From 715b176b2a5bb0b0bb249ee35713905afb82adce Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Mon, 19 Oct 2026 11:48:42 +0200
Subject: [PATCH] ci(pr-gate): authorize job asks for the pr-gate runner label

Adds the label to authorize runs-on (operator yes via infra-66), a lint that red-fails without it
(scripts/lint-pr-gate-runs-on.sh, also bans hosted runners), and declares pr-gate in actionlint.yaml
(actionlint rejects an undeclared label). DO NOT MERGE until infra#1859 is live and a pr-gate runner is online.

Refs infra#1859, Refs rmedia#1192

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/actionlint.yaml         |  1 +
 .github/workflows/ci.yml        |  3 +++
 .github/workflows/pr-gate.yml   |  2 +-
 scripts/lint-pr-gate-runs-on.sh | 16 ++++++++++++++++
 4 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100755 scripts/lint-pr-gate-runs-on.sh

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 71a947e..bb2cd28 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -28,3 +28,4 @@ self-hosted-runner:
     - yoga
     - perf-solo
     - merge-queue
+    - pr-gate
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 33e0eac..53bdc6d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -62,6 +62,9 @@ jobs:
           # can reproduce.
           /opt/fleet-bin/bin/yamllint --version
           /opt/fleet-bin/bin/yamllint -d relaxed .github/workflows/
+      - name: pr-gate runs-on lint
+        shell: bash
+        run: bash scripts/lint-pr-gate-runs-on.sh
       - name: actionlint
         shell: bash
         env:
diff --git a/.github/workflows/pr-gate.yml b/.github/workflows/pr-gate.yml
index 5b51986..f8e3c8f 100644
--- a/.github/workflows/pr-gate.yml
+++ b/.github/workflows/pr-gate.yml
@@ -32,7 +32,7 @@ jobs:
     # the job only reads `context.payload` and calls the API. If a checkout step is
     # ever added, this decision must be revisited.
     timeout-minutes: 22
-    runs-on: [self-hosted, Linux, X64, clean-room, intel]
+    runs-on: [self-hosted, Linux, X64, clean-room, intel, pr-gate]
     permissions:
       pull-requests: write
     steps:
diff --git a/scripts/lint-pr-gate-runs-on.sh b/scripts/lint-pr-gate-runs-on.sh
new file mode 100755
index 0000000..96f34fb
--- /dev/null
+++ b/scripts/lint-pr-gate-runs-on.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# lint-pr-gate-runs-on.sh -- the pr-gate `authorize` job must ask for the pr-gate runner label,
+# and no workflow here may ask for a GitHub-hosted runner (paiml/infra#231, #1859; paiml/rmedia#1192).
+set -uo pipefail
+cd "$(dirname "$0")/.." || exit 2
+W=.github/workflows/pr-gate.yml
+rc=0
+# runs-on line of the authorize job: first `runs-on:` after the `  authorize:` key
+line=$(awk '/^  authorize:/{f=1} f && /^    runs-on:/{print; exit}' "$W")
+if [ -z "$line" ]; then echo "lint-pr-gate-runs-on: FAIL: no runs-on found for the authorize job in $W"; rc=1
+elif ! grep -qE '[[,] *pr-gate *[],]' <<<"$line"; then
+  echo "lint-pr-gate-runs-on: FAIL: authorize runs-on lacks the pr-gate label: $line"; rc=1; fi
+if grep -nE '^\s*runs-on:.*(ubuntu-|windows-|macos-)' .github/workflows/*.yml; then
+  echo "lint-pr-gate-runs-on: FAIL: a workflow asks for a GitHub-hosted runner"; rc=1; fi
+[ "$rc" -eq 0 ] && echo "lint-pr-gate-runs-on: OK (authorize carries pr-gate; no hosted runner)"
+exit "$rc"