ci: migrate CodeQL to self-hosted ARC runner (develop)

[evereq]

Migrate the CodeQL analyze job from GitHub-hosted ubuntu-latest to our self-hosted ARC fleet via ${{ vars.RUNNER_LINUX_X64_4 || 'ubuntu-latest' }} (smallest pool, per security-scan-runs-on-_4 policy), retaining the ubuntu-latest fallback.

Other workflows on this branch (build-native-binaries.yml, publish-npm-packages.yml) already run their Linux jobs on RUNNER_LINUX_X64_4; macOS/Windows matrix entries are intentionally left untouched.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: c5cb5774-ad3b-45d3-829e-f4303426c15c

📥 Commits

Reviewing files that changed from the base of the PR and between cdd50d3 and aa32f6a.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

---

Summary by CodeRabbit

• Chores
  • Updated security analysis automation to use a configurable Linux runner when available, with a fallback to the standard hosted runner.

Walkthrough

The CodeQL analyze job now selects its runner from vars.RUNNER_LINUX_X64_4, falling back to ubuntu-latest when the variable is unset.

Changes

CodeQL workflow runner

Layer / File(s)	Summary
Runner selection fallback .github/workflows/codeql.yml	The analyze job uses vars.RUNNER_LINUX_X64_4 with an ubuntu-latest fallback.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

A bunny hops through YAML bright,
Picks a custom runner for the flight.
If that path is not in sight,
Ubuntu waits in fallback light.
CodeQL nibbles bugs tonight!

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/runners-selfhosted

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR migrates the CodeQL analyze job from ubuntu-latest to the self-hosted ARC runner pool via ${{ vars.RUNNER_LINUX_X64_4 || 'ubuntu-latest' }}, retaining ubuntu-latest as a fallback when the variable is unset. The change is a one-line update that aligns CodeQL with the runner strategy already used by build-native-binaries.yml and publish-npm-packages.yml.

• The runner expression pattern and fallback match what other Linux jobs in the repo already use, so the change is internally consistent.
• Running CodeQL on a self-hosted runner while the workflow retains a pull_request trigger introduces a risk for public repos, since autobuild could execute untrusted fork code on a persistent machine — worth verifying the repo visibility and access controls before merging.

Confidence Score: 4/5

The change is a one-line runner expression swap with a sensible fallback; no workflow logic, steps, or permissions are altered.

Moving the CodeQL job to a self-hosted runner while retaining the pull_request trigger is safe for private repos but could expose a persistent machine to untrusted fork code if the repo is public. All other aspects of the change — the variable pattern, fallback, and CodeQL step sequence — are straightforward and consistent with existing workflows.

.github/workflows/codeql.yml — confirm repository visibility and whether the self-hosted runner is appropriately hardened for PR-triggered workloads.

Important Files Changed

Filename	Overview
.github/workflows/codeql.yml	Migrates the analyze job runner from ubuntu-latest to `${{ vars.RUNNER_LINUX_X64_4

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant GH as GitHub (push/PR to test)
    participant ARC as Self-Hosted ARC Runner<br/>(RUNNER_LINUX_X64_4)
    participant FBK as ubuntu-latest (fallback)

    GH->>ARC: Dispatch `analyze` job (if RUNNER_LINUX_X64_4 set)
    alt RUNNER_LINUX_X64_4 defined
        ARC->>ARC: "actions/checkout@v7"
        ARC->>ARC: "github/codeql-action/init@v2 (javascript)"
        ARC->>ARC: "github/codeql-action/autobuild@v2"
        ARC->>ARC: "github/codeql-action/analyze@v2"
        ARC-->>GH: Upload security-events results
    else RUNNER_LINUX_X64_4 not defined
        GH->>FBK: Dispatch `analyze` job (fallback)
        FBK->>FBK: Same CodeQL steps
        FBK-->>GH: Upload security-events results
    end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant GH as GitHub (push/PR to test)
    participant ARC as Self-Hosted ARC Runner<br/>(RUNNER_LINUX_X64_4)
    participant FBK as ubuntu-latest (fallback)

    GH->>ARC: Dispatch `analyze` job (if RUNNER_LINUX_X64_4 set)
    alt RUNNER_LINUX_X64_4 defined
        ARC->>ARC: "actions/checkout@v7"
        ARC->>ARC: "github/codeql-action/init@v2 (javascript)"
        ARC->>ARC: "github/codeql-action/autobuild@v2"
        ARC->>ARC: "github/codeql-action/analyze@v2"
        ARC-->>GH: Upload security-events results
    else RUNNER_LINUX_X64_4 not defined
        GH->>FBK: Dispatch `analyze` job (fallback)
        FBK->>FBK: Same CodeQL steps
        FBK-->>GH: Upload security-events results
    end

Loading

Comments Outside Diff (1)

1. .github/workflows/codeql.yml, line 3-7 (link)

   Self-hosted runner with pull_request trigger

   Moving the analyze job to a self-hosted ARC runner while keeping the pull_request trigger creates a risk for public repositories: a PR opened from a fork can execute arbitrary code (e.g. via a malicious package.json script picked up by autobuild) directly on the persistent self-hosted runner, potentially compromising the machine or exfiltrating runner secrets. GitHub-hosted ubuntu-latest runners are ephemeral and isolated, so this risk didn't exist before this change. If this repository is public, consider restricting the pull_request trigger to trusted contributors or switching to pull_request_target with explicit head-SHA checkouts.

_{Reviews (1): Last reviewed commit: "ci: run CodeQL on self-hosted ARC runner..." | Re-trigger Greptile}