package-ci and gitleaks: CI_POOL=on pools them over every free runner, the Oracle arm64 one included

.github/workflows/gitleaks.yml

@@ -7,9 +7,10 @@
 #       uses: SoulCraft-Org/.github/.github/workflows/gitleaks.yml@main
 #
 # A false positive goes in the repository's .gitleaksignore (one finding fingerprint per line, printed in the log).
-# gitleaks is its release tarball, checked against the SHA-256 the release publishes before it runs. Dependabot cannot
-# move it: on a new gitleaks release, set VERSION and SHA256 (the linux_x64 line of gitleaks_<VERSION>_checksums.txt at
-# https://github.com/gitleaks/gitleaks/releases) and the pre-commit rev in each repository's .pre-commit-config.yaml.
+# gitleaks is its release tarball for the runner's architecture, checked against the SHA-256 the release publishes before
+# it runs. Dependabot cannot move it: on a new gitleaks release, set VERSION, SHA256_X64 and SHA256_ARM64 (the linux_x64
+# and linux_arm64 lines of gitleaks_<VERSION>_checksums.txt at https://github.com/gitleaks/gitleaks/releases) and the
+# pre-commit rev in each repository's .pre-commit-config.yaml.
 name: gitleaks
 
 on:
@@ -24,12 +25,14 @@ permissions:
 
 jobs:
   gitleaks:
-    # CI_RUNNER: see package-ci.yml (private repositories only; public ones never see it and stay on GitHub's runners)
-    runs-on: ${{ vars.CI_RUNNER == 'hf' && 'soulcraft-hf' || 'ubuntu-24.04' }}
+    # CI_RUNNER and CI_POOL: see package-ci.yml (private repositories only; public ones never see them and stay on
+    # GitHub's runners). Proven on linux-arm64 and x64 alike (gitleaks 8.30.1, both tarballs, 2026-10-16).
+    runs-on: ${{ vars.CI_RUNNER == 'hf' && (vars.CI_POOL == 'on' && 'soulcraft-free' || 'soulcraft-hf') || 'ubuntu-24.04' }}
     timeout-minutes: 15
     env:
       VERSION: 8.30.1
-      SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+      SHA256_X64: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+      SHA256_ARM64: e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -38,9 +41,14 @@ jobs:
 
       - name: gitleaks ${{ env.VERSION }} (checksum verified)
         run: |
+          case "$RUNNER_ARCH" in
+            X64)   arch=x64;   sum="$SHA256_X64" ;;
+            ARM64) arch=arm64; sum="$SHA256_ARM64" ;;
+            *) echo "::error::no gitleaks tarball pinned for $RUNNER_ARCH"; exit 1 ;;
+          esac
           curl -fsSL -o "$RUNNER_TEMP/gitleaks.tgz" \
-            "https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_linux_x64.tar.gz"
-          echo "$SHA256  $RUNNER_TEMP/gitleaks.tgz" | sha256sum -c -
+            "https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_linux_$arch.tar.gz"
+          echo "$sum  $RUNNER_TEMP/gitleaks.tgz" | sha256sum -c -
           tar -xzf "$RUNNER_TEMP/gitleaks.tgz" -C "$RUNNER_TEMP" gitleaks
 
       - name: no secret anywhere in the history

.github/workflows/package-ci.yml

@@ -43,9 +43,11 @@ permissions:
 jobs:
   verify:
     # CI_RUNNER (organization variable, private repositories only): "hf" while GitHub-hosted minutes are out; the job then
-    # runs on SoulCraft-Org's self-hosted runner on a free Hugging Face Space (runner group hf-free, label soulcraft-hf;
-    # workspace ci/hf-runner/). Unset or "github": GitHub's ubuntu-24.04.
-    runs-on: ${{ vars.CI_RUNNER == 'hf' && 'soulcraft-hf' || 'ubuntu-24.04' }}
+    # runs on SoulCraft-Org's self-hosted runners (runner group hf-free). Unset or "github": GitHub's ubuntu-24.04.
+    # Self-hosted, CI_POOL picks which: "on" = label soulcraft-free, any free runner, the never-sleeping linux-arm64 one on
+    # Oracle Cloud included (this gate is proven on arm64; workspace ci/oracle-runner/); unset = label soulcraft-hf, the
+    # Hugging Face Spaces (x64, workspace ci/hf-runner/).
+    runs-on: ${{ vars.CI_RUNNER == 'hf' && (vars.CI_POOL == 'on' && 'soulcraft-free' || 'soulcraft-hf') || 'ubuntu-24.04' }}
     timeout-minutes: 90
     env:
       NAME: ${{ github.event.repository.name }}
@@ -79,10 +81,12 @@ jobs:
           echo "COMFY_BASE=$GITHUB_WORKSPACE/ComfyUI-Base" >> "$GITHUB_ENV"
           echo "BASE_WORKSPACE=$GITHUB_WORKSPACE" >> "$GITHUB_ENV"
 
-      # base_test reaches pytest through `uv run --no-project --python <newest> --with pytest`
+      # base_test reaches pytest through `uv run --no-project --python <newest> --with pytest`. The Oracle runners keep
+      # their uv cache on disk between jobs (UV_CACHE_DIR, workspace ci/oracle-runner/): the GitHub cache would only
+      # download it again and upload it whole, so they skip it.
       - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
-          enable-cache: true
+          enable-cache: ${{ !startsWith(runner.name, 'soulcraft-oracle') }}
 
       # The live App-view tier drives the real frontend through _build/appview.py, a uv script that pins its own
       # playwright; the browser build has to match that pin, so it is installed per pinned version (none: no-op).