Move Greenlight workflows off ubuntu-latest onto OSDC ARC runners - #8430
Closed
jeanschmidt wants to merge 5 commits into
Closed
Move Greenlight workflows off ubuntu-latest onto OSDC ARC runners#8430jeanschmidt wants to merge 5 commits into
jeanschmidt wants to merge 5 commits into
Conversation
**Impact:** CI only — the Greenlight scan and PR-review workflows **Risk:** medium ## What Switches the `scan`, `announce_start`, `review`, and `record` jobs from `ubuntu-latest` to the OSDC ARC runner `mt-l-x86iavx512-16-32`, running each job inside a `node:20-bookworm` container and bootstrapping the CLI tools the GitHub-hosted image used to provide (jq, AWS CLI v2, gh) via the new `greenlight-container-tools` composite action. ## Why Dodging current instability with GitHub-hosted `ubuntu-latest`. Moving onto our own ARC fleet gets Greenlight off the shared hosted runners. Because ARC's kubernetes-novolume mode has no host-execution path, every step now runs in the job container, so tools that came free on the hosted image (jq, awscli, gh) have to be installed explicitly — only the ones each job actually needs. # Notes - `mise-action` still supplies Python 3.14 / uv / just on the scan job; `setup-python` handles 3.14 on the pr-review jobs. The composite action only adds the extra CLIs, requested per-job. - First run against ARC — untested vs the hosted baseline: docker.io image pull, py3.14 pypi wheel availability from cache, novolume node behavior, and the base image being tagged rather than digest-pinned are the open risks to watch. Signed-off-by: Jean Schmidt <contato@jschmidt.me>
- Add `defaults.run.shell: bash` to greenlight-review.yml - Add `defaults.run.shell: bash` to greenlight-pr-review.yml - Keep existing greenlight-review working-directory default alongside shell The container base (node:20-bookworm) from the ARC runner migration defaults run steps to dash, which rejects `set -o pipefail`. Forcing bash keeps the existing bash-syntax steps working after the move off ubuntu-latest. Signed-off-by: Jean Schmidt <contato@jschmidt.me>
meta-cla
Bot
added
the
CLA Signed
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
- Switch every job in both workflows from mt-l-x86iavx512-16-32 to mt-l-x86iavx512-8-64 - Replace the greenlight-container-tools composite action with inline apt-get/curl installs - Install AWS CLI v2 inline in announce_start and record jobs - Install gh (via apt keyring) and jq inline in the review job Notes: The 8-64 runner (8 CPU / 64 GB) fits the workload better than 16-32. Dropping the local composite action removes a repo-relative dependency and makes each job's tool setup self-contained and explicit, matching the container-based (node:20-bookworm) jobs that have no host execution mode. Signed-off-by: Jean Schmidt <contato@jschmidt.me>
- Add greenlight-container-tools composite action installing jq, AWS CLI v2, and gh on demand for minimal container base images - Replace three inline apt/curl install steps in greenlight-pr-review.yml with calls to the new action (awscli; gh+jq; awscli+jq) - Each job now requests only the tools it needs via boolean inputs Notes: The ARC runners use a minimal node:20-bookworm container that lacks the CLI tools the GitHub-hosted ubuntu image ships by default, so each job hand-rolled the same apt/curl install boilerplate. Consolidating into one composite action removes the duplication and keeps the install logic single-sourced. Signed-off-by: Jean Schmidt <contato@jschmidt.me>
jeanschmidt
temporarily deployed
to
greenlight-record
August 3, 2026 22:55 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
- Delete .github/actions/greenlight-container-tools composite action - Inline AWS CLI v2, gh, and jq installs into greenlight-pr-review.yml - Replace local ./.github/actions/setup-uv with astral-sh/setup-uv@v8.1.0 (pinned uv 0.11.14) Local `./` actions do not resolve on the kubernetes-novolume ARC runners the greenlight workflows now run on, so the checkout-dependent composite actions can't be used. Each job's tool installs move to inline run steps and uv is fetched via the remote setup-uv action. Signed-off-by: Jean Schmidt <contato@jschmidt.me>
jeanschmidt
temporarily deployed
to
greenlight-record
August 3, 2026 23:05 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
jeanschmidt
marked this pull request as draft
August 3, 2026 23:30
Contributor
Author
|
abandoning, given it seems to not worth the effort |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Impact: CI only — the Greenlight scan and PR-review workflows
Risk: low
What
Switches the
scan,announce_start,review, andrecordjobs fromubuntu-latestto the OSDC ARC runnermt-l-x86iavx512-8-64, running each job inside anode:20-bookwormcontainer and bootstrapping the CLI tools the GitHub-hosted image used to provide (jq, AWS CLI v2, gh) via the newgreenlight-container-toolscomposite action.Why
Dodging current instability with GitHub-hosted
ubuntu-latest. Moving onto our own ARC fleet gets Greenlight off the hared hosted runners. Because ARC's kubernetes-novolume mode has no host-execution path, every step now runs in the job container, so tools that came free on the hosted image (jq, awscli, gh) have to be installed explicitly — only the ones each job actually needs.And our runners should be cheaper anyways :)