Merge pull request #74 from github/nodeselector-noop-hosted-runner-flags

Remove hosted/self-hosted runner restrictions

Author: nodeselector

README.md

@@ -31,6 +31,5 @@ Finally, locked actions must have a branch that the commit being locked exists w
 ## Limitations
 
 There are currently eligibility limitations for workflows that can be onboarded to lockfiles:
-- Workflows in the lockfile must use a hosted runner. In the meantime, we will skip onboarding self-hosted runners. Discerning a self-hosted runner from a Larger runner requires the `manage_runners:org` which users are unlikely to have on their CLI in the typical case, if workflows are skipped during onboarding, the cli will output the command to run to allow onboarding those workflows. The requirement for hosted runners is enforced at runtime. This is a short-term gap.
 - Workflows in the lockfile cannot use local-path actions, these will be skipped for onboarding. This is also a short-term gap.
 

actions/lint/action.yml

@@ -3,13 +3,13 @@ description: Check that actions.lock is in sync with workflow files
 
 inputs:
   extra-flags:
-    description: Extra flags passed to gh actions-lock (e.g. "--allow-runners foo")
+    description: Extra flags passed to gh actions-lock
     required: false
     default: ""
   ignore-categories:
     description: Comma-separated finding categories to treat as warnings instead of errors (e.g. "local-action")
     required: false
-    default: "self-hosted-runner"
+    default: ""
 
 runs:
   using: composite

cmd/gh-actions-lock/format/json.go

@@ -11,17 +11,17 @@ import (
 )
 
 // skipFindingInJSON reports whether a finding should be omitted from JSON
-// output. Run-only and valid-OK workflows are noise; local-action and
-// self-hosted-runner warnings are informational skips (errors are kept
-// because they mean an already-tracked workflow became ineligible).
+// output. Run-only and valid-OK workflows are noise; local-action
+// warnings are informational skips (errors are kept because they mean
+// an already-tracked workflow became ineligible).
 func skipFindingInJSON(f checks.Finding) bool {
 	if f.Category == checks.RunOnly {
 		return true
 	}
 	if f.Category == checks.Valid && f.Severity == checks.SeverityOK {
 		return true
 	}
-	if (f.Category == checks.LocalAction || f.Category == checks.SelfHostedRunner || f.Category == checks.ExpressionRunner) && f.Severity != checks.SeverityError {
+	if f.Category == checks.LocalAction && f.Severity != checks.SeverityError {
 		return true
 	}
 	return false

cmd/gh-actions-lock/format/terminal.go

@@ -90,30 +90,21 @@ func renderErrorFindings(out *ui.UI, report *checks.Report, failedCount, checked
 			continue
 		}
 
-		// Self-hosted-runner findings share the same empty dep key;
-		// render them as a deduplicated group showing affected workflows.
-		var selfHostedFindings []checks.Finding
+		// Self-hosted-runner findings are no longer generated; render
+		// remaining non-excluded, non-not-pinned findings directly.
 		for _, f := range dg.findings {
 			if f.Category == checks.NotPinned || exclude[f.Category] {
 				continue
 			}
-			if f.Category == checks.SelfHostedRunner {
-				selfHostedFindings = append(selfHostedFindings, f)
-				continue
-			}
 			renderFindingDetail(out, f, dep)
 		}
-		if len(selfHostedFindings) > 0 {
-			renderSelfHostedGroup(out, selfHostedFindings)
-		}
 	}
 
 	parts := []string{}
 	for _, cat := range []checks.Category{
 		checks.LockfileForgery,
 		checks.RefChanged, checks.NotPinned, checks.OnboardingRequired,
 		checks.LocalAction,
-		checks.SelfHostedRunner, checks.ExpressionRunner,
 		checks.Stale, checks.MisleadingSHA,
 	} {
 		if n, ok := catCounts[cat]; ok {
@@ -163,38 +154,6 @@ func renderFindingDetail(out *ui.UI, f checks.Finding, dep string) {
 	}
 }
 
-// renderSelfHostedGroup prints a deduplicated block for self-hosted-runner
-// findings, listing each affected workflow and its non-hosted labels.
-func renderSelfHostedGroup(out *ui.UI, findings []checks.Finding) {
-	label := "SELF-HOSTED-RUNNER"
-	icon := "!"
-	if IsAlertedCategory(checks.SelfHostedRunner) {
-		icon = "✗"
-	}
-	out.Detail("%s %s", icon, out.Dim(label))
-	for _, f := range findings {
-		wfName := workflowName(f.WorkflowPath)
-		out.Detail("  %s: %s", out.Bold(wfName), f.Detail)
-	}
-	if IsAlertedCategory(checks.SelfHostedRunner) && findings[0].Remediation != "" {
-		out.Detail("  %s %s", ui.IconWarning, findings[0].Remediation)
-	}
-	labelSet := map[string]bool{}
-	for _, f := range findings {
-		for _, l := range extractBracketedLabels(f.Detail) {
-			labelSet[l] = true
-		}
-	}
-	if len(labelSet) > 0 {
-		var labels []string
-		for l := range labelSet {
-			labels = append(labels, l)
-		}
-		sort.Strings(labels)
-		out.Detail("  ↳ re-run with --allow-runners %s or -A to allow all", strings.Join(labels, ","))
-	}
-}
-
 // workflowName extracts the workflow filename from a path like
 // ".github/workflows/ci.yml".
 func workflowName(path string) string {
@@ -204,32 +163,6 @@ func workflowName(path string) string {
 	return path
 }
 
