.github/workflows/test-dotnet.yml +++ b/.github/workflows/test-dotnet.yml @@ -76,7 +76,7 @@ jobs: name: 'Ubuntu' # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. # When public, use GitHub-hosted runners by default. - runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }} + runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","linux"]' || '["ubuntu-latest"]') }} timeout-minutes: 20 steps: - name: Checkout code From fb0c9c5babebfaabc7a0eec70942d12ec69d3d35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Przemys=C5=82aw=20K=C5=82ys?= Date: Mon, 9 Feb 2026 08:45:55 +0100 Subject: [PATCH 4/4] CI: use self-hosted ubuntu label for private repo --- .github/workflows/claude-code-review.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/review-intelligencex.yml | 2 +- .github/workflows/test-dotnet.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 6a02e79d9..997776b03 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -20,7 +20,7 @@ jobs: # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. # When public, use GitHub-hosted runners by default. - runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","linux"]' || '["ubuntu-latest"]') }} + runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }} permissions: contents: read pull-requests: write diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 598331e85..ea30ee464 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -14,7 +14,7 @@ jobs: name: Analyze (${{ matrix.language }}) # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. # When public, use GitHub-hosted runners by default. - runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","linux"]' || '["ubuntu-latest"]') }} + runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }} permissions: actions: read contents: read diff --git a/.github/workflows/review-intelligencex.yml b/.github/workflows/review-intelligencex.yml index 87ae237d4..31e9458c0 100644 --- a/.github/workflows/review-intelligencex.yml +++ b/.github/workflows/review-intelligencex.yml @@ -19,7 +19,7 @@ jobs: review: # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. # When public, use GitHub-hosted runners by default. - runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","linux"]' || '["ubuntu-latest"]') }} + runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }} permissions: contents: read pull-requests: write diff --git a/.github/workflows/test-dotnet.yml b/.github/workflows/test-dotnet.yml index ee0eda46a..4e31ced35 100644 --- a/.github/workflows/test-dotnet.yml +++ b/.github/workflows/test-dotnet.yml @@ -76,7 +76,7 @@ jobs: name: 'Ubuntu' # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits. # When public, use GitHub-hosted runners by default. - runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","linux"]' || '["ubuntu-latest"]') }} + runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }} timeout-minutes: 20 steps: - name: Checkout code