Move Greenlight workflows off ubuntu-latest onto OSDC ARC runners

.github/workflows/greenlight-pr-review.yml

@@ -37,10 +37,21 @@ concurrency:
   group: greenlight-pr-review-${{ github.event.inputs.pr_number }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    # Container base (node:20-bookworm) defaults run steps to dash, which rejects
+    # `set -o pipefail`; force bash so the existing bash-syntax steps keep working.
+    shell: bash
+
 jobs:
   announce_start:
     environment: greenlight-record
-    runs-on: ubuntu-latest
+    runs-on: mt-l-x86iavx512-8-64
+    # OSDC ARC (kubernetes-novolume) has no host execution mode: steps run in this
+    # container, which is the pod that receives the runner's CPU/memory. The base image
+    # supplies node (JS actions) + git; setup-python/uv and the tools step add the rest.
+    container:
+      image: node:20-bookworm
     timeout-minutes: 15
     permissions:
       contents: read
@@ -57,13 +68,25 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Install AWS CLI v2
+        run: |
+          set -euo pipefail
+          apt-get update
+          apt-get install -y --no-install-recommends ca-certificates curl unzip
+          curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o /tmp/awscliv2.zip
+          unzip -q /tmp/awscliv2.zip -d /tmp
+          /tmp/aws/install
+          rm -rf /tmp/awscliv2.zip /tmp/aws
+
       - name: Set up Python 3.14
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: "3.14"
 
       - name: Install uv
-        uses: ./.github/actions/setup-uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
+        with:
+          version: "0.11.14"
 
       - name: Configure AWS credentials via OIDC
         uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a  # v4.3.1
@@ -105,7 +128,9 @@ jobs:
 
   review:
     environment: bedrock
-    runs-on: ubuntu-latest
+    runs-on: mt-l-x86iavx512-8-64
+    container:
+      image: node:20-bookworm
     timeout-minutes: 40
     permissions:
       contents: read
@@ -125,6 +150,20 @@ jobs:
           path: pytorch
           fetch-depth: 1
 
+      - name: Install gh and jq
+        run: |
+          set -euo pipefail
+          apt-get update
+          apt-get install -y --no-install-recommends ca-certificates curl gnupg jq
+          install -d -m 755 /etc/apt/keyrings
+          curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+            -o /etc/apt/keyrings/githubcli-archive-keyring.gpg
+          chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+            > /etc/apt/sources.list.d/github-cli.list
+          apt-get update
+          apt-get install -y --no-install-recommends gh
+
       - name: Configure AWS credentials via OIDC
         uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a  # v4.3.1
         with:
@@ -271,7 +310,9 @@ jobs:
   record:
     needs: [announce_start, review]
     if: ${{ always() }}
-    runs-on: ubuntu-latest
+    runs-on: mt-l-x86iavx512-8-64
+    container:
+      image: node:20-bookworm
     timeout-minutes: 15
     # Protected environment holding the Green Light App key (provision before first run):
     #   GREENLIGHT_APP_ID and GREENLIGHT_APP_PRIVATE_KEY. These live on this environment
@@ -293,6 +334,16 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Install AWS CLI v2 and jq
+        run: |
+          set -euo pipefail
+          apt-get update
+          apt-get install -y --no-install-recommends ca-certificates curl unzip jq
+          curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o /tmp/awscliv2.zip
+          unzip -q /tmp/awscliv2.zip -d /tmp
+          /tmp/aws/install
+          rm -rf /tmp/awscliv2.zip /tmp/aws
+
       - name: Set up Python 3.14
         # greenlight pins requires-python >=3.14 with uv python-preference=only-system,
         # so uv will not download an interpreter; CI must supply a system 3.14.
@@ -301,7 +352,9 @@ jobs:
           python-version: "3.14"
 
       - name: Install uv
-        uses: ./.github/actions/setup-uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
+        with:
+          version: "0.11.14"
 
       - name: Configure AWS credentials via OIDC
         # Ungated: success, cancelled, and failed all upload a verdict row to S3.

.github/workflows/greenlight-review.yml

@@ -56,10 +56,18 @@ permissions:
 defaults:
   run:
     working-directory: greenlight
+    # Container base (node:20-bookworm) defaults run steps to dash, which rejects
+    # `set -o pipefail`; force bash so the existing bash-syntax steps keep working.
+    shell: bash
 
 jobs:
   scan:
-    runs-on: ubuntu-latest
+    runs-on: mt-l-x86iavx512-8-64
+    # OSDC ARC (kubernetes-novolume) has no host execution mode: steps run in this
+    # container, which is the pod that receives the runner's CPU/memory. The base image
+    # supplies node (for JS actions) + git; mise-action installs Python 3.14, uv, and just.
+    container:
+      image: node:20-bookworm
     # Protected environment holding the Green Light App key: GREENLIGHT_APP_ID and
     # GREENLIGHT_APP_PRIVATE_KEY. The App must be installed on pytorch/test-infra with
     # Actions: write and Pull requests: read so the minted token can dispatch the