From 634f482ff841357e6e0d4403557de7fa42a4b40f Mon Sep 17 00:00:00 2001 From: ethernet Date: Fri, 31 Jul 2026 14:05:34 -0400 Subject: [PATCH] perf(ci): route jobs to the new capability-split runner scale sets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hermes-agent-ci-infra now offers three amd64 scale sets instead of one, split by capability rather than size: arc-runner-set no dind 4/8Gi general (unchanged label) arc-runner-docker dind 4/8Gi needs a docker daemon arc-runner-small no dind 500m/1Gi short gates, warm pod Of the 22 workflows targeting arc-runner-set, only docker.yml ever talks to a daemon. Every other job was booting a privileged docker:dind sidecar, an extra init container and a `docker info` startup probe just to run ruff, so dind now lives only on arc-runner-docker (and arm64, which already had it). docker.yml's amd64 legs and its manifest-merge job move there; the arm64 legs are unchanged. The short gate jobs move to arc-runner-small. Each of these ran for 14-29s while reserving 4 CPU / 8Gi — a fifth of a c3-standard-22 node — and there are enough of them per PR to delay the test matrix they run alongside. The small set sits on the always-on system pool and keeps one warm pod, so these jobs skip pod creation and image pull entirely. No behavior change to what any job does; only where it runs. --- .github/workflows/docker-lint.yml | 6 ++++-- .github/workflows/docker.yml | 11 ++++++++--- .github/workflows/history-check.yml | 3 ++- .github/workflows/infographic-check.yml | 3 ++- .github/workflows/osv-scanner.yml | 3 ++- .github/workflows/review-labels.yml | 3 ++- 6 files changed, 20 insertions(+), 9 deletions(-) diff --git a/.github/workflows/docker-lint.yml b/.github/workflows/docker-lint.yml index fd4e4cae0d5..ae1b32368c9 100644 --- a/.github/workflows/docker-lint.yml +++ b/.github/workflows/docker-lint.yml @@ -23,7 +23,8 @@ concurrency: jobs: hadolint: name: Lint Dockerfile (hadolint) - runs-on: arc-runner-set + # Short gate job: small runner, no dind (see hermes-agent-ci-infra). + runs-on: arc-runner-small timeout-minutes: 5 steps: - name: Checkout code @@ -38,7 +39,8 @@ jobs: shellcheck: name: Lint docker/ shell scripts (shellcheck) - runs-on: arc-runner-set + # Short gate job: small runner, no dind (see hermes-agent-ci-infra). + runs-on: arc-runner-small timeout-minutes: 5 steps: - name: Checkout code diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 50c88bb25d2..2f18ab8da3c 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -49,7 +49,10 @@ jobs: matrix: include: - arch: amd64 - runner: arc-runner-set + # dind lives only on arc-runner-docker now; the general amd64 + # set dropped it so the ~20 workflows that never touch a daemon + # stop paying for a privileged sidecar on every pod. + runner: arc-runner-docker platform: linux/amd64 - arch: arm64 runner: arc-runner-arm64 @@ -197,7 +200,8 @@ jobs: matrix: include: - arch: amd64 - runner: arc-runner-set + # See the build job: dind lives only on arc-runner-docker. + runner: arc-runner-docker platform: linux/amd64 - arch: arm64 runner: arc-runner-arm64 @@ -284,7 +288,8 @@ jobs: # --------------------------------------------------------------------------- merge: if: github.repository == 'NousResearch/hermes-agent' && (github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'release') - runs-on: arc-runner-set + # Needs buildx to assemble the manifest list — see the build job. + runs-on: arc-runner-docker needs: [publish] timeout-minutes: 10 environment: container-publish diff --git a/.github/workflows/history-check.yml b/.github/workflows/history-check.yml index cf513012abe..82ad63e3ee3 100644 --- a/.github/workflows/history-check.yml +++ b/.github/workflows/history-check.yml @@ -25,7 +25,8 @@ permissions: jobs: check-common-ancestor: - runs-on: arc-runner-set + # Short gate job: small runner, no dind (see hermes-agent-ci-infra). + runs-on: arc-runner-small timeout-minutes: 10 outputs: review_status: ${{ steps.merge-base-check.outputs.review_status }} diff --git a/.github/workflows/infographic-check.yml b/.github/workflows/infographic-check.yml index 34974a38ccb..0b715ae9a4d 100644 --- a/.github/workflows/infographic-check.yml +++ b/.github/workflows/infographic-check.yml @@ -28,7 +28,8 @@ permissions: jobs: check-no-committed-infographics: - runs-on: arc-runner-set + # Short gate job: small runner, no dind (see hermes-agent-ci-infra). + runs-on: arc-runner-small timeout-minutes: 10 outputs: review_status: ${{ steps.infographic-check.outputs.review_status }} diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index a78a657c89b..df887fa34d6 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -55,7 +55,8 @@ jobs: emit-status: name: Emit review status - runs-on: arc-runner-set + # Short gate job: small runner, no dind (see hermes-agent-ci-infra). + runs-on: arc-runner-small needs: scan if: always() outputs: diff --git a/.github/workflows/review-labels.yml b/.github/workflows/review-labels.yml index cd8901457d4..90b0b255474 100644 --- a/.github/workflows/review-labels.yml +++ b/.github/workflows/review-labels.yml @@ -51,7 +51,8 @@ jobs: check: name: Review label gate if: inputs.ci_review || inputs.mcp_catalog || inputs.supply_chain - runs-on: arc-runner-set + # Short gate job: small runner, no dind (see hermes-agent-ci-infra). + runs-on: arc-runner-small timeout-minutes: 2 outputs: ci_reviewed: ${{ steps.label-check.outputs.ci_reviewed }}