Secure Qodana PR workflow runner

2026-06-01 23:36:44 +02:00
parent 0a7e58fc01
commit e7481297c8
1 changed files with 5 additions and 5 deletions
@@ -9,12 +9,12 @@ on:

 jobs:
  qodana:
-    # Run on our self-hosted runner to avoid GitHub-hosted Actions budget limits.
-    runs-on: [self-hosted, Linux, X64, default]
+    # Use GitHub-hosted runners for PR scans so untrusted code never runs on persistent internal infrastructure.
+    runs-on: ubuntu-latest
    permissions:
-      contents: write
-      pull-requests: write
-      checks: write
+      contents: read
+      pull-requests: read
+      checks: read
    steps:
      - uses: actions/checkout@v4
        with: