ci: run linux jobs on hanzo-build-linux-amd64 ARC scale set (no GitHub-hosted builders)

Co-authored-by: Hanzo Dev <[email protected]>

.github/workflows/blob-size-policy.yml

@@ -6,7 +6,7 @@ on:
 jobs:
   check:
     name: Blob size policy
-    runs-on: ubuntu-24.04
+    runs-on: hanzo-build-linux-amd64
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:

.github/workflows/cargo-deny.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   cargo-deny:
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     defaults:
       run:
         working-directory: ./codex-rs

.github/workflows/ci.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   build-test:
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     timeout-minutes: 10
     env:
       NODE_OPTIONS: --max-old-space-size=4096

.github/workflows/cla.yml

@@ -16,7 +16,7 @@ jobs:
     # Only run the CLA assistant for the canonical openai repo so forks are not blocked
     # and contributors who signed previously do not receive duplicate CLA notifications.
     if: ${{ github.repository_owner == 'openai' }}
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     steps:
       - uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
         # Run on close only if the PR was merged. This will lock the PR to preserve

.github/workflows/close-stale-contributor-prs.yml

@@ -14,7 +14,7 @@ jobs:
   close-stale-contributor-prs:
     # Prevent scheduled runs on forks
     if: github.repository == 'openai/codex'
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     steps:
       - name: Close inactive PRs from contributors
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8

.github/workflows/codespell.yml

@@ -14,7 +14,7 @@ permissions:
 jobs:
   codespell:
     name: Check for spelling errors
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
 
     steps:
       - name: Checkout

.github/workflows/do-deploy.yml

@@ -54,7 +54,7 @@ jobs:
   # ==========================================================================
   validate:
     name: Validate Configuration
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
 
     steps:
       - name: Checkout
@@ -116,7 +116,7 @@ jobs:
   # ==========================================================================
   build-images:
     name: Build Docker Images
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     needs: validate
     if: github.event_name == 'push' || github.event.inputs.action == 'deploy'
 
@@ -208,7 +208,7 @@ jobs:
   # ==========================================================================
   terraform-plan:
     name: Terraform Plan
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     needs: validate
     if: github.event_name == 'pull_request' || github.event.inputs.action == 'plan'
 
@@ -294,7 +294,7 @@ jobs:
   # ==========================================================================
   terraform-apply:
     name: Terraform Apply
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     needs: [validate, build-images]
     if: |
       (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
@@ -354,7 +354,7 @@ jobs:
   # ==========================================================================
   deploy-app:
     name: Deploy to DO App Platform
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     needs: [build-images, terraform-apply]
     if: |
       (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
@@ -421,7 +421,7 @@ jobs:
   # ==========================================================================
   migrate:
     name: Run Migrations
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     needs: deploy-app
     if: github.event_name == 'push'
 
@@ -480,7 +480,7 @@ jobs:
   # ==========================================================================
   health-check:
     name: Health Check
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     needs: deploy-app
     if: always() && needs.deploy-app.result == 'success'
 
@@ -518,7 +518,7 @@ jobs:
   # ==========================================================================
   cleanup:
     name: Cleanup Staging
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     if: github.event_name == 'pull_request' && github.event.action == 'closed'
 
     steps:

.github/workflows/hanzo-node-release.yml

@@ -48,7 +48,7 @@ env:
 jobs:
   npm-auth-check:
     name: Validate npm auth
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     if: "!contains(github.event.head_commit.message, '[skip ci]')"
     timeout-minutes: 5
     env:
@@ -80,7 +80,7 @@ jobs:
   determine-version:
     name: Determine Version
     needs: [npm-auth-check]
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     outputs:
       version: ${{ steps.version.outputs.version }}
       should_release: ${{ steps.version.outputs.should_release }}
@@ -333,7 +333,7 @@ jobs:
   release:
     name: Create Release & Publish npm
     needs: [determine-version, build-binaries]
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     if: "!contains(github.event.head_commit.message, '[skip ci]')"
     timeout-minutes: 30
     env:

.github/workflows/issue-code.yml

@@ -25,7 +25,7 @@ permissions:
 jobs:
   implement:
     name: Implement changes and open PR
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     env:
       # Consistent Cargo/rustup homes for caching across all workflows
       CARGO_HOME: ${{ github.workspace }}/.cargo-home

.github/workflows/issue-comment.yml

@@ -48,7 +48,7 @@ jobs:
        github.event.workflow_run.event == 'pull_request' &&
        github.event.workflow_run.conclusion == 'success')
       || (github.event_name == 'workflow_dispatch' && (inputs.type == 'preview' || !inputs.type))
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     env:
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
       RUST_WORKSPACE_DIR: codex-rs
@@ -490,7 +490,7 @@ jobs:
   dispatch_comment:
     name: Post triage comment to issue (dispatch via Code)
     if: github.event_name == 'repository_dispatch' && github.event.action == 'issue-comment'
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     env:
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
     steps:

.github/workflows/issue-deduplicator.yml

@@ -11,7 +11,7 @@ jobs:
     name: Identify potential duplicates (all issues)
     # Prevent runs on forks (requires OpenAI API key, wastes Actions minutes)
     if: github.repository == 'openai/codex' && (github.event.action == 'opened' || (github.event.action == 'labeled' && github.event.label.name == 'codex-deduplicate'))
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     permissions:
       contents: read
     outputs:
@@ -147,7 +147,7 @@ jobs:
     # Pass 1 may drop sudo on the runner, so run the fallback in a fresh job.
     needs: gather-duplicates-all
     if: ${{ needs.gather-duplicates-all.result == 'success' && needs.gather-duplicates-all.outputs.has_matches != 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     permissions:
       contents: read
     outputs:
@@ -282,7 +282,7 @@ jobs:
       - gather-duplicates-all
       - gather-duplicates-open
     if: ${{ always() && needs.gather-duplicates-all.result == 'success' && (needs.gather-duplicates-open.result == 'success' || needs.gather-duplicates-open.result == 'skipped') }}
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     permissions:
       contents: read
     outputs:
@@ -336,7 +336,7 @@ jobs:
     name: Comment with potential duplicates
     needs: select-final
     if: ${{ always() && needs.select-final.result == 'success' }}
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     permissions:
       contents: read
       issues: write

.github/workflows/issue-labeler.yml

@@ -11,7 +11,7 @@ jobs:
     name: Generate label suggestions
     # Prevent runs on forks (requires OpenAI API key, wastes Actions minutes)
     if: github.repository == 'openai/codex' && (github.event.action == 'opened' || (github.event.action == 'labeled' && github.event.label.name == 'codex-label'))
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     permissions:
       contents: read
     outputs:
@@ -90,7 +90,7 @@ jobs:
     name: Apply labels from Codex output
     needs: gather-labels
     if: ${{ needs.gather-labels.result != 'skipped' }}
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     permissions:
       contents: read
       issues: write

.github/workflows/issue-triage.yml

@@ -47,7 +47,7 @@ jobs:
         github.actor != 'zemaj')
       ||
       (github.event_name == 'workflow_dispatch')
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     timeout-minutes: 30
 
     env:

.github/workflows/preview-build.yml

@@ -225,7 +225,7 @@ jobs:
       github.event_name == 'pull_request' &&
       github.event.pull_request.head.ref != 'upstream-merge' &&
       github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     steps:
       - name: Resolve slug and next tag
         id: slug
@@ -385,7 +385,7 @@ jobs:
         needs.release.result == 'skipped' ||
         needs.release.outputs.skip == 'true'
       )
-    runs-on: ubuntu-24.04
+    runs-on: hanzo-build-linux-amd64
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -402,7 +402,7 @@ jobs:
       github.event.pull_request.head.ref != 'upstream-merge' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
       needs.release.outputs.skip != 'true'
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     steps:
       - name: Resolve slug and latest tag
         id: slug

.github/workflows/rust-ci-full.yml

@@ -11,7 +11,7 @@ jobs:
   # --- CI that doesn't need specific targets ---------------------------------
   general:
     name: Format / etc
-    runs-on: ubuntu-24.04
+    runs-on: hanzo-build-linux-amd64
     defaults:
       run:
         working-directory: codex-rs
@@ -25,7 +25,7 @@ jobs:
 
   cargo_shear:
     name: cargo shear
-    runs-on: ubuntu-24.04
+    runs-on: hanzo-build-linux-amd64
     defaults:
       run:
         working-directory: codex-rs
@@ -41,7 +41,7 @@ jobs:
 
   argument_comment_lint_package:
     name: Argument comment lint package
-    runs-on: ubuntu-24.04
+    runs-on: hanzo-build-linux-amd64
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
@@ -751,7 +751,7 @@ jobs:
         tests,
       ]
     if: always()
-    runs-on: ubuntu-24.04
+    runs-on: hanzo-build-linux-amd64
     steps:
       - name: Summarize
         shell: bash

