From 632d3049392234a793783b44ed2ac3f6155704e7 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Wed, 8 Jul 2026 17:45:32 -0300
Subject: [PATCH] ci(quality): route the 3 heavy fast-path jobs to the
 self-hosted VPS pool when USE_VPS_RUNNER is on (#6691)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extends the same dynamic-runner gate ci.yml already uses (build/test-unit/test-vitest)
to quality.yml's fast-gates/fast-vitest/fast-unit — the ~9min-on-ubuntu jobs that run on
every PR→release/**. Inert until USE_VPS_RUNNER flips to true (falls back to ubuntu-latest
when the var is unset/false OR the PR is a fork — own-origin branches only, never the LAN
runner for fork code). lint-guard/merge-integrity stay on ubuntu-latest (trivial; keeps VPS
concurrency low). No behavior change today.
---
 .github/workflows/quality.yml | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index f5c0aa9967..d1e765cb79 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -23,7 +23,11 @@ env:
 jobs:
   fast-gates:
     name: Fast Quality Gates
-    runs-on: ubuntu-latest
+    # Dynamic runner (same rule as ci.yml): use the self-hosted VPS pool only when the
+    # release captain has USE_VPS_RUNNER=true AND this is not a fork PR (own-origin
+    # branches only — a fork PR must never execute on the LAN runner). Var unset/false
+    # or a fork PR falls back to ubuntu-latest, so this is inert until the flag flips.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     # tsx gates (known-symbols, route-guard-membership) import modules that open
     # SQLite on load; provide DB env so a fresh CI DB initializes cleanly.
     env:
@@ -108,7 +112,8 @@ jobs:
 
   fast-vitest:
     name: Vitest (fast-path)
-    runs-on: ubuntu-latest
+    # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     env:
       JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-lint-api-key-secret-long
@@ -126,7 +131,10 @@ jobs:
 
   fast-unit:
     name: Unit Tests fast-path (${{ matrix.shard }}/2)
-    runs-on: ubuntu-latest
+    # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
+    # This is the heaviest fast-path job (~9min on ubuntu-latest); the 32-core VPS
+    # cuts it to ~2-3min when the flag is on.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     strategy:
       fail-fast: false
       matrix: