ci: switch from self-hosted to GitHub-hosted runners

Now that the repo is public, GitHub-hosted runners are free and unlimited.

- unit-test and build: ubuntu-latest
- integration-test: macos-latest (needs macOS for UI test patches)
- npm-audit: ubuntu-latest
- trivy: ubuntu-latest with aquasecurity/trivy-action
- gitleaks: ubuntu-latest with gitleaks/gitleaks-action
- links: ubuntu-latest with lycheeverse/lychee-action
- Remove fork PR guards (no longer needed on GitHub-hosted runners)
- Remove private-repo guards on CodeQL, dependency-review, scorecard, FOSSA

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

Author: SebTardif

.github/workflows/ci.yml

@@ -14,12 +14,7 @@ concurrency:
 
 jobs:
   unit-test:
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - patchloom-vscode
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -40,12 +35,7 @@ jobs:
         run: npm test
 
   build:
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - patchloom-vscode
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -69,13 +59,8 @@ jobs:
         run: npm run package
 
   integration-test:
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     needs: [unit-test, build]
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - patchloom-vscode
+    runs-on: macos-latest
     timeout-minutes: 15
     steps:
       - name: Checkout

.github/workflows/fossa.yml

@@ -16,7 +16,6 @@ concurrency:
 jobs:
   fossa:
     name: License compliance
-    if: ${{ !github.event.repository.private }}
     env:
       FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
     runs-on: ubuntu-latest

.github/workflows/links.yml

@@ -24,21 +24,16 @@ concurrency:
 jobs:
   links:
     name: Check links
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - patchloom-vscode
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
-      - name: Install lychee
-        run: brew install lychee 2>/dev/null || true
-
       - name: Run lychee
-        run: lychee --config lychee.toml '**/*.md'
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2
+        with:
+          args: --config lychee.toml '**/*.md'
+          fail: true

.github/workflows/scorecard.yml

@@ -17,7 +17,6 @@ concurrency:
 jobs:
   scorecard:
     name: Scorecard analysis
-    if: ${{ !github.event.repository.private }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:

.github/workflows/security.yml

@@ -18,12 +18,7 @@ concurrency:
 jobs:
   npm-audit:
     name: npm audit
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - patchloom-vscode
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Checkout
@@ -45,12 +40,7 @@ jobs:
 
   trivy:
     name: Trivy vulnerability scan
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - patchloom-vscode
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -68,16 +58,16 @@ jobs:
         run: npm ci
 
       - name: Run Trivy filesystem scan
-        run: trivy fs --scanners vuln,misconfig --severity HIGH,CRITICAL --exit-code 1 .
+        uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
+        with:
+          scan-type: fs
+          scanners: vuln,misconfig
+          severity: HIGH,CRITICAL
+          exit-code: "1"
 
   gitleaks:
     name: Gitleaks secret detection
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    runs-on:
-      - self-hosted
-      - macOS
-      - ARM64
-      - patchloom-vscode
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Checkout
@@ -87,11 +77,12 @@ jobs:
           fetch-depth: 0
 
       - name: Run Gitleaks
-        run: gitleaks detect --source . --verbose
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
+        env:
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
 
   codeql:
     name: CodeQL analysis
-    if: ${{ !github.event.repository.private }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
@@ -115,7 +106,7 @@ jobs:
 
   dependency-review:
     name: Dependency review
-    if: ${{ !github.event.repository.private && github.event_name == 'pull_request' }}
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps: