From ef380d2874a4846c7b272ff596b89db7c210c08c Mon Sep 17 00:00:00 2001
From: sidj-thr <siddharth.jain@tether.io>
Date: Tue, 16 Jun 2026 14:13:43 +0530
Subject: [PATCH 01/13] infra[notask]: add qvac-ci pending-approval workflow
 and CODEOWNERS

---
 .github/CODEOWNERS                           |  1 +
 .github/workflows/check-pending-approval.yml | 47 ++++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 .github/CODEOWNERS
 create mode 100644 .github/workflows/check-pending-approval.yml

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000000..86ec9227ce
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1 @@
+* @tetherto/qvac-internal-merge @tetherto/qvac-internal-mgmt
diff --git a/.github/workflows/check-pending-approval.yml b/.github/workflows/check-pending-approval.yml
new file mode 100644
index 0000000000..b19b53d242
--- /dev/null
+++ b/.github/workflows/check-pending-approval.yml
@@ -0,0 +1,47 @@
+name: Check Approvals
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, labeled, synchronize]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  check-approvals:
+    name: Check Approvals
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    if: >-
+      (
+        github.event_name == 'issue_comment' &&
+        github.event.comment.body == 'pending_reviews' &&
+        github.event.issue.pull_request != null
+      ) || (
+        github.event_name == 'pull_request_target' &&
+        github.event.action == 'opened'
+      ) || (
+        github.event_name == 'pull_request_target' &&
+        (github.event.action == 'labeled' || github.event.action == 'synchronize') &&
+        contains(github.event.pull_request.labels.*.name, 'verified')
+      )
+    steps:
+      - name: Install @qvac/ci
+        run: npm install -g @qvac/ci@0.1.0
+
+      - name: Check Approvals
+        continue-on-error: true
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_APP_ID: ${{ secrets.APP_ID }}
+          GITHUB_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
+        run: |
+          qvac-ci pending-approvals \
+            --pr-number "${{ github.event.pull_request.number || github.event.issue.number }}" \
+            --maintainers-team 'qvac-internal-mgmt' \
+            --team-leads-team 'qvac-internal-merge' \
+            --min-approvals '2'

From b16e2baab5eb92783b558f6caedca669cd7d4c17 Mon Sep 17 00:00:00 2001
From: sidj-thr <siddharth.jain@tether.io>
Date: Tue, 16 Jun 2026 15:59:35 +0530
Subject: [PATCH 02/13] infra[notask]: rename workflow file to
 check-approvals.yml

---
 .../workflows/{check-pending-approval.yml => check-approvals.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename .github/workflows/{check-pending-approval.yml => check-approvals.yml} (100%)

diff --git a/.github/workflows/check-pending-approval.yml b/.github/workflows/check-approvals.yml
similarity index 100%
rename from .github/workflows/check-pending-approval.yml
rename to .github/workflows/check-approvals.yml

From f7b8d2c5e4244998861e8bc1f8f934d71b49f6ea Mon Sep 17 00:00:00 2001
From: sidj-thr <siddharth.jain@tether.io>
Date: Tue, 16 Jun 2026 19:04:03 +0530
Subject: [PATCH 03/13] chore(ci): remove labeled trigger and verified label
 condition

Remove the `labeled` trigger type from pull_request_target and the
associated `verified` label guard from the if condition. The check
now fires on opened and synchronize only, without requiring a label.
---
 .github/workflows/check-approvals.yml | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/check-approvals.yml b/.github/workflows/check-approvals.yml
index b19b53d242..0077a9745a 100644
--- a/.github/workflows/check-approvals.yml
+++ b/.github/workflows/check-approvals.yml
@@ -4,7 +4,7 @@ on:
   issue_comment:
     types: [created]
   pull_request_target:
-    types: [opened, labeled, synchronize]
+    types: [opened, synchronize]
 
 permissions:
   contents: read
@@ -23,11 +23,7 @@ jobs:
         github.event.issue.pull_request != null
       ) || (
         github.event_name == 'pull_request_target' &&
-        github.event.action == 'opened'
-      ) || (
-        github.event_name == 'pull_request_target' &&
-        (github.event.action == 'labeled' || github.event.action == 'synchronize') &&
-        contains(github.event.pull_request.labels.*.name, 'verified')
+        (github.event.action == 'opened' || github.event.action == 'synchronize')
       )
     steps:
       - name: Install @qvac/ci

From 1cb653b99d1ed7d84fc6cc0f701e1226865f3fff Mon Sep 17 00:00:00 2001
From: sidj-thr <siddharth.jain@tether.io>
Date: Wed, 17 Jun 2026 13:18:12 +0530
Subject: [PATCH 04/13] chore(ci): restrict check-approvals trigger to main and
 master branches

---
 .github/workflows/check-approvals.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/check-approvals.yml b/.github/workflows/check-approvals.yml
index 0077a9745a..913f17aec0 100644
--- a/.github/workflows/check-approvals.yml
+++ b/.github/workflows/check-approvals.yml
@@ -5,6 +5,7 @@ on:
     types: [created]
   pull_request_target:
     types: [opened, synchronize]
+    branches: [main, master]
 
 permissions:
   contents: read

From 088ff4332e50c5b957cd4f45d9083342c5f83ad6 Mon Sep 17 00:00:00 2001
From: sidj-thr <siddharth.jain@tether.io>
Date: Tue, 23 Jun 2026 18:55:40 +0530
Subject: [PATCH 05/13] infra[notask]: add concurrency, timeout, and fix
 issue-comment trigger in check-approvals (#15)

---
 .github/workflows/check-approvals.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/check-approvals.yml b/.github/workflows/check-approvals.yml
index 913f17aec0..a55ddc1618 100644
--- a/.github/workflows/check-approvals.yml
+++ b/.github/workflows/check-approvals.yml
@@ -12,15 +12,20 @@ permissions:
   pull-requests: write
   issues: write
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
+  cancel-in-progress: false
+
 jobs:
   check-approvals:
     name: Check Approvals
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     continue-on-error: true
     if: >-
       (
         github.event_name == 'issue_comment' &&
-        github.event.comment.body == 'pending_reviews' &&
+        contains(github.event.comment.body, 'review') &&
         github.event.issue.pull_request != null
       ) || (
         github.event_name == 'pull_request_target' &&

From 5e27830fbd26913533e9a45843b48f80cc559eeb Mon Sep 17 00:00:00 2001
From: sidj-thr <siddharth.jain@tether.io>
Date: Thu, 25 Jun 2026 18:11:54 +0530
Subject: [PATCH 06/13] QVAC-21374 chore: bump @qvac/ci to 0.2.0 (#16)

---
 .github/workflows/check-approvals.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/check-approvals.yml b/.github/workflows/check-approvals.yml
index a55ddc1618..c093d4f47e 100644
--- a/.github/workflows/check-approvals.yml
+++ b/.github/workflows/check-approvals.yml
@@ -33,7 +33,7 @@ jobs:
       )
     steps:
       - name: Install @qvac/ci
-        run: npm install -g @qvac/ci@0.1.0
+        run: npm install -g @qvac/ci@0.2.0
 
       - name: Check Approvals
         continue-on-error: true

From 705b7a4233c262e8367d469eb54b6fd41c4b2215 Mon Sep 17 00:00:00 2001
From: GSServita <giacomo.sorbi@servita.com>
Date: Tue, 7 Jul 2026 12:09:33 +0100
Subject: [PATCH 07/13] QVAC-21550 infra: roll out canonical security baseline
 (TruffleHog + CodeQL) to qvac-ext-stable-diffusion.cpp (#17)

* QVAC-21550 infra: add canonical security baseline caller (TruffleHog + CodeQL)

* QVAC-21550 fix: drop paths-exclude (unsupported by reusable security v0)

* QVAC-21550 fix: buildless CodeQL (codeql-build-mode: none) via qvac-actions#10

* QVAC-21550 fix: drop secrets: inherit (baseline needs no repo secrets; github.token suffices)

