feat(workflows): default every shared workflow to ARC; public repos use GitHub's runner

.github/actions/runner-size-converter/README.md

@@ -47,3 +47,5 @@ instead, or `use-arc-runners: true` to resolve the self-hosted ARC runners
 | `large` | `false` | `true` | `blacksmith-16vcpu-ubuntu-2404-arm` |
 | `normal` | `true` | any | `arc-arm64-4cpu-12gb` |
 | `large` | `true` | any | `arc-arm64-8cpu-24gb` |
+
+In a public repository (`github.event.repository.private == false`) the output is always `ubuntu-24.04-arm`, GitHub's standard arm64 runner, whatever the inputs. ARC is only used in private repositories; when the event has no repository (e.g. `schedule`), the table above applies without ARC.

.github/actions/runner-size-converter/action.yml

@@ -30,6 +30,7 @@ runs:
         SIZE="${{ inputs.runner-size }}"
         USE_BLACKSMITH="${{ inputs.use-blacksmith-runners }}"
         USE_ARC="${{ inputs.use-arc-runners }}"
+        PRIVATE="${{ github.event.repository.private }}"
 
         # Validate size
         case "$SIZE" in
@@ -42,7 +43,9 @@ runs:
         esac
 
         # Resolve the runner name (arm64 only)
-        if [ "$USE_ARC" = "true" ]; then
+        if [ "$PRIVATE" = "false" ]; then
+          RUNNER_NAME="ubuntu-24.04-arm"
+        elif [ "$USE_ARC" = "true" ] && [ "$PRIVATE" = "true" ]; then
           # Self-hosted ARC runners on the internal EKS cluster
           if [ "$SIZE" = "large" ]; then
             RUNNER_NAME="arc-arm64-8cpu-24gb"

.github/workflows/component-build.yml

@@ -15,8 +15,8 @@ on:
       use-arc-runners:
         required: false
         type: boolean
-        default: false
-        description: "Run on the self-hosted ARC arm64 runners (takes precedence over use-blacksmith-runners). Builds with docker buildx and the ECR registry layer cache, like the self-hosted path."
+        default: true
+        description: "Run on the self-hosted ARC arm64 runners (default in private repositories, never used in public ones; takes precedence over use-blacksmith-runners). Builds with docker buildx and the ECR registry layer cache, like the self-hosted path."
       stage:
         required: true
         type: string
@@ -104,7 +104,7 @@ permissions:
 jobs:
   setup:
     name: Setup
-    runs-on: ${{ inputs.use-arc-runners && 'arc-arm64-2cpu-4gb' || 'linux-arm64' }}
+    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-2cpu-4gb' || 'linux-arm64' }}
     timeout-minutes: 5
     outputs:
       runner: ${{ steps.runner.outputs.runner-name }}
@@ -120,13 +120,13 @@ jobs:
         with:
           runner-size: ${{ inputs.runner-size }}
           use-blacksmith-runners: ${{ inputs.use-blacksmith-runners }}
-          use-arc-runners: ${{ inputs.use-arc-runners }}
+          use-arc-runners: ${{ (inputs.use-arc-runners && github.event.repository.private) }}
   # Blacksmith path: build on a Blacksmith arm64 cloud runner. Its sticky-disk builder
   # hydrates the layer cache from prior runs, so no registry cache directives are needed.
   build-blacksmith:
     name: Build (Blacksmith)
     needs: setup
-    if: ${{ inputs.use-blacksmith-runners && !inputs.use-arc-runners }}
+    if: ${{ inputs.use-blacksmith-runners && !(inputs.use-arc-runners && github.event.repository.private) && github.event.repository.private != false }}
     runs-on: ${{ needs.setup.outputs.runner }}
     timeout-minutes: 30
     steps:
@@ -189,11 +189,11 @@ jobs:
   build-self-hosted:
     name: Build (self-hosted)
     needs: setup
-    if: ${{ !inputs.use-blacksmith-runners || inputs.use-arc-runners }}
+    if: ${{ !inputs.use-blacksmith-runners || (inputs.use-arc-runners && github.event.repository.private) || github.event.repository.private == false }}
     runs-on: ${{ needs.setup.outputs.runner }}
     timeout-minutes: 30
     env:
-      S3_CACHE: ${{ inputs.use-arc-runners && secrets.GH_ACTION_ACCESS_KEY_ID != '' }}
+      S3_CACHE: ${{ (inputs.use-arc-runners && github.event.repository.private) && secrets.GH_ACTION_ACCESS_KEY_ID != '' }}
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -222,7 +222,7 @@ jobs:
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
       - name: Restore Dockerfile cache mounts
         id: cache-mounts
-        if: ${{ inputs.use-arc-runners && env.S3_CACHE != 'true' }}
+        if: ${{ (inputs.use-arc-runners && github.event.repository.private) && env.S3_CACHE != 'true' }}
         uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with: &cache-mounts
           path: buildkit-cache-mounts
@@ -242,7 +242,7 @@ jobs:
           AWS_REGION: eu-west-1
         with: *cache-mounts
       - name: Inject Dockerfile cache mounts into the builder
-        if: ${{ inputs.use-arc-runners }}
+        if: ${{ (inputs.use-arc-runners && github.event.repository.private) }}
         uses: reproducible-containers/buildkit-cache-dance@5422eac04292c961a382e0f584ea0f03ad9da723 # v3.4.0
         with:
           dockerfile: ${{ inputs.docker-file-name }}

.github/workflows/component-test-python.yml

@@ -11,6 +11,11 @@ on:
         type: boolean
         default: true
         description: "Run on Blacksmith arm64 cloud runners (default). Set to false to run on the self-hosted linux-arm64 runners."
+      use-arc-runners:
+        required: false
+        type: boolean
+        default: true
+        description: "Run on the self-hosted ARC arm64 runners (default in private repositories, never used in public ones; takes precedence over use-blacksmith-runners). Set to false to opt out."
       service-name:
         required: false
         type: string
@@ -50,7 +55,7 @@ permissions:
 jobs:
   setup:
     name: Setup
-    runs-on: linux-arm64
+    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-2cpu-4gb' || 'linux-arm64' }}
     outputs:
       runner-name: ${{ steps.runner.outputs.runner-name }}
     steps:
@@ -60,6 +65,7 @@ jobs:
         with:
           runner-size: ${{ inputs.runner-size }}
           use-blacksmith-runners: ${{ inputs.use-blacksmith-runners }}
+          use-arc-runners: ${{ (inputs.use-arc-runners && github.event.repository.private) }}
   test:
     name: Test
     needs: setup

.github/workflows/deploy-generic-v2.yml

@@ -13,6 +13,11 @@ on:
         type: boolean
         default: true
         description: "Run on Blacksmith arm64 cloud runners (default). Set to false to run on the self-hosted linux-arm64 runners."
+      use-arc-runners:
+        required: false
+        type: boolean
+        default: true
+        description: "Run on the self-hosted ARC arm64 runners (default in private repositories, never used in public ones; takes precedence over use-blacksmith-runners). Set to false to opt out."
       # DEPRECATED (no-op): all builds and CI run on arm64. Retained for backwards
       # compatibility with callers still passing it; the value is ignored and this
       # input will be removed in a future release.
@@ -159,6 +164,7 @@ jobs:
     with:
       runner-size: ${{ inputs.runner-size }}
       use-blacksmith-runners: ${{ inputs.use-blacksmith-runners }}
+      use-arc-runners: ${{ (inputs.use-arc-runners && github.event.repository.private) }}
       stage: ${{ inputs.stage }}
       service-name: ${{ inputs.service-name }}
       service-emoji: ${{ inputs.service-emoji }}

