#31831 ci(nightly): signer jobs take GitHub-hosted Ubuntu first again, Blacksmith 4 vCPU on a re-run

The four NEXT nightly signer jobs (signer-build, signer-app, signer-app-notary, signer-dmg) go back to the routes #29886 gave them, and that the hosted-runner guard (tests/test_ci_self_hosted_guard.sh, signer_route and signer_build_route) still allowlists:

• attempt 1: GitHub-hosted ubuntu-24.04
• re-run: blacksmith-4vcpu-ubuntu-2404, never 16 or 32 vCPU
• signer-build takes decide's early fleet placement first, then the same route

Each runs-on line now matches the guard's allowlisted line exactly. #30081 had moved the four jobs onto the sign picker's Blacksmith Linux 4/16/32 output, citing the older 2026-10-27 no-hosted rule. The 2026-11-01 rule below overrides that rule for signing.

The rule, verbatim:

"One measured exception to the two rules above: a small job that is not CPU-bound, such as signing and its runner pick, takes GitHub-hosted Ubuntu first. It's trusted like Blacksmith and free on a public repo. The fleet, or the smallest Blacksmith size that fits, is its re-run route, never 16 or 32 vCPU. It still needs a fallback so a hosted queue never stalls it: a re-run onto that route, or a twin that takes over (the nightly's macOS signer). Each such job is one exact line in the hosted-runner guard's allowlist (cmux tests/test_ci_self_hosted_guard.sh), with its measured wall time beside it."

The fallback is unchanged. A hosted signer that GitHub drops unstarted fails the pool path, and the macOS signer (build-sign-notarize-nightly) signs instead. A re-run takes Blacksmith 4 vCPU.

What does not change:

• pick-nightly-sign-runner's own route (#31642 put it on the all-nightly reservation first).
• The six other jobs that read the picker's route: keep-published-dsyms, publish-nightly-identity-legacy, republish-nightly-deltas, sign-release-notes, publish-release-notes and publish-nightly-reel.
• The signers' needs lists.
• Secrets, environments, permissions and runner trust lists.

Tests:

• tests/test_nightly_signer_jobs.py: the two tests #30081 added now assert the opposite. Each signer's runs-on equals the guard's exact line, never 16 or 32 vCPU, never LINUX_RUNNER or RUNNER_POOLS, and signer-build's early placement comes first.
• tests/test_nightly_trusted_routing.py: #29886's test_signer_jobs_take_hosted_ubuntu_then_blacksmith_4vcpu_never_16_or_32 is back for the four signers. It evaluates each route whatever LINUX_RUNNER, RUNNER_POOLS or the picker's outputs hold.
• tests/test_ci_nightly_off_blacksmith.py: signer-build leaves the Blacksmith-only debt list, because it has an early fleet route again.

Run and passing: test_nightly_signer_jobs, test_nightly_trusted_routing, test_ci_nightly_off_blacksmith, test_nightly_sign_runner, test_ci_linux_single_size, test_runner_routing_table, test_runner_label_policy, test_supplychain_security, test_ci_signing_keychain_is_deleted_before_bundle_code and bash tests/test_ci_self_hosted_guard.sh. Of the 114 test files that mention nightly.yml or the signers, the 3 that fail here (missing bashlex, the scripts import path, no lipo) fail the same way on base.

Performance

metric	before	after	delta	harness or run link
queue per serial signer job (4 jobs)	~2-4 min each on blacksmith-4vcpu (picker placed 'unverified')	measured on the first nightly after merge	TBD	runs 41383305465, 41385114223
signer queue added to landing-to-feed time	8-15 min per nightly (30-min target)	measured on the first nightly after merge	TBD	runs 41383305465, 41385114223
Blacksmith minutes/day for signers	all four jobs on Blacksmith Linux (4 vCPU tonight, 16 vCPU earlier)	re-runs only	not measured yet (estimate: Blacksmith only on re-runs)	first nightly runs after merge

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Route the four NEXT nightly signer jobs to GitHub-hosted Ubuntu on the first attempt and Blacksmith 4 vCPU on re-runs, replacing the sign picker’s 4/16/32 vCPU route. This reduces runner wait and Blacksmith use for signing jobs that are not CPU-bound.

• signer-build keeps decide’s early fleet placement before the signer route.
• If GitHub drops a hosted job before it starts, the existing macOS signer remains the fallback.
• The sign picker and other jobs that use its route are unchanged.
• Tests verify the runner expressions match the hosted-runner guard’s allowlist.