ci: move pytest/packaging/security to GitHub-hosted ubuntu-latest (repo is public) - #177
Merged
Merged
Conversation
…public The lenovo self-hosted runner was attached to motionvector-dev/spacepilot, which is a PUBLIC repo — AGENTS.md's standing rule is 'private repo only, never attach a self-hosted runner to a public one (fork PRs execute arbitrary code on the box)'. That configuration was an active vulnerability for as long as forks could open PRs against any ref the runner was attached to. The runner has been detached from this repo (2026-09-25), before this commit lands, so the window in which a fork PR could have triggered a run on it has stalled at 'runs the tests in a sandboxed venv, but still'. - pytest / packaging / security -> ubuntu-latest - verify-system-packages step now documents the ubuntu-latest assumption and the fix to run if it ever stops holding - no workflow changes to triggers/scoping: paths-ignore and the push/pull_request filters already skip md/docs/LICENSE - publish.yml was already ubuntu-latest Waste guardrails kept as-is. The infra story moves from 'the one laptop burning its own CPU' to 'the free quota we were already entitled to', with no new gate added.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The repo is PUBLIC, and the lenovo self-hosted runner was attached to it — AGENTS.md's standing rule is 'never attach a self-hosted runner to a public repo (fork PRs execute arbitrary code on the box)'. That was an active vulnerability until the runner was detached from the repo the moment this inconsistency was noticed (2026-09-25, before this PR landed).
Changes:
ubuntu-latestPost-merge, every job costs GitHub-hosted minutes; this stays inside the free tier at current cadence, and the repo loses its dependency on one laptop burning its own CPU.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.