[WRONG BRANCH] ci: keep Windows jobs on hosted runners

[luvs01]

Motivation

• Prevent untrusted pull requests from scheduling PR-controlled code on a maintainer's self-hosted Windows runner by removing the in-workflow selector that could be mutated by a PR head.
• Preserve Windows verification and operational stability while enforcing that Windows shards run only when explicitly dispatched by trusted events.

Description

• Remove the select-windows-runner job and all logic that emitted self-hosted runner labels from .github/workflows/ci.yml.
• Pin the Windows shards (platform-windows) to runs-on: windows-latest and remove the dependency on selector outputs.
• Drop the self-hosted-only cleanup and related if: runner.environment == 'self-hosted' steps that were tied to the mutable selector.
• Update the aggregate ci job needs list and small workflow comment/text cleanups to match the removed job and preserve other platform/job behavior.

Testing

• Parsed the workflow YAML successfully with ruby -e "require 'yaml'; YAML.load_file('.github/workflows/ci.yml', aliases: true)".
• Confirmed no remaining selector artifacts with rg -n 'self-hosted|ocx-home|select-windows-runner|OCX_SELF_HOSTED_WINDOWS' .github/workflows/ci.yml.
• Ran the repository prepush steps via bun run prepush; bun x tsc --noEmit and GUI lint passed, but the full test suite exhibited unrelated existing failures and timeouts (for example: OAuth live-update, API-key attribution, provider outbound GET/proxy, and several Grok discovery tests), so the long-running suite was not fully green.
• Static checks (git diff --check, YAML parse, and the grep above) succeeded for the workflow remediation.

---

Codex Task

Summary by CodeRabbit

• Chores
  • Updated automated build and validation workflows for improved reliability across supported environments.
  • Simplified Windows validation by using a consistent hosted environment.
  • Refined runner setup, workspace cleanup, and credential-handling practices.
  • Preserved coverage for npm-global testing and disposable keyring scenarios.
  • No user-facing product functionality or behavior changes.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev. UI screenshot required.

What to do

• Retarget this PR to dev — all contributions go to dev.
• Add a screenshot of the UI change to the PR description.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

📝 Walkthrough

Walkthrough

The CI workflow removes self-hosted Windows runner selection, runs Windows jobs on windows-latest, removes runner cleanup and reporting, updates disposable-runner guidance, and removes the obsolete selection job from the aggregate CI gate.

Changes

CI runner policy

Layer / File(s)	Summary
Hosted Windows execution .github/workflows/ci.yml	The workflow removes self-hosted Windows routing. The Windows job runs directly on windows-latest, retains manual-dispatch gating, and removes runner reporting and workspace cleanup. Checkout and hosted-runner comments now describe disposable workspaces. Keyring and npm-global checks retain hosted-runner requirements.
Aggregate CI gate wiring .github/workflows/ci.yml	The aggregate CI gate removes select-windows-runner from its dependencies while retaining the actual producer jobs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: lidge-jun, wibias, ingwannu

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: keeping Windows CI jobs on GitHub-hosted runners.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-self-hosted-runner-gate-vulnerability

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/ci.yml (1)

320-336: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Update the CI workflow contract test.

tests/ci-workflows.test.ts:63-202 still requires select-windows-runner to have a two-minute timeout. It also requires a Windows step that runs git clean -xffd on a self-hosted runner.

This workflow removes both behaviors. The test will fail when it reads undefined for the removed job and finds no cleanup step.

Remove the obsolete assertions. Add an assertion that platform-windows.runs-on is windows-latest. Add an assertion that the Windows job has no self-hosted cleanup condition.

Proposed test update

- expect(ci.jobs?.["select-windows-runner"]?.["timeout-minutes"]).toBe(2);
+ expect(ci.jobs?.["platform-windows"]?.["runs-on"]).toBe("windows-latest");

- expect(winSteps.some(step => step.if === "runner.environment == 'self-hosted'"
-   && step.run?.includes("git clean -xffd"))).toBe(true);
+ expect(winSteps.some(step => step.if === "runner.environment == 'self-hosted'"
+   || step.run?.includes("git clean -xffd"))).toBe(false);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 320 - 336, Update the CI workflow
contract test in tests/ci-workflows.test.ts to remove assertions for the deleted
select-windows-runner timeout and self-hosted git clean step. Add assertions
verifying platform-windows.runs-on is windows-latest and that its Windows job
contains no self-hosted cleanup condition.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 320-336: Update the CI workflow contract test in
tests/ci-workflows.test.ts to remove assertions for the deleted
select-windows-runner timeout and self-hosted git clean step. Add assertions
verifying platform-windows.runs-on is windows-latest and that its Windows job
contains no self-hosted cleanup condition.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3945466e-d26b-46eb-99dc-e1c2693053f8

📥 Commits

Reviewing files that changed from the base of the PR and between 2468502 and 41bce86.

📒 Files selected for processing (1)

• .github/workflows/ci.yml