fix(utils): recognize GitHub-hosted ARM64 Ubuntu and Windows runner labels (#449)

[Tyagiquamar]

Problem

pr_runs_on_self_hosted flags GitHub-hosted ARM64 runner labels (such as ubuntu-24.04-arm, ubuntu-22.04-arm, windows-11-arm, and windows-11-vs2026-arm) as self-hosted runners because the runner matching regex in opa/rego/poutine/utils.rego does not account for -arm suffixes on versioned Linux or Windows 11 runner labels.

Root Cause

job_uses_self_hosted_runner in opa/rego/poutine/utils.rego matched runner strings against ubuntu-(([0-9]{2})\.04|...) and windows-(20[0-9]{2}|...), omitting optional -arm suffixes for Ubuntu labels and Windows 11 ARM variants.

Fix

• Updated job_uses_self_hosted_runner regex in opa/rego/poutine/utils.rego to support ubuntu-NN.NN-arm and windows-11(-vsNNNN)?-arm.
• Added test cases for ubuntu-24.04-arm, ubuntu-22.04-arm, windows-11-arm, and windows-11-vs2026-arm in opa/opa_test.go.

Verification

go test ./opa passed cleanly (100% test suite green).

Fixes #449

[Tyagiquamar]

Hi, just following up on this when you get a chance. The branch is up to date and checks are green. If it looks good from your side, it should be ready to merge. Happy to make any changes if needed. Thanks!

[fproulx-boostsecurity]

Hi, just following up on this when you get a chance. The branch is up to date and checks are green. If it looks good from your side, it should be ready to merge. Happy to make any changes if needed. Thanks!

sorry, just noticed this. will have a look

[Copilot]

Copilot review overview

🟡 Changes recommended

Add coverage for ubuntu-26.04-arm and scanner integration fixtures.

Review effort: Lite
Findings: 1

Open (1)

• Add coverage for the ubuntu-26.04-arm label · New

What changed in this PR

Updates runner detection so GitHub-hosted ARM64 Ubuntu and Windows labels are not misclassified as self-hosted.

Changes:

• Extends the Rego runner regex for ARM64 labels.
• Adds Ubuntu and Windows ARM64 regression tests.

File	Description
opa/​rego/​poutine/​utils.rego	Recognizes ARM64 hosted runner labels.
opa/​opa_test.go	Adds regression tests for ARM64 labels.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

tests failing

[fproulx-boostsecurity]

Sorry for the delay @Tyagiquamar , merged now