ci(runners): restore Blacksmith runners

[tinsever]

What changed?

Restore the Blacksmith runner labels, checkout action, and Docker builder actions across CI, maintenance, and release workflows. This reverts the temporary GitHub-hosted runner switch in commit 2b97d49, including its actionlint configuration change.

Keep this PR as a draft until Blacksmith is receiving workflow jobs and provisioning runners again.

How did you check it?

• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 -color
• pnpm lint
• pnpm typecheck
• Confirmed the restored branch tree matches the pre-switch commit aedd1860a exactly.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T12:43:21.479208Z	424cb98	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Restore Blacksmith runners and actions across workflows

⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Restore Blacksmith runners and checkout actions across CI, maintenance, deployment, and release
 workflows.
• Restore Blacksmith Docker builders and caching for image builds.
• Register the runner label with actionlint so workflow validation recognizes it.

Diagram

graph TD
  A["GitHub events"] --> B["Workflow jobs"] --> C["Blacksmith runners"] --> D["Checkout action"] --> E["Builder action"] --> F["Build push action"] --> G[("GHCR")]
  H["Actionlint config"] --> B

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Configurable runner selection

• ➕ Could make a future runner outage switch less repetitive.
• ➖ Checkout and Docker actions would still need provider-specific selection.
• ➖ Adds conditional paths to security-sensitive CI and release workflows.

Recommendation: Use the direct restoration for this PR: it returns the workflows to one consistent runner and action stack without adding conditional release paths. Keep it in draft until Blacksmith is provisioning runners and accepting jobs, as the stated validation does not establish runtime availability.

Files changed (22) +106 / -99

Other (22) +106 / -99

actionlint.yamlRegister Blacksmith's runner label with actionlint +3/-0

Register Blacksmith's runner label with actionlint

• Adds the self-hosted runner label so actionlint accepts the restored workflow jobs.

.github/actionlint.yaml

agentscan.ymlMove agent scanning back to Blacksmith +1/-1

Move agent scanning back to Blacksmith

• Routes the scan job to the Blacksmith runner.

.github/workflows/agentscan.yml

auto-assign.ymlMove automatic assignment back to Blacksmith +1/-1

Move automatic assignment back to Blacksmith

• Routes the assignment job to the Blacksmith runner.

.github/workflows/auto-assign.yml

auto-merge.ymlMove Dependabot auto-merge back to Blacksmith +1/-1

Move Dependabot auto-merge back to Blacksmith

• Routes the auto-merge job to the Blacksmith runner.

.github/workflows/auto-merge.yml

build-images.ymlRestore Blacksmith release-image builds +8/-8

Restore Blacksmith release-image builds

• Restores the Blacksmith runner and checkout for the image matrix. Replaces standard Buildx and build-push actions and GitHub Actions cache settings with Blacksmith builder setup, a per-image cache key, and Blacksmith build-push.

.github/workflows/build-images.yml

ci.ymlRestore Blacksmith across CI jobs and Docker builds +40/-38

Restore Blacksmith across CI jobs and Docker builds

• Moves CI jobs back to Blacksmith runners and restores Blacksmith checkout where source is needed. Docker test jobs regain Blacksmith builder and build-push actions with per-image cache keys; secret-scan comments explain why TruffleHog runs as a downloaded binary with Blacksmith's git mirror.

.github/workflows/ci.yml

code-review.ymlRestore Blacksmith code-review jobs +4/-4

Restore Blacksmith code-review jobs

• Moves authorization and review jobs to Blacksmith runners and restores Blacksmith checkout for trusted workflow code.

.github/workflows/code-review.yml

deploy-site.ymlRestore Blacksmith site deployment jobs +3/-3

Restore Blacksmith site deployment jobs

• Moves site build and deployment jobs to Blacksmith runners and restores Blacksmith checkout for the build.

.github/workflows/deploy-site.yml

helm-chart.ymlRestore Blacksmith Helm publication +3/-3

Restore Blacksmith Helm publication

• Moves chart publication to a Blacksmith runner and uses Blacksmith checkout for both repository and verified release sources.

.github/workflows/helm-chart.yml

helm-validate.ymlRestore Blacksmith Helm validation +2/-2

Restore Blacksmith Helm validation

• Moves the validation matrix to Blacksmith runners and restores Blacksmith checkout.

.github/workflows/helm-validate.yml

issue-notify.ymlMove issue notifications back to Blacksmith +1/-1

Move issue notifications back to Blacksmith

• Routes the issue notification job to the Blacksmith runner.

.github/workflows/issue-notify.yml

issue-priority.ymlRestore Blacksmith issue-priority execution +2/-2

Restore Blacksmith issue-priority execution

• Moves issue ranking to a Blacksmith runner and restores Blacksmith checkout of trusted workflow code.

.github/workflows/issue-priority.yml

nightly.ymlRestore Blacksmith nightly security jobs +8/-6

Restore Blacksmith nightly security jobs

• Moves full-history secret scanning and workflow auditing to Blacksmith runners and restores Blacksmith checkout. The scan comment documents why a downloaded TruffleHog binary is used instead of a container against Blacksmith's git mirror.

.github/workflows/nightly.yml

pr-size-labeler.ymlRestore Blacksmith PR-size labeling +2/-2

Restore Blacksmith PR-size labeling

• Moves PR-size labeling to a Blacksmith runner and restores Blacksmith checkout of base-branch configuration.

.github/workflows/pr-size-labeler.yml

pr-title.ymlRestore Blacksmith PR-title validation +2/-2

Restore Blacksmith PR-title validation

• Moves title validation to a Blacksmith runner and restores Blacksmith checkout of the target branch's policy.

.github/workflows/pr-title.yml

publish-mcp.ymlRestore Blacksmith MCP publishing +4/-4

Restore Blacksmith MCP publishing

• Moves package and registry publishing jobs to Blacksmith runners and restores Blacksmith checkout in both jobs.

.github/workflows/publish-mcp.yml

publish-planka-import.ymlRestore Blacksmith Planka import publishing +2/-2

Restore Blacksmith Planka import publishing

• Moves publishing to a Blacksmith runner and restores Blacksmith checkout.

.github/workflows/publish-planka-import.yml

release-notify.ymlMove release notifications back to Blacksmith +1/-1

Move release notifications back to Blacksmith

• Routes the release notification job to the Blacksmith runner.

.github/workflows/release-notify.yml

release.ymlRestore Blacksmith release orchestration +7/-7

Restore Blacksmith release orchestration

• Moves planning, CI verification, release, and promotion jobs to Blacksmith runners. Restores Blacksmith checkout in the jobs that fetch source; the image build remains delegated to its reusable workflow.

.github/workflows/release.yml

ui-review-run.ymlRestore Blacksmith UI-review execution +6/-6

Restore Blacksmith UI-review execution

• Moves planning, capture, and review-and-post jobs to Blacksmith runners and restores Blacksmith checkout in each.

.github/workflows/ui-review-run.yml

ui-review.ymlRestore Blacksmith UI-review authorization +2/-2

Restore Blacksmith UI-review authorization

• Moves the UI-review authorization job to a Blacksmith runner and restores Blacksmith checkout of trusted workflow code.

.github/workflows/ui-review.yml

update-contributors.ymlRestore Blacksmith contributor maintenance +3/-3

Restore Blacksmith contributor maintenance

• Moves contributor updates and the subsequent site-deployment trigger to Blacksmith runners. Restores Blacksmith checkout for contributor generation.

.github/workflows/update-contributors.yml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