ci(workflows): run the shared workflows' own jobs on ARC in private repos

[JesperTerkelsen]

What

The 17 jobs in the shared workflows that still named a GitHub-hosted runner (linux-arm64 / ubuntu-latest) now pick it by the calling repo's visibility:

runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}

Workflow	Job
component-deploy.yml, component-deploy-v2.yml	deploy (manifest bump + ArgoCD wait)
create-release-tag.yml	create-tag
deploy-kotlin.yml, deploy-kotlin-v2.yml	create-changelog
deploy-generic.yml, deploy-generic-v2.yml, deploy-python.yml	slack-token-deprecation
rollback.yml	slackNotification, push-manifest
track-pending-release.yml	update-pending-release
pr-digest.yml	digest
publish-tech-docs.yml	publish-techdocs-site
allow-deploys.yml, block-deploys.yml	allow-release, disable-deploy-flows
semgrep-security-scan.yml	semgrep → arc-arm64-4cpu-12gb (Semgrep can use a few GB on large repos)
pull-request.yml	lint-workflows (this repo is public, so it gets ubuntu-24.04-arm)

The caller examples in the README and workflow guide use arc-arm64-2cpu-4gb, and CLAUDE.md has the change entry.

Why

Moving private-repo CI to ARC to cut GitHub-hosted cost. These jobs run in every repo that deploys through the shared workflows, so one change moves them all. Most are short, and GitHub bills each job as at least a whole minute, so small jobs like these cost more than their runtime suggests.

Compatibility checked

• The deploy and rollback jobs use yq v4 and jq from the runner. Both are in the ARC image (https://github.com/monta-app/actions-runner). argocd is downloaded by argocd-wait-sync for the runner's architecture, and nothing calls the helm CLI ("helm" only appears in values paths).
• Public callers, and events without a repository in the payload (schedule), get GitHub's standard ubuntu-24.04-arm, never ARC, which rejects public repositories.

QA

• actionlint: no new findings.
• These jobs run in callers' deploys after merge; the first deploys of a few private services should show the deploy, release tag and changelog jobs on arc-arm64-2cpu-4gb.

nojira

🤖 Generated with Claude Code

[github-actions]

📝 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2016:info:5:86: Expressions don't expand in single quotes, use double quotes for that [shellcheck]

github-workflows/.github/workflows/track-pending-release.yml

Line 73 in e8ecea6

run: |

[JesperTerkelsen]

Fixed in 7e147bf: the backticks are written as jq's ``` escape, so the shell string has none for shellcheck to flag. Same output: checked with jq and with gh --jq (gojq) on a real comparison.