ci: run CI on the self-hosted triton runners

.github/actions/rust-setup/action.yaml

@@ -27,12 +27,20 @@ runs:
         wget -q https://github.com/protocolbuffers/protobuf/releases/download/v21.8/protoc-21.8-linux-x86_64.zip
         unzip -q protoc*.zip
         sudo mv bin/protoc /usr/local/bin
-        sudo mv include/google /usr/local/include
+        # cp, not mv: a self-hosted runner keeps /usr/local/include/google from
+        # the previous job, and mv refuses to replace a non-empty directory.
+        sudo cp -r include/google /usr/local/include/
         rm -rf protoc*.zip bin include readme.txt
 
+    # make-default replaces the system /usr/bin/ld with mold. That is fine on a
+    # throwaway GitHub-hosted VM, but a self-hosted runner keeps it for every
+    # later job, including other repos' builds, so there mold is installed
+    # without taking over ld.
     - name: Setup mold linker
       if: inputs.mold == 'true'
       uses: rui314/setup-mold@v1
+      with:
+        make-default: ${{ runner.environment == 'github-hosted' }}
 
     - name: Install toolchain
       uses: dtolnay/rust-toolchain@master

.github/workflows/audit-rust.yaml

@@ -25,7 +25,9 @@ concurrency:
 
 jobs:
   audit:
-    runs-on: ubuntu-latest
+    # Pull requests from forks stay on GitHub-hosted runners: the repo is
+    # public, and self-hosted runners must not run untrusted code.
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('{"group":"triton","labels":["self-hosted","APP"]}') || 'ubuntu-latest' }}
 
     steps:
       - name: Checkout code

.github/workflows/ci-rust.yaml

@@ -39,7 +39,9 @@ env:
 jobs:
   check:
     name: Test
-    runs-on: ubuntu-latest
+    # Pull requests from forks stay on GitHub-hosted runners: the repo is
+    # public, and self-hosted runners must not run untrusted code.
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('{"group":"triton","labels":["self-hosted","APP"]}') || 'ubuntu-latest' }}
     timeout-minutes: 45
     services:
       postgres:
@@ -59,7 +61,11 @@ jobs:
       METEROID_TEST_PG_URL: postgres://postgres:postgres@127.0.0.1:5432/postgres
     steps:
       - uses: actions/checkout@v7
+      # Strips the GitHub-hosted image to make room. On a self-hosted runner it
+      # would uninstall toolchains and prune Docker images that later jobs
+      # rely on, and those runners have the disk to spare.
       - name: Free disk space
+        if: runner.environment == 'github-hosted'
         run: |
           df -h
           sudo apt-get remove -y '^llvm-.*'
@@ -92,7 +98,9 @@ jobs:
 
   fmt:
     name: Rustfmt
-    runs-on: ubuntu-latest
+    # Pull requests from forks stay on GitHub-hosted runners: the repo is
+    # public, and self-hosted runners must not run untrusted code.
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('{"group":"triton","labels":["self-hosted","APP"]}') || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
@@ -105,7 +113,9 @@ jobs:
 
   clippy:
     name: Clippy
-    runs-on: ubuntu-latest
+    # Pull requests from forks stay on GitHub-hosted runners: the repo is
+    # public, and self-hosted runners must not run untrusted code.
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('{"group":"triton","labels":["self-hosted","APP"]}') || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup

.github/workflows/ci-ui.yaml

@@ -18,7 +18,9 @@ concurrency:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    # Pull requests from forks stay on GitHub-hosted runners: the repo is
+    # public, and self-hosted runners must not run untrusted code.
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('{"group":"triton","labels":["self-hosted","APP"]}') || 'ubuntu-latest' }}
     name: Lint
     env:
       TURBO_TELEMETRY_DISABLED: true

.github/workflows/docker.yaml

@@ -44,12 +44,15 @@ jobs:
             proto_arch: x86_64
             grpc_health_probe_arch: amd64
             prefix: amd64
-            runs_on: ubuntu-latest
+            runs_on:
+              group: triton
+              labels: [self-hosted, APP]
           - platform: linux/arm64
             mold_arch: aarch64
             proto_arch: aarch_64
             grpc_health_probe_arch: arm64
             prefix: arm64
+            # GitHub-hosted: there are no arm64 self-hosted runners.
             runs_on: ubuntu-24.04-arm
     runs-on: ${{ matrix.runs_on }}
     steps:
@@ -113,17 +116,20 @@ jobs:
           provenance: false
           outputs: type=image,name=${{ env.IMAGE_PREFIX }}/${{ matrix.image_type.name }},push-by-digest=true,name-canonical=true,push=true,store=true
 
