From 6b7f22967befbd1229f0618c9eafa7437694a150 Mon Sep 17 00:00:00 2001
From: Mike Odnis <airwolf635@gmail.com>
Date: Thu, 30 Jul 2026 00:35:56 -0400
Subject: [PATCH] feat(security-scan): add optional `runner` input for
 self-hosted runners
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mirrors node-ci.yml's `runner` input (#38). All 9 scan jobs (vet, codeql,
gitleaks, osv, dependency-review, snyk, semgrep, zizmor, actionlint) were
hardcoded to `ubuntu-latest`; when GitHub-hosted runners are unavailable
(exhausted minutes) every scan fails with no runner assigned.

Adds a `runner` string input (default `ubuntu-latest`, fully backward
compatible — existing callers are unchanged) and switches every job to
`runs-on: ${{ inputs.runner }}`. Callers on self-hosted infra pass
`runner: self-hosted`.

harden-runner stays in `egress-policy: audit` on every job, which is
self-hosted-safe (monitors rather than blocks).
---
 .github/workflows/security-scan.yml | 30 ++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 57889ac..56b4a87 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -79,6 +79,18 @@ on:
         type: string
         required: false
         default: ""
+      runner:
+        description: >-
+          Label(s) the scan jobs run on. Defaults to GitHub-hosted
+          `ubuntu-latest`; set to a self-hosted label (e.g. `self-hosted`)
+          to run on an org/repo self-hosted runner instead — useful when
+          GitHub-hosted minutes are exhausted. A single label string;
+          callers typically wire this to a repo variable so it can be
+          toggled without editing the workflow. Mirrors node-ci.yml's
+          `runner` input.
+        type: string
+        required: false
+        default: "ubuntu-latest"
 
     # Declared so callers can forward these by name instead of `secrets:
     # inherit` (which hands this workflow ALL of the caller's secrets and
@@ -115,7 +127,7 @@ jobs:
   vet:
     name: vet (OSS dependency policy)
     if: ${{ inputs.enable-vet }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     permissions:
       contents: read
       # NOTE: write perms (pull-requests/issues) are intentionally omitted.
@@ -152,7 +164,7 @@ jobs:
   codeql:
     name: CodeQL (${{ matrix.language }})
     if: ${{ inputs.languages != '' && inputs.languages != '[]' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     permissions:
       contents: read
       security-events: write
@@ -190,7 +202,7 @@ jobs:
   gitleaks:
     name: gitleaks
     if: ${{ inputs.enable-gitleaks }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176  # v2
@@ -208,7 +220,7 @@ jobs:
   osv-scanner:
     name: osv-scanner
     if: ${{ inputs.enable-osv }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176  # v2
@@ -237,7 +249,7 @@ jobs:
   dependency-review:
     name: dependency-review
     if: ${{ inputs.enable-dependency-review && github.event_name == 'pull_request' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176  # v2
@@ -253,7 +265,7 @@ jobs:
   zizmor:
     name: zizmor
     if: ${{ inputs.enable-zizmor }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     permissions:
       contents: read
       security-events: write
@@ -289,7 +301,7 @@ jobs:
   actionlint:
     name: actionlint
     if: ${{ inputs.enable-actionlint }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176  # v2
@@ -308,7 +320,7 @@ jobs:
   semgrep:
     name: semgrep
     if: ${{ inputs.enable-semgrep }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     container:
       image: semgrep/semgrep
     steps:
@@ -326,7 +338,7 @@ jobs:
   snyk:
     name: snyk
     if: ${{ inputs.enable-snyk }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176  # v2