feat: add governed runner input to three hosted-only reusables

[kyle-sexton]

Summary

• Add an optional runner input (type: string, default: ubuntu-24.04) and route runs-on through ${{ inputs.runner }} in three previously hosted-only reusable workflows: link-check.yml, standards-sync.yml (all three jobs — plan, attest, sync), and pulumi-version-drift-check.yml.
• Mirrors the governed runner-input contract already carried by zizmor.yml and claude-review.yml: selector-routed callers pass their runner label; the ubuntu-24.04 default keeps direct and public callers on the same GitHub-hosted image.
• Permissions blocks and every SHA-pinned uses: step are byte-for-byte unchanged.
• Update pulumi-deploy-guard.test.cjs to assert the governed runner input and runs-on: ${{ inputs.runner }} in place of the retired hosted pin.

Why

Wave 1 of the private-repo floor conversion (melodic-software/github-iac#78, decision of record 2026-07-16). These three are the hosted-only privileged reusables still lacking a runner-input contract. Adding the input here is the source-side prerequisite that lets:

• Wave 2 — melodic-software/standards register runner-input contracts for these three merged SHAs in components/runner-policy/policy.json, and
• Wave 3 — each private-repo caller add a select-runner job and route these to the fleet, dropping the hosted-control-plane / privileged-control-plane exceptions.

Under the org's strict self-hosted-only policy the selector returns the fleet label or the ci-runner-selection-failed sentinel (never empty), so a converted caller spends zero hosted minutes; the retained ubuntu-24.04 default only serves direct and public callers, which this repo's own dogfood exercises.

Scope note — source only

This PR changes only the reusable definitions. It adds/repins no caller, and no consumer references these new SHAs until Wave 2 registers them and Wave 3 wires them. The optional-default form (matching zizmor / claude-review) is deliberate: these are scheduled maintenance jobs, not required PR checks, so they do not need the required/no-default + sentinel-guard caller contract that osv-scanner and semantic-pr use.

Validation

• actionlint (schema + expression syntax) on all three workflows — clean.
• node --test across the affected and runner-posture guard suites (pulumi-deploy-guard, hosted-runner-pins, link-check, network-timeout-policy, standards-sync-app-attestation, zizmor-native, osv-scanner-pin) — 59 passed, 0 failed.
• select-runner.yml untouched.

Related

• Refs melodic-software/github-iac#78 (epic — zero hosted floor for private repos).
• Prerequisite for the standards runner-policy registration PR (Wave 2) and the per-repo caller conversions (Wave 3).

No linked issue.

🤖 Generated with Claude Code

https://claude.ai/code/session_01K3QehVwmWzkBLpKokNCkkt

[claude]

Claude finished @kyle-sexton's task in 2m 43s —— View job

---

PR Review: feat/runner-input-hosted-only-reusables

• Gather context and understand the request
• Read changed files
• Review for correctness, security, and CLAUDE.md alignment
• Post findings

---

Summary

The change is mechanically correct and well-scoped. It mirrors the established runner-input contract from zizmor.yml and claude-review.yml byte-for-byte in structure, leaves all SHA pins and permission blocks untouched, and preserves the ubuntu-24.04 default so existing direct callers are unaffected. I have two observations — one minor test-coverage gap, one latent architectural coupling.

---

Correctness

Input/runs-on wiring — link-check.yml

link-check.yml L13–16, L40: runner added as first input; runs-on switched to ${{ inputs.runner }}. Correct.

Input/runs-on wiring — pulumi-version-drift-check.yml

pulumi-version-drift-check.yml L7–11, L22: inputs: block created under the previously bare workflow_call:, runner added, job switched to ${{ inputs.runner }}. Correct.

Input/runs-on wiring — standards-sync.yml

standards-sync.yml L9–12: runner added as first input; all three jobs (plan at L53, attest at L132, sync at L357) switched to ${{ inputs.runner }}. Correct — every job in the workflow is covered.

Test update — pulumi-deploy-guard.test.cjs

Lines 152–156: The old assertion assert.match(drift, /^ {4}runs-on: ubuntu-24\.04$/mu) is replaced with two assertions — one for the full input block structure (indentation, type, default) and one for runs-on: ${{ inputs.runner }}. The indentation in the regex (^ {4}inputs:, {6}runner:, {8}description/type/default) correctly reflects the YAML structure under on.workflow_call. The $mu flag ensures multiline and unicode matching. Correct.

---

Security

• workflow_call only — no pull_request_target or workflow_run with secrets introduced. ✓
• All uses: SHA pins are byte-for-byte unchanged across all three workflows. ✓
• Permission blocks on all jobs are unchanged. ✓
• inputs.runner flows only into runs-on:, which is evaluated by GitHub infrastructure before job dispatch — no shell injection surface. ✓
• No secrets: inherit added (validated by hosted-runner-pins.test.cjs's existing assertion). ✓
• ubuntu-24.04 default is a pinned, non-moving label — passes the hosted-runner-pins.test.cjs moving-label check. ✓

---

Observations

1. Test coverage gap for link-check.yml and standards-sync.yml runner contracts (low)

pulumi-deploy-guard.test.cjs now asserts the runner input block and runs-on: ${{ inputs.runner }} for the drift workflow, but neither link-check.test.cjs nor standards-sync-app-attestation.test.cjs adds a parallel assertion for their workflows. A future commit that reverts runs-on back to a hardcoded pin in either file would not be caught by the test suite. This is consistent with how those test files are scoped (rolling-issue behaviour and App attestation respectively), but the asymmetry is worth noting. Fix this →

2. standards-sync.yml has an implicit Linux AMD64 runner requirement (informational)

The plan and sync jobs download yq_linux_amd64 by name and verify its SHA256. This silently couples inputs.runner to a Linux AMD64 host. If the fleet selector ever returns a non-AMD64 label for this workflow, the Install checksum-verified yq step will fail at runtime rather than at submission. zizmor.yml guards against this class of failure with an explicit early step (echo '::error::The native zizmor release requires a Linux X64 runner.'). This is a pre-existing coupling — not introduced by this PR — but surfacing a runner input makes it slightly more discoverable. No action required here unless the fleet label set expands beyond AMD64 Linux.

---

Verdict

Approve. The two items above are not blockers. Observation 1 is a low-priority test-coverage improvement; observation 2 is pre-existing and informational only. The change correctly implements the governed runner-input contract and is safe to merge as the Wave 1 source-side prerequisite.