chore: change to centralized managed GitHub pool - #1022
Open
tibrnui wants to merge 1 commit into
Open
Conversation
Contributor
|
Apollo Coded App preview deployments finished with failures.
|
Contributor
Dependency License Review
License distribution
Excluded packages
|
Contributor
📊 Coverage + size by packagePer-package bundle size on this PR (no JS/TS source changes detected under
"Coverage" is each package's own |
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s GitHub Actions workflows to run on the centralized managed runner pool by switching runs-on labels from GitHub-hosted images (e.g. ubuntu-latest, ubuntu-24.04) to the corresponding uipath-* runner labels. It also refreshes several action pins to newer released SHAs (notably in security scanning workflows).
Changes:
- Updated workflow runner labels to
uipath-ubuntu-latest/uipath-ubuntu-24.04. - Refreshed several action SHAs (e.g. CodeQL, zizmor, actionlint) while keeping full-SHA pinning.
- Minor formatting alignment in some
uses:lines (extra spacing before# vXcomments).
Reviewed changes
Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/support-branch-scope.yml | Switch job runner to uipath-ubuntu-latest. |
| .github/workflows/security-scan.yml | Switch runners to uipath-* and update zizmor/actionlint pins. |
| .github/workflows/release.yml | Switch runners to uipath-ubuntu-latest and keep release hardening patterns intact. |
| .github/workflows/prune-release-age-exemptions.yml | Switch runner to uipath-ubuntu-latest. |
| .github/workflows/production-deploy.yml | Switch runner to uipath-ubuntu-latest. |
| .github/workflows/preview-deploy.yml | Switch multiple job runners to uipath-ubuntu-latest. |
| .github/workflows/pr-size.yml | Switch runners to uipath-ubuntu-24.04. |
| .github/workflows/pr-labeler.yml | Switch runner to uipath-ubuntu-latest. |
| .github/workflows/pr-checks.yml | Switch runners to uipath-ubuntu-latest. |
| .github/workflows/notify-vertex-updates.yml | Switch runner to uipath-ubuntu-latest. |
| .github/workflows/monitor-npm-publishes.yml | Switch runner to uipath-ubuntu-latest. |
| .github/workflows/dev-publish.yml | Switch multiple job runners to uipath-ubuntu-latest. |
| .github/workflows/dev-cleanup.yml | Switch runner to uipath-ubuntu-latest. |
| .github/workflows/dependency-review.yml | Switch runners to uipath-ubuntu-latest. |
| .github/workflows/commit-lint.yml | Switch runner to uipath-ubuntu-latest. |
| .github/workflows/codeql.yml | Switch runner to uipath-ubuntu-latest and update CodeQL/dismiss-alerts pins. |
| .github/workflows/close-stale-prs.yml | Switch runner to uipath-ubuntu-latest. |
| .github/workflows/apollo-vertex-registry-check.yml | Switch multiple job runners to uipath-ubuntu-latest. |
| .github/workflows/apollo-vertex-lint.yml | Switch runner to uipath-ubuntu-latest. |
| .github/workflows/apollo-vertex-auto-merge.yml | Switch runner to uipath-ubuntu-latest. |
Contributor
Storybook visual diff⏭️ Skipped: the apollo-design preview deployment did not succeed, so no comparison ran. Logs Updated (PT): Aug 06, 2026, 05:09:52 AM |
20 workflow file(s) modified Runners migrated: ubuntu-latest ubuntu-24.04 ubuntu-22.04 ubuntu-24.04-arm ubuntu-22.04-arm ubuntu-slim ubuntu-18.04 ubuntu-20.04 windows-latest Adds .github/actionlint.yaml so actionlint accepts the uipath- prefixed labels as self-hosted runners instead of failing [runner-label].
tibrnui
force-pushed
the
chore/migrate-runners-to-uipath-images-7a21e4d2
branch
from
August 6, 2026 12:03
ee59a8f to
69cf268
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 21 out of 21 changed files in this pull request and generated 4 comments.
Suppressed comments (4)
.github/workflows/pr-size.yml:46
- This job writes labels/comments (
issues: write,pull-requests: write) on apull_requesttrigger but is not fork-guarded. Add a fork guard to avoid running on fork PRs on the managed/self-hosted runner pool.
label:
name: Label PR size
needs: sync-label-definitions
runs-on: uipath-ubuntu-24.04
permissions:
.github/workflows/support-branch-scope.yml:22
- This job runs on
pull_requestand requestsissues: write, but it is not fork-guarded. Add the standard fork guard to avoid running on fork PRs on the managed/self-hosted runner pool.
check-scope:
name: Check package scope
runs-on: uipath-ubuntu-latest
permissions:
contents: read
pull-requests: read
issues: write
.github/workflows/security-scan.yml:50
- This job writes check results (
checks: write) on apull_requesttrigger but is not fork-guarded. Add the standard fork guard so it doesn't run on untrusted forks on the managed/self-hosted runner pool.
name: Actionlint Workflow Syntax Check
runs-on: uipath-ubuntu-latest
# github-pr-check reporter only surfaces results in PR context; skip on push.
if: github.event_name == 'pull_request'
permissions:
.github/workflows/release.yml:39
- Repo guidance pins
actions/checkoutv4 to34e114876b0b11c390a56381ad16ebd13914f8d5(see.github/copilot-instructions.mdAction SHA Reference). This workflow uses a different SHA, which makes it harder to audit and may bypass the repo's vetted pins.
- name: Checkout code
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
fetch-depth: 0
persist-credentials: false
Comment on lines
21
to
24
| sync-label-definitions: | ||
| name: Sync PR size label definitions | ||
| runs-on: ubuntu-24.04 | ||
| runs-on: uipath-ubuntu-24.04 | ||
| permissions: |
Comment on lines
15
to
17
| label: | ||
| runs-on: ubuntu-latest | ||
| runs-on: uipath-ubuntu-latest | ||
| permissions: |
Comment on lines
21
to
24
| zizmor: | ||
| name: Zizmor Security Scan | ||
| runs-on: ubuntu-latest | ||
| runs-on: uipath-ubuntu-latest | ||
| permissions: |
| contents: read | ||
| pull-requests: write | ||
| # The dependency-review-action requires a pull_request event with the base ref available. | ||
| if: github.event_name == 'pull_request' |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves this repository's workflows to the centralized managed GitHub pool.
uipath-in all workflow filesubuntu-latest→uipath-ubuntu-latestChanges
All workflow
.ymlfiles (including non-standard locations likeworkflows-src/) with staticruns-onvalues are updated.Dynamic expressions (
${{ ... }}) and already-prefixed images are skipped.Action Version Pinning
All
uses:references are pinned to the SHA of the latest release published ≥ 48h ago.This prevents supply-chain attacks via recently-published compromised versions.