ci: consolidate runner selection

Author: rjaegers

.github/workflows/continuous-integration.yml

@@ -14,7 +14,7 @@ permissions: {}
 
 jobs:
   build-push-test:
-    name: 🛠️ Build → Push → Test (🍨 ${{ matrix.flavor }})
+    name: Build → Push → Test (🍨 ${{ matrix.flavor }})
     strategy:
       matrix:
         flavor: [cpp, rust]

.github/workflows/wc-build-push-test.yml

@@ -22,23 +22,19 @@ on:
         type: string
         default: "ghcr.io"
       build-test-runner-labels:
-        description: >-
-          JSON object passed to fromJson to become the build matrix. Example:
-          '["ubuntu-latest", "ubuntu-24.04-arm"]'
+        description: 'JSON array used for build matrix (e.g. ["ubuntu-latest", "ubuntu-24.04-arm"]). Must be valid JSON.'
         required: false
         type: string
         default: '["ubuntu-latest", "ubuntu-24.04-arm"]'
       runner-labels:
         description: >-
-          Single runner label OR JSON array of runner labels for non-build jobs.
+          JSON array of runner labels for non-build jobs.
           Examples:
-            ubuntu-latest
             '["ubuntu-latest"]'
             '["self-hosted", "linux", "x86_64"]'
-          Provide a valid JSON array (starting with '[') to use multiple labels; any other value is treated as a single label string.
         required: false
         type: string
-        default: ubuntu-latest
+        default: '["ubuntu-latest"]'
       integration-test-file:
         description: "Path to the BATS test file to run for integration tests"
         required: false
@@ -96,7 +92,7 @@ jobs:
     if: ${{ inputs.integration-test-file }}
     strategy:
       matrix:
-        runner: ${{ (startsWith(inputs.build-test-runner-labels, '[') && endsWith(inputs.build-test-runner-labels, ']')) && fromJson(inputs.build-test-runner-labels) || inputs.build-test-runner-labels }}
+        runner: ${{ fromJson(inputs.build-test-runner-labels) }}
     needs: build-push
     uses: ./.github/workflows/wc-integration-test.yml
     permissions:

.github/workflows/wc-build-push.yml

@@ -57,10 +57,10 @@ jobs:
       runner-labels: ${{ inputs.runner-labels }}
 
   build-push:
-    name: ${{ matrix.runner }}
+    name: Build (${{ matrix.runner }})
     strategy:
       matrix:
-        runner: ${{ (startsWith(inputs.build-test-runner-labels, '[') && endsWith(inputs.build-test-runner-labels, ']')) && fromJson(inputs.build-test-runner-labels) || inputs.build-test-runner-labels }}
+        runner: ${{ fromJson(inputs.build-test-runner-labels) }}
     runs-on: ${{ matrix.runner }}
     needs: sanitize-image-name
     permissions:
@@ -137,9 +137,7 @@ jobs:
 
   merge-image:
     name: 🔗 Merge Image
-    # Support either a plain single label (e.g. ubuntu-latest) OR a JSON array of labels.
-    # If the input starts & ends with brackets we attempt JSON parsing; otherwise we pass the raw string.
-    runs-on: ${{ (startsWith(inputs.runner-labels, '[') && endsWith(inputs.runner-labels, ']')) && fromJson(inputs.runner-labels) || inputs.runner-labels }}
+    runs-on: ${{ fromJson(inputs.runner-labels) }}
     needs:
       - build-push
       - sanitize-image-name
@@ -159,9 +157,6 @@ jobs:
         with:
           disable-sudo: true
           egress-policy: audit
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
       - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           path: ${{ runner.temp }}/digests

.github/workflows/wc-dependency-review.yml

@@ -5,17 +5,17 @@ on:
   workflow_call:
     inputs:
       runner-labels:
-        description: "Runner to use for the job, will be passed to `runs-on`"
+        description: "JSON array of runner labels (default [\"ubuntu-latest\"]). Must be valid JSON."
         required: false
         type: string
-        default: ubuntu-latest
+        default: '["ubuntu-latest"]'
 
 permissions: {}
 
 jobs:
   dependency-review:
     name: Review
-    runs-on: ${{ (startsWith(inputs.runner-labels, '[') && endsWith(inputs.runner-labels, ']')) && fromJson(inputs.runner-labels) || inputs.runner-labels }}
+    runs-on: ${{ fromJson(inputs.runner-labels) }}
     permissions:
       contents: read
       pull-requests: write

.github/workflows/wc-integration-test.yml

@@ -17,7 +17,6 @@ on:
         required: true
         type: string
       runner-labels:
-        description: "Runner to use for the job, will be passed to `runs-on`"
         required: true
         type: string
       registry:
@@ -36,7 +35,7 @@ permissions: {}
 jobs:
   run-test:
     name: 🧪 Integration Test
-    runs-on: ${{ (startsWith(inputs.runner-labels, '[') && endsWith(inputs.runner-labels, ']')) && fromJson(inputs.runner-labels) || inputs.runner-labels }}
+    runs-on: ${{ fromJson(inputs.runner-labels) }}
     container:
       image: ${{ inputs.fully-qualified-image-name }}@${{ inputs.image-digest }}
       credentials:

.github/workflows/wc-sanitize-image-name.yml

@@ -29,7 +29,7 @@ permissions: {}
 jobs:
   sanitize:
     name: Sanitize Image Name
-    runs-on: ${{ (startsWith(inputs.runner-labels, '[') && endsWith(inputs.runner-labels, ']')) && fromJson(inputs.runner-labels) || inputs.runner-labels }}
+    runs-on: ${{ fromJson(inputs.runner-labels) }}
     outputs:
       image-basename: ${{ steps.sanitize-image-name.outputs.sanitized-basename }}
       image-name: ${{ steps.sanitize-image-name.outputs.sanitized-image-name }}