From dd7d21fb5e0046e17f8c1a4c6cc3ad906ebf274d Mon Sep 17 00:00:00 2001 From: ScriptedAlchemy Date: Tue, 3 Nov 2026 17:16:12 -0800 Subject: [PATCH] ci: remove Blacksmith leftovers and restrict hosted runner inputs --- .github/actions/setup-apt-mirrors/action.yml | 5 ++--- .github/actions/setup-ci-deps/action.yml | 5 +---- .github/scripts/check-runner-labels.py | 12 +++++------- .github/scripts/check-runner-labels.test.py | 12 ++++++------ .github/workflows/ci.yml | 2 -- .github/workflows/fork-release.yml | 2 +- .github/workflows/release-desktop.yml | 6 +++--- .github/workflows/release.yml | 3 +-- .github/workflows/windows-tests.yml | 3 +-- docs/operations/mobile-app-store-screenshots.md | 4 ++-- scripts/mobile-showcase.config.ts | 2 +- 11 files changed, 23 insertions(+), 33 deletions(-) diff --git a/.github/actions/setup-apt-mirrors/action.yml b/.github/actions/setup-apt-mirrors/action.yml index 5beff201d188e..7fa98064f5e71 100644 --- a/.github/actions/setup-apt-mirrors/action.yml +++ b/.github/actions/setup-apt-mirrors/action.yml @@ -5,17 +5,16 @@ runs: steps: - shell: bash run: | - # Replace the existing Blacksmith mirror list as well as direct sources. printf '%s\tpriority:%s\n' \ https://archive.ubuntu.com/ubuntu 1 \ https://mirrors.edge.kernel.org/ubuntu 2 \ https://mirror.math.princeton.edu/pub/ubuntu 3 \ - | sudo tee /etc/apt/blacksmith-ubuntu-mirrors.txt > /dev/null + | sudo tee /etc/apt/ci-ubuntu-mirrors.txt > /dev/null # APT's mirror transport retries each file against the next server. sudo find /etc/apt -maxdepth 2 -type f \( -name '*.list' -o -name '*.sources' \) \ -exec sed -i -E \ - 's#https?://(([^/]+\.)?archive|security)\.ubuntu\.com/ubuntu/?#mirror+file:/etc/apt/blacksmith-ubuntu-mirrors.txt#g' {} + + 's#https?://(([^/]+\.)?archive|security)\.ubuntu\.com/ubuntu/?#mirror+file:/etc/apt/ci-ubuntu-mirrors.txt#g' {} + # Move on to a fallback before an unreachable server exhausts the job. printf '%s\n' 'Acquire::http::Timeout "15";' 'Acquire::https::Timeout "15";' \ diff --git a/.github/actions/setup-ci-deps/action.yml b/.github/actions/setup-ci-deps/action.yml index 330de88425734..877664a033020 100644 --- a/.github/actions/setup-ci-deps/action.yml +++ b/.github/actions/setup-ci-deps/action.yml @@ -86,10 +86,7 @@ runs: # Filtered installs prefer the current full store, which holds every package, # over an older store of their own. - # The pnpm store stays a cache tarball on the runner's own disk. A store on a - # Blacksmith sticky disk mounts in under a second, but pnpm then copies every - # package across filesystems instead of hard-linking it: install took 28-49s - # against 9s plus an 11s restore. + # Keep the pnpm store on the workspace filesystem so installs can hard-link packages. - name: Restore pnpm store id: pnpm_cache if: inputs.install == 'true' diff --git a/.github/scripts/check-runner-labels.py b/.github/scripts/check-runner-labels.py index 15ca898e08423..90862b6a2f0f4 100644 --- a/.github/scripts/check-runner-labels.py +++ b/.github/scripts/check-runner-labels.py @@ -3,8 +3,7 @@ This repository has no self-hosted runners. Pull requests from forks can propose workflow changes, and a workflow that selects a private runner would put untrusted code on hardware that holds credentials and reaches the internal -network. Every `runs-on` value must therefore name a Blacksmith pool -(`blacksmith-*`) or a GitHub-hosted image (`ubuntu-*`, `macos-*`, `windows-*`). +network. Every `runs-on` value must name a standard GitHub-hosted image. Two modes: @@ -26,9 +25,8 @@ WORKFLOWS_DIR = Path(__file__).resolve().parent.parent / "workflows" -# A label a hosted pool provides: Blacksmith's per-capacity labels and GitHub's -# own images. `[a-z0-9.-]*` covers suffixes such as `ubuntu-24.04-arm`. -HOSTED_LABEL = re.compile(r"^(?:blacksmith|ubuntu|macos|windows)-[a-z0-9][a-z0-9.-]*$") +# Excludes paid larger runners and third-party pools. +HOSTED_LABEL = re.compile(r"^(?:ubuntu-(?:latest|22\.04|24\.04|26\.04)(?:-arm)?|macos-(?:latest|14|15|26)(?:-intel)?|windows-(?:latest|2022|2025|11-arm))$") # Runner labels that name hardware this account owns. `-runner` is a stronger # signal than `-hosted`, so a label such as `linux-runner` is private by @@ -39,7 +37,7 @@ # selector, the private labels this repository used to have, and the `bench-*` # capacity pool. `android-emulator-runner` and other action names do not match. FORBIDDEN_REFERENCE = re.compile( - r"self-hosted|\b(?:linux|windows|macos)-runner\b|\bbench-[a-z0-9][a-z0-9.-]*" + r"blacksmith-[a-z0-9.-]+|self-hosted|\b(?:linux|windows|macos)-runner\b|\bbench-[a-z0-9][a-z0-9.-]*" ) @@ -82,7 +80,7 @@ def check_label(name, label, required): if any(hint in label for hint in PRIVATE_LABEL_HINT) or not HOSTED_LABEL.match(label): return ( f"inputs.{name}={label!r} is not a hosted runner label; " - "use blacksmith-*, ubuntu-*, macos-* or windows-*" + "use a standard GitHub-hosted Ubuntu, macOS or Windows image" ) return None diff --git a/.github/scripts/check-runner-labels.test.py b/.github/scripts/check-runner-labels.test.py index dc6186a9dae50..42542198b6e6f 100644 --- a/.github/scripts/check-runner-labels.test.py +++ b/.github/scripts/check-runner-labels.test.py @@ -24,7 +24,7 @@ def test_accepts_hosted_pools(self): self.assertEqual(self.scan("build.yml", """ jobs: build: - runs-on: blacksmith-8vcpu-ubuntu-2404 + runs-on: ubuntu-24.04 verify: runs-on: windows-11-arm lint: @@ -40,7 +40,7 @@ def test_rejects_self_hosted(self): self.assertIn("self-hosted", problems[0]) def test_rejects_private_runner_labels(self): - for label in ("linux-runner", "windows-runner", "macos-runner", "bench-32vcpu"): + for label in ("linux-runner", "windows-runner", "macos-runner", "bench-32vcpu", "blacksmith-8vcpu-ubuntu-2404"): with self.subTest(label=label): self.workflows.joinpath("build.yml").unlink(missing_ok=True) problems = self.scan("build.yml", f" runs-on: {label}\n") @@ -50,7 +50,7 @@ def test_rejects_matrix_values(self): problems = self.scan("release.yml", """ strategy: matrix: - runner: [blacksmith-8vcpu-ubuntu-2404, bench-arm64] + runner: [ubuntu-24.04, bench-arm64] runs-on: ${{ matrix.runner }} """) self.assertEqual(len(problems), 1) @@ -61,7 +61,7 @@ def test_ignores_comments_and_action_names(self): # A private runner would be self-hosted or linux-runner. jobs: emulator: - runs-on: blacksmith-4vcpu-ubuntu-2404 + runs-on: ubuntu-24.04 steps: - uses: reactivecircus/android-emulator-runner@v2 """), []) @@ -79,12 +79,12 @@ def test_strip_comment_keeps_hash_inside_quotes(self): class CheckLabelsTests(unittest.TestCase): def test_accepts_hosted_labels(self): self.assertEqual( - labels.check_labels("blacksmith-16vcpu-ubuntu-2404", "windows-2025"), [] + labels.check_labels("ubuntu-24.04", "windows-2025"), [] ) self.assertEqual(labels.check_labels("ubuntu-24.04-arm", ""), []) def test_rejects_private_labels(self): - for label in ("self-hosted", "linux-runner", "bench-32vcpu", "macos-26-runner"): + for label in ("self-hosted", "linux-runner", "bench-32vcpu", "macos-26-runner", "blacksmith-8vcpu-ubuntu-2404", "macos-15-large", "macos-15-xlarge"): with self.subTest(label=label): problems = labels.check_labels(label, "") self.assertEqual(len(problems), 1, problems) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dcffa524b23db..5dc23ecd84dd4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -150,7 +150,6 @@ jobs: - name: Start installing browser secret helper build libraries if: needs.changes.outputs.build != 'false' run: | - sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources ( set +e sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config @@ -248,7 +247,6 @@ jobs: # the background while Vite+ installs; the step before the tests waits for it. - name: Start installing browser secret helper build libraries run: | - sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources ( set +e sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config diff --git a/.github/workflows/fork-release.yml b/.github/workflows/fork-release.yml index 00e8d9c2cefd8..9fdeb8f4d5a6a 100644 --- a/.github/workflows/fork-release.yml +++ b/.github/workflows/fork-release.yml @@ -1,7 +1,7 @@ name: Fork release # Publishes installers for this fork as a GitHub Release on every push to main. -# release.yml needs upstream's Blacksmith runners, signing identities, and +# release.yml needs upstream's signing identities and # deploy secrets, so this reuses only its per-platform packaging # (release-desktop.yml) on GitHub-hosted runners. diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml index 4f7632d6e4850..af811a1396c78 100644 --- a/.github/workflows/release-desktop.yml +++ b/.github/workflows/release-desktop.yml @@ -139,8 +139,8 @@ jobs: VERIFY_RUNNER_LABEL: ${{ inputs.verify_runner }} run: | set -euo pipefail - # Blacksmith's per-capacity labels and GitHub's own images only. - allowed='^(blacksmith|ubuntu|macos|windows)-[a-z0-9][a-z0-9.