* QVAC-21550 fix: repin security baseline to qvac-actions 0.2.0 (buildless c-cpp)
---
 .github/workflows/security-baseline.yml | 49 +++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 .github/workflows/security-baseline.yml

diff --git a/.github/workflows/security-baseline.yml b/.github/workflows/security-baseline.yml
new file mode 100644
index 0000000000..4b78950191
--- /dev/null
+++ b/.github/workflows/security-baseline.yml
@@ -0,0 +1,49 @@
+name: Security baseline
+
+# Canonical security baseline (TruffleHog secret scan + CodeQL static analysis)
+# rolled out to Tier-1 repos per QVAC-21550. This is a thin caller that
+# delegates to the org's reusable workflow (authored under QVAC-19055); its
+# inputs and behavior are documented in
+# tetherto/qvac-actions/docs/security-baseline.md.
+#
+# Uses plain `pull_request` (never `pull_request_target`): fork PRs run with a
+# read-only token and no secrets, and this baseline needs none of the
+# privileged context (`codeql-upload: never` below), so the "pwn request"
+# surface of `pull_request_target` buys nothing here.
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  baseline:
+    # Pinned to the qvac-actions 0.2.0 release commit (immutable SHA + version
+    # comment, per the org freeze-and-pin convention).
+    uses: tetherto/qvac-actions/.github/workflows/public-reusable-security.yml@be1d22629cc48b6dcc36645acc9e6d89cfaf54d8 # 0.2.0
+    permissions:
+      contents: read
+      security-events: write
+      pull-requests: write
+      actions: read
+    with:
+      # C/C++ fork: set languages explicitly (CodeQL autodetect misses C/C++).
+      languages: c-cpp
+      severity-threshold: high
+      # These repos use GitHub "Default setup" for code scanning, which rejects
+      # SARIF from advanced workflows. Skip the upload; the severity gate and
+      # TruffleHog still run (SARIF is written locally for the gate to read).
+      codeql-upload: never
+      # Buildless C/C++ extraction (no compilation / submodule checkout).
+      # Uniform across every Tier-1 C/C++ caller and robust vs autobuild on
+      # native/submodule projects. Requires qvac-actions >= 0.2.0.
+      codeql-build-mode: none

From e417a9ead43ca86d6e8822670ace0629bf9ff88f Mon Sep 17 00:00:00 2001
From: GSServita <giacomo.sorbi@servita.com>
Date: Thu, 30 Jul 2026 13:14:23 +0100
Subject: [PATCH 08/13] QVAC-22747 infra: add weekly schedule to CodeScan
 caller (#23)

The canonical CodeScan baseline currently runs on push/PR only, so the
QVAC-19056 commitment to a weekly scan is unmet. Add a scheduled cron
(staggered per repo across the fleet) alongside the existing
push / pull_request / workflow_dispatch triggers. No other change.
---
 .github/workflows/security-baseline.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/security-baseline.yml b/.github/workflows/security-baseline.yml
index 4b78950191..335bb805c7 100644
--- a/.github/workflows/security-baseline.yml
+++ b/.github/workflows/security-baseline.yml
@@ -16,6 +16,9 @@ on:
     branches:
       - master
   pull_request:
+  schedule:
+    # Weekly full scan (QVAC-19056 rollout). Staggered per repo across weekdays.
+    - cron: "0 7 * * 0"
   workflow_dispatch:
 
 permissions:

From 48361f9f1fd21e2d595f7b683d64189aa17d772a Mon Sep 17 00:00:00 2001
From: GSServita <giacomo.sorbi@servita.com>
Date: Fri, 31 Jul 2026 12:00:10 +0100
Subject: [PATCH 09/13] QVAC-22740 infra: bump CodeScan caller to qvac-actions
 0.3.0 (#26)

Bump the reusable security workflow pin 0.2.0 -> 0.3.0 (SHA bbb0740e). 0.3.0
adds the findings-export artifact (export-report default on), so each run now
publishes a downloadable security-scan-report (findings.json/md + SARIF).
---
 .github/workflows/security-baseline.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/security-baseline.yml b/.github/workflows/security-baseline.yml
index 335bb805c7..aa5c8a96f4 100644
--- a/.github/workflows/security-baseline.yml
+++ b/.github/workflows/security-baseline.yml
@@ -32,7 +32,7 @@ jobs:
   baseline:
     # Pinned to the qvac-actions 0.2.0 release commit (immutable SHA + version
     # comment, per the org freeze-and-pin convention).
-    uses: tetherto/qvac-actions/.github/workflows/public-reusable-security.yml@be1d22629cc48b6dcc36645acc9e6d89cfaf54d8 # 0.2.0
+    uses: tetherto/qvac-actions/.github/workflows/public-reusable-security.yml@bbb0740e2a16b94371c7439e0e06945c5b68e759 # 0.3.0
     permissions:
       contents: read
       security-events: write

