ci: Use GitHub-hosted runners and fix release workflow#297
Merged
Conversation
Public repos can use GitHub-hosted runners directly. The self-hosted runner dependency was preventing releases (macOS runner unavailable) and adding unnecessary coupling to internal infrastructure. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When dispatched on a non-main branch, the local 'main' ref doesn't exist. Use 'origin/main' which is always available after fetch. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace any existing version in Cargo.toml, not just 0.0.0-dev (release branch retains the previous release version) - Handle no-op merge when release is already up to date with main - Use git add -A to capture all merge + version changes Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Only the git push step needs the self-hosted runner (due to org IP allow list). All other jobs use GitHub-hosted runners. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Cargo rejects leading zeros in version components (e.g. 2026.04.07). Use non-padded month/day to produce valid versions like 2026.4.7.1809. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Cargo requires strict semver (MAJOR.MINOR.PATCH) with no leading zeros. Use YEAR.MONTHDAY.HOURMIN format (e.g. 2026.407.1813). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Creating a GitHub release requires write API access, which is blocked by the org IP allow list on GitHub-hosted runners. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Since this isn't published to crates.io, we can use build metadata for the time component. Produces versions like 2026.4.7+1823. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
kejadlen
approved these changes
Apr 7, 2026
Contributor
kejadlen
left a comment
kejadlen
left a comment
There was a problem hiding this comment.
Oh, duh, that makes sense to split up which runners do what things.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ubuntu-latest,macos-latest)gusto-ubuntu-defaultonly for jobs that need write access (git push, release creation) due to org IP allow listworkflow_dispatchRunner layout
The Gusto org IP allow list blocks GitHub-hosted runners from write operations, so only jobs that push or create releases use the self-hosted runner:
ubuntu-latestgusto-ubuntu-defaultubuntu-latest/macos-latestgusto-ubuntu-defaultThis unblocks the macOS (
aarch64-apple-darwin) build which was previously impossible since this repo doesn't have access togusto-osx-default.Version format
Versions use CalVer:
YEAR.MONTH.DAY+HHMM(e.g.,2026.4.7+1823).The
+HHMMbuild metadata ensures uniqueness for multiple same-day releases. Per semver, build metadata is ignored for version comparison (2026.4.7+0900 == 2026.4.7+1400), but this is fine since the package isn't published to crates.io — the version only appears in the compiled binary and git tags. Verified locally thatcargo checkaccepts this format.Test plan
cargo checkaccepts the version format locallyworkflow_dispatch— all jobs greenubuntu-latestubuntu-latest🤖 Generated with Claude Code