.github/workflows/deploy-generic.yml

@@ -13,6 +13,11 @@ on:
         type: boolean
         default: true
         description: "Run on Blacksmith arm64 cloud runners (default). Set to false to run on the self-hosted linux-arm64 runners."
+      use-arc-runners:
+        required: false
+        type: boolean
+        default: true
+        description: "Run on the self-hosted ARC arm64 runners (default in private repositories, never used in public ones; takes precedence over use-blacksmith-runners). Set to false to opt out."
       # DEPRECATED (no-op): all builds and CI run on arm64. Retained for backwards
       # compatibility with callers still passing it; the value is ignored and this
       # input will be removed in a future release.
@@ -150,6 +155,7 @@ jobs:
     with:
       runner-size: ${{ inputs.runner-size }}
       use-blacksmith-runners: ${{ inputs.use-blacksmith-runners }}
+      use-arc-runners: ${{ (inputs.use-arc-runners && github.event.repository.private) }}
       stage: ${{ inputs.stage }}
       service-name: ${{ inputs.service-name }}
       service-emoji: ${{ inputs.service-emoji }}

.github/workflows/deploy-python.yml

@@ -13,6 +13,11 @@ on:
         type: boolean
         default: true
         description: "Run on Blacksmith arm64 cloud runners (default). Set to false to run on the self-hosted linux-arm64 runners."
+      use-arc-runners:
+        required: false
+        type: boolean
+        default: true
+        description: "Run on the self-hosted ARC arm64 runners (default in private repositories, never used in public ones; takes precedence over use-blacksmith-runners). Set to false to opt out."
       # DEPRECATED (no-op): all builds and CI run on arm64. Retained for backwards
       # compatibility with callers still passing it; the value is ignored and this
       # input will be removed in a future release.
@@ -110,6 +115,7 @@ jobs:
     with:
       runner-size: ${{ inputs.runner-size }}
       use-blacksmith-runners: ${{ inputs.use-blacksmith-runners }}
+      use-arc-runners: ${{ (inputs.use-arc-runners && github.event.repository.private) }}
       service-name: ${{ inputs.service-name }}
       service-emoji: ${{ inputs.service-emoji }}
       docker-compose-path: ${{ inputs.docker-compose-path }}
@@ -121,6 +127,7 @@ jobs:
     with:
       runner-size: ${{ inputs.runner-size }}
       use-blacksmith-runners: ${{ inputs.use-blacksmith-runners }}
+      use-arc-runners: ${{ (inputs.use-arc-runners && github.event.repository.private) }}
       stage: ${{ inputs.stage }}
       service-name: ${{ inputs.service-name }}
       service-emoji: ${{ inputs.service-emoji }}

.github/workflows/pull-request-bun.yml

@@ -12,6 +12,11 @@ on:
         type: boolean
         default: true
         description: "Run on Blacksmith arm64 cloud runners (default). Set to false to run on the self-hosted linux-arm64 runners."
+      use-arc-runners:
+        required: false
+        type: boolean
+        default: true
+        description: "Run on the self-hosted ARC arm64 runners (default in private repositories, never used in public ones; takes precedence over use-blacksmith-runners). Set to false to opt out."
       # DEPRECATED (no-op): all builds and CI run on arm64. Retained for backwards
       # compatibility with callers still passing it; the value is ignored and this
       # input will be removed in a future release.
@@ -57,7 +62,7 @@ on:
 jobs:
   setup:
     name: Setup
-    runs-on: linux-arm64
+    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-2cpu-4gb' || 'linux-arm64' }}
     timeout-minutes: 5
     outputs:
       runner-name: ${{ steps.runner.outputs.runner-name }}
@@ -70,6 +75,7 @@ jobs:
         with:
           runner-size: ${{ inputs.runner-size }}
           use-blacksmith-runners: ${{ inputs.use-blacksmith-runners }}
+          use-arc-runners: ${{ (inputs.use-arc-runners && github.event.repository.private) }}
   lint-build-test:
     name: Lint & Build & Test
     needs: setup

