From e8ecea68acdb9a4ab600e67dfd68d777223a18ae Mon Sep 17 00:00:00 2001
From: Jesper Terkelsen <jete@monta.com>
Date: Tue, 6 Oct 2026 08:14:48 +0200
Subject: [PATCH 1/2] ci(workflows): run the shared workflows' own jobs on ARC
 in private repos

The deploy step, release tag, changelog, rollback, pending-release,
PR digest, tech docs, deploy block/allow, semgrep and the Slack-token
deprecation check named GitHub-hosted labels. They now use
arc-arm64-2cpu-4gb (semgrep arc-arm64-4cpu-12gb) when the calling repo
is private, and GitHub's ubuntu-24.04-arm otherwise.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/allow-deploys.yml         | 2 +-
 .github/workflows/block-deploys.yml         | 2 +-
 .github/workflows/component-deploy-v2.yml   | 2 +-
 .github/workflows/component-deploy.yml      | 2 +-
 .github/workflows/create-release-tag.yml    | 2 +-
 .github/workflows/deploy-generic-v2.yml     | 2 +-
 .github/workflows/deploy-generic.yml        | 2 +-
 .github/workflows/deploy-kotlin-v2.yml      | 2 +-
 .github/workflows/deploy-kotlin.yml         | 2 +-
 .github/workflows/deploy-python.yml         | 2 +-
 .github/workflows/pr-digest.yml             | 2 +-
 .github/workflows/publish-tech-docs.yml     | 2 +-
 .github/workflows/pull-request.yml          | 2 +-
 .github/workflows/rollback.yml              | 4 ++--
 .github/workflows/semgrep-security-scan.yml | 2 +-
 .github/workflows/track-pending-release.yml | 2 +-
 CLAUDE.md                                   | 9 ++++++---
 README.md                                   | 2 +-
 docs/workflow-guide.md                      | 4 ++--
 19 files changed, 26 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/allow-deploys.yml b/.github/workflows/allow-deploys.yml
index 5f4e213a..8dc8f073 100644
--- a/.github/workflows/allow-deploys.yml
+++ b/.github/workflows/allow-deploys.yml
@@ -20,7 +20,7 @@ permissions:
 jobs:
   allow-release:
     name: Allow release
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
diff --git a/.github/workflows/block-deploys.yml b/.github/workflows/block-deploys.yml
index aff3603a..a698c814 100644
--- a/.github/workflows/block-deploys.yml
+++ b/.github/workflows/block-deploys.yml
@@ -20,7 +20,7 @@ permissions:
 jobs:
   disable-deploy-flows:
     name: Disable and cancel deploy
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
diff --git a/.github/workflows/component-deploy-v2.yml b/.github/workflows/component-deploy-v2.yml
index 4d91c543..352c48db 100644
--- a/.github/workflows/component-deploy-v2.yml
+++ b/.github/workflows/component-deploy-v2.yml
@@ -84,7 +84,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 10
     outputs:
       stage: ${{ inputs.stage }}
diff --git a/.github/workflows/component-deploy.yml b/.github/workflows/component-deploy.yml
index eed3807d..a4f965f7 100644
--- a/.github/workflows/component-deploy.yml
+++ b/.github/workflows/component-deploy.yml
@@ -72,7 +72,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 20
     outputs:
       stage: ${{ inputs.stage }}
diff --git a/.github/workflows/create-release-tag.yml b/.github/workflows/create-release-tag.yml
index 96669083..51a08b66 100644
--- a/.github/workflows/create-release-tag.yml
+++ b/.github/workflows/create-release-tag.yml
@@ -12,7 +12,7 @@ on:
 jobs:
   create-tag:
     name: Create Release Tag
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     permissions:
       contents: write
     steps:
diff --git a/.github/workflows/deploy-generic-v2.yml b/.github/workflows/deploy-generic-v2.yml
index fd284bb6..fb47c14d 100644
--- a/.github/workflows/deploy-generic-v2.yml
+++ b/.github/workflows/deploy-generic-v2.yml
@@ -149,7 +149,7 @@ permissions:
 jobs:
   slack-token-deprecation:
     name: Deprecation check
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Warn if deprecated SLACK_APP_TOKEN is provided
         env:
diff --git a/.github/workflows/deploy-generic.yml b/.github/workflows/deploy-generic.yml
index ea290945..0d23b61d 100644
--- a/.github/workflows/deploy-generic.yml
+++ b/.github/workflows/deploy-generic.yml
@@ -140,7 +140,7 @@ permissions:
 jobs:
   slack-token-deprecation:
     name: Deprecation check
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Warn if deprecated SLACK_APP_TOKEN is provided
         env:
diff --git a/.github/workflows/deploy-kotlin-v2.yml b/.github/workflows/deploy-kotlin-v2.yml
index 755b088d..657cf22c 100644
--- a/.github/workflows/deploy-kotlin-v2.yml
+++ b/.github/workflows/deploy-kotlin-v2.yml
@@ -328,7 +328,7 @@ jobs:
     name: Create and Publish Changelog
     needs: [create-release-tag, deploy]
     if: always() && inputs.enable-changelog && needs.deploy.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 5
     steps:
       - name: Run changelog cli action
diff --git a/.github/workflows/deploy-kotlin.yml b/.github/workflows/deploy-kotlin.yml
index dc55b3c0..ee71c18a 100644
--- a/.github/workflows/deploy-kotlin.yml
+++ b/.github/workflows/deploy-kotlin.yml
@@ -313,7 +313,7 @@ jobs:
     name: Create and Publish Changelog
     needs: [create-release-tag, deploy]
     if: always() && inputs.enable-changelog && needs.deploy.result == 'success'
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 5
     steps:
       - name: Run changelog cli action
diff --git a/.github/workflows/deploy-python.yml b/.github/workflows/deploy-python.yml
index 3555ec31..7eccc297 100644
--- a/.github/workflows/deploy-python.yml
+++ b/.github/workflows/deploy-python.yml
@@ -100,7 +100,7 @@ permissions:
 jobs:
   slack-token-deprecation:
     name: Deprecation check
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Warn if deprecated SLACK_APP_TOKEN is provided
         env:
diff --git a/.github/workflows/pr-digest.yml b/.github/workflows/pr-digest.yml
index 86547b2d..6a944220 100644
--- a/.github/workflows/pr-digest.yml
+++ b/.github/workflows/pr-digest.yml
@@ -69,7 +69,7 @@ permissions:
 jobs:
   digest:
     name: Build and post PR digest
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 10
     env:
       GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/publish-tech-docs.yml b/.github/workflows/publish-tech-docs.yml
index 52f34168..2d02535c 100644
--- a/.github/workflows/publish-tech-docs.yml
+++ b/.github/workflows/publish-tech-docs.yml
@@ -13,7 +13,7 @@ on:
 
 jobs:
   publish-techdocs-site:
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
 
     env:
       TECHDOCS_S3_BUCKET_NAME: 'monta-tech-docs'
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index dc38a6f3..8337bbea 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -13,7 +13,7 @@ permissions:
 jobs:
   lint-workflows:
     name: Lint GitHub Workflows
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout code
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
diff --git a/.github/workflows/rollback.yml b/.github/workflows/rollback.yml
index 3db0ca07..4917c7bf 100644
--- a/.github/workflows/rollback.yml
+++ b/.github/workflows/rollback.yml
@@ -51,7 +51,7 @@ jobs:
   slackNotification:
     name: Send Slack notification
     if: ${{ !inputs.dry-run }}
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Slack Notification
@@ -79,7 +79,7 @@ jobs:
     needs: block-deploys
     if: ${{ !cancelled() && (needs.block-deploys.result == 'success' || needs.block-deploys.result == 'skipped') }}
     name: Deploy rollback
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout branch
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
diff --git a/.github/workflows/semgrep-security-scan.yml b/.github/workflows/semgrep-security-scan.yml
index 643ab48f..59c103a4 100644
--- a/.github/workflows/semgrep-security-scan.yml
+++ b/.github/workflows/semgrep-security-scan.yml
@@ -20,7 +20,7 @@ on:
 jobs:
   semgrep:
     name: Security Scan
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-4cpu-12gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: ${{ inputs.timeout-minutes }}
     permissions:
       contents: read
diff --git a/.github/workflows/track-pending-release.yml b/.github/workflows/track-pending-release.yml
index 5cd90b21..d2f40362 100644
--- a/.github/workflows/track-pending-release.yml
+++ b/.github/workflows/track-pending-release.yml
@@ -17,7 +17,7 @@ on:
 jobs:
   update-pending-release:
     name: Update Pending Release Changelog
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 5
     steps:
       - name: Checkout
diff --git a/CLAUDE.md b/CLAUDE.md
index ed530f8d..3fa88b1e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,9 +1,12 @@
 # Claude Code Notes
 
