ci(pr-gate): authorize runs-on carries pr-gate (HOLD until infra#1859)

.github/actionlint.yaml

@@ -28,3 +28,4 @@ self-hosted-runner:
     - yoga
     - perf-solo
     - merge-queue
+    - pr-gate

.github/workflows/ci.yml

@@ -62,6 +62,9 @@ jobs:
           # can reproduce.
           /opt/fleet-bin/bin/yamllint --version
           /opt/fleet-bin/bin/yamllint -d relaxed .github/workflows/
+      - name: pr-gate runs-on lint
+        shell: bash
+        run: bash scripts/lint-pr-gate-runs-on.sh
       - name: actionlint
         shell: bash
         env:

.github/workflows/pr-gate.yml

@@ -32,7 +32,7 @@ jobs:
     # the job only reads `context.payload` and calls the API. If a checkout step is
     # ever added, this decision must be revisited.
     timeout-minutes: 22
-    runs-on: [self-hosted, Linux, X64, clean-room, intel]
+    runs-on: [self-hosted, Linux, X64, clean-room, intel, pr-gate]
     permissions:
       pull-requests: write
     steps:

scripts/lint-pr-gate-runs-on.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# lint-pr-gate-runs-on.sh -- the pr-gate `authorize` job must ask for the pr-gate runner label,
+# and no workflow here may ask for a GitHub-hosted runner (paiml/infra#231, #1859; paiml/rmedia#1192).
+set -uo pipefail
+cd "$(dirname "$0")/.." || exit 2
+W=.github/workflows/pr-gate.yml
+rc=0
+# runs-on line of the authorize job: first `runs-on:` after the `  authorize:` key
+line=$(awk '/^  authorize:/{f=1} f && /^    runs-on:/{print; exit}' "$W")
+if [ -z "$line" ]; then echo "lint-pr-gate-runs-on: FAIL: no runs-on found for the authorize job in $W"; rc=1
+elif ! grep -qE '[[,] *pr-gate *[],]' <<<"$line"; then
+  echo "lint-pr-gate-runs-on: FAIL: authorize runs-on lacks the pr-gate label: $line"; rc=1; fi
+if grep -nE '^\s*runs-on:.*(ubuntu-|windows-|macos-)' .github/workflows/*.yml; then
+  echo "lint-pr-gate-runs-on: FAIL: a workflow asks for a GitHub-hosted runner"; rc=1; fi
+[ "$rc" -eq 0 ] && echo "lint-pr-gate-runs-on: OK (authorize carries pr-gate; no hosted runner)"
+exit "$rc"