From 928fa95c40ac5fc5d595769c7703923bb8d81739 Mon Sep 17 00:00:00 2001
From: Ray Walker <ray@27b.io>
Date: Mon, 31 Aug 2026 05:24:14 +1000
Subject: [PATCH] ci(release): move release-please off the shared-cache ARC
 pool (LAB-1040)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

release-please inherits contents+PR write and mints a GitHub App
installation token, but ran on the self-hosted 'cachekit' pool whose
/cache hostPath is shared across all pods and all cachekit-io repos.
Job-level permissions: scope tokens, not filesystems — untrusted
build-script/proc-macro code in a credential-less job can poison
/cache/cargo (config.toml rustc-wrapper, shimmed cargo-<subcommand>)
and be executed later by this credentialed job. Move it to
ubuntu-latest, matching the other four sibling repos' release-please
jobs and this file's own publish job. release-please runs npm/action
code only, so it loses nothing without the warm cargo cache.

Also correct two comments this move makes stale (gh-CLI rationale,
cargo-sbom --force rationale).
---
 .github/workflows/release.yml | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6bfff20..90d1c83 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,8 +20,14 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # GitHub-hosted: this job inherits contents+PR write and mints an App
+  # installation token. The self-hosted `cachekit` pool shares a writable
+  # hostPath build cache (/cache) across all pods and every cachekit-io repo,
+  # and job-level `permissions:` does not isolate that filesystem — untrusted
+  # build-script/proc-macro code can poison the cache a later credentialed
+  # job runs against (LAB-1040). release-please needs no warm cache anyway.
   release-please:
-    runs-on: cachekit
+    runs-on: ubuntu-latest
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
@@ -41,8 +47,9 @@ jobs:
       # release PR here. outputs.pr is set whenever the release PR was created
       # OR updated, so this re-runs on every push to main while a release PR is
       # open — adding an already-present assignee is a no-op, so that's safe.
-      # github-script, NOT `gh`: the self-hosted cachekit runner has no gh CLI
-      # (LAB-899). outputs.pr is passed raw via env and parsed in JS — never
+      # github-script, NOT `gh`: chosen when this job ran on the self-hosted
+      # cachekit runner, which has no gh CLI (LAB-899); it works identically on
+      # a hosted runner. outputs.pr is passed raw via env and parsed in JS — never
       # through template-position fromJson, which is evaluated even when if: is
       # false and crashes on '' for no-release pushes (LAB-865).
       - name: Assign release PR to 27Bslash6
@@ -103,10 +110,9 @@ jobs:
           subject-path: target/package/*.crate
 
       - name: Install cargo-sbom
-        # --force is required: the self-hosted runner's CARGO_HOME (/cache/cargo) is a
-        # persistent volume, so the binary survives between runs and a plain install
-        # exits 101 ("binary `cargo-sbom` already exists"). --force reinstalls the
-        # --locked pinned version idempotently.
+        # --force kept from when this job ran self-hosted with a persistent
+        # CARGO_HOME (/cache/cargo), where a plain install exits 101 ("binary
+        # `cargo-sbom` already exists"). Harmless no-op cost on a hosted runner.
         run: cargo install cargo-sbom --locked --force
 
       - name: Generate SBOM