.github/workflows/rust-ci.yml

@@ -7,7 +7,7 @@ jobs:
   # --- Detect what changed so the fast PR workflow only runs relevant jobs ----
   changed:
     name: Detect changed areas
-    runs-on: ubuntu-24.04
+    runs-on: hanzo-build-linux-amd64
     outputs:
       argument_comment_lint: ${{ steps.detect.outputs.argument_comment_lint }}
       argument_comment_lint_package: ${{ steps.detect.outputs.argument_comment_lint_package }}
@@ -53,7 +53,7 @@ jobs:
   # --- Fast Cargo-native PR checks -------------------------------------------
   general:
     name: Format / etc
-    runs-on: ubuntu-24.04
+    runs-on: hanzo-build-linux-amd64
     needs: changed
     if: ${{ needs.changed.outputs.codex == 'true' || needs.changed.outputs.workflows == 'true' }}
     defaults:
@@ -69,7 +69,7 @@ jobs:
 
   cargo_shear:
     name: cargo shear
-    runs-on: ubuntu-24.04
+    runs-on: hanzo-build-linux-amd64
     needs: changed
     if: ${{ needs.changed.outputs.codex == 'true' || needs.changed.outputs.workflows == 'true' }}
     defaults:
@@ -87,7 +87,7 @@ jobs:
 
   argument_comment_lint_package:
     name: Argument comment lint package
-    runs-on: ubuntu-24.04
+    runs-on: hanzo-build-linux-amd64
     needs: changed
     if: ${{ needs.changed.outputs.argument_comment_lint_package == 'true' }}
     steps:
@@ -198,7 +198,7 @@ jobs:
         argument_comment_lint_prebuilt,
       ]
     if: always()
-    runs-on: ubuntu-24.04
+    runs-on: hanzo-build-linux-amd64
     steps:
       - name: Summarize
         shell: bash

.github/workflows/rust-release-argument-comment-lint.yml

@@ -10,7 +10,7 @@ on:
 jobs:
   skip:
     if: ${{ !inputs.publish }}
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     steps:
       - run: echo "Skipping argument-comment-lint release assets for prerelease tag"
 

.github/workflows/rust-release-prepare.yml

@@ -16,7 +16,7 @@ jobs:
   prepare:
     # Prevent scheduled runs on forks (no secrets, wastes Actions minutes)
     if: github.repository == 'openai/codex'
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:

.github/workflows/rust-release.yml

@@ -17,7 +17,7 @@ concurrency:
 
 jobs:
   tag-check:
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: dtolnay/rust-toolchain@c2b55edffaf41a251c410bb32bed22afefa800f1 # 1.92
@@ -408,7 +408,7 @@ jobs:
       - argument-comment-lint-release-assets
       - zsh-release-assets
     name: release
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     permissions:
       contents: write
       actions: read
@@ -575,7 +575,7 @@ jobs:
     if: ${{ needs.release.outputs.should_publish_npm == 'true' }}
     name: publish-npm
     needs: release
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     permissions:
       id-token: write # Required for OIDC
       contents: read
@@ -687,7 +687,7 @@ jobs:
     if: ${{ !contains(needs.release.outputs.version, '-') }}
     # This job only invokes a GitHub Action to open/update the winget-pkgs PR;
     # it does not execute Windows-only tooling, so Linux is sufficient.
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     permissions:
       contents: read
 
@@ -707,7 +707,7 @@ jobs:
     permissions:
       contents: write
     needs: release
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
 
     steps:
       - name: Update latest-alpha-cli branch

.github/workflows/rusty-v8-release.yml

@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   metadata:
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     outputs:
       release_tag: ${{ steps.release_tag.outputs.release_tag }}
       v8_version: ${{ steps.v8_version.outputs.version }}
@@ -158,7 +158,7 @@ jobs:
     needs:
       - metadata
       - build
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     permissions:
       contents: write
       actions: read

.github/workflows/upstream-sync.yml

@@ -37,7 +37,7 @@ concurrency:
 
 jobs:
   sync:
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     timeout-minutes: 30
     env:
       UPSTREAM_URL: ${{ inputs.upstream_url || 'https://github.com/openai/codex.git' }}

.github/workflows/v8-canary.yml

@@ -12,7 +12,7 @@ concurrency:
 
 jobs:
   metadata:
-    runs-on: ubuntu-latest
+    runs-on: hanzo-build-linux-amd64
     outputs:
       v8_version: ${{ steps.v8_version.outputs.version }}