feat: single runs-on entry routes all generated jobs to self-hosted runners

[Copilot]

Support jobs (activation, pre_activation, safe_outputs, cache_memory, repo_memory) ignored the top-level runs-on and used hardcoded ubuntu-slim/ubuntu-latest, making it impossible to avoid GitHub-hosted minutes with a single config change.

Changes

Runner inheritance

• formatSafeOutputsRunsOn now resolves runners in priority order:

  1. safe-outputs.runs-on — explicit support-job override
  2. Top-level runs-on — inherited when explicitly set by user
  3. ubuntu-slim — final default

• Added RunsOnExplicit bool to WorkflowData to distinguish a user-set runs-on from the compiler-applied ubuntu-latest default (avoids unintentional inheritance)

Jobs now configurable via top-level runs-on

Previously hardcoded; now use formatSafeOutputsRunsOn:

• update_cache_memory job (cache.go)
• push_repo_memory job (repo_memory.go)
• Custom safe-jobs default (safe_jobs.go)

Note: The detection job retains its original ubuntu-latest hardcoded runner and is not affected by runs-on.

Default improvement (no config change needed)

Cache and repo-memory jobs now default to ubuntu-slim instead of ubuntu-latest, saving hosted minutes for all users.

Usage

Route every job (except detection) to self-hosted with a single entry:

runs-on: [self-hosted, linux]   # applies to agent + all support jobs except detection

Use different runners for agent vs. support jobs:

runs-on: [self-hosted, heavy]   # agent job
safe-outputs:
  runs-on: ubuntu-slim          # support jobs only

Docs

• New guide: docs/.../guides/self-hosted-runners.md
• Updated frontmatter.md and safe-outputs.md reference pages
• Updated JSON schema descriptions for runs-on and safe-outputs.runs-on

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Full self-hosted runner support</issue_title>
<issue_description>Is it possible to add support for running of all the Jobs in the Workflows here on self-hosted runners?
I followed the docs and this caused the agent job in the generated file to execute on my self-hosted runners :-)
However the other jobs all continued to be given ubuntu-slim or ubuntu-latest runners, which included activation, detection, safe_outputs, conclusion.

It is mainly the exhaustion of GitHub minutes by these surrounding Jobs that I would like to avoid.

</issue_description>

Comments on the Issue (you are @copilot in this section)

@pelikhan Copilot, ensure that the runners used in every job in the generated .lock.yml file are configurable (aside from custom jobs). Update the docs with a dedicated guide on self-hosted runners. One should be able to change the job using for activation/conclusion/safe_outputs/pre_activation with a single frontmatter entry since they all have the same runtime requirement.

• Fixes Full self-hosted runner support #17962

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[pelikhan]

@copilot do not change the logic for detection. revert changes for that job

[Copilot]

@copilot do not change the logic for detection. revert changes for that job

Reverted in 9af7b9d — threat_detection.go and its test are back to the original ubuntu-latest hardcoded value.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/workflow/features_import_test.go /home/REDACTED/work/gh-aw/gh-aw/pkg/workflow/importable_tools_test.go (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -embedcfg /tmp/go-build974847915/b334/embedcfg -pack (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/11bd71901bbe5b1630ceea73d27597364c9af683
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/11bd71901bbe5b1630ceea73d27597364c9af683 --jq .object.sha (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v7
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v7 --jq .object.sha ACCEPT (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v7 --jq .object.sha 0 -j ACCEPT (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v7 --jq .object.sha (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/4dc6199c7b1a012772edbd06daecab0f50c9053c
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/4dc6199c7b1a012772edbd06daecab0f50c9053c --jq .object.sha (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/v5
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v5 --jq .object.sha (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v6 --jq .object.sha (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha (http block)
• https://api.github.com/repos/anchore/sbom-action/git/ref/tags/v0
  • Triggering command: /usr/bin/gh gh api /repos/anchore/sbom-action/git/ref/tags/v0 --jq .object.sha (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
• https://api.github.com/repos/docker/build-push-action/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v6 --jq .object.sha (http block)
• https://api.github.com/repos/docker/login-action/git/ref/tags/v3
  • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq .object.sha (http block)
• https://api.github.com/repos/docker/metadata-action/git/ref/tags/v5
  • Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v5 --jq .object.sha (http block)
• https://api.github.com/repos/docker/setup-buildx-action/git/ref/tags/v3
  • Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v3 --jq .object.sha (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb --jq .object.sha (http block)
• https://api.github.com/repos/githubnext/agentics/git/ref/tags/
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[pelikhan]

@copilot detection should use the same runner as "agent"