From e724dcfc67a18f418506e71426b88e1916d76942 Mon Sep 17 00:00:00 2001
From: Kyle Tse <hi@kylet.se>
Date: Mon, 27 Jul 2026 08:39:25 +0000
Subject: [PATCH] ci: move image reader to owned runners

Use the static Sylphx Linux runner profile for validation, registry publishing, and release work, with an in-repo workflow conformance check.

Work: wi_01KYFN6993PMG8WD00Q51AE231

Claim/run: fleet-agent-work / codex-ts-false-authority-20260726
---
 .../scripts/check-owned-runner-profiles.py    | 58 +++++++++++++++++++
 .github/workflows/ci.yml                      |  5 +-
 .github/workflows/publish-mcp-registry.yml    |  4 +-
 .github/workflows/release.yml                 |  4 +-
 4 files changed, 66 insertions(+), 5 deletions(-)
 create mode 100644 .github/scripts/check-owned-runner-profiles.py

diff --git a/.github/scripts/check-owned-runner-profiles.py b/.github/scripts/check-owned-runner-profiles.py
new file mode 100644
index 0000000..2ebcc68
--- /dev/null
+++ b/.github/scripts/check-owned-runner-profiles.py
@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+"""Reject hosted, dynamic, or noncanonical CI runner selectors."""
+
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+
+RUNS_ON = re.compile(r"^\s*runs-on\s*:\s*(?P<value>[^#]+?)(?:\s+#.*)?$")
+LINUX = re.compile(r"^sylphx-linux-(?:control|standard|large|xlarge|2xlarge)$")
+MACOS_SIZES = {"nano", "small", "standard", "large", "xlarge", "2xlarge"}
+
+
+def unquote(value: str) -> str:
+    return value.strip().strip("\"'")
+
+
+def is_owned(value: str) -> bool:
+    value = unquote(value)
+    if LINUX.fullmatch(value):
+        return True
+    if not (value.startswith("[") and value.endswith("]")):
+        return False
+    labels = [unquote(label).lower() for label in value[1:-1].split(",") if label.strip()]
+    return (
+        len(labels) == 2
+        and labels[0] == "self-hosted"
+        and LINUX.fullmatch(labels[1]) is not None
+    ) or (
+        len(labels) == 4
+        and labels[:3] == ["self-hosted", "sylphx", "macos"]
+        and labels[3] in MACOS_SIZES
+    )
+
+
+def main() -> int:
+    root = Path(__file__).resolve().parents[2]
+    workflows = sorted((root / ".github" / "workflows").glob("*.y*ml"))
+    errors: list[str] = []
+    for workflow in workflows:
+        for line, raw in enumerate(workflow.read_text(encoding="utf-8").splitlines(), 1):
+            match = RUNS_ON.match(raw)
+            if not match:
+                continue
+            value = match.group("value").strip()
+            if "${{" in value or not is_owned(value):
+                errors.append(f"{workflow.relative_to(root)}:{line}: forbidden runner selection {value!r}")
+    if errors:
+        print("\n".join(errors), file=sys.stderr)
+        return 1
+    print(f"OK: {len(workflows)} workflow(s) use static owned runner profiles")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index abf4cf7..b6e3105 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,11 +11,14 @@ on:
 jobs:
   validate:
     name: Validate
-    runs-on: ubuntu-latest
+    runs-on: sylphx-linux-standard
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7.0.0
 
+      - name: Enforce owned CI runner profiles
+        run: python3 .github/scripts/check-owned-runner-profiles.py
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
diff --git a/.github/workflows/publish-mcp-registry.yml b/.github/workflows/publish-mcp-registry.yml
index ac863f0..3eb55ee 100644
--- a/.github/workflows/publish-mcp-registry.yml
+++ b/.github/workflows/publish-mcp-registry.yml
@@ -17,7 +17,7 @@ permissions:
 jobs:
   publish:
     name: Publish MCP Registry metadata
-    runs-on: ubuntu-latest
+    runs-on: sylphx-linux-standard
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7.0.0
@@ -53,4 +53,4 @@ jobs:
             exit 0
           fi
           git commit -m "chore(registry): sync server.json to ${GITHUB_REF_NAME}"
-          git push origin HEAD:main
\ No newline at end of file
+          git push origin HEAD:main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2ca78a1..e1f2ee0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ permissions:
 jobs:
   release:
     name: Release
-    runs-on: ubuntu-latest
+    runs-on: sylphx-linux-standard
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7.0.0
@@ -51,4 +51,4 @@ jobs:
           createGithubReleases: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
\ No newline at end of file
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}