From 0c58801a8462c174c3589a3061d8ef5b036746ed Mon Sep 17 00:00:00 2001 From: Reuben Bowlby Date: Fri, 31 Jul 2026 20:13:01 -0400 Subject: [PATCH] fix(ci): migrate self-hosted to ubuntu-latest for PR safety (ADR-FM-027 D3) Eliminates P1 security exposure: pull_request trigger was running untrusted PR code on self-hosted runners. Per GitHub guidance, self-hosted runners should never be used on public repos with PR triggers. ubuntu-latest is ephemeral and eliminates the risk. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0e4acdb..97024ef 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,7 +11,7 @@ jobs: if: >- github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository - runs-on: [self-hosted, Linux, X64, wsl, base120] + runs-on: ubuntu-latest strategy: matrix: python-version: ["3.11", "3.12"]