CI regression: pull requests still invoke GitHub-hosted test runners

[hummbl-dev]

Problem

The standing repository constraint is no GitHub-hosted Actions minutes. Self-hosted runners are allowed.

PR #138 was merged with the stated intent of switching all workflows to [self-hosted, Linux, X64, wsl, arbiter], but current main still contains this job in .github/workflows/ci.yml:

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.11", "3.12", "3.13"]

The workflow triggers on every pull request to main, so opening a PR currently risks three GitHub-hosted jobs.

Immediate impact

Implementation for #141 is preserved on branch feat/risk-scanner-phase-1, but no PR was opened because doing so would violate the no-hosted-minutes constraint.

Required investigation

1. Determine which post-fix(ci): switch workflows to self-hosted runner #138 change reintroduced ubuntu-latest for the test job.
2. Restore the intended self-hosted runner labels without changing test semantics.
3. Verify every active PR-triggered workflow in this repository uses approved self-hosted labels.
4. Confirm that opening a draft PR does not schedule any GitHub-hosted runner.

Acceptance criteria

• .github/workflows/ci.yml test job uses approved self-hosted labels.
• Repository-wide search finds no active PR workflow using GitHub-hosted runner labels.
• Local workflow inspection is documented.
• Phase 1: local codebase risk scanner vertical slice #141 can open a draft PR without consuming GitHub-hosted Actions minutes.

Constraint

Do not open a test PR merely to prove this until static inspection confirms no GitHub-hosted jobs can be scheduled.

[hummbl-dev]

P0 blocker check complete on feat/risk-scanner-phase-1. The regression was introduced in commit 9a9abe2, where ci.yml test job changed from self-hosted to ubuntu-latest. I updated ci.yml to use [self-hosted, Linux, X64, wsl, arbiter] for the test job and re-scanned workflow files for hosted runner labels.

[hummbl-dev]

P0 dedicated CI repair branch is now live: fix/ci/restore-self-hosted-test-job (commit 563f955) and draft PR opened at #143.
This lane is bounded to .github/workflows/ci.yml one-line runner-label correction only (ubuntu-latest -> [self-hosted, Linux, X64, wsl, arbiter]), preserving matrix/test semantics.
Regression source identified as 9a9abe2.
Keep #142 open until merge to main; this is not a local-only fix.

[hummbl-dev]

Follow-up after dedicated lane:

• PR fix(ci): restore self-hosted PR test runner #143 opened from fix/ci/restore-self-hosted-test-job and is still the blocker-gating repair path.
• This PR contains only the one-line ci.yml runner-label correction and is intentionally separate from scanner PR scope.
• Regression source still tracked as 9a9abe2.
• Keep this issue open until merge to main and CI runner-scope audit is revalidated.

[hummbl-dev]

CI repair status update: PR #143 has been merged. Branch ix/ci/restore-self-hosted-test-job is closed as planned. Scanner branch remains at eat/risk-scanner-phase-1 and has been rebased onto merged origin/main (tip includes PR #143 commit 47ab96).

[hummbl-dev]

CI repair status update: PR #143 (fix(ci): restore self-hosted PR test runner) is MERGED at 2026-07-21T16:36:32Z and includes the one-line runner-label restoration tied to issue #142.

Evidence from current tree:

• rg -n "runs-on:" .github/workflows -g '*.yml' -> all jobs currently use [self-hosted, Linux, X64, wsl, arbiter].
• rg -n "ubuntu-latest|windows-latest|macos-latest" .github/workflows -g '*.yml' -> no matches.

Given this, #142 is no longer blocking scanner PR from a runner-hosting perspective.

[hummbl-dev]

$Review comment:

• Batch 1 status: QUESTION + execution hold.

Live issue evidence is sufficient to keep the hold in force:

• main still contains a PR-triggered workflow using ubuntu-latest.
• Accepting this state risks GitHub-hosted runner execution.

Required before any draft PR can be opened:

1. Static inspection evidence identifying the reintroduction path.
2. Restoration of only approved self-hosted labels.
3. Repository-wide confirmation that no active PR workflow schedules GitHub-hosted runners.

Requested information:

• Owner/assignee for the fix.
• Date the static verification evidence will be posted here.

[hummbl-dev]

Batch 4 dependency-risk receipt ? 2026-07-22

PORTFOLIO_MONITORING_DEPENDENCY_RISK
Risk tier: HIGH

Dependency map

• Blocked by: .github/workflows migration to self-hosted labels.
• Blocks: hummbl-governance#252 (fleet runner trust policy) ? unable to finalize taxonomy without first resolving CI regression.
• Cross-repo consumers: arbiter PR workflow definitions.

State

PR #138 intended to switch all workflows to self-hosted labels, but main still contains GitHub-hosted runners. Active violation of no-GitHub-hosted-actions-minutes constraint.

Non-mutations

No mutations.

[hummbl-dev]

---

Automated triage run (2026-07-24)

• Category: bug
• Priority: P1
• Severity: high
• Staleness: fresh
• Recommended next action: Merge the ci.yml fix restoring self-hosted labels and verify no active PR-triggered workflow in the repository uses GitHub-hosted runner labels.

Notes: The test job in ci.yml was reverted to ubuntu-latest in commit 9a9abe2, violating the no-hosted-minutes constraint. A fix exists on feat/risk-scanner-phase-1 but has not been merged.

[hummbl-dev]

Operator confirmation (2026-07-24): GitHub Actions billing has been resolved — the bill is paid. The 'zero hosted minutes' constraint is no longer active. Please update any dependent work that was blocked on this. Removing billing from the active decision queue.

[hummbl-dev]

Operator confirmation: GitHub Actions billing resolved. Assessing whether the no-hosted-minutes constraint still applies or if ubuntu-latest is now acceptable.

[hummbl-dev]

Assessment: Issue already resolved on main

Investigation

Current main (commit 460e93c) was inspected:

ci.yml test job — already uses self-hosted labels:

runs-on: [self-hosted, Linux, X64, wsl, arbiter]

Repository-wide audit — no GitHub-hosted runner labels found:

rg -n "ubuntu-latest|windows-latest|macos-latest" .github/workflows -g '*.yml'
# no matches

Fix history

The regression (introduced in 9a9abe2) was fixed in commit 563f955 ("fix(ci): restore self-hosted PR test runner") and merged via PR #143. The feat/risk-scanner-phase-1 branch was subsequently merged via PR #144. All workflows now use [self-hosted, Linux, X64, wsl, arbiter].

Constraint status

Per operator confirmation (2026-07-24): GitHub Actions billing is resolved and the 'zero hosted minutes' constraint is no longer active. ubuntu-latest would now be acceptable. However, the current self-hosted configuration is also fine and already in place.

Acceptance criteria

• .github/workflows/ci.yml test job uses approved self-hosted labels
• Repository-wide search finds no active PR workflow using GitHub-hosted runner labels
• Local workflow inspection documented (this comment)
• Phase 1: local codebase risk scanner vertical slice #141 can open a draft PR without consuming GitHub-hosted Actions minutes

Recommendation

No further action needed. The fix is already on main and the constraint is lifted. Closing this issue as resolved.