From 88c1e8b7466cb85b41f7ab52bc9b52853f072b7f Mon Sep 17 00:00:00 2001
From: GSServita <giacomo.sorbi@servita.com>
Date: Fri, 4 Sep 2026 09:59:06 +0100
Subject: [PATCH 10/13] QVAC-14347 infra: centralize CI runner labels in a
 shared catalog (#36)

Add .github/runners.yaml as the single source of truth for specialized CI runner labels, a generated reusable-runner-names workflow that exports them as job outputs, and sync/validate scripts with unit tests. Wire build.yml's Windows jobs to consume the output instead of hardcoding windows-2022. Rolling -latest aliases and matrix.os identities stay hardcoded.
---
 .github/RUNNERS.md                          |  51 ++++
 .github/runners.yaml                        |  17 ++
 .github/scripts/lib/runner-names.mjs        | 255 ++++++++++++++++++++
 .github/scripts/sync-runner-names.mjs       |  15 ++
 .github/scripts/validate-runner-names.mjs   |  47 ++++
 .github/workflows/build.yml                 |  14 +-
 .github/workflows/reusable-runner-names.yml |  27 +++
 .github/workflows/runner-names-validate.yml |  32 +++
 8 files changed, 454 insertions(+), 4 deletions(-)
 create mode 100644 .github/RUNNERS.md
 create mode 100644 .github/runners.yaml
 create mode 100644 .github/scripts/lib/runner-names.mjs
 create mode 100644 .github/scripts/sync-runner-names.mjs
 create mode 100644 .github/scripts/validate-runner-names.mjs
 create mode 100644 .github/workflows/reusable-runner-names.yml
 create mode 100644 .github/workflows/runner-names-validate.yml

