ci: migrate CodeQL to self-hosted ARC runner (master)

[evereq]

Migrate the CodeQL analyze job from GitHub-hosted ubuntu-latest to our self-hosted ARC fleet via ${{ vars.RUNNER_LINUX_X64_4 || 'ubuntu-latest' }} (smallest pool, per security-scan-runs-on-_4 policy), retaining the ubuntu-latest fallback.

Production branch (master). Only workflow present is codeql.yml.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a955553c-ecdc-4e99-9792-fa1e132eab99

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/runners-selfhosted-master

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR migrates the CodeQL analyze job's runner from ubuntu-latest to a self-hosted ARC runner via ${{ vars.RUNNER_LINUX_X64_4 || 'ubuntu-latest' }}, retaining a GitHub-hosted fallback when the variable is unset.

• The one-line runs-on change uses the standard vars.* expression with a || 'ubuntu-latest' fallback, which is idiomatic and safe from a workflow-syntax perspective.
• Two concerns are worth considering: (1) running a pull_request-triggered CodeQL scan on self-hosted runners exposes those runners to arbitrary code from fork PRs in public repositories; and (2) the _4 designation (smallest pool) may be under-resourced for CodeQL's memory and disk requirements on non-trivial JavaScript codebases.

Confidence Score: 3/5

The change is a one-line runner migration with a safe ubuntu-latest fallback, but the pull_request trigger on a self-hosted runner warrants review before merging to master.

Routing a pull_request-triggered CodeQL job through self-hosted ARC runners means any fork contributor's code is built and analyzed directly on fleet infrastructure. If the repo accepts external PRs, this opens the runner host to arbitrary code execution. Additionally, the _4 (smallest) pool may lack the RAM and disk headroom CodeQL needs, which could silently drop security coverage on pushes to master.

.github/workflows/codeql.yml — specifically the interaction between the pull_request trigger and the self-hosted runner assignment.

Important Files Changed

Filename	Overview
.github/workflows/codeql.yml	Migrates runs-on to a self-hosted ARC runner with ubuntu-latest fallback; introduces exposure of self-hosted runner to fork PR code and potential resource constraints from the smallest runner pool.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant GH as GitHub Events
    participant WF as CodeQL Workflow
    participant ARC as ARC Runner (RUNNER_LINUX_X64_4)
    participant GHR as ubuntu-latest (fallback)
    participant CODEQL as CodeQL Action v2

    GH->>WF: push / pull_request / schedule
    WF->>WF: evaluate vars.RUNNER_LINUX_X64_4
    alt variable is set
        WF->>ARC: dispatch job
        ARC->>CODEQL: checkout + init + autobuild + analyze
    else variable unset
        WF->>GHR: dispatch job
        GHR->>CODEQL: checkout + init + autobuild + analyze
    end
    CODEQL-->>GH: upload SARIF security-events

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant GH as GitHub Events
    participant WF as CodeQL Workflow
    participant ARC as ARC Runner (RUNNER_LINUX_X64_4)
    participant GHR as ubuntu-latest (fallback)
    participant CODEQL as CodeQL Action v2

    GH->>WF: push / pull_request / schedule
    WF->>WF: evaluate vars.RUNNER_LINUX_X64_4
    alt variable is set
        WF->>ARC: dispatch job
        ARC->>CODEQL: checkout + init + autobuild + analyze
    else variable unset
        WF->>GHR: dispatch job
        GHR->>CODEQL: checkout + init + autobuild + analyze
    end
    CODEQL-->>GH: upload SARIF security-events

Loading

_{Reviews (1): Last reviewed commit: "ci: run CodeQL on self-hosted ARC runner..." | Re-trigger Greptile}

[greptile-apps]

Self-hosted runner risk for pull_request-triggered CodeQL

This workflow runs on pull_request events, meaning a contributor submitting a fork PR will have their code checked out and built (autobuild) on the self-hosted ARC runner. GitHub's security hardening guide explicitly warns that public repos should avoid self-hosted runners for pull_request triggers because a malicious PR can execute arbitrary code on the runner host, potentially exfiltrating secrets or pivoting inside the ARC fleet. If the repository is public (or accepts PRs from untrusted forks), consider restricting self-hosted runners to the push trigger only and keeping pull_request on ubuntu-latest.

[greptile-apps]

Smallest runner pool may be insufficient for CodeQL

The _4 suffix per the PR description designates the smallest pool in the ARC fleet. CodeQL analysis — especially with +security-and-quality queries over a JavaScript codebase — typically requires at least 8 GB of RAM and several GB of free disk space. On an under-resourced runner the job can fail with OOM or disk-full errors mid-analysis, silently dropping security coverage for a push to master. Confirm that runners in the RUNNER_LINUX_X64_4 pool meet CodeQL's minimum hardware requirements before relying on them for this scan.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!