From 6d03bc6be6997955db392d3d6b4d408dc9267a09 Mon Sep 17 00:00:00 2001 From: Peder Schmedling <24737456+Laffs2k5@users.noreply.github.com> Date: Mon, 29 Jun 2026 11:05:53 +0200 Subject: [PATCH 1/4] feat: configurable runs-on in ci-cd-default (default = current self-hosted) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a `runs-on` workflow input (JSON-encoded string, decoded with fromJSON) so callers can target GitHub-hosted larger runners instead of the self-hosted `dsb-builder` pool. The default is the historical hardcoded value `["self-hosted", "dsb-builder", "linux", "x64"]`, so existing callers are unaffected. Enables gradual, per-repo migration with one-line rollback. Applied to all five build/deploy jobs (check-docker-disk-space, create-matrix, build-deploy, deploy-to-static, prune-maven-artifacts). The final `ci-cd-conclusion` gate stays on ubuntu-latest (mirrors the terraform pipeline). Phase A (global only) — per-app override via the apps[] matrix is a follow-up. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci-cd-default.yml | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci-cd-default.yml b/.github/workflows/ci-cd-default.yml index 1409686..5c04ebb 100644 --- a/.github/workflows/ci-cd-default.yml +++ b/.github/workflows/ci-cd-default.yml @@ -40,6 +40,17 @@ on: - application-name - string For optional fields see possible inputs to the create-build-envs action. required: true + runs-on: + type: string + required: false + # Default IS the historical hardcoded value, so callers that don't set this are unaffected. + # Enables gradual, per-repo migration to GitHub-hosted runners with one-line rollback. + default: '["self-hosted", "dsb-builder", "linux", "x64"]' + description: | + Runner to run jobs on, as a JSON-encoded string (decoded with fromJSON). + Either a label array, e.g. '["self-hosted", "dsb-builder", "linux", "x64"]' (default), + or a single GitHub-hosted runner name, e.g. '"builder-app-platform-ghr-ubuntu-large"'. + Applies to all jobs except the final 'ci-cd-conclusion' gate (always ubuntu-latest). # below are repo-specific settings, not app specific and thus does not belong in 'apps' # for explanation of maven artifact pruning configuration see inputs of 'ci-cd/prune-maven-artifacts-in-repo/action.yml' # sane defaults are defined but can be overridden pr. repo @@ -71,7 +82,7 @@ on: jobs: check-docker-disk-space: name: Check Docker Disk Space & Prune if Needed - runs-on: [self-hosted, dsb-builder, linux, x64] + runs-on: ${{ fromJSON(inputs.runs-on) }} defaults: run: shell: bash @@ -91,7 +102,7 @@ jobs: create-matrix: name: Create build matrix needs: check-docker-disk-space - runs-on: [self-hosted, dsb-builder, linux, x64] + runs-on: ${{ fromJSON(inputs.runs-on) }} defaults: run: shell: bash @@ -133,7 +144,7 @@ jobs: build-deploy: name: Build and deploy needs: create-matrix - runs-on: [self-hosted, dsb-builder, linux, x64] + runs-on: ${{ fromJSON(inputs.runs-on) }} strategy: matrix: ${{ fromJSON(needs.create-matrix.outputs.app-vars-matrix) }} fail-fast: false @@ -468,7 +479,7 @@ jobs: if: | (github.event_name == 'push' || github.event_name == 'workflow_dispatch' ) needs: [create-matrix, build-deploy] - runs-on: [self-hosted, dsb-builder, linux, x64] + runs-on: ${{ fromJSON(inputs.runs-on) }} defaults: run: shell: bash @@ -546,7 +557,7 @@ jobs: && ( github.event_name != 'pull_request' || github.event.action == 'closed' ) needs: [create-matrix, build-deploy] - runs-on: [self-hosted, dsb-builder, linux, x64] + runs-on: ${{ fromJSON(inputs.runs-on) }} defaults: run: shell: bash From 9c6aa81d70b21518e253160846ea76ed96260062 Mon Sep 17 00:00:00 2001 From: Peder Schmedling <24737456+Laffs2k5@users.noreply.github.com> Date: Mon, 29 Jun 2026 13:32:21 +0200 Subject: [PATCH 2/4] docs: prefer JSON-array form for runs-on input example Recommend '["runner-name"]' (uniform with the default label array) over the bare JSON-string form '"runner-name"' to avoid the confusing nested quoting. Both still work via fromJSON. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci-cd-default.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci-cd-default.yml b/.github/workflows/ci-cd-default.yml index 5c04ebb..7243cac 100644 --- a/.github/workflows/ci-cd-default.yml +++ b/.github/workflows/ci-cd-default.yml @@ -47,10 +47,13 @@ on: # Enables gradual, per-repo migration to GitHub-hosted runners with one-line rollback. default: '["self-hosted", "dsb-builder", "linux", "x64"]' description: | - Runner to run jobs on, as a JSON-encoded string (decoded with fromJSON). - Either a label array, e.g. '["self-hosted", "dsb-builder", "linux", "x64"]' (default), - or a single GitHub-hosted runner name, e.g. '"builder-app-platform-ghr-ubuntu-large"'. - Applies to all jobs except the final 'ci-cd-conclusion' gate (always ubuntu-latest). + Runner to run jobs on, as a JSON array string (decoded with fromJSON). Use a one-element + array for a single GitHub-hosted larger runner (matched by name), same shape as the default: + self-hosted pool (default): '["self-hosted", "dsb-builder", "linux", "x64"]' + GitHub-hosted larger runner: '["builder-app-platform-ghr-ubuntu-large"]' + (A bare JSON string like '"builder-app-platform-ghr-ubuntu-large"' also works, but the array + form is preferred for consistency.) Applies to all jobs except the final 'ci-cd-conclusion' + gate (always ubuntu-latest). # below are repo-specific settings, not app specific and thus does not belong in 'apps' # for explanation of maven artifact pruning configuration see inputs of 'ci-cd/prune-maven-artifacts-in-repo/action.yml' # sane defaults are defined but can be overridden pr. repo From 03399392c92c27dec86cd71199b9e0ba7949df3e Mon Sep 17 00:00:00 2001 From: Peder Schmedling <24737456+Laffs2k5@users.noreply.github.com> Date: Tue, 30 Jun 2026 07:55:12 +0200 Subject: [PATCH 3/4] feat: configurable runs-on in the remaining reusable workflows Extend the runs-on input (default = current self-hosted set) to the other two reusable workflows so a repo can move its WHOLE pipeline to GitHub-hosted runners, not just ci-cd-default: - maven-artifacts-pruner.yml (called by app repos' prune workflows, incl. test-application) - ci-cd-build-deploy-maven-lib.yml (maven-library repos) Same approach as ci-cd-default: JSON-array string decoded with fromJSON; the ci-cd-conclusion gate stays on ubuntu-latest. No hardcoded [self-hosted, dsb-builder, linux, x64] remains in any reusable workflow. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../workflows/ci-cd-build-deploy-maven-lib.yml | 18 +++++++++++++++--- .github/workflows/maven-artifacts-pruner.yml | 14 +++++++++++++- 2 files changed, 28 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci-cd-build-deploy-maven-lib.yml b/.github/workflows/ci-cd-build-deploy-maven-lib.yml index cb78658..9b957ce 100644 --- a/.github/workflows/ci-cd-build-deploy-maven-lib.yml +++ b/.github/workflows/ci-cd-build-deploy-maven-lib.yml @@ -34,6 +34,18 @@ on: - application-type - string, always 'maven-library' For optional fields see possible inputs to the create-build-envs action. required: true + runs-on: + type: string + required: false + # Default IS the historical hardcoded value, so callers that don't set this are unaffected. + # Enables gradual, per-repo migration to GitHub-hosted runners with one-line rollback. + default: '["self-hosted", "dsb-builder", "linux", "x64"]' + description: | + Runner to run jobs on, as a JSON array string (decoded with fromJSON). Use a one-element + array for a single GitHub-hosted larger runner (matched by name), same shape as the default: + self-hosted pool (default): '["self-hosted", "dsb-builder", "linux", "x64"]' + GitHub-hosted larger runner: '["builder-app-platform-ghr-ubuntu-large"]' + Applies to all jobs except the final 'ci-cd-conclusion' gate (always ubuntu-latest). # below are repo-specific settings, not app specific and thus does not belong in 'apps' # for explanation of maven artifact pruning configuration see inputs of 'ci-cd/prune-maven-artifacts-in-repo/action.yml' # sane defaults are defined but can be overridden pr. repo @@ -65,7 +77,7 @@ on: jobs: create-matrix: name: Create build matrix - runs-on: [self-hosted, dsb-builder, linux, x64] + runs-on: ${{ fromJSON(inputs.runs-on) }} defaults: run: shell: bash @@ -91,7 +103,7 @@ jobs: build-and-deploy: name: Build and deploy to artifact repo needs: create-matrix - runs-on: [self-hosted, dsb-builder, linux, x64] + runs-on: ${{ fromJSON(inputs.runs-on) }} strategy: matrix: ${{ fromJSON(needs.create-matrix.outputs.app-vars-matrix) }} defaults: @@ -213,7 +225,7 @@ jobs: && ( github.event_name != 'pull_request' || github.event.action == 'closed' ) needs: [create-matrix, build-and-deploy] - runs-on: [self-hosted, dsb-builder, linux, x64] + runs-on: ${{ fromJSON(inputs.runs-on) }} defaults: run: shell: bash diff --git a/.github/workflows/maven-artifacts-pruner.yml b/.github/workflows/maven-artifacts-pruner.yml index a8baf29..2a7ea98 100644 --- a/.github/workflows/maven-artifacts-pruner.yml +++ b/.github/workflows/maven-artifacts-pruner.yml @@ -6,6 +6,18 @@ name: "DSB retention policy for maven artifacts in GitHub Packages" on: workflow_call: inputs: + runs-on: + type: string + required: false + # Default IS the historical hardcoded value, so callers that don't set this are unaffected. + # Enables gradual, per-repo migration to GitHub-hosted runners with one-line rollback. + default: '["self-hosted", "dsb-builder", "linux", "x64"]' + description: | + Runner to run jobs on, as a JSON array string (decoded with fromJSON). Use a one-element + array for a single GitHub-hosted larger runner (matched by name), same shape as the default: + self-hosted pool (default): '["self-hosted", "dsb-builder", "linux", "x64"]' + GitHub-hosted larger runner: '["builder-app-platform-ghr-ubuntu-large"]' + Applies to the prune job; the 'ci-cd-conclusion' gate always runs on ubuntu-latest. # for explanation of maven artifact pruning configuration see inputs of 'ci-cd/prune-maven-artifacts-in-repo/action.yml' # sane defaults are defined but can be overridden pr. repo release-prune-keep-min-count: @@ -45,7 +57,7 @@ jobs: prune-maven-artifacts: name: Prune maven artifacts # This job handles pruning of maven artifacts published in the calling repo - runs-on: [self-hosted, dsb-builder, linux, x64] + runs-on: ${{ fromJSON(inputs.runs-on) }} defaults: run: shell: bash From 9b817f41c03445d6a69e148e7056e90f66ef28b3 Mon Sep 17 00:00:00 2001 From: Peder Schmedling <24737456+Laffs2k5@users.noreply.github.com> Date: Tue, 30 Jun 2026 08:49:15 +0200 Subject: [PATCH 4/4] refactor: plain-string runs-on + per-app override (drop JSON-array input) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Refine the runs-on mechanism per review: - Input is now a PLAIN STRING (like the terraform actions), default "". Opting a repo in is just `runs-on: builder-app-platform-ghr-ubuntu-large` — no more JSON-array-in- string clunk. The multi-label self-hosted default is kept inside each workflow as a fromJSON('["self-hosted","dsb-builder","linux","x64"]') fallback, so an unset/empty input preserves the exact historical behaviour. - PER-APP override: build/deploy matrix jobs resolve `matrix.app-vars.runs-on || inputs.runs-on || `, so a `runs-on` field on an apps[] entry wins, else the global input, else self-hosted. Relies on `||` short-circuiting (null/'' are falsy) — no create-app-vars-matrix change needed. - Applied consistently across ci-cd-default, ci-cd-build-deploy-maven-lib and maven-artifacts-pruner; ci-cd-conclusion gates stay on ubuntu-latest. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../ci-cd-build-deploy-maven-lib.yml | 24 ++++++++------- .github/workflows/ci-cd-default.yml | 30 +++++++++---------- .github/workflows/maven-artifacts-pruner.yml | 18 +++++------ 3 files changed, 37 insertions(+), 35 deletions(-) diff --git a/.github/workflows/ci-cd-build-deploy-maven-lib.yml b/.github/workflows/ci-cd-build-deploy-maven-lib.yml index 9b957ce..6fe7e66 100644 --- a/.github/workflows/ci-cd-build-deploy-maven-lib.yml +++ b/.github/workflows/ci-cd-build-deploy-maven-lib.yml @@ -37,15 +37,16 @@ on: runs-on: type: string required: false - # Default IS the historical hardcoded value, so callers that don't set this are unaffected. - # Enables gradual, per-repo migration to GitHub-hosted runners with one-line rollback. - default: '["self-hosted", "dsb-builder", "linux", "x64"]' + # Empty (default) = the historical self-hosted pool, kept inside the workflow as a fromJSON + # fallback so callers that don't set this are unaffected. Any non-empty value is used as-is + # (like the terraform actions), so opting in is just a plain string — no JSON. + default: "" description: | - Runner to run jobs on, as a JSON array string (decoded with fromJSON). Use a one-element - array for a single GitHub-hosted larger runner (matched by name), same shape as the default: - self-hosted pool (default): '["self-hosted", "dsb-builder", "linux", "x64"]' - GitHub-hosted larger runner: '["builder-app-platform-ghr-ubuntu-large"]' - Applies to all jobs except the final 'ci-cd-conclusion' gate (always ubuntu-latest). + Global runner for all jobs, as a plain string: a single GitHub-hosted larger runner name + (matched by name), e.g. 'builder-app-platform-ghr-ubuntu-large'. Empty (default) uses the + self-hosted pool [self-hosted, dsb-builder, linux, x64]. Can be overridden per application + with a 'runs-on' field on an entry in 'apps'. The final 'ci-cd-conclusion' gate always + runs on ubuntu-latest. # below are repo-specific settings, not app specific and thus does not belong in 'apps' # for explanation of maven artifact pruning configuration see inputs of 'ci-cd/prune-maven-artifacts-in-repo/action.yml' # sane defaults are defined but can be overridden pr. repo @@ -77,7 +78,7 @@ on: jobs: create-matrix: name: Create build matrix - runs-on: ${{ fromJSON(inputs.runs-on) }} + runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }} defaults: run: shell: bash @@ -103,7 +104,8 @@ jobs: build-and-deploy: name: Build and deploy to artifact repo needs: create-matrix - runs-on: ${{ fromJSON(inputs.runs-on) }} + # per-app 'runs-on' wins, else the global input, else the self-hosted default + runs-on: ${{ matrix.app-vars.runs-on || inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }} strategy: matrix: ${{ fromJSON(needs.create-matrix.outputs.app-vars-matrix) }} defaults: @@ -225,7 +227,7 @@ jobs: && ( github.event_name != 'pull_request' || github.event.action == 'closed' ) needs: [create-matrix, build-and-deploy] - runs-on: ${{ fromJSON(inputs.runs-on) }} + runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }} defaults: run: shell: bash diff --git a/.github/workflows/ci-cd-default.yml b/.github/workflows/ci-cd-default.yml index 7243cac..332353e 100644 --- a/.github/workflows/ci-cd-default.yml +++ b/.github/workflows/ci-cd-default.yml @@ -43,17 +43,16 @@ on: runs-on: type: string required: false - # Default IS the historical hardcoded value, so callers that don't set this are unaffected. - # Enables gradual, per-repo migration to GitHub-hosted runners with one-line rollback. - default: '["self-hosted", "dsb-builder", "linux", "x64"]' + # Empty (default) = the historical self-hosted pool, kept inside the workflow as a fromJSON + # fallback so callers that don't set this are unaffected. Any non-empty value is used as-is + # (like the terraform actions), so opting in is just a plain string — no JSON. + default: "" description: | - Runner to run jobs on, as a JSON array string (decoded with fromJSON). Use a one-element - array for a single GitHub-hosted larger runner (matched by name), same shape as the default: - self-hosted pool (default): '["self-hosted", "dsb-builder", "linux", "x64"]' - GitHub-hosted larger runner: '["builder-app-platform-ghr-ubuntu-large"]' - (A bare JSON string like '"builder-app-platform-ghr-ubuntu-large"' also works, but the array - form is preferred for consistency.) Applies to all jobs except the final 'ci-cd-conclusion' - gate (always ubuntu-latest). + Global runner for all jobs, as a plain string: a single GitHub-hosted larger runner name + (matched by name), e.g. 'builder-app-platform-ghr-ubuntu-large'. Empty (default) uses the + self-hosted pool [self-hosted, dsb-builder, linux, x64]. Can be overridden per application + with a 'runs-on' field on an entry in 'apps'. The final 'ci-cd-conclusion' gate always + runs on ubuntu-latest. # below are repo-specific settings, not app specific and thus does not belong in 'apps' # for explanation of maven artifact pruning configuration see inputs of 'ci-cd/prune-maven-artifacts-in-repo/action.yml' # sane defaults are defined but can be overridden pr. repo @@ -85,7 +84,7 @@ on: jobs: check-docker-disk-space: name: Check Docker Disk Space & Prune if Needed - runs-on: ${{ fromJSON(inputs.runs-on) }} + runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }} defaults: run: shell: bash @@ -105,7 +104,7 @@ jobs: create-matrix: name: Create build matrix needs: check-docker-disk-space - runs-on: ${{ fromJSON(inputs.runs-on) }} + runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }} defaults: run: shell: bash @@ -147,7 +146,8 @@ jobs: build-deploy: name: Build and deploy needs: create-matrix - runs-on: ${{ fromJSON(inputs.runs-on) }} + # per-app 'runs-on' wins, else the global input, else the self-hosted default + runs-on: ${{ matrix.app-vars.runs-on || inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }} strategy: matrix: ${{ fromJSON(needs.create-matrix.outputs.app-vars-matrix) }} fail-fast: false @@ -482,7 +482,7 @@ jobs: if: | (github.event_name == 'push' || github.event_name == 'workflow_dispatch' ) needs: [create-matrix, build-deploy] - runs-on: ${{ fromJSON(inputs.runs-on) }} + runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }} defaults: run: shell: bash @@ -560,7 +560,7 @@ jobs: && ( github.event_name != 'pull_request' || github.event.action == 'closed' ) needs: [create-matrix, build-deploy] - runs-on: ${{ fromJSON(inputs.runs-on) }} + runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }} defaults: run: shell: bash diff --git a/.github/workflows/maven-artifacts-pruner.yml b/.github/workflows/maven-artifacts-pruner.yml index 2a7ea98..86ebe6e 100644 --- a/.github/workflows/maven-artifacts-pruner.yml +++ b/.github/workflows/maven-artifacts-pruner.yml @@ -9,15 +9,15 @@ on: runs-on: type: string required: false - # Default IS the historical hardcoded value, so callers that don't set this are unaffected. - # Enables gradual, per-repo migration to GitHub-hosted runners with one-line rollback. - default: '["self-hosted", "dsb-builder", "linux", "x64"]' + # Empty (default) = the historical self-hosted pool, kept inside the workflow as a fromJSON + # fallback so callers that don't set this are unaffected. Any non-empty value is used as-is + # (like the terraform actions), so opting in is just a plain string — no JSON. + default: "" description: | - Runner to run jobs on, as a JSON array string (decoded with fromJSON). Use a one-element - array for a single GitHub-hosted larger runner (matched by name), same shape as the default: - self-hosted pool (default): '["self-hosted", "dsb-builder", "linux", "x64"]' - GitHub-hosted larger runner: '["builder-app-platform-ghr-ubuntu-large"]' - Applies to the prune job; the 'ci-cd-conclusion' gate always runs on ubuntu-latest. + Runner for the prune job, as a plain string: a single GitHub-hosted larger runner name + (matched by name), e.g. 'builder-app-platform-ghr-ubuntu-large'. Empty (default) uses the + self-hosted pool [self-hosted, dsb-builder, linux, x64]. The 'ci-cd-conclusion' gate + always runs on ubuntu-latest. # for explanation of maven artifact pruning configuration see inputs of 'ci-cd/prune-maven-artifacts-in-repo/action.yml' # sane defaults are defined but can be overridden pr. repo release-prune-keep-min-count: @@ -57,7 +57,7 @@ jobs: prune-maven-artifacts: name: Prune maven artifacts # This job handles pruning of maven artifacts published in the calling repo - runs-on: ${{ fromJSON(inputs.runs-on) }} + runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }} defaults: run: shell: bash