Skip to content

ci: build and deploy Pages on free GitHub-hosted runners - #40

Merged
rclanan merged 4 commits into
mainfrom
ci/free-standard-runners
Oct 15, 2026
Merged

ci: build and deploy Pages on free GitHub-hosted runners#40
rclanan merged 4 commits into
mainfrom
ci/free-standard-runners

Conversation

@rclanan

@rclanan rclanan commented Oct 15, 2026 •
edited by blacksmith-sh Bot
Loading

Copy link
Copy Markdown
Contributor

This public repo used blacksmith-4vcpu-ubuntu-2404, a billed third-party
runner. Standard GitHub-hosted runners are free for public repositories,
so the Pages verify, build and deploy jobs now use ubuntu-24.04.

Adds a runner guard that fails CI if any workflow selects a runner that can
bill (larger -N-cores/-arm runners, Blacksmith) or an unapproved
self-hosted runner, so a later edit cannot reintroduce charges.

Verified: actionlint clean; the guard passes on this branch and fails on the previous workflows (flags all three Blacksmith jobs).

🤖 Generated with Claude Code

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

@rclanan @claude
ci: build and deploy Pages on free GitHub-hosted runners
6daf2db 
This public repo used blacksmith-4vcpu-ubuntu-2404, a billed third-party
runner. Standard GitHub-hosted runners are free for public repositories,
so the Pages verify, build and deploy jobs now use ubuntu-24.04.

Adds a runner guard that fails CI if any workflow selects a runner that can
bill (larger -N-cores/-arm runners, Blacksmith) or an unapproved
self-hosted runner, so a later edit cannot reintroduce charges.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@codedig-ai

codedig-ai Bot commented Oct 15, 2026

Copy link
Copy Markdown

🟢 CodeDig PR Analysis — PASSED; analysis max severity: medium; shown blockers: 0 (none); budget: 1.7699999999999998/100 points consumed, 98.23 points remaining (green)

Budget status does not override the recorded gate verdict.

🤖 Summary

This PR is low risk (1 findings, 1 files changed).

Summary

Metric Value
Files Changed 1
Total Findings ⚠️ 1
Critical 0
High 0
Public API Changes 0
New PII Flows 0
Complexity Spikes ⚠️ 1
Co-change Risks 0

Coverage data: not available.

⚠️ Key Findings

  • [medium] High complexity in .github/scripts/runner_guard.py — .github/scripts/runner_guard.py

✅ Recommendations

  • Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.
🧪 Test Coverage Delta (no data)

Coverage data not available for this repo — enable via Settings → Coverage

Detailed Findings

[medium] High complexity in .github/scripts/runner_guard.py

Cyclomatic complexity spike detected: .github/scripts/runner_guard.py (complexity: 15, delta: +15)
Affected files: .github/scripts/runner_guard.py
Recommendation: Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.

→ View full report

Powered by CodeDig

1 similar comment
@codedig-ai

codedig-ai Bot commented Oct 15, 2026

Copy link
Copy Markdown

🟢 CodeDig PR Analysis — PASSED; analysis max severity: medium; shown blockers: 0 (none); budget: 1.7699999999999998/100 points consumed, 98.23 points remaining (green)

Budget status does not override the recorded gate verdict.

🤖 Summary

This PR is low risk (1 findings, 1 files changed).

Summary

Metric Value
Files Changed 1
Total Findings ⚠️ 1
Critical 0
High 0
Public API Changes 0
New PII Flows 0
Complexity Spikes ⚠️ 1
Co-change Risks 0

Coverage data: not available.

⚠️ Key Findings

  • [medium] High complexity in .github/scripts/runner_guard.py — .github/scripts/runner_guard.py

✅ Recommendations

  • Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.
🧪 Test Coverage Delta (no data)

Coverage data not available for this repo — enable via Settings → Coverage

Detailed Findings

[medium] High complexity in .github/scripts/runner_guard.py

Cyclomatic complexity spike detected: .github/scripts/runner_guard.py (complexity: 15, delta: +15)
Affected files: .github/scripts/runner_guard.py
Recommendation: Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.

→ View full report

Powered by CodeDig

@rclanan @claude
ci: runner guard resolves matrix runner labels
2bc3d26 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@codedig-ai

codedig-ai Bot commented Oct 15, 2026

Copy link
Copy Markdown

🔴 CodeDig PR Analysis — FAILED; analysis max severity: high; shown blockers: 1 (high); budget: 3.2699999999999996/100 points consumed, 96.73 points remaining (green)

The gate failed with blocking findings marked below. Budget status does not override the recorded gate verdict.

🤖 Summary

This PR is high risk (1 findings, 1 files changed).

Summary

Metric Value
Files Changed 1
Total Findings ⚠️ 1
Critical 0
High 🟠 1
Public API Changes 0
New PII Flows 0
Complexity Spikes ⚠️ 1
Co-change Risks 0

Coverage data: not available.

⚠️ Key Findings

  • [high] High complexity in .github/scripts/runner_guard.py (blocking) — .github/scripts/runner_guard.py

✅ Recommendations

  • Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.
🧪 Test Coverage Delta (no data)

Coverage data not available for this repo — enable via Settings → Coverage

Detailed Findings

[high] High complexity in .github/scripts/runner_guard.py

Cyclomatic complexity spike detected: .github/scripts/runner_guard.py (complexity: 20, delta: +20)
Affected files: .github/scripts/runner_guard.py
Recommendation: Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.

→ View full report

Powered by CodeDig

1 similar comment
@codedig-ai

codedig-ai Bot commented Oct 15, 2026

Copy link
Copy Markdown

🔴 CodeDig PR Analysis — FAILED; analysis max severity: high; shown blockers: 1 (high); budget: 3.2699999999999996/100 points consumed, 96.73 points remaining (green)

The gate failed with blocking findings marked below. Budget status does not override the recorded gate verdict.

🤖 Summary

This PR is high risk (1 findings, 1 files changed).

Summary

Metric Value
Files Changed 1
Total Findings ⚠️ 1
Critical 0
High 🟠 1
Public API Changes 0
New PII Flows 0
Complexity Spikes ⚠️ 1
Co-change Risks 0

Coverage data: not available.

⚠️ Key Findings

  • [high] High complexity in .github/scripts/runner_guard.py (blocking) — .github/scripts/runner_guard.py

✅ Recommendations

  • Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.
🧪 Test Coverage Delta (no data)

Coverage data not available for this repo — enable via Settings → Coverage

Detailed Findings

[high] High complexity in .github/scripts/runner_guard.py

Cyclomatic complexity spike detected: .github/scripts/runner_guard.py (complexity: 20, delta: +20)
Affected files: .github/scripts/runner_guard.py
Recommendation: Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.

→ View full report

Powered by CodeDig

@rclanan @claude
ci: make the runner guard fail closed
2dd2c0a 
A security review showed runs-on: ${{ vars.RUNNER || 'ubuntu-latest' }}
passed because only quoted labels were checked, letting a billed runner
through. The guard now accepts only literal free labels or
${{ matrix.<key> }} over a literal label list, and rejects every other
expression, expression-built matrices, runner groups and mappings, and
reusable workflows from other repositories.

Checked against eight bypass cases (vars fallback, expression matrix,
larger runner in matrix include, runner group, remote reusable workflow,
Blacksmith, -arm, unapproved self-hosted): all rejected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@codedig-ai

codedig-ai Bot commented Oct 15, 2026

Copy link
Copy Markdown

🔴 CodeDig PR Analysis — FAILED; analysis max severity: high; shown blockers: 1 (high); budget: 4.18/100 points consumed, 95.82 points remaining (green)

The gate failed with blocking findings marked below. Budget status does not override the recorded gate verdict.

🤖 Summary

This PR is high risk (1 findings, 1 files changed).

Summary

Metric Value
Files Changed 1
Total Findings ⚠️ 1
Critical 0
High 🟠 1
Public API Changes 0
New PII Flows 0
Complexity Spikes ⚠️ 1
Co-change Risks 0

Coverage data: not available.

⚠️ Key Findings

  • [high] High complexity in .github/scripts/runner_guard.py (blocking) — .github/scripts/runner_guard.py

✅ Recommendations

  • Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.
🧪 Test Coverage Delta (no data)

Coverage data not available for this repo — enable via Settings → Coverage

Detailed Findings

[high] High complexity in .github/scripts/runner_guard.py

Cyclomatic complexity spike detected: .github/scripts/runner_guard.py (complexity: 27, delta: +27)
Affected files: .github/scripts/runner_guard.py
Recommendation: Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.

→ View full report

Powered by CodeDig

1 similar comment
@codedig-ai

codedig-ai Bot commented Oct 15, 2026

Copy link
Copy Markdown

🔴 CodeDig PR Analysis — FAILED; analysis max severity: high; shown blockers: 1 (high); budget: 4.18/100 points consumed, 95.82 points remaining (green)

The gate failed with blocking findings marked below. Budget status does not override the recorded gate verdict.

🤖 Summary

This PR is high risk (1 findings, 1 files changed).

Summary

Metric Value
Files Changed 1
Total Findings ⚠️ 1
Critical 0
High 🟠 1
Public API Changes 0
New PII Flows 0
Complexity Spikes ⚠️ 1
Co-change Risks 0

Coverage data: not available.

⚠️ Key Findings

  • [high] High complexity in .github/scripts/runner_guard.py (blocking) — .github/scripts/runner_guard.py

✅ Recommendations

  • Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.
🧪 Test Coverage Delta (no data)

Coverage data not available for this repo — enable via Settings → Coverage

Detailed Findings

[high] High complexity in .github/scripts/runner_guard.py

Cyclomatic complexity spike detected: .github/scripts/runner_guard.py (complexity: 27, delta: +27)
Affected files: .github/scripts/runner_guard.py
Recommendation: Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.

→ View full report

Powered by CodeDig

@rclanan @claude
ci: simplify runner guard for the complexity gate
908d48c 
Malformed or expression-based runs-on now raises and is rejected, halving
cyclomatic complexity (radon 35 -> 18) with the same fail-closed result:
rejects 12/12 bypass cases, accepts 4/4 legitimate patterns.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@codedig-ai

codedig-ai Bot commented Oct 15, 2026

Copy link
Copy Markdown

🟢 CodeDig PR Analysis — PASSED; analysis max severity: medium; shown blockers: 0 (none); budget: 2.2249999999999996/100 points consumed, 97.775 points remaining (green)

Budget status does not override the recorded gate verdict.

🤖 Summary

This PR is low risk (1 findings, 1 files changed).

Summary

Metric Value
Files Changed 1
Total Findings ⚠️ 1
Critical 0
High 0
Public API Changes 0
New PII Flows 0
Complexity Spikes ⚠️ 1
Co-change Risks 0

Coverage data: not available.

⚠️ Key Findings

  • [medium] High complexity in .github/scripts/runner_guard.py — .github/scripts/runner_guard.py

✅ Recommendations

  • Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.
🧪 Test Coverage Delta (no data)

Coverage data not available for this repo — enable via Settings → Coverage

Detailed Findings

[medium] High complexity in .github/scripts/runner_guard.py

Cyclomatic complexity spike detected: .github/scripts/runner_guard.py (complexity: 16, delta: +16)
Affected files: .github/scripts/runner_guard.py
Recommendation: Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.

→ View full report

Powered by CodeDig

1 similar comment
@codedig-ai

codedig-ai Bot commented Oct 15, 2026

Copy link
Copy Markdown

🟢 CodeDig PR Analysis — PASSED; analysis max severity: medium; shown blockers: 0 (none); budget: 2.2249999999999996/100 points consumed, 97.775 points remaining (green)

Budget status does not override the recorded gate verdict.

🤖 Summary

This PR is low risk (1 findings, 1 files changed).

Summary

Metric Value
Files Changed 1
Total Findings ⚠️ 1
Critical 0
High 0
Public API Changes 0
New PII Flows 0
Complexity Spikes ⚠️ 1
Co-change Risks 0

Coverage data: not available.

⚠️ Key Findings

  • [medium] High complexity in .github/scripts/runner_guard.py — .github/scripts/runner_guard.py

✅ Recommendations

  • Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.
🧪 Test Coverage Delta (no data)

Coverage data not available for this repo — enable via Settings → Coverage

Detailed Findings

[medium] High complexity in .github/scripts/runner_guard.py

Cyclomatic complexity spike detected: .github/scripts/runner_guard.py (complexity: 16, delta: +16)
Affected files: .github/scripts/runner_guard.py
Recommendation: Consider refactoring to reduce complexity. Extract methods, simplify conditionals, or use polymorphism to replace complex branching.

→ View full report

Powered by CodeDig

@codedig-ai codedig-ai Bot added codedig/blast-low Blast radius low — ≤ 10 callers affected codedig/effort-1 Effort score 1/5 — minimal blast radius and complexity codedig/risk-green Risk budget < 50 % — safe to merge labels Oct 15, 2026
@rclanan
rclanan merged commit 1f6620f into main Oct 15, 2026
3 checks passed
@rclanan
rclanan deleted the ci/free-standard-runners branch October 15, 2026 13:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

codedig/blast-low Blast radius low — ≤ 10 callers affected codedig/effort-1 Effort score 1/5 — minimal blast radius and complexity codedig/risk-green Risk budget < 50 % — safe to merge

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rclanan