ci: route lightweight workflow jobs to ubuntu-slim runners

.github/workflows/dependency-review.yml

@@ -61,7 +61,7 @@ permissions:
 jobs:
   dependency-review:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 15
 
     steps:

.github/workflows/helm-publish.yml

@@ -51,7 +51,7 @@ jobs:
   lint:
     name: Lint chart
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 10
 
     permissions:
@@ -78,7 +78,7 @@ jobs:
   publish:
     name: Package and publish to GHCR
     needs: lint
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 15
     if: |
       (

.github/workflows/lint.yml

@@ -58,21 +58,26 @@ jobs:
         target: [mcpgateway, plugins]
         tool:
           - id: ruff
+            runner: ubuntu-slim
             cmd: "uv tool run ruff==$RUFF_VERSION check $TARGET"
           - id: vulture
+            runner: ubuntu-slim
             cmd: 'uv tool run vulture==$VULTURE_VERSION $TARGET --min-confidence 80 --exclude "*_pb2.py,*_pb2_grpc.py"'
           - id: pylint
+            runner: ubuntu-latest
             cmd: >-
               uv tool run --with-editable . --with pylint-pydantic==$PYLINT_PYDANTIC_VERSION
               pylint==$PYLINT_VERSION $TARGET
               --rcfile=.pylintrc.$TARGET --fail-on E --fail-under=10 --jobs=0
           - id: interrogate
+            runner: ubuntu-slim
             cmd: "uv tool run interrogate==$INTERROGATE_VERSION -vv $TARGET --fail-under 100"
           - id: radon
+            runner: ubuntu-slim
             cmd: "uv tool run radon==$RADON_VERSION cc $TARGET --min C --show-complexity && uv tool run radon==$RADON_VERSION mi $TARGET --min B"
 
     name: "${{ matrix.tool.id }} (${{ matrix.target }})"
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.tool.runner }}
     timeout-minutes: 20
 
     steps:
@@ -126,7 +131,7 @@ jobs:
                 xargs -0 -I{} uv tool run tomlcheck==$TOMLCHECK_VERSION "{}"
 
     name: ${{ matrix.id }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 10
 
     steps:

.github/workflows/linting-full.yml

@@ -21,7 +21,7 @@ jobs:
   linting-full:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: linting-full
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 30
 
     steps:

.github/workflows/python-package.yml

@@ -32,7 +32,7 @@ permissions:
 jobs:
   build-package:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 20
 
     # Build the package under multiple Python versions to catch ABI issues early

.github/workflows/vitest.yml

@@ -39,7 +39,7 @@ jobs:
   vitest:
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: vitest
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 15
 
     steps:

.pre-commit-config.yaml

@@ -601,7 +601,7 @@ repos:
       - id: check-ci-workflows
         name: 🔐 Check CI Workflows
         description: Verifies CI workflow YAML structure and SHA pinning.
-        entry: uv run python3 scripts/pre-commit/check_ci_workflows.py
+        entry: uv run --no-project --with pyyaml python3 scripts/pre-commit/check_ci_workflows.py
         language: system
         pass_filenames: false
         files: ^\.github/workflows/|^Makefile$