github-policy/runner-exceptions.json at main · TheDancingDeveloper-org/github-policy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
{
  "schema_version": 1,
  "exceptions": [
    {
      "repo": "cadastre",
      "workflow": "ci.yaml",
      "reason": "Public repository, and this repository enforces a stricter rule than the org's in its own test suite: tests/test_release_workflow.py pins SELF_HOSTED_WORKFLOWS to the two tag-gated release workflows and asserts every other job is NOT self-hosted, because pull_request builds untrusted fork code and the self-hosted pool is persistent, runs as root and sits on the tailnet. Moving ci.yaml or publish.yml would require weakening that test. Revisit only alongside ephemeral runners and fork-PR approval set to all outside contributors.",
      "expires_on": "2027-02-17"
    },
    {
      "repo": "cadastre",
      "workflow": "publish.yml",
      "reason": "Same tested invariant as cadastre/ci.yaml. publish.yml triggers on push to main, so it has no fork exposure, but test_self_hosted_workflows_are_all_tag_gated additionally requires that anything self-hosted be reachable only from refs/tags/v*. The tag-gated release-images.yml and release-pypi.yml are self-hosted and stay that way.",
      "expires_on": "2027-02-17"
    },
    {
      "repo": "FarmEggs",
      "workflow": "ci.yml",
      "jobs": [
        "mobile"
      ],
      "reason": "flutter build apk --debug needs a JDK and the Android SDK. Neither is on any self-hosted runner and subosito/flutter-action does not install them; verified absent on all three runner containers 2026-08-17. Move when the runner image ships them.",
      "expires_on": "2026-11-17"
    },
    {
      "repo": "FarmEggs",
      "workflow": "ci.yml",
      "jobs": [
        "web"
      ],
      "reason": "The browser suite and the M1a acceptance run need google-chrome at the path CHROME_EXECUTABLE/EGGS_WEB_CHROME pin, plus npm for playwright-core. Verified absent on all three runner containers 2026-08-17. Move when the runner image ships them.",
      "expires_on": "2026-11-17"
    },
    {
      "repo": "github-policy",
      "workflow": "audit.yml",
      "reason": "Public repository; GitHub-hosted runners are allowed for light jobs in public repos (operator, 2026-11-02). This legacy line-based checker predates that decision; ci-auditor rule CI-05 (ci-standard) judges these jobs instead.",
      "expires_on": "2027-04-30"
    },
    {
      "repo": "github-policy",
      "workflow": "ci-auditor.yml",
      "reason": "Public repository; GitHub-hosted runners are allowed for light jobs in public repos (operator, 2026-11-02). This legacy line-based checker predates that decision; ci-auditor rule CI-05 (ci-standard) judges these jobs instead.",
      "expires_on": "2027-04-30"
    },
    {
      "repo": "github-policy",
      "workflow": "policy.yml",
      "reason": "Reusable workflow whose `runs-on` comes from a `runs-on` input (default a ci-standard runner class). This legacy line-based checker reads the input's key as a runner selection; ci-auditor rule CI-05 resolves the default instead.",
      "expires_on": "2027-04-30"
    },
    {
      "repo": "github-policy",
      "workflow": "rust-ci.yml",
      "reason": "Reusable workflow whose `runs-on` comes from a `runs-on` input (default a ci-standard runner class). This legacy line-based checker reads the input's key as a runner selection; ci-auditor rule CI-05 resolves the default instead.",
      "expires_on": "2027-04-30"
    },
    {
      "repo": "github-policy",
      "workflow": "image.yml",
      "reason": "Reusable workflow whose `runs-on` comes from a `runs-on` input (default a ci-standard runner class). This legacy line-based checker reads the input's key as a runner selection; ci-auditor rule CI-05 resolves the default instead.",
      "expires_on": "2027-04-30"
    },
    {
      "repo": "github-policy",
      "workflow": "release-dry-run.yml",
      "reason": "Reusable workflow whose `runs-on` comes from a `runs-on` input (default a ci-standard runner class). This legacy line-based checker reads the input's key as a runner selection; ci-auditor rule CI-05 resolves the default instead.",
      "expires_on": "2027-04-30"
    }
  ]
}