Remove hosted/self-hosted runner restrictions by nodeselector · Pull Request #74 · github/gh-actions-lock · GitHub
Skip to content

Remove hosted/self-hosted runner restrictions - #74

Merged
nodeselector merged 1 commit into
mainfrom
nodeselector-noop-hosted-runner-flags
Jun 29, 2026
Merged

nodeselector merged 1 commit into
mainfrom
nodeselector-noop-hosted-runner-flags

Conversation

@nodeselector

@nodeselector nodeselector commented Jun 29, 2026 •

Copy link
Copy Markdown
Collaborator

The hosted-only runner restriction was a temporary gate during initial rollout. That
gate has been lifted -- all runner labels (self-hosted, custom, expression-based,
runner groups) are now accepted for lockfile onboarding.

Approach

Rather than a phased deprecation, this removes all restriction logic in one pass
since no external consumers depend on the self-hosted skip behavior being present.

Kept as deprecated no-ops (removed in the next minor):

  • --allow-runners flag
  • -A / --allow-all-runners flag

Removed:

  • Hosted runner label map and registration (RegisterOrgHostedLabels,
    IsHostedRunnerLabel, NonHostedRunnerLabels, HasNonHostedRunnerLabels)
  • Org hosted runners API client (OrgHostedRunnerNames)
  • NonHostedRunner / NonHostedLabels fields from ParsedWorkflow
  • Diagnose block that generated SelfHostedRunner / ExpressionRunner findings
  • SelfHostedRunner and ExpressionRunner category enum values
  • Terminal rendering for self-hosted warnings (renderSelfHostedGroup,
    extractBracketedLabels, remediation hints)
  • JSON filter, pin_summary unfixable checks, finding.go switch cases
  • self-hosted-runner default in actions/lint/action.yml ignore-categories
  • runson.go and runson_test.go (no remaining consumers)
  • README limitation paragraph

Updated scenarios: six runner-related scenarios now expect successful pinning
instead of skip/error.

Copilot AI review requested due to automatic review settings June 29, 2026 21:24
GitHub Advanced Security started work on behalf of nodeselector June 29, 2026 21:25
GitHub Advanced Security finished work on behalf of nodeselector June 29, 2026 21:25

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Human review recommended

It makes a broad behavioral change by removing runner eligibility gating across parsing/diagnosis/rendering paths, warranting a final human review to confirm no unintended workflow onboarding/pinning regressions.

Pull request overview

Removes the temporary “hosted-only” runner eligibility gate so workflows using any runs-on form (self-hosted labels, custom labels, runner groups, and expressions) can be onboarded and pinned into lockfiles like hosted-runner workflows.

Changes:

  • Deletes hosted-runner allowlist logic and org hosted-runner API plumbing, along with associated findings/rendering behavior.
  • Retains --allow-runners / --allow-all-runners flags as deprecated no-ops for backward compatibility.
  • Updates integration scenarios and docs to reflect that runner labels no longer block onboarding/pinning.
File summaries
File Description
test/scenarios/catalog.yml Updates runner-related scenarios to expect successful pinning (and direct-deps coverage) instead of skip/error.
README.md Removes the hosted-runner onboarding limitation from documented limitations.
internal/workflowfile/runson.go Removes hosted-runner label allowlist and non-hosted label detection helpers; keeps runs-on label extraction.
internal/workflowfile/runson_test.go Removes tests for hosted-runner allowlist/non-hosted detection; keeps extraction tests.
internal/pipeline/run.go Stops skipping workflows based on non-hosted runner detection during the run pipeline.
internal/pipeline/parse.go Stops computing/storing non-hosted runner label metadata on parsed workflows.
internal/pipeline/diagnose.go Removes diagnosis findings for self-hosted/expression runner cases.
internal/pipeline/diagnose_test.go Removes tests asserting self-hosted runner findings behavior.
internal/pipeline/diagnose_helpers_test.go Removes special-case “self-hosted runner warning is not an issue” test.
internal/pipeline/checks/parsed.go Removes NonHostedRunner / NonHostedLabels from ParsedWorkflow.
internal/pipeline/checks/finding.go Updates validity/attention logic to no longer special-case runner-related categories.
internal/ghapi/hosted_runners.go Deletes org hosted-runners API client (no longer needed).
internal/ghapi/hosted_runners_test.go Deletes tests for the removed org hosted-runners API client.
cmd/gh-actions-lock/run.go Deprecates runner-allow flags as explicit no-ops; removes registration and org label fetching.
cmd/gh-actions-lock/root.go Removes CLI help example for --allow-runners.
cmd/gh-actions-lock/pin_summary.go Removes “self-hosted runner” from unfixable-error logic and related commentary.
cmd/gh-actions-lock/format/terminal.go Removes self-hosted/expression runner warning/error rendering paths and summary counts.
cmd/gh-actions-lock/format/terminal_test.go Removes tests specific to self-hosted/expression runner terminal rendering and label extraction helper.
cmd/gh-actions-lock/format/json.go Removes JSON filtering special-cases for self-hosted/expression runner findings.
actions/lint/action.yml Removes default ignore-category of self-hosted-runner and updates flag example text.

Review details

  • Files reviewed: 20/20 changed files
  • Comments generated: 0
  • Review effort level: Low

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@nodeselector
nodeselector force-pushed the nodeselector-noop-hosted-runner-flags branch from e1adaeb to cb5511a Compare June 29, 2026 22:54
GitHub Advanced Security started work on behalf of nodeselector June 29, 2026 22:55
GitHub Advanced Security finished work on behalf of nodeselector June 29, 2026 22:55
The hosted-only restriction was a temporary gate that is no longer needed.
All runner labels (self-hosted, custom, expression, runner groups) are now
accepted for lockfile onboarding.

The --allow-runners and -A (--allow-all-runners) flags are retained as
deprecated no-ops for backward compatibility. They will be removed in the
next minor release.

Removed:
- Self-hosted runner detection in diagnose.go and parse.go
- NonHostedRunner/NonHostedLabels fields from ParsedWorkflow
- RegisterOrgHostedLabels, IsHostedRunnerLabel, NonHostedRunnerLabels,
  HasNonHostedRunnerLabels from workflowfile/runson.go
- OrgHostedRunnerNames API client (hosted_runners.go)
- renderSelfHostedGroup, extractBracketedLabels terminal rendering
- SelfHostedRunner/ExpressionRunner from JSON skip filter, unfixable
  error checks, IsValid/IsWarning/NeedsAttention switch cases
- All related tests and scenario expectations updated
@nodeselector
nodeselector force-pushed the nodeselector-noop-hosted-runner-flags branch from cb5511a to 1656597 Compare June 29, 2026 22:56
GitHub Advanced Security started work on behalf of nodeselector June 29, 2026 22:56
GitHub Advanced Security finished work on behalf of nodeselector June 29, 2026 22:57
@nodeselector
nodeselector merged commit 5d9a23f into main Jun 29, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants