From 702a2eb28f6ca85c90df697f1ea7c607b373dc0f Mon Sep 17 00:00:00 2001
From: Ralf Anton Beier <ralf_beier@me.com>
Date: Sun, 3 May 2026 20:01:46 +0200
Subject: [PATCH] ci: migrate 2 of 9 ci jobs to smithy self-hosted runners

  light       buildifier (ci.yml), docs (docs.yml)

Stays on hosted:
  - verify-rules (ci.yml)             needs Bazel (not on smithy)
  - build (ci.yml)                    needs Nix + Bazel + Rocq toolchain
  - build-macos (ci.yml)              smithy is Linux-only
  - verify-multiplatform              Bazel + macOS matrix
    (ci_comprehensive.yml)
  - quick-test (quick_test.yml)       needs Bazel
  - release (release.yml)             runs bazel build
  - publish (publish.yml)             reusable bazel-contrib workflow

This is a Bazel rules repo bridging Rocq (Coq) and Rust. Per the
smithy migration playbook, neither Bazel nor Coq/Rocq are installed
on the smithy fleet, so every job that compiles or queries Bazel
targets stays on ubuntu-latest, and the macOS matrix entry stays on
macos-latest (smithy is Linux-only).

The two migrable jobs are pure Linux non-Bazel checks: buildifier
just curls a static binary and runs it on the tree; docs runs a
README structure check + `npm install -g markdown-link-check` (Node
LTS via nvm is preinstalled on smithy, no sudo needed).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml               | 5 ++++-
 .github/workflows/ci_comprehensive.yml | 1 +
 .github/workflows/docs.yml             | 2 +-
 .github/workflows/publish.yml          | 1 +
 .github/workflows/quick_test.yml       | 1 +
 .github/workflows/release.yml          | 1 +
 6 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6f2adda..777552b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,6 +15,7 @@ jobs:
   # Basic loading verification (fast, no nix required)
   verify-rules:
     name: Verify Rules Load
+    # Stays on ubuntu-latest: uses bazelbuild/setup-bazelisk; Bazel is not pre-installed on smithy.
     runs-on: ubuntu-latest
 
     steps:
@@ -42,6 +43,7 @@ jobs:
   # Full build with nix toolchain (Linux)
   build:
     name: Build Example (Linux)
+    # Stays on ubuntu-latest: needs Nix + Bazel + Rocq toolchain, none of which are on smithy.
     runs-on: ubuntu-latest
     permissions:
       id-token: write
@@ -122,6 +124,7 @@ jobs:
   # macOS build
   build-macos:
     name: Build Example (macOS)
+    # Stays on macos-latest: smithy fleet is Linux-only.
     runs-on: macos-latest
     permissions:
       id-token: write
@@ -175,7 +178,7 @@ jobs:
   # Buildifier check
   buildifier:
     name: Buildifier Check
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, light]
 
     steps:
     - name: Checkout repository
diff --git a/.github/workflows/ci_comprehensive.yml b/.github/workflows/ci_comprehensive.yml
index 4dca8bf..ec76198 100644
--- a/.github/workflows/ci_comprehensive.yml
+++ b/.github/workflows/ci_comprehensive.yml
@@ -11,6 +11,7 @@ jobs:
   # Multi-platform verification
   verify-multiplatform:
     name: Verify Rules (${{ matrix.os }})
+    # Stays on hosted: needs Bazel (not on smithy) and macOS in matrix (smithy is Linux-only).
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index c2826dc..96e8592 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -16,7 +16,7 @@ on:
 jobs:
   docs:
     name: Documentation Check
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, light]
     
     steps:
     - name: Checkout
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1b8c541..5aeec9d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -12,6 +12,7 @@ on:
 
 jobs:
   publish:
+    # Stays on hosted: reusable workflow from bazel-contrib pins its own runner; not callable to smithy.
     uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.1.0
     with:
       tag_name: ${{ github.event.release.tag_name || inputs.tag_name }}
diff --git a/.github/workflows/quick_test.yml b/.github/workflows/quick_test.yml
index b038299..b0af237 100644
--- a/.github/workflows/quick_test.yml
+++ b/.github/workflows/quick_test.yml
@@ -10,6 +10,7 @@ on:
 jobs:
   quick-test:
     name: Quick Test
+    # Stays on ubuntu-latest: uses bazelbuild/setup-bazelisk and runs bazel; Bazel not on smithy.
     runs-on: ubuntu-latest
     
     steps:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 18197cf..77ba0a7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,6 +9,7 @@ on:
 jobs:
   release:
     name: Create Release
+    # Stays on ubuntu-latest: build step runs `bazel build`; Bazel not on smithy.
     runs-on: ubuntu-latest
     
     steps: