From e7481297c8623a434860150948648a3df47464f3 Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 23:36:44 +0200
Subject: [PATCH] Secure Qodana PR workflow runner

---
 .github/workflows/code_quality.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/code_quality.yml b/.github/workflows/code_quality.yml
index 27d10dea..4f758870 100644
--- a/.github/workflows/code_quality.yml
+++ b/.github/workflows/code_quality.yml
@@ -9,12 +9,12 @@ on:
 
 jobs:
   qodana:
-    # Run on our self-hosted runner to avoid GitHub-hosted Actions budget limits.
-    runs-on: [self-hosted, Linux, X64, default]
+    # Use GitHub-hosted runners for PR scans so untrusted code never runs on persistent internal infrastructure.
+    runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
-      checks: write
+      contents: read
+      pull-requests: read
+      checks: read
     steps:
       - uses: actions/checkout@v4
         with: