From 178c50454c57a6caec5d327783b6d89f4ea6dfff Mon Sep 17 00:00:00 2001 From: thedancingdeveloper Date: Mon, 2 Nov 2026 22:09:34 +0000 Subject: [PATCH] runner-exceptions: github-policy's hosted and reusable workflows (WI-3087) The legacy runner-policy gate (still the required check here) predates the 2026-11-02 decision allowing hosted runners in public repos, and its line-based parser reads a reusable workflow's `runs-on` input key as a runner selection. Dated exceptions until the legacy gate is retired; ci-auditor CI-05 judges these files. Co-Authored-By: Claude Opus 5.5 --- runner-exceptions.json | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/runner-exceptions.json b/runner-exceptions.json index 4a0270e..c3960b8 100644 --- a/runner-exceptions.json +++ b/runner-exceptions.json @@ -30,6 +30,42 @@ ], "reason": "The browser suite and the M1a acceptance run need google-chrome at the path CHROME_EXECUTABLE/EGGS_WEB_CHROME pin, plus npm for playwright-core. Verified absent on all three runner containers 2026-08-17. Move when the runner image ships them.", "expires_on": "2026-11-17" + }, + { + "repo": "github-policy", + "workflow": "audit.yml", + "reason": "Public repository; GitHub-hosted runners are allowed for light jobs in public repos (operator, 2026-11-02). This legacy line-based checker predates that decision; ci-auditor rule CI-05 (ci-standard) judges these jobs instead.", + "expires_on": "2027-04-30" + }, + { + "repo": "github-policy", + "workflow": "ci-auditor.yml", + "reason": "Public repository; GitHub-hosted runners are allowed for light jobs in public repos (operator, 2026-11-02). This legacy line-based checker predates that decision; ci-auditor rule CI-05 (ci-standard) judges these jobs instead.", + "expires_on": "2027-04-30" + }, + { + "repo": "github-policy", + "workflow": "policy.yml", + "reason": "Reusable workflow whose `runs-on` comes from a `runs-on` input (default a ci-standard runner class). This legacy line-based checker reads the input's key as a runner selection; ci-auditor rule CI-05 resolves the default instead.", + "expires_on": "2027-04-30" + }, + { + "repo": "github-policy", + "workflow": "rust-ci.yml", + "reason": "Reusable workflow whose `runs-on` comes from a `runs-on` input (default a ci-standard runner class). This legacy line-based checker reads the input's key as a runner selection; ci-auditor rule CI-05 resolves the default instead.", + "expires_on": "2027-04-30" + }, + { + "repo": "github-policy", + "workflow": "image.yml", + "reason": "Reusable workflow whose `runs-on` comes from a `runs-on` input (default a ci-standard runner class). This legacy line-based checker reads the input's key as a runner selection; ci-auditor rule CI-05 resolves the default instead.", + "expires_on": "2027-04-30" + }, + { + "repo": "github-policy", + "workflow": "release-dry-run.yml", + "reason": "Reusable workflow whose `runs-on` comes from a `runs-on` input (default a ci-standard runner class). This legacy line-based checker reads the input's key as a runner selection; ci-auditor rule CI-05 resolves the default instead.", + "expires_on": "2027-04-30" } ] }