[purpshell]

Change

The owner made polymorfa/cli public. Run CLI checks on standard GitHub-hosted Ubuntu for pull requests, including forks, and main pushes. Preserve CI / Verify Node 22, the Node matrix, all three source commands, npm cache, 20-minute deadline and read-only token. Checkout credentials are not persisted.

Remove the ci-1 workflow, private image/shape admission helper and its tests, custom self-hosted label, controller receipt and operator record. They describe the superseded private-repository routing and are unnecessary on standard GitHub-hosted runners. No private worker or baked image is used. pull_request remains the event; no privileged target event or CI secrets are added. Publication keeps its existing schedule/manual and SDK/API acceptance gates.

Verification

Actionlint, formatting and diff checks pass. Zizmor 1.30.1 reports no issues in the new CI workflow; the unchanged publication workflow retains two low ad-hoc-package notes and four existing suppressions. A structural comparison confirms the unchanged source commands, Node matrix, check names, deadline, read-only permissions and non-persistent checkout. It also verifies ubuntu-latest, no fork-skipping guard, and no ci-1/self-hosted/Blacksmith destination or secrets reference in the CI workflow. Actual GitHub-hosted source CI and first main push remain required.

Impact

Part	Assessment
API	Unaffected: no handlers, authentication, schemas, webhooks or streams changed.
SDKs	Unaffected: no dependency or public contract changes; SDK CI already uses GitHub-hosted runners.
CLI	CI routing updated. Commands, flags, output, credentials, src/, package.json and package-lock.json are unchanged.
Documentation	Internal hosted-CI instructions and provenance updated; obsolete private-runner instructions removed. No customer behavior change, so public product guides and changelog are unaffected.
Feature releases	No product release, flag, entitlement or enrollment changes. Publication workflow unchanged; no package publication invoked.
Admin	Unaffected: no product state, staff authority, UI or control changes.

Rollout

Qualify this exact source on GitHub-hosted Ubuntu, merge after checks and review gates clear, then verify its first main push. Public repositories are excluded from ci-1 at the runner group, independent of workflow declarations. Do not re-enable an old Blacksmith workflow as fallback. Staging and regional rename #744 remain held. This PR supersedes the image-pin-only proposal now that the repository is public.

Hosted CI operator record. Sanitized session record. No automated review was requested.

Summary by CodeRabbit

• CI
  • Pull requests, including those from forks, and pushes to the main branch now run verification checks on GitHub-hosted Ubuntu with Node.js 22.
  • CI uses read-only repository access and runs release-evidence tests.
  • The previous dedicated CI-1 runner and image qualification workflow are no longer used.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Team
• Run ID: 6b03bf70-c4a6-4ffc-a9e5-c66709410526

📥 Commits

Reviewing files that changed from the base of the PR and between 90b7bb6 and 4041af1.

📒 Files selected for processing: 9

• .github/actionlint.yaml
• .github/workflows/ci-hosted.yml
• .github/workflows/ci1.yml
• internal/agent-sessions/ci1-cli-20261019.md
• internal/docs/ci-hosted.md
• internal/docs/ci1-qualified-pool.json
• internal/docs/ci1-runners.md
• scripts/ci1_image_test.py
• scripts/verify-ci1-image.py

💤 Files with no reviewable changes: 6

• internal/docs/ci1-runners.md
• .github/actionlint.yaml
• scripts/ci1_image_test.py
• internal/docs/ci1-qualified-pool.json
• .github/workflows/ci1.yml
• scripts/verify-ci1-image.py

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.

📝 Walkthrough

The CI workflow now runs on GitHub-hosted Ubuntu for pull requests and pushes to main. It retains Node.js 22 verification and release-evidence tests. The CI-1 runner workflow, image qualification tools, and related records are removed.

Changes: Hosted CI transition

Layer / File(s)	Summary
Add hosted-runner CI .github/workflows/ci-hosted.yml, internal/docs/ci-hosted.md, internal/agent-sessions/ci1-cli-20261019.md	The new workflow runs on pull requests and pushes to main using Ubuntu and Node.js 22. Documentation and the session record describe the hosted-runner policy and retained checks.
Remove CI-1 runner and image qualification .github/actionlint.yaml, .github/workflows/ci1.yml, scripts/ci1_image_test.py, scripts/verify-ci1-image.py, internal/docs/ci1-qualified-pool.json, internal/docs/ci1-runners.md	The CI-1 workflow, runner mapping, image validator, admission tests, qualification record, and runner documentation are removed.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Sequence Diagram(s)

sequenceDiagram
  participant GitHub
  participant UbuntuRunner
  participant Node22
  participant npm
  GitHub->>UbuntuRunner: Dispatch CI for pull request or main push
  UbuntuRunner->>Node22: Configure Node.js 22
  UbuntuRunner->>npm: Run npm ci, npm run verify, and release-evidence tests

Loading

Merge Risk: ⚪ Minimal · up to 4041a

The PR routes pull-request and main-push checks to GitHub-hosted Ubuntu while retaining Node 22 verification. No concrete CI break is established; live hosted execution remains to be confirmed.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: routing the public CLI CI to GitHub-hosted runners.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T20:40:24.885116Z	4041af1	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-19T20:41:33.659363Z	4041af1	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.