 ## Last Documentation Update
-- **Date**: 2026-10-05
-- **Latest SHA**: 4491679 (check for newer commits)
-- **Changes**: Removed Blacksmith runner support
+- **Date**: 2026-10-06
+- **Latest SHA**: 340af8f (check for newer commits)
+- **Changes**: The shared workflows' own jobs run on ARC in private repositories
+
+## Recent Changes (2026-10-06)
+1. **The shared workflows' own jobs run on ARC**: the 17 jobs that named a GitHub-hosted label (`component-deploy(-v2)` deploy, `create-release-tag`, the deploy workflows' changelog and Slack-token deprecation jobs, `rollback`, `track-pending-release`, `pr-digest`, `publish-tech-docs`, `allow-/block-deploys`, `semgrep-security-scan`, and this repo's own `pull-request.yml`) use `${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}`; semgrep gets `arc-arm64-4cpu-12gb`. Public callers, and events without a repository in the payload (`schedule`), get GitHub's standard arm64 runner. The deploy and rollback jobs rely on `yq` v4 and `jq` from the runner, both in the ARC image; `argocd` is downloaded by `argocd-wait-sync`, and nothing calls the `helm` CLI.
 
 ## Recent Changes (2026-10-05)
 1. **Blacksmith runner support removed**: the `use-blacksmith-runners` input is gone from every workflow and from `runner-size-converter`, `component-build` no longer has the `build-blacksmith` job (`build-self-hosted` always runs), and the Blacksmith labels are out of `actionlint.yaml`. The converter now resolves ARC (`use-arc-runners: true` in a private repo), `ubuntu-24.04-arm` (public repo), or else the GitHub-hosted `linux-arm64` / `linux-arm64-xl`; that last case covers callers that opt out of ARC and events without a repository in the payload (`schedule`), which previously fell back to Blacksmith. Callers that still pass `use-blacksmith-runners` fail at startup; changelog-monorepo and service-productops dropped it first. Repos pinned to an older github-workflows SHA keep that SHA's behaviour, and the seven pinned to `f0866ab` (Blacksmith by default) were bumped to `4491679`.
diff --git a/README.md b/README.md
index 67dadc0e..14e367f7 100644
--- a/README.md
+++ b/README.md
@@ -295,7 +295,7 @@ on:
 
 jobs:
   schedule-guard:
-    runs-on: ubuntu-latest
+    runs-on: arc-arm64-2cpu-4gb
     outputs:
       proceed: ${{ steps.check.outputs.proceed }}
     steps:
diff --git a/docs/workflow-guide.md b/docs/workflow-guide.md
index 330d8764..78446e5b 100644
--- a/docs/workflow-guide.md
+++ b/docs/workflow-guide.md
@@ -1243,7 +1243,7 @@ on:
 
 jobs:
   schedule-guard:
-    runs-on: ubuntu-latest
+    runs-on: arc-arm64-2cpu-4gb
     outputs:
       proceed: ${{ steps.check.outputs.proceed }}
     steps:
@@ -1392,7 +1392,7 @@ jobs:
   terraform-ok:
     needs: [discover, terraform]
     if: always()
-    runs-on: ubuntu-latest
+    runs-on: arc-arm64-2cpu-4gb
     steps:
       - run: |
           [[ "${{ needs.discover.result }}" == "success" ]] || exit 1

From 7e147bf6471f5a5e05e3417aaf4b43bd80fa5c5d Mon Sep 17 00:00:00 2001
From: Jesper Terkelsen <jete@monta.com>
Date: Tue, 6 Oct 2026 08:19:54 +0200
Subject: [PATCH 2/2] fix(workflows): write the changelog backticks as a jq
 escape

shellcheck read the literal backticks in the --jq filter as a command
substitution that single quotes stop from expanding (SC2016). `
gives the same Markdown and keeps the shell string free of backticks.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/track-pending-release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/track-pending-release.yml b/.github/workflows/track-pending-release.yml
index d2f40362..38e4e647 100644
--- a/.github/workflows/track-pending-release.yml
+++ b/.github/workflows/track-pending-release.yml
@@ -75,7 +75,7 @@ jobs:
           MAIN="${{ steps.get-main.outputs.main-sha }}"
 
           # Get commits between deployed and main
-          COMMITS=$(gh api "repos/${{ github.repository }}/compare/${DEPLOYED}...${MAIN}" --jq '.commits[] | "- [`\(.sha[0:7])`](\(.html_url)) \(.commit.message | split("\n")[0]) by @\(.author.login // "unknown")"')
+          COMMITS=$(gh api "repos/${{ github.repository }}/compare/${DEPLOYED}...${MAIN}" --jq '.commits[] | "- [\u0060\(.sha[0:7])\u0060](\(.html_url)) \(.commit.message | split("\n")[0]) by @\(.author.login // "unknown")"')
 
           # Count commits
           COMMIT_COUNT=$(gh api "repos/${{ github.repository }}/compare/${DEPLOYED}...${MAIN}" --jq '.total_commits')