+      # Under runner.temp, which the runner empties after every job. A fixed
+      # /tmp path survives on a self-hosted runner, and the manifest job would
+      # then pick up digests left by earlier builds.
       - name: Export digest
         run: |
-          mkdir -p /tmp/digests/${{ matrix.image_type.name }}
+          mkdir -p ${{ runner.temp }}/digests/${{ matrix.image_type.name }}
           digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests/${{ matrix.image_type.name }}/${digest#sha256:}"
+          touch "${{ runner.temp }}/digests/${{ matrix.image_type.name }}/${digest#sha256:}"
 
       - name: Upload digest
         uses: actions/upload-artifact@v7
         with:
           name: digests-${{ matrix.image_type.name }}-${{ env.PLATFORM_PAIR }}
-          path: /tmp/digests/${{ matrix.image_type.name }}/*
+          path: ${{ runner.temp }}/digests/${{ matrix.image_type.name }}/*
           retention-days: 1
 
   manifest:
@@ -135,12 +141,14 @@ jobs:
           - meteroid-scheduler
           - metering-api
           - meteroid-web
-    runs-on: ubuntu-latest
+    runs-on:
+      group: triton
+      labels: [self-hosted, APP]
     steps:
       - name: Download digests
         uses: actions/download-artifact@v8
         with:
-          path: /tmp/digests
+          path: ${{ runner.temp }}/digests
           pattern: digests-${{ matrix.image_type }}-*
           merge-multiple: true
 
@@ -174,7 +182,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create and push manifest list
-        working-directory: /tmp/digests
+        working-directory: ${{ runner.temp }}/digests
         run: |
           tags=()
           while IFS= read -r tag; do
@@ -190,7 +198,7 @@ jobs:
 
       - name: Push tip tag
         if: github.ref == 'refs/heads/main'
-        working-directory: /tmp/digests
+        working-directory: ${{ runner.temp }}/digests
         run: |
           images=()
           for digest in *; do

.github/workflows/openapi-rust.yaml

@@ -29,7 +29,9 @@ env:
 jobs:
   openapi:
     name: Open API
-    runs-on: ubuntu-latest
+    # Pull requests from forks stay on GitHub-hosted runners: the repo is
+    # public, and self-hosted runners must not run untrusted code.
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('{"group":"triton","labels":["self-hosted","APP"]}') || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup

.github/workflows/release-artifact.yaml

@@ -27,10 +27,13 @@ concurrency:
 jobs:
   build:
     name: Build deploy artifact
-    # Pinned, not ubuntu-latest. The deploy targets run Ubuntu 24.04 and these
-    # binaries are dynamically linked; a runner on a newer glibc would produce
-    # binaries that will not load there.
-    runs-on: ubuntu-24.04
+    # The deploy targets run Ubuntu 24.04 and these binaries are dynamically
+    # linked; a runner on a newer glibc would produce binaries that will not
+    # load there. The triton runners are Ubuntu 24.04 too: move this back to
+    # a pinned ubuntu-24.04 image if that ever stops being true.
+    runs-on:
+      group: triton
+      labels: [self-hosted, APP]
     timeout-minutes: 60
 
     steps:

.github/workflows/release-drafter.yml

@@ -21,7 +21,9 @@ jobs:
     permissions:
       pull-requests: read
     name: Validate PR title
-    runs-on: ubuntu-latest
+    # Pull requests from forks stay on GitHub-hosted runners: the repo is
+    # public, and self-hosted runners must not run untrusted code.
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('{"group":"triton","labels":["self-hosted","APP"]}') || 'ubuntu-latest' }}
     if: github.event_name == 'pull_request'
     steps:
       - uses: amannn/action-semantic-pull-request@v6
@@ -48,7 +50,9 @@ jobs:
       # write permission is required for autolabeler
       # otherwise, read permission is required at least
       pull-requests: write
-    runs-on: ubuntu-latest
+    # Pull requests from forks stay on GitHub-hosted runners: the repo is
+    # public, and self-hosted runners must not run untrusted code.
+    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('{"group":"triton","labels":["self-hosted","APP"]}') || 'ubuntu-latest' }}
     steps:
       # (Optional) GitHub Enterprise requires GHE_HOST variable set
       #- name: Set GHE_HOST