-]*$' + # Standard GitHub-hosted images only. + allowed='^(ubuntu-(latest|22\.04|24\.04|26\.04)(-arm)?|macos-(latest|14|15|26)(-intel)?|windows-(latest|2022|2025|11-arm))$' failed=0 check_label() { local name="$1" label="$2" required="$3" @@ -154,7 +154,7 @@ jobs: # A private label is either a `*-runner` pool or simply outside the # hosted pools above (GitHub's own self-hosted selector included). if [[ "$label" == *-runner* ]] || [[ ! "$label" =~ $allowed ]]; then - echo "::error::inputs.$name=$label is not a hosted runner label (blacksmith-*, ubuntu-*, macos-*, windows-*)." + echo "::error::inputs.$name=$label is not a hosted runner label (standard GitHub-hosted Ubuntu, macOS or Windows image)." failed=1 else echo "inputs.$name=$label is a hosted runner label." diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fd8327217bea2..08767cbb3ca74 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -289,7 +289,6 @@ jobs: - name: Install browser secret helper build libraries run: | - sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config build-essential - name: Test @@ -1012,7 +1011,7 @@ jobs: name: Publish CLI to npm needs: [preflight, release] if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.release.result == 'success' }} - runs-on: ubuntu-24.04 # ubuntu-24.04 + runs-on: ubuntu-24.04 timeout-minutes: 15 permissions: contents: read diff --git a/.github/workflows/windows-tests.yml b/.github/workflows/windows-tests.yml index ccb72afb180f9..fded5f671e1df 100644 --- a/.github/workflows/windows-tests.yml +++ b/.github/workflows/windows-tests.yml @@ -26,8 +26,7 @@ permissions: jobs: test: name: Test (${{ inputs.package || 'all non-server' }}) - # Forks do not inherit upstream's Blacksmith runner integration. - runs-on: ${{ github.repository == 'pingdotgg/t3code' && 'windows-2025' || 'windows-2025' }} + runs-on: windows-2025 timeout-minutes: 45 steps: - name: Checkout diff --git a/docs/operations/mobile-app-store-screenshots.md b/docs/operations/mobile-app-store-screenshots.md index d063d80e90f27..68838ba282f3b 100644 --- a/docs/operations/mobile-app-store-screenshots.md +++ b/docs/operations/mobile-app-store-screenshots.md @@ -124,8 +124,8 @@ Run the `Mobile Showcase Screenshots` workflow from GitHub's Actions tab, choose `android`, select `light`, `dark`, or `both`, and pick a palette (or `all`, which raises each job's timeout from 60 to 300 minutes). The default dispatch captures both appearances of the `t3-code` palette and runs iOS and Android concurrently: iPhone and iPad capture on a -12-vCPU Blacksmith macOS runner, while Android phone, 7-inch tablet, and 10-inch tablet capture on a -16-vCPU Blacksmith Linux runner with a KVM-accelerated x86_64 emulator. +GitHub-hosted macOS runner, while Android phone, 7-inch tablet, and 10-inch tablet capture on a +GitHub-hosted Ubuntu runner with a KVM-accelerated x86_64 emulator. Every job uploads its PNGs even when capture fails, which makes partial runs useful for diagnosis. The separate validation step is success-gated: it runs before upload only when capture succeeds. If diff --git a/scripts/mobile-showcase.config.ts b/scripts/mobile-showcase.config.ts index 769461189a140..8b4d61d8443e3 100644 --- a/scripts/mobile-showcase.config.ts +++ b/scripts/mobile-showcase.config.ts @@ -160,7 +160,7 @@ const config: ShowcaseConfig = { id: "pixel", platform: "android", avd: "Pixel_10_Pro", - // Apple Silicon defaults to ARM64; Blacksmith Linux CI overrides to x86_64 for KVM. + // Apple Silicon defaults to ARM64; Linux CI overrides to x86_64 for KVM. abi: resolveShowcaseAndroidAbi(process.env.T3_SHOWCASE_ANDROID_ABI), appearance: "dark", theme: DEFAULT_SHOWCASE_THEME,