diff --git a/.github/workflows/adr29-admission.yml b/.github/workflows/adr29-admission.yml index eedecea..518ed40 100644 --- a/.github/workflows/adr29-admission.yml +++ b/.github/workflows/adr29-admission.yml @@ -42,11 +42,6 @@ on: type: string required: false default: adr29-admission-manifest.json - runs-on: - description: Approved Sylphx runner profile for the admission job. - type: string - required: false - default: sylphx-linux-standard base-ref: description: Base ref for diff calculation. type: string @@ -76,7 +71,7 @@ permissions: jobs: admission: name: ${{ inputs.check-name }} - runs-on: [self-hosted, "${{ inputs.runs-on }}"] + runs-on: sylphx-linux-standard steps: - name: Checkout caller repository uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 diff --git a/.github/workflows/project-control.yml b/.github/workflows/project-control.yml index b026db4..f05739f 100644 --- a/.github/workflows/project-control.yml +++ b/.github/workflows/project-control.yml @@ -31,13 +31,14 @@ jobs: reusable=.github/workflows/adr29-admission.yml template=templates/workflows/adr29-admission.yml project_control=.github/workflows/project-control.yml - test "$(grep -Ec '^[[:space:]]*default:[[:space:]]*sylphx-linux-standard$' "$reusable")" -eq 1 - grep -Eq '^[[:space:]]*runs-on:[[:space:]]*\[self-hosted,[[:space:]]*"[$][{][{][[:space:]]*inputs\.runs-on[[:space:]]*[}][}]"[[:space:]]*\]$' "$reusable" + test "$(grep -Ec '^[[:space:]]*runs-on:' "$reusable")" -eq 1 + test "$(grep -Ec '^[[:space:]]*runs-on:[[:space:]]*sylphx-linux-standard$' "$reusable")" -eq 1 test "$(grep -Ec '^[[:space:]]*runs-on:' "$template")" -eq 4 test "$(grep -Ec '^[[:space:]]*runs-on:[[:space:]]*sylphx-linux-standard$' "$template")" -eq 4 - grep -Eq '^[[:space:]]*runs-on:[[:space:]]*sylphx-linux-standard$' "$project_control" - if grep -REn '^[[:space:]]*runs-on:[[:space:]]*(ubuntu|macos|windows)-' "$reusable" "$template" "$project_control"; then - echo '::error::GitHub-hosted runner declarations are not allowed in ADR-29 policy surfaces' + test "$(grep -Ec '^[[:space:]]*runs-on:' "$project_control")" -eq 1 + test "$(grep -Ec '^[[:space:]]*runs-on:[[:space:]]*sylphx-linux-standard$' "$project_control")" -eq 1 + if grep -REn '^[[:space:]]*runs-on:[[:space:]]*.*[$][{][{]' "$reusable" "$template" "$project_control"; then + echo '::error::dynamic runner declarations are not allowed in ADR-29 policy surfaces' exit 1 fi - name: Check Changesets publisher syntax