.github/workflows/pull-request-react.yml

@@ -12,6 +12,11 @@ on:
         type: boolean
         default: true
         description: "Run on Blacksmith arm64 cloud runners (default). Set to false to run on the self-hosted linux-arm64 runners."
+      use-arc-runners:
+        required: false
+        type: boolean
+        default: true
+        description: "Run on the self-hosted ARC arm64 runners (default in private repositories, never used in public ones; takes precedence over use-blacksmith-runners). Set to false to opt out."
       # DEPRECATED (no-op): all builds and CI run on arm64. Retained for backwards
       # compatibility with callers still passing it; the value is ignored and this
       # input will be removed in a future release.
@@ -63,7 +68,7 @@ on:
 jobs:
   setup:
     name: Setup
-    runs-on: linux-arm64
+    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-2cpu-4gb' || 'linux-arm64' }}
     timeout-minutes: 5
     outputs:
       runner-name: ${{ steps.runner.outputs.runner-name }}
@@ -76,6 +81,7 @@ jobs:
         with:
           runner-size: ${{ inputs.runner-size }}
           use-blacksmith-runners: ${{ inputs.use-blacksmith-runners }}
+          use-arc-runners: ${{ (inputs.use-arc-runners && github.event.repository.private) }}
   lint-build-test:
     name: Lint & Build & Test
     needs: setup

CLAUDE.md

@@ -1,10 +1,13 @@
 # Claude Code Notes
 
 ## Last Documentation Update
-- **Date**: 2026-09-30
+- **Date**: 2026-10-01
 - **Latest SHA**: a455757 (check for newer commits)
 - **Changes**: Removed the `code-coverage-kotlin.yml` workflow (and with it `monta-app/push-kover-prometheus-action`)
 
+## Recent Changes (2026-10-01)
+1. **ARC is the default for every shared workflow; public repos use GitHub's standard runner**: `deploy-generic(-v2)`, `deploy-python`, `pull-request-bun`, `pull-request-react` and `component-test-python` gain `use-arc-runners` (default `true`), and `component-build`'s default flips to `true` (its direct callers move too). Every read is `(inputs.use-arc-runners && github.event.repository.private)`, as in the Kotlin workflows. `runner-size-converter` returns `ubuntu-24.04-arm` whenever `github.event.repository.private` is `false`, so public repos never land on ARC or Blacksmith (library-ocpp and ocpp-emulator were on Blacksmith through the Kotlin workflows' fallback). `component-build`'s Blacksmith builder job is skipped in public repos, since `useblacksmith/*` needs a Blacksmith runner. Events without a repository in the payload (`schedule`) keep the previous behaviour. Repos pinned to an older github-workflows SHA are unaffected.
+
 ## Recent Changes (2026-09-30)
 1. **Removed `code-coverage-kotlin.yml`**: its only job beyond running tests was pushing Kover coverage + cloc line counts to Dev Lens via `monta-app/push-kover-prometheus-action`, which is retired. Coverage is covered by `sonar-cloud.yml`, which runs `test koverXmlReport` itself and which every former caller already ran alongside it (their Gradle builds point `sonar.coverage.jacoco.xmlReportPaths` at the Kover report). The 33 callers (a `code-coverage-report` job in each repo's `code-analysis.yml`) had that job removed in separate PRs, which must merge before this removal because they called it at `@main`.
 

docs/workflow-guide.md

@@ -110,7 +110,7 @@ jobs:
 | `service-identifier` | Yes | - | Service identifier (e.g., "ocpp", "vehicle") |
 | `runner-size` | No | "normal" | Runner size: "normal" or "large" |
 | `use-blacksmith-runners` | No | true | Run on Blacksmith arm64 cloud runners (default). Set to false to run on self-hosted linux-arm64 |
-| `use-arc-runners` | No | false | Run on the self-hosted ARC arm64 runners (`normal` → `arc-arm64-4cpu-12gb`, `large` → `arc-arm64-8cpu-24gb`); takes precedence over `use-blacksmith-runners`. Builds with docker buildx and the ECR registry layer cache. Dockerfile `RUN --mount=type=cache` contents (e.g. `/root/.gradle`) are kept between builds: in S3 when the `GH_ACTION_*` secrets are passed, the GitHub cache otherwise. |
+| `use-arc-runners` | No | true | Run on the self-hosted ARC arm64 runners (`normal` → `arc-arm64-4cpu-12gb`, `large` → `arc-arm64-8cpu-24gb`); the default in private repos, never used in public repos. Takes precedence over `use-blacksmith-runners`. Builds with docker buildx and the ECR registry layer cache. Dockerfile `RUN --mount=type=cache` contents (e.g. `/root/.gradle`) are kept between builds: in S3 when the `GH_ACTION_*` secrets are passed, the GitHub cache otherwise. |
 | `region` | No | "eu-west-1" | AWS region |
 | `docker-file-name` | No | "Dockerfile" | Dockerfile name |
 | `additional-build-args` | No | - | Additional Docker build arguments |
@@ -304,6 +304,7 @@ jobs:
 |-------|----------|---------|-------------|
 | `runner-size` | No | - | Runner size for the job |
 | `use-blacksmith-runners` | No | true | Run on Blacksmith arm64 cloud runners (default). Set to false to run on self-hosted linux-arm64 |
+| `use-arc-runners` | No | true | Run on the self-hosted ARC arm64 runners (`normal` → `arc-arm64-4cpu-12gb`, `large` → `arc-arm64-8cpu-24gb`); the default in private repos and never used in public repos, which run on `ubuntu-24.04-arm`. Takes precedence over `use-blacksmith-runners`; set to `false` to opt out. |
 | `service-name` | No | - | Display name for Slack |
 | `service-emoji` | No | - | Emoji for Slack |
 | `python-version` | No | "3.13" | Python version |
@@ -480,6 +481,7 @@ jobs:
 |-------|----------|---------|-------------|
 | `runner-size` | No | "normal" | Runner size ("normal" or "large") |
 | `use-blacksmith-runners` | No | true | Run on Blacksmith arm64 cloud runners (default). Set to false to run on self-hosted linux-arm64 |
+| `use-arc-runners` | No | true | Run on the self-hosted ARC arm64 runners (`normal` → `arc-arm64-4cpu-12gb`, `large` → `arc-arm64-8cpu-24gb`); the default in private repos and never used in public repos, which run on `ubuntu-24.04-arm`. Takes precedence over `use-blacksmith-runners`; set to `false` to opt out. |
 | `stage` | **Yes** | - | Deployment stage (dev/staging/production) |
 | `service-name` | **Yes** | - | Service display name |
 | `service-emoji` | **Yes** | - | Service emoji |
@@ -865,6 +867,7 @@ jobs:
 |-------|----------|---------|-------------|
 | `runner-size` | No | "normal" | Runner size |
 | `use-blacksmith-runners` | No | true | Run on Blacksmith arm64 cloud runners (default). Set to false to run on self-hosted linux-arm64 |
+| `use-arc-runners` | No | true | Run on the self-hosted ARC arm64 runners (`normal` → `arc-arm64-4cpu-12gb`, `large` → `arc-arm64-8cpu-24gb`); the default in private repos and never used in public repos, which run on `ubuntu-24.04-arm`. Takes precedence over `use-blacksmith-runners`; set to `false` to opt out. |
 | `bun-version` | No | "latest" | Bun version |
 | `working-directory` | No | "." | Frontend code directory |
 | `build-timeout-minutes` | No | 15 | Build timeout |
@@ -911,6 +914,7 @@ The workflow automatically reports code coverage if your project generates LCOV
 |-------|----------|---------|-------------|
 | `runner-size` | No | "normal" | Runner size |
 | `use-blacksmith-runners` | No | true | Run on Blacksmith arm64 cloud runners (default). Set to false to run on self-hosted linux-arm64 |
+| `use-arc-runners` | No | true | Run on the self-hosted ARC arm64 runners (`normal` → `arc-arm64-4cpu-12gb`, `large` → `arc-arm64-8cpu-24gb`); the default in private repos and never used in public repos, which run on `ubuntu-24.04-arm`. Takes precedence over `use-blacksmith-runners`; set to `false` to opt out. |
 | `node-version` | No | "lts/jod" | Node.js version |
 | `pnpm-version` | No | "10" | pnpm version |
 | `working-directory` | No | "." | Frontend code directory |