-// extractBracketedLabels pulls comma-separated items from the first
-// [...] group in s. Returns nil if no brackets are found.
-// Template expressions like ${{ matrix.os }} are excluded — they can't
-// be passed as literal --allow-runners values.
-func extractBracketedLabels(s string) []string {
-	start := strings.Index(s, "[")
-	end := strings.Index(s, "]")
-	if start < 0 || end <= start {
-		return nil
-	}
-	inner := s[start+1 : end]
-	var labels []string
-	for _, l := range strings.Split(inner, ",") {
-		l = strings.TrimSpace(l)
-		if l != "" && !isExpression(l) {
-			labels = append(labels, l)
-		}
-	}
-	return labels
-}
-
-// isExpression reports whether s is a GitHub Actions template expression.
-func isExpression(s string) bool {
-	return strings.Contains(s, "${")
-}
-
 type warningGroup struct {
 	finding   checks.Finding
 	count     int
@@ -266,17 +199,13 @@ func renderWarnings(out *ui.UI, report *checks.Report, willRemediate bool) {
 	}
 
 	// Triage warnings into buckets.
-	var unpinnedWorkflows, localActionWorkflows, selfHostedRunnerWorkflows, expressionRunnerWorkflows, bareSHADeps, otherDetailWarnings []string
+	var unpinnedWorkflows, localActionWorkflows, bareSHADeps, otherDetailWarnings []string
 	for _, key := range warnOrder {
 		wg := warnMap[key]
 		f := wg.finding
 		switch {
 		case f.Category == checks.LocalAction:
 			localActionWorkflows = append(localActionWorkflows, f.WorkflowPath)
-		case f.Category == checks.SelfHostedRunner:
-			selfHostedRunnerWorkflows = append(selfHostedRunnerWorkflows, f.WorkflowPath)
-		case f.Category == checks.ExpressionRunner:
-			expressionRunnerWorkflows = append(expressionRunnerWorkflows, f.WorkflowPath)
 		case f.Category == checks.NotPinned && f.ActionRef == nil:
 			unpinnedWorkflows = append(unpinnedWorkflows, f.WorkflowPath)
 		case f.Category == checks.ShaAsRef:
@@ -310,45 +239,6 @@ func renderWarnings(out *ui.UI, report *checks.Report, willRemediate bool) {
 		sort.Strings(localNames)
 		out.TermDetail("↳ %s", strings.Join(localNames, ", "))
 	}
-	if len(selfHostedRunnerWorkflows) > 0 {
-		out.TermCaution("%d %s skipped — non-hosted runner labels are not supported",
-			len(selfHostedRunnerWorkflows),
-			ui.Pluralize(len(selfHostedRunnerWorkflows), "workflow", "workflows"))
-		// Collect distinct labels from findings for the remediation hint.
-		labelSet := map[string]bool{}
-		for _, key := range warnOrder {
-			wg := warnMap[key]
-			if wg.finding.Category != checks.SelfHostedRunner {
-				continue
-			}
-			for _, l := range extractBracketedLabels(wg.finding.Detail) {
-				labelSet[l] = true
-			}
-		}
-		if len(labelSet) > 0 {
-			var labels []string
-			for l := range labelSet {
-				labels = append(labels, l)
-			}
-			sort.Strings(labels)
-			out.TermDetail("↳ if these are org-hosted larger runners, re-run with --allow-runners %s or -A to allow all",
-				strings.Join(labels, ","))
-		} else {
-			out.TermDetail("↳ if these are org-hosted larger runners, re-run with --allow-runners <label> or -A to allow all")
-		}
-	}
-	if len(expressionRunnerWorkflows) > 0 {
-		out.TermCaution("%d %s skipped — runs-on uses expressions that can't be resolved statically",
-			len(expressionRunnerWorkflows),
-			ui.Pluralize(len(expressionRunnerWorkflows), "workflow", "workflows"))
-		var wfNames []string
-		for _, p := range expressionRunnerWorkflows {
-			wfNames = append(wfNames, p)
-		}
-		sort.Strings(wfNames)
-		out.TermDetail("↳ %s — re-run with -A (--allow-all-runners) if the matrix resolves to hosted runners",
-			strings.Join(wfNames, ", "))
-	}
 	if len(unpinnedWorkflows) > 0 {
 		out.TermWarn("%d %s not yet pinned",
 			len(unpinnedWorkflows),

cmd/gh-actions-lock/format/terminal_test.go

@@ -327,132 +327,6 @@ func TestPresentResults_ParseWarningsSurface(t *testing.T) {
 	}
 }
 
-// TestPresentResults_SelfHostedRunnerHintExcludesExpressions verifies that
-// template expressions like ${{ matrix.os }} are excluded from the
-// --allow-runners remediation hint shown for self-hosted-runner warnings.
-func TestPresentResults_SelfHostedRunnerHintExcludesExpressions(t *testing.T) {
-	u, buf := newTestUI()
-	report := &checks.Report{
-		Workflows: []checks.WorkflowReport{{
-			Path: ".github/workflows/ci.yml",
-			Findings: []checks.Finding{
-				{
-					WorkflowPath: ".github/workflows/ci.yml",
-					Category:     checks.SelfHostedRunner,
-					Severity:     checks.SeverityWarning,
-					Confidence:   checks.ConfidenceHigh,
-					Detail:       "non-hosted runner labels [${{ matrix.os }}, internal-runner]",
-				},
-			},
-		}},
-	}
-	PresentResults(u, report, true, false)
-
-	got := buf.String()
-	if strings.Contains(got, "matrix.os") {
-		t.Errorf("--allow-runners hint should not contain matrix expressions:\n%s", got)
-	}
-	if !strings.Contains(got, "internal-runner") {
-		t.Errorf("--allow-runners hint should contain literal labels:\n%s", got)
-	}
-}
-
-// TestPresentResults_ExpressionRunnerWarning verifies that expression-only
-// workflows get their own distinct warning with workflow names and guidance.
-func TestPresentResults_ExpressionRunnerWarning(t *testing.T) {
-	u, buf := newTestUI()
-	report := &checks.Report{
-		Workflows: []checks.WorkflowReport{
-			{
-				Path: ".github/workflows/ci.yaml",
-				Findings: []checks.Finding{{
-					WorkflowPath: ".github/workflows/ci.yaml",
-					Category:     checks.ExpressionRunner,
-					Severity:     checks.SeverityWarning,
-					Confidence:   checks.ConfidenceHigh,
-					Detail:       "runs-on uses expressions [${{ matrix.os }}] that can't be resolved statically",
-				}},
-			},
-			{
-				Path: ".github/workflows/maccloud-unified.yml",
-				Findings: []checks.Finding{{
-					WorkflowPath: ".github/workflows/maccloud-unified.yml",
-					Category:     checks.ExpressionRunner,
-					Severity:     checks.SeverityWarning,
-					Confidence:   checks.ConfidenceHigh,
-					Detail:       "runs-on uses expressions [${{ matrix.runner }}] that can't be resolved statically",
-				}},
-			},
-		},
-	}
-	PresentResults(u, report, true, false)
-
-	got := buf.String()
-	if !strings.Contains(got, "2 workflows skipped") {
-		t.Errorf("should show count of expression-runner workflows:\n%s", got)
-	}
-	if !strings.Contains(got, "expressions that can't be resolved statically") {
-		t.Errorf("should show expression-specific message:\n%s", got)
-	}
-	if !strings.Contains(got, "ci.yaml") {
-		t.Errorf("should list affected workflow names:\n%s", got)
-	}
-	if !strings.Contains(got, "maccloud-unified.yml") {
-		t.Errorf("should list affected workflow names:\n%s", got)
-	}
-	if !strings.Contains(got, "--allow-all-runners") {
-		t.Errorf("should show --allow-all-runners remediation:\n%s", got)
-	}
-}
-
-func TestExtractBracketedLabels(t *testing.T) {
-	tests := []struct {
-		name string
-		s    string
-		want []string
-	}{
-		{
-			name: "plain labels",
-			s:    "non-hosted runner labels [internal-runner, ubuntu-22.04-32core]",
-			want: []string{"internal-runner", "ubuntu-22.04-32core"},
-		},
-		{
-			name: "matrix expression filtered",
-			s:    "non-hosted runner labels [${{ matrix.os }}, internal-runner]",
-			want: []string{"internal-runner"},
-		},
-		{
-			name: "only expressions returns nil",
-			s:    "non-hosted runner labels [${{ matrix.os }}]",
-			want: nil,
-		},
-		{
-			name: "no brackets",
-			s:    "no brackets here",
-			want: nil,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := extractBracketedLabels(tt.s)
-			if len(tt.want) == 0 {
-				if len(got) != 0 {
-					t.Errorf("got %v, want nil/empty", got)
-				}
-			} else {
-				if len(got) != len(tt.want) {
-					t.Fatalf("got %v, want %v", got, tt.want)
-				}
-				for i := range tt.want {
-					if got[i] != tt.want[i] {
-						t.Errorf("got[%d] = %q, want %q", i, got[i], tt.want[i])
-					}
-				}
-			}
-		})
-	}
-}
-
 // TestPresentResults_ExcludeCategoriesSkipsImpostor verifies that excluded
 // categories are not rendered in the error findings block. This prevents
 // duplication when renderInvestigationAlerts already surfaced the same