Full self-hosted runner support

[dhrapson]

Is it possible to add support for running of all the Jobs in the Workflows here on self-hosted runners?
I followed the docs and this caused the agent job in the generated file to execute on my self-hosted runners :-)
However the other jobs all continued to be given ubuntu-slim or ubuntu-latest runners, which included activation, detection, safe_outputs, conclusion.

It is mainly the exhaustion of GitHub minutes by these surrounding Jobs that I would like to avoid.

[pelikhan]

Copilot, ensure that the runners used in every job in the generated .lock.yml file are configurable (aside from custom jobs). Update the docs with a dedicated guide on self-hosted runners. One should be able to change the job using for activation/conclusion/safe_outputs/pre_activation with a single frontmatter entry since they all have the same runtime requirement.

[pelikhan]

/scout research the current github agentic workflows configuration to figure if this is possible already.

[github-actions]

🔍 Scout Research Report

Triggered by @pelikhan

Executive Summary

Partial self-hosted runner support already exists. Using a combination of two frontmatter settings, you can route most jobs to self-hosted runners today. However, one job — detection — is currently hardcoded to ubuntu-latest and cannot be overridden via configuration.

Job	Current Default	Configurable?	How
agent	ubuntu-latest	✅ Yes	Top-level runs-on:
pre_activation	ubuntu-slim	✅ Yes	safe-outputs: runs-on:
activation	ubuntu-slim	✅ Yes	safe-outputs: runs-on:
safe_outputs (all)	ubuntu-slim	✅ Yes	safe-outputs: runs-on:
conclusion	ubuntu-slim	✅ Yes	safe-outputs: runs-on:
unlock	ubuntu-latest	✅ Yes	Top-level runs-on:
detection	ubuntu-latest	❌ No	Hardcoded

View detailed findings

Current Configuration to Maximize Self-Hosted Usage

According to the source code and documentation, users can already use the following frontmatter to route most jobs to self-hosted runners:

---
on:
  issues:
    types: [opened]
runs-on: self-hosted           # → agent + unlock jobs
safe-outputs:
  runs-on: self-hosted         # → activation + pre_activation + conclusion + all safe-output jobs
  add-comment: {}
---

# Workflow body

This is already documented in the safe-outputs reference (docs/src/content/docs/reference/safe-outputs.md, line 1292): "Specify custom runner for safe output jobs (default: ubuntu-slim): runs-on: ubuntu-22.04"

What's Not Possible Today

The detection job runner is hardcoded in pkg/workflow/threat_detection.go:144:

RunsOn: "runs-on: ubuntu-latest",

There is no frontmatter option to override this. This job runs threat analysis on agent output and always uses a GitHub-hosted runner.

Code Locations

• runs-on affects agent job: pkg/workflow/compiler_jobs.go
• runs-on affects unlock job: pkg/workflow/compiler_unlock_job.go:103
• safe-outputs:runs-on affects pre_activation: pkg/workflow/compiler_activation_jobs.go:350
• safe-outputs:runs-on affects activation: pkg/workflow/compiler_activation_jobs.go:730
• safe-outputs:runs-on affects conclusion: pkg/workflow/notify_comment.go:388
• safe-outputs:runs-on affects safe-output jobs: pkg/workflow/safe_outputs_jobs.go:136
• detection hardcoded: pkg/workflow/threat_detection.go:144

Documentation References

• Frontmatter runs-on reference: docs/src/content/docs/reference/frontmatter.md:462
• Safe-outputs runs-on reference: docs/src/content/docs/reference/safe-outputs.md:1290
• Full frontmatter spec (including self-hosted examples): docs/src/content/docs/reference/frontmatter-full.md:794

Recommendations

1. For the issue reporter: Try adding safe-outputs: runs-on: self-hosted to your workflow frontmatter alongside the existing runs-on: self-hosted. This should move activation, safe_outputs, and conclusion jobs to your self-hosted runners.

2. For the feature gap: The detection job runner is hardcoded (pkg/workflow/threat_detection.go:144). Supporting self-hosted runners there would require adding a new frontmatter option (e.g., detection: runs-on:) or extending runs-on to apply globally across all jobs.

3. Global runs-on option: An enhancement worth considering is a global runs-on that propagates to all generated jobs (including detection), with per-job overrides possible. This would be the cleanest UX for the full self-hosted use case.

References:

• §22322330650

🔭 Intelligence gathered by Scout

[pelikhan]

Copilot:

• unlock should use safe-outputs.runs-on
• detection should use safe-outputs.detection.run-on or run-on or ubuntu-latest

[pelikhan]

#17979

[pelikhan]

See https://github.github.com/gh-aw/guides/self-hosted-runners/