ci(workflows): run the shared workflows' own jobs on ARC in private repos

.github/workflows/allow-deploys.yml

@@ -20,7 +20,7 @@ permissions:
 jobs:
   allow-release:
     name: Allow release
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

.github/workflows/block-deploys.yml

@@ -20,7 +20,7 @@ permissions:
 jobs:
   disable-deploy-flows:
     name: Disable and cancel deploy
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

.github/workflows/component-deploy-v2.yml

@@ -84,7 +84,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 10
     outputs:
       stage: ${{ inputs.stage }}

.github/workflows/component-deploy.yml

@@ -72,7 +72,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 20
     outputs:
       stage: ${{ inputs.stage }}

.github/workflows/create-release-tag.yml

@@ -12,7 +12,7 @@ on:
 jobs:
   create-tag:
     name: Create Release Tag
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     permissions:
       contents: write
     steps:

.github/workflows/deploy-generic-v2.yml

@@ -149,7 +149,7 @@ permissions:
 jobs:
   slack-token-deprecation:
     name: Deprecation check
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Warn if deprecated SLACK_APP_TOKEN is provided
         env:

.github/workflows/deploy-generic.yml

@@ -140,7 +140,7 @@ permissions:
 jobs:
   slack-token-deprecation:
     name: Deprecation check
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Warn if deprecated SLACK_APP_TOKEN is provided
         env:

.github/workflows/deploy-kotlin-v2.yml

@@ -328,7 +328,7 @@ jobs:
     name: Create and Publish Changelog
     needs: [create-release-tag, deploy]
     if: always() && inputs.enable-changelog && needs.deploy.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 5
     steps:
       - name: Run changelog cli action

.github/workflows/deploy-kotlin.yml

@@ -313,7 +313,7 @@ jobs:
     name: Create and Publish Changelog
     needs: [create-release-tag, deploy]
     if: always() && inputs.enable-changelog && needs.deploy.result == 'success'
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 5
     steps:
       - name: Run changelog cli action

.github/workflows/deploy-python.yml

@@ -100,7 +100,7 @@ permissions:
 jobs:
   slack-token-deprecation:
     name: Deprecation check
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Warn if deprecated SLACK_APP_TOKEN is provided
         env:

.github/workflows/pr-digest.yml

@@ -69,7 +69,7 @@ permissions:
 jobs:
   digest:
     name: Build and post PR digest
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 10
     env:
       GH_TOKEN: ${{ github.token }}

.github/workflows/publish-tech-docs.yml

@@ -13,7 +13,7 @@ on:
 
 jobs:
   publish-techdocs-site:
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
 
     env:
       TECHDOCS_S3_BUCKET_NAME: 'monta-tech-docs'

.github/workflows/pull-request.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   lint-workflows:
     name: Lint GitHub Workflows
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout code
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

.github/workflows/rollback.yml

@@ -51,7 +51,7 @@ jobs:
   slackNotification:
     name: Send Slack notification
     if: ${{ !inputs.dry-run }}
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Slack Notification
@@ -79,7 +79,7 @@ jobs:
     needs: block-deploys
     if: ${{ !cancelled() && (needs.block-deploys.result == 'success' || needs.block-deploys.result == 'skipped') }}
     name: Deploy rollback
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout branch
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

.github/workflows/semgrep-security-scan.yml

@@ -20,7 +20,7 @@ on:
 jobs:
   semgrep:
     name: Security Scan
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-4cpu-12gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: ${{ inputs.timeout-minutes }}
     permissions:
       contents: read

.github/workflows/track-pending-release.yml

 run: | 
 run: | 
@@ -17,7 +17,7 @@ on:
 jobs:
   update-pending-release:
     name: Update Pending Release Changelog
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 5
     steps:
       - name: Checkout
@@ -75,7 +75,7 @@ jobs:
           MAIN="${{ steps.get-main.outputs.main-sha }}"
 
           # Get commits between deployed and main
-          COMMITS=$(gh api "repos/${{ github.repository }}/compare/${DEPLOYED}...${MAIN}" --jq '.commits[] | "- [`\(.sha[0:7])`](\(.html_url)) \(.commit.message | split("\n")[0]) by @\(.author.login // "unknown")"')
+          COMMITS=$(gh api "repos/${{ github.repository }}/compare/${DEPLOYED}...${MAIN}" --jq '.commits[] | "- [\u0060\(.sha[0:7])\u0060](\(.html_url)) \(.commit.message | split("\n")[0]) by @\(.author.login // "unknown")"')
 
           # Count commits
           COMMIT_COUNT=$(gh api "repos/${{ github.repository }}/compare/${DEPLOYED}...${MAIN}" --jq '.total_commits')

CLAUDE.md

@@ -1,9 +1,12 @@
 # Claude Code Notes
 
 ## Last Documentation Update
-- **Date**: 2026-10-05
-- **Latest SHA**: 4491679 (check for newer commits)
-- **Changes**: Removed Blacksmith runner support
+- **Date**: 2026-10-06
+- **Latest SHA**: 340af8f (check for newer commits)
+- **Changes**: The shared workflows' own jobs run on ARC in private repositories
+
+## Recent Changes (2026-10-06)
+1. **The shared workflows' own jobs run on ARC**: the 17 jobs that named a GitHub-hosted label (`component-deploy(-v2)` deploy, `create-release-tag`, the deploy workflows' changelog and Slack-token deprecation jobs, `rollback`, `track-pending-release`, `pr-digest`, `publish-tech-docs`, `allow-/block-deploys`, `semgrep-security-scan`, and this repo's own `pull-request.yml`) use `${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}`; semgrep gets `arc-arm64-4cpu-12gb`. Public callers, and events without a repository in the payload (`schedule`), get GitHub's standard arm64 runner. The deploy and rollback jobs rely on `yq` v4 and `jq` from the runner, both in the ARC image; `argocd` is downloaded by `argocd-wait-sync`, and nothing calls the `helm` CLI.
 
 ## Recent Changes (2026-10-05)
 1. **Blacksmith runner support removed**: the `use-blacksmith-runners` input is gone from every workflow and from `runner-size-converter`, `component-build` no longer has the `build-blacksmith` job (`build-self-hosted` always runs), and the Blacksmith labels are out of `actionlint.yaml`. The converter now resolves ARC (`use-arc-runners: true` in a private repo), `ubuntu-24.04-arm` (public repo), or else the GitHub-hosted `linux-arm64` / `linux-arm64-xl`; that last case covers callers that opt out of ARC and events without a repository in the payload (`schedule`), which previously fell back to Blacksmith. Callers that still pass `use-blacksmith-runners` fail at startup; changelog-monorepo and service-productops dropped it first. Repos pinned to an older github-workflows SHA keep that SHA's behaviour, and the seven pinned to `f0866ab` (Blacksmith by default) were bumped to `4491679`.

README.md

@@ -295,7 +295,7 @@ on:
 
 jobs:
   schedule-guard:
-    runs-on: ubuntu-latest
+    runs-on: arc-arm64-2cpu-4gb
     outputs:
       proceed: ${{ steps.check.outputs.proceed }}
     steps:

docs/workflow-guide.md

@@ -1243,7 +1243,7 @@ on:
 
 jobs:
   schedule-guard:
-    runs-on: ubuntu-latest
+    runs-on: arc-arm64-2cpu-4gb
     outputs:
       proceed: ${{ steps.check.outputs.proceed }}
     steps:
@@ -1392,7 +1392,7 @@ jobs:
   terraform-ok:
     needs: [discover, terraform]
     if: always()
-    runs-on: ubuntu-latest
+    runs-on: arc-arm64-2cpu-4gb
     steps:
       - run: |
           [[ "${{ needs.discover.result }}" == "success" ]] || exit 1