Skip to content

Use ubuntu-slim runner for lightweight workflow jobs - #1964

Merged
coliff merged 3 commits into
mainfrom
ci/ubuntu-slim
Nov 9, 2026
Merged

coliff merged 3 commits into
mainfrom
ci/ubuntu-slim

Conversation

@coliff

@coliff coliff commented Nov 9, 2026 •

Copy link
Copy Markdown
Member

Requested by Christian · project thread

Short description of what this resolves

Moves the light GitHub Actions jobs from ubuntu-latest to ubuntu-slim, the single-CPU container runner (fewer preinstalled tools, no Docker, 15-minute job limit).

Proposed changes

Switched to ubuntu-slim:

  • labeler.yml (triage): actions/labeler is a Node action
  • spellcheck.yml (spellcheck): cspell-action is a Node action
  • test.yml (lint): checkout, setup-node, npm ci, npm run lint

Left on ubuntu-latest:

  • publish.yml: any edit makes Super-Linter run zizmor on the file, and it fails on the existing use-trusted-publishing and cache-poisoning findings. Moving to npm trusted publishing is a separate change.
  • codeql-analysis.yml: CodeQL analysis is CPU and memory heavy
  • ossf-scorecard.yml: ossf/scorecard-action is a Docker container action, which ubuntu-slim cannot run
  • sync-labels.yml: micnncim/action-label-syncer is a Docker container action
  • super-linter.yml: Super-Linter runs as a Docker image
  • test.yml (build): OS/Node matrix that pairs with windows-latest, and the matrix.os != 'ubuntu-latest' condition depends on the label
  • website.yml: full Astro/Starlight build with full git history, which risks the 15-minute limit on a single CPU

Generated by Claude Code

- Switch labeler, spellcheck, publish and the test lint job to ubuntu-slim
- Keep ubuntu-latest for Docker-based actions, CodeQL, the OS/Node test matrix and the website build

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B4uAX78vP2cYisKwLmZgSP
Copilot AI balanced review requested due to automatic review settings November 9, 2026 04:03
@coliff coliff self-assigned this Nov 9, 2026
Fixes zizmor cache-poisoning finding surfaced by Super-Linter.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B4uAX78vP2cYisKwLmZgSP
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Nov 9, 2026 •

Copy link
Copy Markdown

Deploying htmlhint with  Cloudflare Pages  Cloudflare Pages

Latest commit: 719030c
Status: ✅  Deploy successful!
Preview URL: https://3551b81c.htmlhint.pages.dev
Branch Preview URL: https://ci-ubuntu-slim.htmlhint.pages.dev

View logs

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues were identified for the changes moving four GitHub Actions jobs to ubuntu-slim.

No open issues 🎉

What changed in this PR

Moves four lightweight GitHub Actions jobs to ubuntu-slim, while leaving heavier and Docker-dependent workflows on their existing runners.

Changes:

  • Switches PR labeling, spellchecking, linting, and package publishing to ubuntu-slim.
  • Leaves job steps and the test build matrix unchanged.
File Description
.github/​workflows/​test.yml Moves only the lint job to ubuntu-slim.
.github/​workflows/​spellcheck.yml Moves spellchecking to ubuntu-slim.
.github/​workflows/​publish.yml Moves the build-and-publish job to ubuntu-slim.
.github/​workflows/​labeler.yml Moves PR label triage to ubuntu-slim.

Review effort: Balanced

Touching publish.yml makes Super-Linter run zizmor on it, which fails on
the existing use-trusted-publishing finding. Keep it on ubuntu-latest so
this PR stays limited to the runner switch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B4uAX78vP2cYisKwLmZgSP

coliff commented Nov 9, 2026

Copy link
Copy Markdown
Member Author

The red Lint Code Base run on 719030c is the push run. Super-Linter only lints the files changed in that one push, and that push was the commit reverting publish.yml. So zizmor reported the existing findings in publish.yml (use-trusted-publishing, cache-poisoning), which this PR doesn't change.

The pull_request run diffs against main and passed. Re-running the push run would fail the same way. Once this is squash-merged, publish.yml won't be in the diff, so the run on main won't be affected.


Generated by Claude Code

@coliff
coliff merged commit fcf5afe into main Nov 9, 2026
20 of 21 checks passed
@coliff
coliff deleted the ci/ubuntu-slim branch November 9, 2026 05:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants