From 25cd8bdef50e78af251521353d479f42ad28a923 Mon Sep 17 00:00:00 2001 From: Kombiz Lavasany Date: Wed, 9 Sep 2026 14:26:36 -0500 Subject: [PATCH 1/3] ci: route safe Linux workflows to self-hosted runners Signed-off-by: Kombiz Lavasany --- .github/workflows/benchmark-harbor.yml | 2 +- .github/workflows/docker.yml | 8 ++++---- .github/workflows/helm-chart.yml | 6 +++--- .github/workflows/push-gateway-helm-chart.yml | 4 ++-- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/benchmark-harbor.yml b/.github/workflows/benchmark-harbor.yml index 31efe933c58..89683a97c27 100644 --- a/.github/workflows/benchmark-harbor.yml +++ b/.github/workflows/benchmark-harbor.yml @@ -17,7 +17,7 @@ permissions: jobs: test: name: Python tests and lint - runs-on: ubuntu-latest + runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'onlyarag-linux-x64' }} timeout-minutes: 15 steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 31080652eaf..a4f2558b2ab 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -89,7 +89,7 @@ jobs: matrix: include: - platform: linux/amd64 - runner: ubuntu-24.04 + runner: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || 'onlyarag-linux-x64-docker' }} arch: amd64 - platform: linux/arm64 runner: ubuntu-24.04-arm @@ -200,7 +200,7 @@ jobs: merge: name: Merge multi-arch manifest if: github.event_name != 'pull_request' - runs-on: ubuntu-24.04 + runs-on: onlyarag-linux-x64-docker needs: build timeout-minutes: 15 permissions: @@ -315,7 +315,7 @@ jobs: matrix: include: - platform: linux/amd64 - runner: ubuntu-24.04 + runner: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || 'onlyarag-linux-x64-docker' }} arch: amd64 - platform: linux/arm64 runner: ubuntu-24.04-arm @@ -383,7 +383,7 @@ jobs: push-gateway-merge: name: Publish public push gateway image if: github.event_name != 'pull_request' - runs-on: ubuntu-24.04 + runs-on: onlyarag-linux-x64-docker needs: push-gateway-build timeout-minutes: 15 permissions: diff --git a/.github/workflows/helm-chart.yml b/.github/workflows/helm-chart.yml index e3d443d9f36..c28232ddac5 100644 --- a/.github/workflows/helm-chart.yml +++ b/.github/workflows/helm-chart.yml @@ -55,7 +55,7 @@ env: jobs: lint-and-unittest: name: lint + unittest + render matrix - runs-on: ubuntu-latest + runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'onlyarag-linux-x64' }} permissions: contents: read steps: @@ -114,7 +114,7 @@ jobs: # carries a version): that path only packages+publishes, it does not install. name: install on kind (gated) if: github.event_name == 'workflow_dispatch' && inputs.version == '' - runs-on: ubuntu-latest + runs-on: onlyarag-linux-x64-docker needs: lint-and-unittest permissions: contents: read @@ -158,7 +158,7 @@ jobs: if: > startsWith(github.ref, 'refs/tags/chart-v') || (github.event_name == 'workflow_dispatch' && inputs.version != '') - runs-on: ubuntu-latest + runs-on: onlyarag-linux-x64-docker needs: lint-and-unittest timeout-minutes: 15 permissions: diff --git a/.github/workflows/push-gateway-helm-chart.yml b/.github/workflows/push-gateway-helm-chart.yml index 1aaa9100219..0d662d53847 100644 --- a/.github/workflows/push-gateway-helm-chart.yml +++ b/.github/workflows/push-gateway-helm-chart.yml @@ -20,7 +20,7 @@ env: CHART_REPO: oci://ghcr.io/block/buzz/charts jobs: validate: - runs-on: ubuntu-latest + runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'onlyarag-linux-x64' }} permissions: { contents: read } steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 @@ -34,7 +34,7 @@ jobs: publish: if: github.event_name != 'pull_request' needs: validate - runs-on: ubuntu-latest + runs-on: onlyarag-linux-x64-docker permissions: contents: read packages: write From a6cfab0fa2d611da04b3053c3925fb4d69e369b6 Mon Sep 17 00:00:00 2001 From: Kombiz Lavasany Date: Wed, 9 Sep 2026 14:31:01 -0500 Subject: [PATCH 2/3] ci: recognize same-repository fork pull requests Signed-off-by: Kombiz Lavasany --- .github/workflows/benchmark-harbor.yml | 2 +- .github/workflows/docker.yml | 4 ++-- .github/workflows/helm-chart.yml | 2 +- .github/workflows/push-gateway-helm-chart.yml | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/benchmark-harbor.yml b/.github/workflows/benchmark-harbor.yml index 89683a97c27..94b980b013a 100644 --- a/.github/workflows/benchmark-harbor.yml +++ b/.github/workflows/benchmark-harbor.yml @@ -17,7 +17,7 @@ permissions: jobs: test: name: Python tests and lint - runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'onlyarag-linux-x64' }} + runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'onlyarag-linux-x64' }} timeout-minutes: 15 steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index a4f2558b2ab..b0e18785509 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -89,7 +89,7 @@ jobs: matrix: include: - platform: linux/amd64 - runner: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || 'onlyarag-linux-x64-docker' }} + runner: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-24.04' || 'onlyarag-linux-x64-docker' }} arch: amd64 - platform: linux/arm64 runner: ubuntu-24.04-arm @@ -315,7 +315,7 @@ jobs: matrix: include: - platform: linux/amd64 - runner: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || 'onlyarag-linux-x64-docker' }} + runner: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-24.04' || 'onlyarag-linux-x64-docker' }} arch: amd64 - platform: linux/arm64 runner: ubuntu-24.04-arm diff --git a/.github/workflows/helm-chart.yml b/.github/workflows/helm-chart.yml index c28232ddac5..db493f95fb0 100644 --- a/.github/workflows/helm-chart.yml +++ b/.github/workflows/helm-chart.yml @@ -55,7 +55,7 @@ env: jobs: lint-and-unittest: name: lint + unittest + render matrix - runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'onlyarag-linux-x64' }} + runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'onlyarag-linux-x64' }} permissions: contents: read steps: diff --git a/.github/workflows/push-gateway-helm-chart.yml b/.github/workflows/push-gateway-helm-chart.yml index 0d662d53847..b43336b4158 100644 --- a/.github/workflows/push-gateway-helm-chart.yml +++ b/.github/workflows/push-gateway-helm-chart.yml @@ -20,7 +20,7 @@ env: CHART_REPO: oci://ghcr.io/block/buzz/charts jobs: validate: - runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'onlyarag-linux-x64' }} + runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 'ubuntu-latest' || 'onlyarag-linux-x64' }} permissions: { contents: read } steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 From 3eb8f5b573d6d2d9bf6d06d0a44ab3937017bef8 Mon Sep 17 00:00:00 2001 From: Kombiz Lavasany Date: Fri, 25 Sep 2026 02:38:04 -0500 Subject: [PATCH 3/3] ci: tear down Postgres/Redis/MinIO fixtures at job end The owner registered these as ephemeral per-job CI fixtures on 2026-09-25 (self-hosted-ci-buzz): job-scoped containers, destroyed at job end, nothing persistent. The two ci.yml jobs that start them with `docker compose up -d postgres redis minio minio-init` (desktop-e2e-integration-shard, backend-integration) now end with an always() step that runs `docker compose down --volumes --remove-orphans`, so the containers and the buzz-postgres-data / buzz-minio-data volumes are removed even on failure or cancellation. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index acdf5237bd8..87f20bc82c9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -540,6 +540,11 @@ jobs: with: path: ${{ steps.pnpm-cache.outputs.STORE_PATH }} key: pnpm-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }} + - name: Tear down ephemeral integration fixtures + # Job-scoped CI fixtures: remove the Postgres/Redis/MinIO containers + # and their named volumes at job end so nothing persists on the runner. + if: always() + run: docker compose down --volumes --remove-orphans desktop-e2e-integration: name: Desktop E2E Integration @@ -698,6 +703,11 @@ jobs: name: backend-integration-relay-log path: /tmp/buzz-relay.log if-no-files-found: ignore + - name: Tear down ephemeral integration fixtures + # Job-scoped CI fixtures: remove the Postgres/Redis/MinIO containers + # and their named volumes at job end so nothing persists on the runner. + if: always() + run: docker compose down --volumes --remove-orphans relay-e2e: name: Relay E2E