ci: run jobs on the self-hosted runners

[Coldaine]

User description

Moves this repository's GitHub Actions jobs from GitHub-hosted runners (ubuntu-latest) to our own runners: the moosegoose-linux scale set that GARM runs in the homelab cluster.

Note: this repository is public. GitHub-hosted runners are still free for it, so nothing here is broken today; this moves it only so that every repository runs on the same runners. A pull request from a fork keeps running on GitHub-hosted runners, so a stranger's code never runs on the homelab. The org also requires approval before any outside contributor's workflow runs.

What changed: only the runs-on line of each job. Every job now reads

runs-on: ${{ (github.event.pull_request.head.repo.fork || vars.CI_FORCE_HOSTED == 'true') && 'ubuntu-latest' || 'moosegoose-linux' }}

which picks moosegoose-linux, except for a fork's pull request or when the org variable CI_FORCE_HOSTED is true (the org-wide switch back to hosted runners). The job steps are unchanged.

About the runner: it is an Ubuntu container from ghcr.io/actions/actions-runner with Node 24, Python 3, build-essential, git-lfs and yq preinstalled, and it has its own Docker daemon, so Docker builds, container: jobs and services: work. Anything else a job needs has to be installed by the job, as it would on a hosted runner.

Worth watching on the first run: the visual tests install xvfb and other system packages with sudo apt-get; the runner image does not ship them. Existing actionlint findings in these files are unchanged by this PR.

🤖 Generated with Claude Code

---

CodeAnt-AI Description

Run CI and visual checks on the organization’s self-hosted runners

What Changed

• Standard tests, lint checks, visual tests, and overlay unit tests now use the moosegoose-linux self-hosted runner by default
• Fork pull requests continue using GitHub-hosted runners
• The CI_FORCE_HOSTED organization setting can switch all jobs back to GitHub-hosted runners

Impact

✅ CI uses the organization’s self-hosted infrastructure
✅ Fork workflows remain isolated from self-hosted runners
✅ Hosted-runner fallback remains available

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	b1edb34	Sep 23, 2026 · 07:08	07:10

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

Suggestion: Same-repository pull requests run untrusted checkout code, package installation, and tests on the persistent self-hosted runner, exposing its host and credentials.

Assessment: 🔴 Critical · 🔁 Occurrence: Rarely · 🏷️ Security

Prompt for AI Agent 🤖

This is a comment left during a code review.

**Path:** .github/workflows/ci.yml
**Line:** 11:11
**Comment:**
	*Security: Same-repository pull requests run untrusted checkout code, package installation, and tests on the persistent self-hosted runner, exposing its host and credentials.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

[Coldaine]

Public repo: GitHub-hosted runners are free here, and self-hosted runners must not serve public-repo PRs. Closing; opened in error by the private-repo migration.