From 6a5f4758d0ef7ddb15cffb8e4a9e86f53907aa60 Mon Sep 17 00:00:00 2001 From: George Oastler Date: Thu, 13 Aug 2026 17:21:54 +0100 Subject: [PATCH] ci: document why this public repo stays on hosted runners --- .github/workflows/lint.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 21e598a..e7a7521 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -22,6 +22,14 @@ jobs: # no checks at all, so the required context could never be satisfied and every # PR was permanently unmergeable. check: + # Hosted, and deliberately not routed through `vars.GH_RUNNER` the way the + # private repos are: this repository is public, so a fork PR would run on + # the self-hosted fleet -- executing arbitrary contributor code on hardware + # we own, where it can also persist and poison later trusted jobs. Nothing + # is given up by staying hosted: standard GitHub-hosted runners are free + # and unlimited on public repos, macOS and Windows included. Only *larger* + # runners are billed, so do not "upgrade" a job to one. + # https://docs.github.com/en/billing/reference/actions-runner-pricing runs-on: ubuntu-latest steps: - uses: actions/checkout@v4