Run the release gates on local runners when PM_LOCAL_RUNNER=on, and cancel superseded PR runs

Draft
UN
4h ago
+10-1

Pilot for moving the fleet's heaviest CI jobs off GitHub's shared 20-job pool. Over the last 48 h the fleet used about 60,800 runner wall-minutes; pm-memory used 4,551 of them, the most of any repository.

Change

  • runtime (the three full release gates): runs-on is an expression. With the repository variable PM_LOCAL_RUNNER=on it targets [self-hosted, pm-local], the fleet's LAN runners. Each runner is a fresh container that takes one job (--ephemeral) and is then removed. It is capped in CPU, memory and pids, and has no Docker socket or host mounts.
  • Fork pull requests always use ubuntu-latest, so untrusted code never reaches a self-hosted runner.
  • With the variable unset or off, nothing changes. The controller switches it off by itself if no LAN host is reachable for 10 minutes.
  • Concurrency: a new push to a PR cancels that PR's earlier CI run. Pushes to main and manual runs are never cancelled.

The required checks test (22) and test (26) are unchanged. test/release-ci.test.ts asserts the matrix, step conditions and aggregation, not runs-on.

Draft until a run on the local runners has passed.

Summary by Sourcery

Move eligible release gates to local runners and cancel outdated pull-request runs to reduce CI contention.

Enhancements:

  • Route eligible release-gate jobs to ephemeral local runners when enabled, while keeping fork pull requests on GitHub-hosted runners.
  • Cancel superseded pull-request CI runs while allowing main-branch and manual runs to proceed independently.

CI:

  • Add CI concurrency controls to reduce redundant pull-request runner usage.

Summary by cubic

Pilots moving the fleet's heaviest CI jobs off GitHub's shared 20-job pool. In 48 hours the fleet used about 60,800 runner wall-minutes, roughly 21 concurrent against the 20-job limit, so every pull request queued.

  • The three full release gates (runtime) now target [self-hosted, pm-local] ephemeral LAN runners when the repository variable PM_LOCAL_RUNNER=on; each runner is a fresh container capped in CPU, memory, and pids, with no Docker socket or host mounts.
  • Fork pull requests always stay on ubuntu-latest, so untrusted code never reaches a self-hosted runner.
  • With the variable unset or off, nothing changes; the controller turns it off on its own if no LAN host is reachable for 10 minutes.
  • A new push to a pull request cancels that PR's earlier CI run; pushes to main and manual runs use their own concurrency group, so they never wait for or cancel each other.
  • The required checks test (22) and test (26) are unchanged, and test/release-ci.test.ts doesn't assert runs-on.