ci: remove Blacksmith leftovers and require standard GitHub runners

.github/actions/setup-apt-mirrors/action.yml

@@ -5,17 +5,16 @@ runs:
   steps:
     - shell: bash
       run: |
-        # Replace the existing Blacksmith mirror list as well as direct sources.
         printf '%s\tpriority:%s\n' \
           https://archive.ubuntu.com/ubuntu 1 \
           https://mirrors.edge.kernel.org/ubuntu 2 \
           https://mirror.math.princeton.edu/pub/ubuntu 3 \
-          | sudo tee /etc/apt/blacksmith-ubuntu-mirrors.txt > /dev/null
+          | sudo tee /etc/apt/ci-ubuntu-mirrors.txt > /dev/null
 
         # APT's mirror transport retries each file against the next server.
         sudo find /etc/apt -maxdepth 2 -type f \( -name '*.list' -o -name '*.sources' \) \
           -exec sed -i -E \
-          's#https?://(([^/]+\.)?archive|security)\.ubuntu\.com/ubuntu/?#mirror+file:/etc/apt/blacksmith-ubuntu-mirrors.txt#g' {} +
+          's#https?://(([^/]+\.)?archive|security)\.ubuntu\.com/ubuntu/?#mirror+file:/etc/apt/ci-ubuntu-mirrors.txt#g' {} +
 
         # Move on to a fallback before an unreachable server exhausts the job.
         printf '%s\n' 'Acquire::http::Timeout "15";' 'Acquire::https::Timeout "15";' \

.github/actions/setup-ci-deps/action.yml

@@ -86,10 +86,7 @@ runs:
 
     # Filtered installs prefer the current full store, which holds every package,
     # over an older store of their own.
-    # The pnpm store stays a cache tarball on the runner's own disk. A store on a
-    # Blacksmith sticky disk mounts in under a second, but pnpm then copies every
-    # package across filesystems instead of hard-linking it: install took 28-49s
-    # against 9s plus an 11s restore.
+    # Keep the pnpm store on the workspace filesystem so installs can hard-link packages.
     - name: Restore pnpm store
       id: pnpm_cache
       if: inputs.install == 'true'

.github/scripts/check-runner-labels.py

@@ -3,8 +3,7 @@
 This repository has no self-hosted runners. Pull requests from forks can propose
 workflow changes, and a workflow that selects a private runner would put
 untrusted code on hardware that holds credentials and reaches the internal
-network. Every `runs-on` value must therefore name a Blacksmith pool
-(`blacksmith-*`) or a GitHub-hosted image (`ubuntu-*`, `macos-*`, `windows-*`).
+network. Every `runs-on` value must name a standard GitHub-hosted image.
 
 Two modes:
 
@@ -26,9 +25,8 @@
 
 WORKFLOWS_DIR = Path(__file__).resolve().parent.parent / "workflows"
 
-# A label a hosted pool provides: Blacksmith's per-capacity labels and GitHub's
-# own images. `[a-z0-9.-]*` covers suffixes such as `ubuntu-24.04-arm`.
-HOSTED_LABEL = re.compile(r"^(?:blacksmith|ubuntu|macos|windows)-[a-z0-9][a-z0-9.-]*$")
+# Excludes paid larger runners and third-party pools.
+HOSTED_LABEL = re.compile(r"^(?:ubuntu-(?:latest|22\.04|24\.04|26\.04)(?:-arm)?|macos-(?:latest|14|15|26)(?:-intel)?|windows-(?:latest|2022|2025|11-arm))$")
 
 # Runner labels that name hardware this account owns. `-runner` is a stronger
 # signal than `-hosted`, so a label such as `linux-runner` is private by
@@ -39,7 +37,7 @@
 # selector, the private labels this repository used to have, and the `bench-*`
 # capacity pool. `android-emulator-runner` and other action names do not match.
 FORBIDDEN_REFERENCE = re.compile(
-    r"self-hosted|\b(?:linux|windows|macos)-runner\b|\bbench-[a-z0-9][a-z0-9.-]*"
+    r"blacksmith-[a-z0-9.-]+|self-hosted|\b(?:linux|windows|macos)-runner\b|\bbench-[a-z0-9][a-z0-9.-]*"
 )
 
 
@@ -82,7 +80,7 @@ def check_label(name, label, required):
     if any(hint in label for hint in PRIVATE_LABEL_HINT) or not HOSTED_LABEL.match(label):
         return (
             f"inputs.{name}={label!r} is not a hosted runner label; "
-            "use blacksmith-*, ubuntu-*, macos-* or windows-*"
+            "use a standard GitHub-hosted Ubuntu, macOS or Windows image"
         )
     return None
 

.github/scripts/check-runner-labels.test.py

@@ -24,7 +24,7 @@ def test_accepts_hosted_pools(self):
         self.assertEqual(self.scan("build.yml", """
             jobs:
               build:
-                runs-on: blacksmith-8vcpu-ubuntu-2404
+                runs-on: ubuntu-24.04
               verify:
                 runs-on: windows-11-arm
               lint:
@@ -40,7 +40,7 @@ def test_rejects_self_hosted(self):
         self.assertIn("self-hosted", problems[0])
 
     def test_rejects_private_runner_labels(self):
-        for label in ("linux-runner", "windows-runner", "macos-runner", "bench-32vcpu"):
+        for label in ("linux-runner", "windows-runner", "macos-runner", "bench-32vcpu", "blacksmith-8vcpu-ubuntu-2404"):
             with self.subTest(label=label):
                 self.workflows.joinpath("build.yml").unlink(missing_ok=True)
                 problems = self.scan("build.yml", f"        runs-on: {label}\n")
@@ -50,7 +50,7 @@ def test_rejects_matrix_values(self):
         problems = self.scan("release.yml", """
             strategy:
               matrix:
-                runner: [blacksmith-8vcpu-ubuntu-2404, bench-arm64]
+                runner: [ubuntu-24.04, bench-arm64]
             runs-on: ${{ matrix.runner }}
         """)
         self.assertEqual(len(problems), 1)
@@ -61,7 +61,7 @@ def test_ignores_comments_and_action_names(self):
             # A private runner would be self-hosted or linux-runner.
             jobs:
               emulator:
-                runs-on: blacksmith-4vcpu-ubuntu-2404
+                runs-on: ubuntu-24.04
                 steps:
                   - uses: reactivecircus/android-emulator-runner@v2
         """), [])
@@ -79,12 +79,12 @@ def test_strip_comment_keeps_hash_inside_quotes(self):
 class CheckLabelsTests(unittest.TestCase):
     def test_accepts_hosted_labels(self):
         self.assertEqual(
-            labels.check_labels("blacksmith-16vcpu-ubuntu-2404", "windows-2025"), []
+            labels.check_labels("ubuntu-24.04", "windows-2025"), []
         )
         self.assertEqual(labels.check_labels("ubuntu-24.04-arm", ""), [])
 
     def test_rejects_private_labels(self):
-        for label in ("self-hosted", "linux-runner", "bench-32vcpu", "macos-26-runner"):
+        for label in ("self-hosted", "linux-runner", "bench-32vcpu", "macos-26-runner", "blacksmith-8vcpu-ubuntu-2404", "macos-15-large", "macos-15-xlarge"):
             with self.subTest(label=label):
                 problems = labels.check_labels(label, "")
                 self.assertEqual(len(problems), 1, problems)

.github/workflows/ci.yml

@@ -150,7 +150,6 @@ jobs:
       - name: Start installing browser secret helper build libraries
         if: needs.changes.outputs.build != 'false'
         run: |
-          sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
           (
             set +e
             sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
@@ -248,7 +247,6 @@ jobs:
       # the background while Vite+ installs; the step before the tests waits for it.
       - name: Start installing browser secret helper build libraries
         run: |
-          sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
           (
             set +e
             sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config

.github/workflows/fork-release.yml

@@ -1,7 +1,7 @@
 name: Fork release
 
 # Publishes installers for this fork as a GitHub Release on every push to main.
-# release.yml needs upstream's Blacksmith runners, signing identities, and
+# release.yml needs upstream's signing identities and
 # deploy secrets, so this reuses only its per-platform packaging
 # (release-desktop.yml) on GitHub-hosted runners.
 

.github/workflows/release-desktop.yml

@@ -139,8 +139,8 @@ jobs:
           VERIFY_RUNNER_LABEL: ${{ inputs.verify_runner }}
         run: |
           set -euo pipefail
-          # Blacksmith's per-capacity labels and GitHub's own images only.
-          allowed='^(blacksmith|ubuntu|macos|windows)-[a-z0-9][a-z0-9.-]*$'
+          # Standard GitHub-hosted images only.
+          allowed='^(ubuntu-(latest|22\.04|24\.04|26\.04)(-arm)?|macos-(latest|14|15|26)(-intel)?|windows-(latest|2022|2025|11-arm))$'
           failed=0
           check_label() {
             local name="$1" label="$2" required="$3"
@@ -154,7 +154,7 @@ jobs:
             # A private label is either a `*-runner` pool or simply outside the
             # hosted pools above (GitHub's own self-hosted selector included).
             if [[ "$label" == *-runner* ]] || [[ ! "$label" =~ $allowed ]]; then
-              echo "::error::inputs.$name=$label is not a hosted runner label (blacksmith-*, ubuntu-*, macos-*, windows-*)."
+              echo "::error::inputs.$name=$label is not a hosted runner label (standard GitHub-hosted Ubuntu, macOS or Windows image)."
               failed=1
             else
               echo "inputs.$name=$label is a hosted runner label."

.github/workflows/release.yml

@@ -289,7 +289,6 @@ jobs:
 
       - name: Install browser secret helper build libraries
         run: |
-          sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
           sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config build-essential
 
       - name: Test
@@ -1012,7 +1011,7 @@ jobs:
     name: Publish CLI to npm
     needs: [preflight, release]
     if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.release.result == 'success' }}
-    runs-on: ubuntu-24.04 # ubuntu-24.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:
       contents: read

.github/workflows/windows-tests.yml

@@ -26,8 +26,7 @@ permissions:
 jobs:
   test:
     name: Test (${{ inputs.package || 'all non-server' }})
-    # Forks do not inherit upstream's Blacksmith runner integration.
-    runs-on: ${{ github.repository == 'pingdotgg/t3code' && 'windows-2025' || 'windows-2025' }}
+    runs-on: windows-2025
     timeout-minutes: 45
     steps:
       - name: Checkout

docs/operations/mobile-app-store-screenshots.md

@@ -124,8 +124,8 @@ Run the `Mobile Showcase Screenshots` workflow from GitHub's Actions tab, choose
 `android`, select `light`, `dark`, or `both`, and pick a palette (or `all`, which raises each job's
 timeout from 60 to 300 minutes). The default dispatch captures both appearances of the `t3-code`
 palette and runs iOS and Android concurrently: iPhone and iPad capture on a
-12-vCPU Blacksmith macOS runner, while Android phone, 7-inch tablet, and 10-inch tablet capture on a
-16-vCPU Blacksmith Linux runner with a KVM-accelerated x86_64 emulator.
+GitHub-hosted macOS runner, while Android phone, 7-inch tablet, and 10-inch tablet capture on a
+GitHub-hosted Ubuntu runner with a KVM-accelerated x86_64 emulator.
 
 Every job uploads its PNGs even when capture fails, which makes partial runs useful for diagnosis.
 The separate validation step is success-gated: it runs before upload only when capture succeeds. If

scripts/mobile-showcase.config.ts

@@ -160,7 +160,7 @@ const config: ShowcaseConfig = {
       id: "pixel",
       platform: "android",
       avd: "Pixel_10_Pro",
-      // Apple Silicon defaults to ARM64; Blacksmith Linux CI overrides to x86_64 for KVM.
+      // Apple Silicon defaults to ARM64; Linux CI overrides to x86_64 for KVM.
       abi: resolveShowcaseAndroidAbi(process.env.T3_SHOWCASE_ANDROID_ABI),
       appearance: "dark",
       theme: DEFAULT_SHOWCASE_THEME,