From 53f570277af068af6c71373653367c37116c481a Mon Sep 17 00:00:00 2001
From: Alma Tuck <alma.tuck@gmail.com>
Date: Mon, 5 Oct 2026 19:49:29 -0600
Subject: [PATCH 1/3] CI: no GitHub-hosted runners

The Main workflow runs on the stadium Linux runners, and the
no-hosted-runners guard fails a PR that names a GitHub-hosted label. Fork
PRs do not run on our machines.
---
 .github/workflows/main.yml              |  5 +++-
 .github/workflows/no-hosted-runners.yml | 36 +++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/no-hosted-runners.yml

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 08ceec9..c52cd8b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -13,7 +13,10 @@ env:
 jobs:
   main:
     name: Main Process
-    runs-on: ubuntu-latest
+    # Our runners only (the org's GitHub Actions budget is capped). A fork's
+    # PR never runs on our machines.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, Linux, ARM64, neboloop]
 
     steps:
       - name: Set up Go ${{ env.GO_VERSION }}
diff --git a/.github/workflows/no-hosted-runners.yml b/.github/workflows/no-hosted-runners.yml
new file mode 100644
index 0000000..576871b
--- /dev/null
+++ b/.github/workflows/no-hosted-runners.yml
@@ -0,0 +1,36 @@
+name: No GitHub-hosted runners
+
+# Every NeboLoop workflow runs on our own machines (the stadium Mac mini's
+# runners, the house Windows box, or a per-run DigitalOcean droplet): the
+# org's GitHub Actions budget is capped. Fails a PR whose workflows name a
+# GitHub-hosted label (ubuntu-*, macos-*, windows-*). The same check as
+# NeboLoop/stadium-runners' reusable no-hosted-runners.yml, inlined because a
+# public repo cannot call a workflow in a private one. Only .github/ is checked
+# out and nothing from the PR is executed.
+on:
+  pull_request:
+    paths: [".github/**"]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: [self-hosted, Linux, ARM64, neboloop-orch]
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: .github
+      - name: Workflows use our runners only
+        run: |
+          shopt -s nullglob
+          bad=$(for f in .github/workflows/*.yml .github/workflows/*.yaml; do
+            sed 's/#.*//' "$f" | grep -nE '\b(ubuntu|macos|windows)-(latest|slim|[0-9])' | sed "s|^|$f:|"
+          done)
+          if [ -n "$bad" ]; then
+            echo "::error::GitHub-hosted runners are not used in NeboLoop. Use [self-hosted, Linux, ARM64, neboloop] (light), neboloop-orch (orchestration), stadium-mac, stadium-win, or a per-run droplet."
+            echo "$bad"
+            exit 1
+          fi
+          echo "no GitHub-hosted runner labels"

From 158c984ea566b5e88fdc3c54034dae8658ef019e Mon Sep 17 00:00:00 2001
From: Alma Tuck <alma.tuck@gmail.com>
Date: Mon, 5 Oct 2026 20:00:08 -0600
Subject: [PATCH 2/3] CI: actions/cache v2 is shut down; cache v4, checkout v4,
 setup-go v5

---
 .github/workflows/main.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c52cd8b..b09991b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -20,17 +20,17 @@ jobs:
 
     steps:
       - name: Set up Go ${{ env.GO_VERSION }}
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Cache Go modules
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}

From 364875911238116b8385e376df5521c07d945422 Mon Sep 17 00:00:00 2001
From: Alma Tuck <alma.tuck@gmail.com>
Date: Mon, 5 Oct 2026 20:07:31 -0600
Subject: [PATCH 3/3] CI: Go 1.20, the version go.mod names

---
 .github/workflows/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b09991b..5a5dafa 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
 
 env:
-  GO_VERSION: 1.17
+  GO_VERSION: "1.20"
   GOLANGCI_LINT_VERSION: v1.43.0
 
 jobs: