ci(runner-policy): declare public visibility, hosted-only CI

[kyle-sexton]

Summary

Repository is now public. Public repos get free unlimited GitHub-hosted runners and must not route to the self-hosted fleet.

• Declares visibility: public and selfHostedCi: false in the local runner-policy declaration.
• Unwinds the governed selector repo-wide (the policy's public-self-hosted-routing rule forbids the local-runner selector once selfHostedCi is false): all seven callers drop their select-runner/select-review jobs and pin runs-on/runner: to ubuntu-24.04 directly; prerequisite-result inputs fall back to their success defaults.
• Removes the now-unused publish-packages.yml#publish hosted exception (flagged as exception-inventory-drift once publication is hosted by construction).

npm run lint:runner-policy passes locally on this tree with CI_REPOSITORY_VISIBILITY=public; actionlint clean.

Related

No linked issue: follows the repository visibility change to public. Supersedes #199 (closed). Pin bump #189 rebases over this once merged.

🤖 Generated with Claude Code

[claude]

Claude finished @kyle-sexton's task in 2m 45s —— View job

---

PR Review: ci(runner-policy): declare public visibility, hosted-only CI

Tasks:

• Gather context and understand the request
• Review changed files
• Post review findings

---

Summary

The direction of this change is correct: the repository is public, so visibility: "public" and selfHostedCi: false are the right values. However, the PR leaves behind a stale exception entry that directly causes the runner-policy CI lane to fail (confirmed by the CI log — step "Enforce runner policy on standards" at job #88115074143).

---

🔴 Important — Stale exception causes exception-inventory-drift CI failure

File: .github/runner-policy.json

The exceptions block still declares a hosted-exception for publish-packages.yml#publish:

"exceptions": {
  ".github/workflows/publish-packages.yml#publish": {
    "reason": "publication",
    "justification": "Registry publication stays on GitHub-hosted infrastructure …"
  }
}

When selfHostedCi: false, the runner-policy validator computes routingEnabled = false (runner-policy.mjs:3194):

const routingEnabled = config.visibility === "private" && config.selfHostedCi;

With routingEnabled === false, the per-job loop does continue before any exception-consuming logic runs (line 3350–3363). After all jobs are processed, the cleanup pass at line 3438 finds the exception was never consumed and emits:

.github/workflows/publish-packages.yml#publish: exception-inventory-drift:
  configured exception .github/workflows/publish-packages.yml#publish is unused; remove or correct it

This is confirmed in the CI log at line 583. The test suite also documents this behavior in runner-policy.test.mjs:7478–7493: "hosted-only repository rejects exception inventory".

Fix: Remove the entire exceptions object from .github/runner-policy.json. The exception's justification ("publication stays on GitHub-hosted infrastructure") is redundant when every job in the repo is already forced onto GitHub-hosted runners by selfHostedCi: false.

Fix this →

---

Context: Other CI failures are pre-existing and out of scope

The CI log also shows many public-self-hosted-routing findings across every workflow in the repo (e.g. ci.yml#gitleaks, ci.yml#select-runner, etc.). These exist because the workflow files still use the self-hosted selector pattern for their runs-on values. Those failures are not introduced by this PR — they were already latent under visibility: "private" — and fixing them is a follow-on task (updating each workflow to use ubuntu-24.04 directly). This PR's scope of fixing the runner-policy declaration is correct; the exceptions fix above is the only change needed here.

---

| Runner policy CI failure

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ddc883cdb0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kyle-sexton]

Took this over after 45 min idle (main-session drive, user-approved): the declaration alone left every selector-calling workflow failing public-self-hosted-routing, so 80a577b adds the repo-wide selector unwind + exception removal. Local runner-policy lint and actionlint pass.

[kyle-sexton]

Superseded by #200, which merged the same public hosted-runner posture (declaration, repo-wide selector unwind, pin bumps to 90f1c54, zizmor rationale comments, sync-bot skip-actors). After merging main into this branch the diff vs main is empty — nothing left to land.