fix(ci): switch governed-pr-check to self-hosted runner

[hummbl-dev]

Summary

• Switches reusable governed-pr-check workflow from ubuntu-latest to [self-hosted, Linux, X64, wsl]
• Uses generic WSL labels so any WSL-based runner in the org can pick up the job

Why

GitHub org billing lock blocks all hosted runners. Self-hosted WSL runners are online across the org.

Test plan

• Workflow updated to [self-hosted, Linux, X64, wsl]
• Reusable workflow call succeeds from a caller repo

[coderabbitai]

Warning

Review limit reached

@hummbl-dev, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 13 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f4e9d2e4-0e8f-4526-958d-671ee0bcb33d

📥 Commits

Reviewing files that changed from the base of the PR and between 7c74478 and 2d38e93.

📒 Files selected for processing (1)

• .github/workflows/governed-pr-check.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ci/self-hosted-runner

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hummbl-dev]

CONTROL-PLANE HOLD — DO NOT MERGE AS WRITTEN

Governed by hummbl-dev/founder-mode#1534 and runner-placement lane hummbl-dev/founder-mode#1452.

Findings

1. This public repository is owned by the hummbl-dev user account, not a GitHub organization. The PR's claim that generic labels allow “any WSL-based runner in the org” to pick up the job is therefore unverified and conflicts with the current repository-owner model. Existing evidence in hummbl-dev/hummbl-dev#216 indicates runners are repository-scoped under this owner.
2. The PR is a root dependency for downstream caller changes such as hummbl-dev/hummbl-dev#219, yet its own test plan still shows the reusable call as unverified.
3. The workflow uses broad labels [self-hosted, Linux, X64, wsl] with no repository/workload-specific label, runner group, or isolation boundary.
4. The workflow does not directly check out caller PR code; it checks out the governed-check tooling and processes PR metadata. That makes it lower-risk than the blanket public-PR execution PRs, but it does not justify routing it onto an arbitrary shared persistent runner.
5. Sharing the same runner pool with jobs that execute repository code, publish packages, merge Dependabot PRs, or hold broader credentials creates cross-job persistence and contamination risk.

Required redesign

• Verify the actual runner registration scope and document which runner can satisfy this job.
• Use a dedicated label such as governed-pr-metadata-check, not generic WSL labels.
• Ensure the selected runner never executes untrusted repository code and is isolated from build, test, publishing, deployment, and auto-merge runners.
• Preserve persist-credentials: false, least permissions, pinned actions, and strict input handling.
• Add an adversarial fixture set for PR titles, bodies, filenames, Unicode, shell metacharacters, Markdown/HTML, oversized inputs, and malformed API data.
• Validate the reusable call from a bounded synthetic/private caller before repinning production callers.
• Do not merge downstream repin PRs until the root workflow and runner scope are independently reviewed and demonstrated.

Disposition

DO_NOT_MERGE_AS_WRITTEN

This may be salvageable as a narrowly isolated metadata-only lane, but it is not a general account-wide self-hosted runner solution.

[hummbl-dev]

Local CI audit — blocking remediation before merge

Disposition: HOLD

This PR has not produced a successful self-hosted proof. Run 29270155429 concluded cancelled, and its job executed no steps.

Two changes are required before another exact-head run:

1. Check out tooling from the exact reusable-workflow revision. The current checkout omits ref, so it resolves mutable default-branch content rather than the workflow definition's immutable source. Use:

- name: Checkout governed check tools
  uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
  with:
    repository: ${{ job.workflow_repository }}
    ref: ${{ job.workflow_sha }}
    path: governed-pr-check-tools
    persist-credentials: false

2. Reconcile runner routing with actual account topology. The PR description says any WSL runner in the organization may accept the job, while the parent runner issue records hummbl-dev as a personal account with repository-scoped runners. Document the exact runner(s) visible to this repository and add a workload/repository-specific label unless repository scope alone proves the boundary.

Also add a bounded receipt step that records RUNNER_NAME, runner OS/architecture, event, caller repository/SHA, job.workflow_sha, workspace/disk state, cache/artifact behavior, cleanup, and rollback.

Do not rerun the cancelled job blindly. First prove the intended matching self-hosted runner is online and eligible. Zero GitHub-hosted minutes remain the active constraint. Parent evidence: hummbl-dev/hummbl-dev#216 and #220.