ci: run the pipeline on the koombea-ci self-hosted runner

[fabolivark]

What

Routes the three CI jobs to the koombea-ci self-hosted runner, following the org's migration convention:

runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted","koombea-ci"]') || 'ubuntu-latest' }}

A pull request opened from another fork stays on ubuntu-latest, so untrusted code never runs on the server. The job is routed, never skipped with an if: — a skipped job never reports, and a required check that never reports blocks the pull request forever.

The leading github.event_name != 'pull_request' is what keeps the push: branches: [main] trigger on the server: outside a pull request github.event.pull_request is null.

release.yml and publish-images.yml stay on ubuntu-latest — publishing and releasing should not depend on the server being up, and image publishing needs the arm64 matrix runners. cla.yml and pr-title.yml stay too: they run for fork pull requests, which the guard routes to ubuntu-latest anyway, and they invoke no repository tooling.

Why

The org runs its CI on koombea-ci. This repository was still entirely on GitHub-hosted runners.

How to test

This pull request is also a probe. No workflow of this repository has ever run in koombea/itsaplan: ci.yml reports state: active with zero runs in its whole history, and the repository's only three Actions runs are Copilot's dynamic workflow. The merge of #7 was a push to main, which ci.yml subscribes to, and it triggered nothing.

Ruled out so far: Actions is enabled at repository level (allowed_actions: all), enabled org-wide (enabled_repositories: all), ci.yml is present on the default branch, default workflow permissions are write, and the fork banner is not on the Actions tab.

So the first thing to read on this pull request is whether any check appears at all.

Checklist

• bun run typecheck passes — unaffected, no source change
• bun run lint and bun run format:check pass — prettier --check clean on the file
• Tests added or updated for the changed behaviour — not applicable, CI configuration
• Database schema changed — no
• New environment variables documented in .env.example — no
• Docs updated — no

Known risk

The Test suite job is the heaviest in the repository: it builds the production api image and runs Postgres, MinIO and 1947 tests. A koombea-ci lane is 3 threads and 7 GiB split between the runner and its dind. Watch this job's memory before making it a required status check.

[github-actions]

Thanks for the pull request. Before it can be merged, please read the Individual Contributor License Agreement and sign it by posting the comment below. You keep the copyright in your contribution, and It's a Plan stays open source.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}