From 5a3ccd16b86e7da72748bb7ec38b619eadef514a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stefan=20W=C3=A4rting?= <stefan@warting.se>
Date: Tue, 29 Sep 2026 10:18:40 +0200
Subject: [PATCH 1/2] Move legacy Android action workflows to self-hosted
 runners

---
 .github/actionlint.yaml                    |  3 +++
 .github/workflows/build-test.yml           | 27 ++++++++++++----------
 .github/workflows/codeql-analysis.yml      |  3 ++-
 .github/workflows/dependabot-automerge.yml |  2 +-
 .github/workflows/run.yml                  | 10 ++++----
 .github/workflows/update-sdk-versions.yml  |  2 +-
 6 files changed, 27 insertions(+), 20 deletions(-)
 create mode 100644 .github/actionlint.yaml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 00000000..3453c7e2
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - tart
diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index fd084383..3365d69d 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -2,6 +2,7 @@ name: CI
 
 on:
   push:
+    branches: [main]
     paths-ignore:
       - '**.md'
   pull_request:
@@ -14,7 +15,8 @@ concurrency:
 
 jobs:
   checks:
-    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, macOS, ARM64, tart]
     steps:
       - uses: actions/checkout@v4
 
@@ -37,18 +39,19 @@ jobs:
       - run: npm test
 
   runSdkManager:
-    runs-on: ${{ matrix.os }}
-    name: ${{ matrix.os }} - ${{ matrix.cmdline-tools-version }}
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ${{ matrix.platform.runner }}
+    name: ${{ matrix.platform.name }} - ${{ matrix.cmdline-tools-version }}
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - ubuntu-24.04
-          - ubuntu-22.04
-          - macos-15
-          - macos-14
-          - windows-2025
-          - windows-2022
+        platform:
+          - name: macos-arm64
+            runner: [self-hosted, macOS, ARM64, tart]
+          - name: linux-x64
+            runner: [self-hosted, linux, x64]
+          - name: windows-x64
+            runner: [self-hosted, windows, x64]
         cmdline-tools-version:
           - 14742923
           - 13114758
@@ -86,9 +89,9 @@ jobs:
       - run: sdkmanager --list
 
   CI:
-    if: always()
+    if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     needs: [checks, runSdkManager]
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64, tart]
     steps:
       - run: |
           if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index c3b9f224..4032d6d6 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -22,8 +22,9 @@ on:
 
 jobs:
   analyze:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     name: Analyze
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64, tart]
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index be95f5f2..b46dcd43 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -26,7 +26,7 @@ permissions:
 
 jobs:
   dependabot:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64, tart]
     if: ${{ github.actor == 'dependabot[bot]' || github.actor == 'premex-pot[bot]' }}
     steps:
       # Generate an elevated token via the Premex Pot GitHub App.
diff --git a/.github/workflows/run.yml b/.github/workflows/run.yml
index dc430c24..9a65d748 100644
--- a/.github/workflows/run.yml
+++ b/.github/workflows/run.yml
@@ -8,13 +8,13 @@ on:
 
 jobs:
   build:
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.runner }}
     strategy:
       matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-          - macos-latest
+        runner:
+          - [self-hosted, linux, x64]
+          - [self-hosted, windows, x64]
+          - [self-hosted, macOS, ARM64, tart]
 
     # Disabled, because daveol/SampleApplication is missing
     if: ${{ false }}
diff --git a/.github/workflows/update-sdk-versions.yml b/.github/workflows/update-sdk-versions.yml
index 00ef7ff2..c0a15f9b 100644
--- a/.github/workflows/update-sdk-versions.yml
+++ b/.github/workflows/update-sdk-versions.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   update:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64, tart]
     steps:
       - uses: actions/create-github-app-token@v2
         id: app-token

From 577992f8d8d5b3bfa78fbb66d8802bd3bcdad611 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stefan=20W=C3=A4rting?= <stefan@warting.se>
Date: Tue, 29 Sep 2026 10:22:51 +0200
Subject: [PATCH 2/2] Test available platform tools on clean runner images

---
 .github/workflows/build-test.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index 3365d69d..34225c38 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -85,6 +85,8 @@ jobs:
         with:
           cmdline-tools-version: ${{ matrix.cmdline-tools-version }}
           log-accepted-android-sdk-licenses: 'false'
+          # The obsolete tools package is absent on clean self-hosted images.
+          packages: platform-tools
 
       - run: sdkmanager --list