jamesnetherton opened a new pull request, #9149: URL: https://github.com/apache/camel-quarkus/pull/9149
Similar to apache/camel@b117561 ([Use ubuntu-slim for small GitHub Actions](https://github.com/apache/camel/commit/b11756115741463dcf4ae0ea7b8e3675b3daa1ff)). Runner availability for Apache projects is often exhausted, so this switches some short-lived workflows to the 1 vCPU `ubuntu-slim` runner. `ubuntu-slim` jobs are limited to 15 minutes of execution time, and each job here completes well within that. | Workflow | Typical run time | Max run time | Change | |---|---|---|---| | `label-issue.yaml` | ~15s | 19s | Runner only | | `assign-issue-milestone.yaml` | ~4s | 6s | Runner only | | `assign-wontfix-issue-milestone.yaml` | ~5s | 7s | Runner only | | `pr-doc-validation.yml` | ~80s | 93s | Runner, plus a yarn install step | | `synchronize-dependabot-branch.yaml` (`update` job) | ~24s | 44s | Runner, plus `RUNNER_TEMP` paths | | `synchronize-dependabot-branch.yaml` (`rerun-pr-workflow` job) | ~4s | 6s | Runner only | Run times are job execution times on `ubuntu-latest` (excluding time spent queued for a runner), taken from recent successful runs. ### Notes - `ubuntu-slim` does not provide yarn, so `pr-doc-validation.yml` installs Yarn 1.22.22, the same version that `ubuntu-latest` provides. - `synchronize-dependabot-branch.yaml` previously hard coded `/home/runner/work` paths. It now uses the `RUNNER_TEMP` environment variable, and fails if it is not set. ### Testing Because `synchronize-dependabot-branch.yaml` has `contents: write` and processes an artifact from an unprivileged PR run, the old and new versions of its steps were tested against crafted artifact zips (path traversal, absolute paths & symlinks) on Ubuntu 24.04 with the same `unzip` version as `ubuntu-slim`. Both behaved identically and nothing was written outside of the extraction directory. [zizmor](https://docs.zizmor.sh/) reports the same findings before and after the change. `pr-doc-validation.yml` only runs for `.adoc` changes. The label, milestone and dependabot workflows only run after merge. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
