From 465d75db80088230df6aa84ead364cf4de3acd30 Mon Sep 17 00:00:00 2001
From: Neil Galvin <neil@galv.in>
Date: Fri, 11 Sep 2026 12:54:57 +0100
Subject: [PATCH] feat(claude-code-review)!: default to a GitHub-hosted runner

The review job reads a PR diff and calls the Claude API. It needs no
private-network access, no local toolchain and no persistent state, so a
self-hosted runner buys it nothing -- while costing a great deal on a
contended pool.

Measured on the sproncy pool: the job queued 40-77 minutes to do 3-6 minutes
of work, so reviews routinely posted after the PR had already merged, and it
failed outright at runner assignment (zero steps executed) in roughly one run
in six. Both are queueing artefacts rather than anything wrong with the
review.

Moving the default also returns capacity to the pool for the jobs that do need
a real machine -- heavy test suites with service containers and local
toolchains.

BREAKING: changes behaviour for every consumer that does not pass runs-on
explicitly, which is currently all but sproncy/monitoring_stack. Those wanting
the old behaviour pass runs-on: \x27["self-hosted", "linux", "x64"]\x27.

Pinned to a dated image rather than ubuntu-latest so a GitHub-side image bump
is an intentional, reviewable change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0114gaSKj6YinQCkmxVbDACv
---
 .github/workflows/claude-code-review.yml | 16 ++++++++++++++--
 CHANGELOG.md                             | 21 +++++++++++++++++++++
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index d24fa31..a5c884b 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -7,9 +7,21 @@ on:
   workflow_call:
     inputs:
       runs-on:
-        description: "Runner label(s) as a JSON array string (parsed with fromJSON). Defaults to the self-hosted pool. Public/open-source repos opt out by passing '[\"ubuntu-latest\"]'."
+        description: "Runner label(s) as a JSON array string (parsed with fromJSON). Defaults to a GitHub-hosted image; pass '[\"self-hosted\", \"linux\", \"x64\"]' to use a self-hosted pool instead."
         type: string
-        default: '["self-hosted", "linux", "x64"]'
+        # GitHub-hosted by default. This job reads the PR diff and calls the
+        # Claude API -- it needs no private-network access, no local toolchain
+        # and no persistent state, so a self-hosted runner buys it nothing.
+        #
+        # It cost quite a lot, though: on a contended pool the review queued
+        # 40-77 minutes for 3-6 minutes of work, routinely finishing after the
+        # PR had already merged, and failed outright at runner assignment
+        # roughly one run in six. Both faults are queueing artefacts, not
+        # review problems.
+        #
+        # Pinned to a dated image rather than ubuntu-latest so a GitHub-side
+        # image bump is an intentional, reviewable change.
+        default: '["ubuntu-24.04"]'
       timeout-minutes:
         type: number
         default: 30
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 23ec30f..fceb802 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,27 @@ project uses [SemVer](https://semver.org/) for the `vMAJOR.MINOR.PATCH` tags.
 
 ## [Unreleased]
 
+### Changed
+
+- **`claude-code-review.yml` now defaults to a GitHub-hosted runner**
+  (`["ubuntu-24.04"]`) instead of `["self-hosted", "linux", "x64"]`. The job
+  reads a PR diff and calls the Claude API — it needs no private-network
+  access, no local toolchain and no persistent state, so a self-hosted runner
+  bought it nothing while costing a great deal on a contended pool: measured
+  queue times of 40–77 minutes for 3–6 minutes of work, reviews routinely
+  landing after the PR had already merged, and outright failure at runner
+  assignment in roughly one run in six. Both faults are queueing artefacts
+  rather than review problems.
+
+  **This changes behaviour for every consumer that does not pass `runs-on`
+  explicitly** — currently all but one. Consumers that want the old behaviour
+  pass `runs-on: '["self-hosted", "linux", "x64"]'`, which is what
+  `sproncy/monitoring_stack` already does and is therefore unaffected.
+
+  Hosted minutes are metered on private repos; a review is 3–6 minutes, so
+  budget accordingly. The image is pinned to a dated label rather than
+  `ubuntu-latest` so a GitHub-side bump is an intentional, reviewable change.
+
 ## [3.3.0] - 2026-09-10
 
 ### Added