CI: trusted pull requests use the self-hosted runners too (#2012)

Pull requests from branches of this repository share the work with the self-hosted runners like main does; fork pull requests stay on GitHub's runners. Select checks and ci run on a light self-hosted runner; the repository checks, Clippy, doc tests, reference tests and test shards 1-2 on the fast ones. The test archive is still built on GitHub's runners (glibc).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/actionlint.yaml

@@ -1,3 +1,4 @@
 self-hosted-runner:
   labels:
     - self-hosted-fast
+    - self-hosted-light

.github/workflows/ci.yml

@@ -15,13 +15,16 @@
 # that skipped the queue still runs everything. Pull requests run the reference tests when the
 # command line (or anything it depends on) changes, and doc tests for the affected packages.
 # Cross-compilation is opt-in through Run workflow; release builds remain in release.yml.
-# Pushes to main and merge-queue groups use both pools: Clippy, the doc tests and test shards
-# 1-2 run on the self-hosted runner (`self-hosted-fast`, warm build directories via
-# scripts/ci/warm-target.sh), everything else on GitHub's runners. The test archive is built on
-# GitHub's runners: the self-hosted machine has a newer glibc, so its binaries wouldn't start
-# on ubuntu-24.04, while the archive runs there unchanged (same /home/runner/work checkout
-# path). Pull requests, the nightly run and Run workflow use GitHub's runners only; the
-# self-hosted runner refuses any job that isn't a push to main or a merge-queue group.
+# Trusted runs use both pools: pushes to main, merge-queue groups and pull requests from a branch
+# of this repository (people with write access; fork pull requests never run on this machine).
+# There, Select checks and ci run on the self-hosted light runner (`self-hosted-light`, quick
+# jobs, so they never wait behind a build), and the repository checks, Clippy, the doc tests,
+# the reference tests and test shards 1-2 on the self-hosted runners (`self-hosted-fast`, warm
+# build directories via scripts/ci/warm-target.sh); everything else runs on GitHub's runners.
+# The test archive is always built on GitHub's runners: the self-hosted machine has a newer
+# glibc, so its binaries wouldn't start on ubuntu-24.04, while the archive runs there unchanged
+# (same /home/runner/work checkout path). Fork pull requests, the nightly run and Run workflow
+# use GitHub's runners only; the self-hosted runners refuse any other job.
 name: CI
 
 on:
@@ -67,7 +70,8 @@ jobs:
 
   changes:
     name: Select checks
-    runs-on: ubuntu-24.04
+    # Trusted runs (see the top of this file) use the self-hosted runners.
+    runs-on: ${{ (github.event_name == 'merge_group' || (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)) && 'self-hosted-light' || 'ubuntu-24.04' }}
     permissions:
       contents: read
       # To ask whether the merge queue already tested a commit pushed to main.
@@ -79,6 +83,8 @@ jobs:
       full: ${{ steps.paths.outputs.full }}
       packages: ${{ steps.paths.outputs.packages }}
       oracle: ${{ steps.paths.outputs.oracle }}
+      # Whether the other Linux jobs use the self-hosted runners too.
+      local: ${{ runner.environment == 'self-hosted' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -164,14 +170,19 @@ jobs:
 
   checks:
     name: Format and repository checks
-    runs-on: ubuntu-24.04
+    runs-on: ${{ (github.event_name == 'merge_group' || (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)) && 'self-hosted-fast' || 'ubuntu-24.04' }}
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Warm build directory (self-hosted runner)
+        if: runner.environment == 'self-hosted'
+        run: scripts/ci/warm-target.sh checks
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      # The self-hosted runner keeps its build directory and Cargo home instead.
+      - if: runner.environment == 'github-hosted'
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: repo-checks
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -196,7 +207,7 @@ jobs:
     name: Native Linux Clippy
     needs: changes
     if: needs.changes.outputs.native == 'true'
-    runs-on: ${{ (github.event_name == 'merge_group' || (github.event_name == 'push' && github.ref == 'refs/heads/main')) && 'self-hosted-fast' || 'ubuntu-24.04' }}
+    runs-on: ${{ needs.changes.outputs.local == 'true' && 'self-hosted-fast' || 'ubuntu-24.04' }}
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -269,7 +280,7 @@ jobs:
   tests:
     name: Native Linux tests (${{ matrix.shard }}/4)
     needs: [changes, build-tests]
-    runs-on: ${{ ((github.event_name == 'merge_group' || (github.event_name == 'push' && github.ref == 'refs/heads/main')) && matrix.shard <= 2) && 'self-hosted-fast' || 'ubuntu-24.04' }}
+    runs-on: ${{ (needs.changes.outputs.local == 'true' && matrix.shard <= 2) && 'self-hosted-fast' || 'ubuntu-24.04' }}
     timeout-minutes: 60
     strategy:
       fail-fast: false
@@ -425,7 +436,7 @@ jobs:
     name: Doc tests
     needs: changes
     if: needs.changes.outputs.native == 'true'
-    runs-on: ${{ (github.event_name == 'merge_group' || (github.event_name == 'push' && github.ref == 'refs/heads/main')) && 'self-hosted-fast' || 'ubuntu-24.04' }}
+    runs-on: ${{ needs.changes.outputs.local == 'true' && 'self-hosted-fast' || 'ubuntu-24.04' }}
     timeout-minutes: 45
     env:
       CARGO_INCREMENTAL: "0"
@@ -475,7 +486,7 @@ jobs:
     name: Reference tests
     needs: changes
     if: needs.changes.outputs.oracle == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ${{ needs.changes.outputs.local == 'true' && 'self-hosted-fast' || 'ubuntu-24.04' }}
     timeout-minutes: 60
     env:
       CARGO_INCREMENTAL: "0"
@@ -484,8 +495,13 @@ jobs:
       SCCACHE_IGNORE_SERVER_IO_ERROR: "1"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Warm build directory (self-hosted runner)
+        if: runner.environment == 'self-hosted'
+        run: scripts/ci/warm-target.sh oracle
       - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      # The self-hosted runner keeps its build directory and Cargo home instead.
+      - if: runner.environment == 'github-hosted'
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: oracle
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -496,7 +512,7 @@ jobs:
       - name: Build the command line
         run: cargo build -p solidcraft-cli --profile ci --locked
       - name: Replay tests/oracle and compare with expected.json
-        run: cargo xtask oracle --cli target/ci/solidcraft-cli
+        run: cargo xtask oracle --cli "${CARGO_TARGET_DIR:-target}/ci/solidcraft-cli"
       - name: Upload the report
         if: always()
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
@@ -565,7 +581,7 @@ jobs:
   ci:
     needs: [changes, checks, clippy, build-tests, tests, doc-tests, oracle, windows-fxc, windows-startup]
     if: always()
-    runs-on: ubuntu-24.04
+    runs-on: ${{ needs.changes.outputs.local == 'true' && 'self-hosted-light' || 'ubuntu-24.04' }}
     steps:
       - name: Verify required checks
         env: