[noahgift]

What

Move the authorize job's runs-on from [self-hosted, Linux, X64, clean-room, intel] to [self-hosted, Linux, clean-room, ephemeral], and declare ephemeral in .github/actionlint.yaml.

Why

runs-on in a reusable workflow resolves against the CALLER's runner groups. Every runner labelled intel sits in a group with a repo allow-list, so callers outside those lists (bashrs, forjar-cookbook, pmat-book and others) had no eligible runner. The job sat in GitHub's 24 h queue and was then failed or cancelled. Measured 2026-10-16: bashrs 8/8 runs queued 24 h then cancelled; forjar-cookbook #24 and #27 took 1440 min each.

The new label set matches only the Default-pool runners in the Default group, which is open to all repos. The authorization logic does not change. No checkout is added, so no PR-authored code is fetched or run under pull_request_target. If the pool's ambient auth cannot see private org memberships, the existing instrument probe fails red within seconds and closes nothing.

Evidence (measured, read-only)

• actionlint 1.7.12: rc=0. Control without the ephemeral declaration: rc=1.
• Further measurements of the pool and its auth are tracked in a private infra issue.
• Not measured: whether the probe passes on a real run.

Review

Non-author quorum rounds 1-4 are recorded privately. The latest round is 3/3 PASS at the current head. This PR is not armed.

🤖 Generated with Claude Code

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=true disarmed=true)

{
 "ticket": "DOTGITHUB-83",
 "head": "d978fe972c4ff7cc0e014eedfef2d5ece757b34b",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": true,
  "disarmed": true,
  "note": "auto-merge was armed from an earlier round; disarmed before lanes launched"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 3
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 3
  },
  {
   "lane": 3,
   "verdict": "FAIL",
   "findings": 7
  }
 ]
}

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "DOTGITHUB-83",
 "head": "f376fd7c171ad2d6650fc1a86f65d45f848609aa",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 3
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 3
  },
  {
   "lane": 3,
   "verdict": "FAIL",
   "findings": 5
  }
 ]
}

[noahgift]

quorum-review (AD-04): three PASS — agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "DOTGITHUB-83",
 "head": "5d21a46febce15e72b87f61702ce5284140b7c57",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 2
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 5
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 6
  }
 ]
}

[noahgift]

workflow sign-off — seat, aprender-pace @d6353c53c8c0 02:33Z

Read the full diff at this head (2 files: .github/actionlint.yaml +3/-1, .github/workflows/pr-gate.yml +21/-3). Note for the record: relative to main this is NOT comment-only — it changes pr-gate.yml authorize runs-on from [self-hosted, Linux, X64, clean-room, intel] to [self-hosted, Linux, clean-room, ephemeral] and adds the ephemeral label to actionlint.yaml. No checkout step is added; no step logic changes. Scope of my sign-off: the diff as written is consistent (label added to actionlint matches the new runs-on; comments match the change). NOT verified by me: that the Default-group ephemeral runners carry the ambient auth the comment claims, and the measured 24 h queue figures. I am not the author. Body redaction still pending, so this is bound to this head sha only; no arm from me.

[noahgift]

seat 1, aprender-triage-worker (claude-sonnet-5-5) @d6353c53c8c0706372b603da8f502127d7f32534 APPROVE — workflow sign-off (02:33Z)

Not an author of any commit on this PR (0 triage-worker trailers). Did not run CI.

• Delta d6353c5 vs f376fd7 is comment-only, as stated: actionlint.yaml (-1 +1 comment) and three comment lines in pr-gate.yml; no key, label or step changed.
• The PR as a whole changes pr-gate.yml authorize runs-on from [self-hosted, Linux, X64, clean-room, intel] to [self-hosted, Linux, clean-room, ephemeral] and declares ephemeral in actionlint.yaml. The job still has no checkout (no PR-authored code is fetched or run), the authorization logic is unchanged, and the stated reason (callers outside the intel groups queued 24 h) is coherent with how runs-on resolves against the caller's groups. If the ambient auth on the Default pool cannot see private org memberships, the probe fails red fast rather than closing anything, per the comment.
• The PR body redaction is still running per infra-66; this review is not an arm signal. Do not arm until "redaction done".