ci(runners): run the heavy 16 vCPU jobs on RunsOn

.github/actionlint.yaml

@@ -7,12 +7,14 @@
 #
 # Nothing complained before because actionlint has never run in this repository;
 # lint-release.yml is what introduces it.
+#
+# RunsOn labels need no entry here. Each one starts with
+# `runs-on=${{ github.run_id }}`, and actionlint does not check a label that
+# contains an expression.
 self-hosted-runner:
   labels:
     - blacksmith-4vcpu-ubuntu-2404
-    # Every job in the imported EQL suite. Sixteen of them, and the size is
-    # deliberate upstream: the sharded SQLx matrix compiles the full Rust
-    # dependency tree, so the runner is chosen for the compile rather than for
-    # the tests. Kept as its own label rather than renamed to the 4vcpu one —
-    # rehoming those jobs is a cost decision, not a lint fix.
+    # Only light jobs still use this label: they run bash, compute a matrix or
+    # summarise results. The heavy jobs that used it, such as the Rust compiles
+    # and the Postgres suites, run on RunsOn instead.
     - blacksmith-16vcpu-ubuntu-2204

.github/workflows/_build-eql-docs.yml

@@ -37,7 +37,7 @@ permissions:
 jobs:
   publish-docs:
     name: Build and publish documentation
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 20
 
     steps:
@@ -53,10 +53,12 @@ jobs:
           cache: false # publish path; see _build-eql-sql.yml
           working_directory: packages/eql
 
+      # A fresh RunsOn machine can still be running apt from boot, and apt-get
+      # fails at once on a held lock unless told to wait for it.
       - name: Install Doxygen
         run: |
-          sudo apt-get update
-          sudo apt-get install -y doxygen
+          sudo apt-get -o DPkg::Lock::Timeout=300 update
+          sudo apt-get -o DPkg::Lock::Timeout=300 install -y doxygen
 
       - name: Generate documentation
         env:

.github/workflows/_build-eql-sql.yml

@@ -57,7 +57,7 @@ permissions:
 jobs:
   build:
     name: Build EQL
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 20
 
     steps:

.github/workflows/_build-ffi-artifacts.yml

@@ -114,12 +114,15 @@ jobs:
       # a native x86_64 build — so the other two legs were paying an
       # `apt-get update` (full package indexes) plus a ~200MB toolchain they do
       # not link against.
+      #
+      # A fresh RunsOn machine can still be running apt from boot, and apt-get
+      # fails at once on a held lock unless told to wait for it.
       - name: Install cross-compile toolchain (linux-arm64-gnu)
         if: ${{ matrix.cfg.platform == 'linux-arm64-gnu' }}
         run: |
           set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install -y gcc-13-aarch64-linux-gnu
+          sudo apt-get -o DPkg::Lock::Timeout=300 update
+          sudo apt-get -o DPkg::Lock::Timeout=300 install -y gcc-13-aarch64-linux-gnu
           sudo ln -sf /usr/bin/aarch64-linux-gnu-gcc-13 /usr/bin/aarch64-linux-gnu-gcc
 
       # Rust comes from the runner image; only the TARGET has to be added. This

.github/workflows/_test-auth-refresh-soak.yml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   soak:
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 30
     env:
       MISE_ENV: test

.github/workflows/bench-eql.yml

@@ -93,7 +93,7 @@ defaults:
 jobs:
   bench:
     name: "Bench EQL (Postgres 17)"
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 60
 
     env:
@@ -146,6 +146,24 @@ jobs:
           # slow. Asserted by scripts/__tests__/eql-suite-ci.test.mjs.
           save-if: false
 
+      # Docker Hub refuses pulls without a login after too many from one
+      # address, and RunsOn machines reach that limit. With either secret empty,
+      # as on a fork's pull request, this step does nothing and pulls stay
+      # anonymous. scripts/__tests__/workflow-docker-hub-login.test.mjs
+      # requires it.
+      - name: Log in to Docker Hub
+        env:
+          DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
+          DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [ -z "$DOCKER_HUB_USERNAME" ] || [ -z "$DOCKER_HUB_PASSWORD" ]; then
+            echo "No Docker Hub credentials, so image pulls stay anonymous."
+            exit 0
+          fi
+          printf '%s' "$DOCKER_HUB_PASSWORD" |
+            docker login --username "$DOCKER_HUB_USERNAME" --password-stdin
+
       - name: Setup database
         run: |
           mise run postgres:up "postgres-${POSTGRES_VERSION}" --extra-args "--detach --wait"

.github/workflows/crap-crates.yml

@@ -59,7 +59,7 @@ env:
 jobs:
   crap-stack-auth:
     name: CRAP (stack-auth)
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -83,7 +83,7 @@ jobs:
 
   crap-stack-encrypt:
     name: CRAP (stack-encrypt)
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

.github/workflows/integration-drizzle.yml

@@ -204,7 +204,7 @@ on:
 jobs:
   integration:
     name: Drizzle v3 integration (db=${{ matrix.db }})
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu24-full-x64/volume=80gb/extras=s3-cache
     # No concurrency group: `integration-db` gives each job its own compose
     # project and ephemeral host ports, so live-DB jobs no longer contend and do
     # not need serialising. See that action for why the old
@@ -299,6 +299,24 @@ jobs:
         with:
           wasm: 'true'
 
+      # Docker Hub refuses pulls without a login after too many from one
+      # address, and RunsOn machines reach that limit. With either secret empty,
+      # as on a fork's pull request, this step does nothing and pulls stay
+      # anonymous. scripts/__tests__/workflow-docker-hub-login.test.mjs
+      # requires it.
+      - name: Log in to Docker Hub
+        env:
+          DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
+          DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [ -z "$DOCKER_HUB_USERNAME" ] || [ -z "$DOCKER_HUB_PASSWORD" ]; then
+            echo "No Docker Hub credentials, so image pulls stay anonymous."
+            exit 0
+          fi
+          printf '%s' "$DOCKER_HUB_PASSWORD" |
+            docker login --username "$DOCKER_HUB_USERNAME" --password-stdin
+
       # No pre-`up` cleanup step any more: the project name is unique per job, so
       # a container leaked by a hard-killed prior run cannot hold this job's
       # name or its (ephemeral) port. Blanket-pruning would now be actively

.github/workflows/integration-prisma-next.yml

@@ -114,7 +114,7 @@ on:
 jobs:
   integration:
     name: prisma-next v3 integration (db=${{ matrix.db }})
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu24-full-x64/volume=80gb/extras=s3-cache
     # No concurrency group: `integration-db` gives each job its own compose
     # project and ephemeral host ports, so live-DB jobs no longer contend and do
     # not need serialising. See that action for why the old
@@ -171,6 +171,24 @@ jobs:
       - name: Build the @cipherstash/auth binding
         uses: ./.github/actions/build-auth-binding
 
+      # Docker Hub refuses pulls without a login after too many from one
+      # address, and RunsOn machines reach that limit. With either secret empty,
+      # as on a fork's pull request, this step does nothing and pulls stay
+      # anonymous. scripts/__tests__/workflow-docker-hub-login.test.mjs
+      # requires it.
+      - name: Log in to Docker Hub
+        env:
+          DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
+          DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [ -z "$DOCKER_HUB_USERNAME" ] || [ -z "$DOCKER_HUB_PASSWORD" ]; then
+            echo "No Docker Hub credentials, so image pulls stay anonymous."
+            exit 0
+          fi
+          printf '%s' "$DOCKER_HUB_PASSWORD" |
+            docker login --username "$DOCKER_HUB_USERNAME" --password-stdin
+
       # No pre-`up` cleanup step any more: the project name is unique per job, so
       # a container leaked by a hard-killed prior run cannot hold this job's
       # name or its (ephemeral) port. Blanket-pruning would now be actively

.github/workflows/integration-protect-ffi.yml

@@ -160,7 +160,7 @@ concurrency:
 jobs:
   integration:
     name: protect-ffi integration suite
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu24-full-x64/volume=80gb/extras=s3-cache
     # Generous, because a cold `build-ffi-binding` compiles the cipherstash
     # client graph from scratch. It is also the backstop for `mise run
     # start-db`, whose readiness loop retries `pg_isready` forever rather than
@@ -341,6 +341,24 @@ jobs:
           # Must name runs-on's image; see scripts/__tests__/workflow-mise-cache-image.test.mjs
           cache_key_prefix: mise-v1-ubuntu-2404
 
+      # Docker Hub refuses pulls without a login after too many from one
+      # address, and RunsOn machines reach that limit. With either secret empty,
+      # as on a fork's pull request, this step does nothing and pulls stay
+      # anonymous. scripts/__tests__/workflow-docker-hub-login.test.mjs
+      # requires it.
+      - name: Log in to Docker Hub
+        env:
+          DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
+          DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [ -z "$DOCKER_HUB_USERNAME" ] || [ -z "$DOCKER_HUB_PASSWORD" ]; then
+            echo "No Docker Hub credentials, so image pulls stay anonymous."
+            exit 0
+          fi
+          printf '%s' "$DOCKER_HUB_PASSWORD" |
+            docker login --username "$DOCKER_HUB_USERNAME" --password-stdin
+
       # One task, four things the suite cannot run without (see
       # integration-tests/tasks.toml): `pnpm install --frozen-lockfile` (a
       # no-op here — the step above already ran it), `docker compose up` for

.github/workflows/integration-supabase.yml

@@ -173,7 +173,7 @@ on:
 jobs:
   integration:
     name: Supabase v3 integration (db=${{ matrix.db }})
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu24-full-x64/volume=80gb/extras=s3-cache
     # No concurrency group: `integration-db` gives each job its own compose
     # project and ephemeral host ports, so live-DB jobs no longer contend and do
     # not need serialising. See that action for why the old
@@ -250,6 +250,24 @@ jobs:
       - name: Build the @cipherstash/auth binding
         uses: ./.github/actions/build-auth-binding
 
+      # Docker Hub refuses pulls without a login after too many from one
+      # address, and RunsOn machines reach that limit. With either secret empty,
+      # as on a fork's pull request, this step does nothing and pulls stay
+      # anonymous. scripts/__tests__/workflow-docker-hub-login.test.mjs
+      # requires it.
+      - name: Log in to Docker Hub
+        env:
+          DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
+          DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [ -z "$DOCKER_HUB_USERNAME" ] || [ -z "$DOCKER_HUB_PASSWORD" ]; then
+            echo "No Docker Hub credentials, so image pulls stay anonymous."
+            exit 0
+          fi
+          printf '%s' "$DOCKER_HUB_PASSWORD" |
+            docker login --username "$DOCKER_HUB_USERNAME" --password-stdin
+
       # No pre-`up` cleanup step any more: the project name is unique per job, so
       # a container leaked by a hard-killed prior run cannot hold this job's
       # name or its (ephemeral) port. Blanket-pruning would now be actively

.github/workflows/macro-expand-eql.yml

@@ -51,7 +51,7 @@ permissions:
 jobs:
   macro-expand:
     name: "Macro expand drift (nightly)"
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 30
 
     steps:

.github/workflows/mutants.yml

@@ -64,7 +64,7 @@ env:
 jobs:
   mutants:
     name: Mutants gate
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=16/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 120
     permissions:
       contents: read

.github/workflows/release-golang.yml

@@ -71,7 +71,7 @@ concurrency:
 jobs:
   build:
     name: Build and test the release
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 90
     env:
       VERSION: ${{ inputs.version }}

.github/workflows/release-postgres-eql-image.yml

@@ -58,7 +58,7 @@ jobs:
     name: Build EQL SQL
     needs: [eql-armed]
     if: needs.eql-armed.outputs.armed == 'true'
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 20
     defaults:
       run:
@@ -110,7 +110,7 @@ jobs:
     name: Build postgres-eql image (PG ${{ matrix.pg_version }})
     needs: [eql-armed, build-sql]
     if: needs.eql-armed.outputs.armed == 'true'
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 30
     permissions:
       contents: read
@@ -135,6 +135,24 @@ jobs:
           # The Dockerfile COPYs it from its own build context.
           path: packages/eql/docker/
 
+      # Docker Hub refuses pulls without a login after too many from one
+      # address, and RunsOn machines reach that limit. With either secret empty,
+      # as on a fork's pull request, this step does nothing and pulls stay
+      # anonymous. scripts/__tests__/workflow-docker-hub-login.test.mjs
+      # requires it.
+      - name: Log in to Docker Hub
+        env:
+          DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
+          DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [ -z "$DOCKER_HUB_USERNAME" ] || [ -z "$DOCKER_HUB_PASSWORD" ]; then
+            echo "No Docker Hub credentials, so image pulls stay anonymous."
+            exit 0
+          fi
+          printf '%s' "$DOCKER_HUB_PASSWORD" |
+            docker login --username "$DOCKER_HUB_USERNAME" --password-stdin
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
         with: