From 8d939f6433b624fd044a6ed65c87207c244aa1ca Mon Sep 17 00:00:00 2001 From: luke Date: Sun, 27 Sep 2026 04:52:29 -0400 Subject: [PATCH] ci: run verify on GitHub-hosted ubuntu This public repo ran its verify job on the org's shared self-hosted pool on nit. That pool's runners could read the host user's credentials, and fork PRs from first-time contributors are the only ones needing approval. GitHub-hosted runners are free for public repos, and this job is plain Node/pnpm with no macOS-only steps and no private packages. Also scopes the job's GITHUB_TOKEN to contents: read. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/verify.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 25efabc..2415e11 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -5,9 +5,12 @@ on: branches: [main] pull_request: +permissions: + contents: read + jobs: verify: - runs-on: [self-hosted, macOS, ARM64, cic-macbook-pro] + runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: pnpm/action-setup@v4