diff --git a/.github/RUNNERS.md b/.github/RUNNERS.md
new file mode 100644
index 0000000000..1d1da77a9a
--- /dev/null
+++ b/.github/RUNNERS.md
@@ -0,0 +1,51 @@
+# Runner label catalog
+
+CI runner labels live in one place: [`.github/runners.yaml`](./runners.yaml).
+This lets a runner-image migration (OS bump, hosted-image retirement) update a
+single file instead of grepping every workflow.
+
+## How it works
+
+`runners.yaml` is the source of truth. A generated reusable workflow,
+[`.github/workflows/reusable-runner-names.yml`](./workflows/reusable-runner-names.yml),
+exports each catalog entry as a job output. Callers pull the label from that
+output instead of hardcoding it, because `runs-on:` is evaluated before any step
+runs, so a composite action cannot supply the label — a reusable workflow's
+outputs can.
+
+A catalog value is one of:
+
+- a **scalar** label (`windows-2022`) — consumed as
+  `runs-on: ${{ needs.runner_names.outputs.<key> }}`
+- a **composite label set** (`[self-hosted, Linux, X64]`) — exported as a JSON
+  array string and consumed as
+  `runs-on: ${{ fromJSON(needs.runner_names.outputs.<key>) }}`
+
+Rolling `-latest` aliases (`ubuntu-latest`, `macos-latest`, `windows-latest`)
+are intentionally left hardcoded — they are GitHub aliases, not fleet labels.
+`matrix.os` values (and `matrix.os == '...'` conditionals) are frozen logical
+identities and are not managed by the catalog.
+
+## Wiring a job
+
+```yaml
+jobs:
+  runner_names:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/reusable-runner-names.yml
+
+  my-job:
+    needs: runner_names
+    runs-on: ${{ needs.runner_names.outputs.windows_2022 }}
+    steps: ...
+```
+
+## Changing a label
+
+1. Edit `.github/runners.yaml`.
+2. Regenerate: `node .github/scripts/sync-runner-names.mjs`
+3. Test: `node --test .github/scripts/test/runner-names.test.mjs`
+
+CI enforces both invariants via
+[`runner-names-validate.yml`](./workflows/runner-names-validate.yml).
diff --git a/.github/runners.yaml b/.github/runners.yaml
new file mode 100644
index 0000000000..ab4613d62b
--- /dev/null
+++ b/.github/runners.yaml
@@ -0,0 +1,17 @@
+# Specialized GitHub Actions runner labels for qvac-ext-stable-diffusion.cpp CI.
+# Edit this file, then run: node .github/scripts/sync-runner-names.mjs
+#
+# ubuntu-latest / macos-latest / windows-latest are intentionally omitted; keep
+# them hardcoded as GitHub's rolling aliases.
+#
+# FORMAT CONTRACT: a flat `key: value # comment` list, one entry per line. The
+# parser (.github/scripts/lib/runner-names.mjs) is line-based, not YAML. A value
+# is EITHER a bare single label (`windows-2022`) OR a flow array of bare tokens
+# (`[self-hosted, Linux, X64]`). Do not quote values or nest maps (the parser
+# fails loudly).
+#
+# SCOPE: this catalog governs only where jobs RUN (runs-on / matrix.runner). It
+# does NOT manage `matrix.os` identities or `matrix.os == '...'` conditionals.
+
+# GitHub-hosted (pinned images)
+windows_2022: windows-2022 # Windows Server 2022 hosted x64
diff --git a/.github/scripts/lib/runner-names.mjs b/.github/scripts/lib/runner-names.mjs
new file mode 100644
index 0000000000..a9a3c0fce2
--- /dev/null
+++ b/.github/scripts/lib/runner-names.mjs
@@ -0,0 +1,255 @@
+/**
+ * Shared helpers for the qvac-ext-stable-diffusion.cpp runner-label catalog.
+ *
+ * Source of truth: .github/runners.yaml
+ * Generated consumer: .github/workflows/reusable-runner-names.yml
+ *
+ * A catalog entry is either a scalar label or an ordered array of labels
+ * (composite self-hosted set). Array entries are exported as a JSON-array
+ * string and consumed with `fromJSON(...)` in runs-on.
+ */
+import { readdirSync, readFileSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+export const repoRoot = resolve(here, '../../..')
+
+export const RUNNERS_YAML = '.github/runners.yaml'
+export const REUSABLE_WORKFLOW = '.github/workflows/reusable-runner-names.yml'
+export const REUSABLE_USES = './.github/workflows/reusable-runner-names.yml'
+
+// Workflows wired to the catalog and validated. Orchestration-only files that
+// use nothing but ubuntu-latest / the org reusable (check-approvals,
+// security-baseline) stay out of scope.
+const ADDON_WORKFLOWS = new Set(['build.yml'])
+
+const KEY = '[a-z][a-z0-9_]*'
+const COMMENT = '(?:#\\s*(.*\\S))?'
+const SCALAR_RE = new RegExp(`^(${KEY}):\\s+([^#\\[\\s'"][^#]*?)\\s*${COMMENT}\\s*$`)
+const ARRAY_RE = new RegExp(`^(${KEY}):\\s+\\[([^\\]]+)\\]\\s*${COMMENT}\\s*$`)
+
+export function parseRunnersYaml(source) {
+  const runners = []
+  const seenKeys = new Set()
+  const seenTargets = new Set()
+
+  for (const line of source.split(/\r?\n/)) {
+    const trimmed = line.trim()
+    if (!trimmed || trimmed.startsWith('#')) continue
+
+    const arrayMatch = line.match(ARRAY_RE)
+    const scalarMatch = arrayMatch ? null : line.match(SCALAR_RE)
+    if (!arrayMatch && !scalarMatch) {
+      throw new Error(`invalid runners.yaml line (expected "key: label" or "key: [a, b]"): ${JSON.stringify(line)}`)
+    }
+
+    let entry
+    if (arrayMatch) {
+      const [, key, body, description = ''] = arrayMatch
+      const labels = body.split(',').map((token) => token.trim()).filter(Boolean)
+      if (labels.length === 0) throw new Error(`empty runner array: ${JSON.stringify(line)}`)
+      for (const label of labels) {
+        if (/["'{}[\]]/.test(label)) {
+          throw new Error(`runner label must be bare, not quoted/structured: ${JSON.stringify(line)}`)
+        }
+      }
+      entry = { key, kind: 'array', labels, description }
+    } else {
+      const [, key, rawLabel, description = ''] = scalarMatch
+      const label = rawLabel.trim()
+      if (/["'{}[\]]/.test(label)) {
+        throw new Error(`runner label must be bare, not quoted/structured: ${JSON.stringify(line)}`)
+      }
+      entry = { key, kind: 'scalar', label, description }
+    }
+
+    const target = targetKeyString(entry)
+    if (seenKeys.has(entry.key)) throw new Error(`duplicate runner key: ${entry.key}`)
+    if (seenTargets.has(target)) throw new Error(`duplicate runner target: ${target}`)
+    seenKeys.add(entry.key)
+    seenTargets.add(target)
+    runners.push(entry)
+  }
+
+  if (runners.length === 0) throw new Error('runners.yaml has no entries')
+  return runners
+}
+
+/** Canonical string for a target, used for duplicate detection + matching. */
+export function targetKeyString(entry) {
+  return entry.kind === 'array' ? `[${entry.labels.join(',')}]` : entry.label
+}
+
+/** The output value the reusable exports: scalar label, or compact JSON array. */
+export function outputValue(entry) {
+  return entry.kind === 'array' ? JSON.stringify(entry.labels) : entry.label
+}
+
+/** How a caller references the output in `runs-on:`. */
+export function runsOnExpression(entry) {
+  const ref = `needs.runner_names.outputs.${entry.key}`
+  return entry.kind === 'array' ? `\${{ fromJSON(${ref}) }}` : `\${{ ${ref} }}`
+}
+
+export function loadRunners() {
+  return parseRunnersYaml(readFileSync(join(repoRoot, RUNNERS_YAML), 'utf8'))
+}
+
+export function listAddonWorkflows() {
+  const directory = join(repoRoot, '.github/workflows')
+  return readdirSync(directory)
+    .filter((name) => ADDON_WORKFLOWS.has(name))
+    .map((name) => `.github/workflows/${name}`)
+    .sort()
+}
+
+export function renderReusableWorkflow(runners) {
+  const outputsBlock = runners
+    .map((entry) => {
+      const description = entry.description || `Runner target ${targetKeyString(entry)}`
+      return [
+        `      ${entry.key}:`,
+        `        description: ${yamlDoubleQuoted(description)}`,
+        `        value: \${{ jobs.export.outputs.${entry.key} }}`,
+      ].join('\n')
+    })
+    .join('\n')
+
+  const jobOutputs = runners
+    .map((entry) => `      ${entry.key}: \${{ steps.export.outputs.${entry.key} }}`)
+    .join('\n')
+
+  const exportLines = runners
+    .map((entry) => `          echo '${entry.key}=${outputValue(entry)}' >> "$GITHUB_OUTPUT"`)
+    .join('\n')
+
+  return `# AUTO-GENERATED by .github/scripts/sync-runner-names.mjs
+# Source of truth: ${RUNNERS_YAML}
+# Do not edit this file by hand.
+
+name: Runner names
+
+on:
+  workflow_call:
+    outputs:
+${outputsBlock}
+
+permissions:
+  contents: read
+
+jobs:
+  export:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+${jobOutputs}
+    steps:
+      - name: Export runner labels
+        id: export
+        run: |
+${exportLines}
+`
+}
+
+export function assertReusableMatchesCatalog(runners, reusableSource) {
+  const expected = renderReusableWorkflow(runners)
+  if (normalizeNewlines(reusableSource) !== normalizeNewlines(expected)) {
+    throw new Error(`${REUSABLE_WORKFLOW} is out of date. Run: node .github/scripts/sync-runner-names.mjs`)
+  }
+}
+
+const LABEL_BOUNDARY_BEFORE = `(^|[\\s"'\\[,])`
+const LABEL_BOUNDARY_AFTER = `([\\s"'\\],]|$)`
+
+function escapeLabel(label) {
+  return label.replaceAll(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+function normalizeArrayTokens(body) {
+  return body.split(',').map((token) => token.trim().replace(/^['"]|['"]$/g, '')).filter(Boolean)
+}
+
+function isCommentLine(line) {
+  return /^\s*#/.test(line)
+}
+
+/**
+ * Flags catalog targets hardcoded in `runs-on:` where they select the machine.
+ * Handles scalar forms (bare / quoted / inside a `${{ }}` expression) and the
+ * composite flow-array form. Frozen logical identities are intentionally NOT
+ * flagged: `matrix.os` values and `matrix.<x> == '<label>'` conditionals (the
+ * label there names an identity, not where the job runs — the runs-on value is
+ * still driven by the catalog outputs on the same line).
+ */
+export function findHardcodedLabelViolations(relativePath, source, runners) {
+  const findings = []
+  const lines = source.split(/\r?\n/)
+  const scalars = runners.filter((entry) => entry.kind === 'scalar')
+  const arrays = runners.filter((entry) => entry.kind === 'array')
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    if (isCommentLine(line)) continue
+
+    const assign = line.match(/^\s+runs-on:\s*(.*?)\s*$/)
+    if (!assign) continue
+    const value = assign[1]
+
+    // Composite flow array: compare token sets against catalog array entries.
+    const arrayValue = value.match(/^\[([^\]]+)\]$/)
+    if (arrayValue) {
+      const tokens = normalizeArrayTokens(arrayValue[1])
+      const match = arrays.find((entry) => sameSet(entry.labels, tokens))
+      if (match) findings.push({ file: relativePath, line: i + 1, target: targetKeyString(match), text: line.trim() })
+      continue
+    }
+
+    // `${{ }}` expression: flag a quoted scalar label used as a VALUE. Strip
+    // `== '...'` / `!= '...'` operands first so logical-id conditionals like
+    // `matrix.os == 'macos-12'` are not mistaken for a hardcoded runner label.
+    if (value.includes('${{')) {
+      const scan = value.replace(/(==|!=)\s*(['"])[^'"]*\2/g, '')
+      const hit = scalars.find((entry) => new RegExp(`['"]${escapeLabel(entry.label)}['"]`).test(scan))
+      if (hit) findings.push({ file: relativePath, line: i + 1, target: hit.label, text: line.trim() })
+      continue
+    }
+
+    // Bare / quoted scalar.
+    const hit = scalars.find((entry) =>
+      new RegExp(`${LABEL_BOUNDARY_BEFORE}${escapeLabel(entry.label)}${LABEL_BOUNDARY_AFTER}`).test(value),
+    )
+    if (hit) findings.push({ file: relativePath, line: i + 1, target: hit.label, text: line.trim() })
+  }
+
+  return findings
+}
+
+export function hasRunnerNamesJob(source) {
+  return /^\s+runner_names:\s*$/m.test(source) && source.includes(`uses: ${REUSABLE_USES}`)
+}
+
+export function findMissingRunnerNamesNeeds(relativePath, source) {
+  if (!source.includes('needs.runner_names.outputs')) return []
+  if (hasRunnerNamesJob(source)) return []
+  return [{ file: relativePath, message: `references needs.runner_names.outputs but has no runner_names job using ${REUSABLE_USES}` }]
+}
+
+function sameSet(a, b) {
+  if (a.length !== b.length) return false
+  const sortedA = [...a].sort()
+  const sortedB = [...b].sort()
+  return sortedA.every((value, index) => value === sortedB[index])
+}
+
+function yamlDoubleQuoted(value) {
+  return `"${value.replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`
+}
+
+function normalizeNewlines(text) {
+  return text.replaceAll('\r\n', '\n')
+}
+
+export function readRepoFile(relativePath) {
+  return readFileSync(join(repoRoot, relativePath), 'utf8')
+}
diff --git a/.github/scripts/sync-runner-names.mjs b/.github/scripts/sync-runner-names.mjs
new file mode 100644
index 0000000000..ebcaa1f0f7
--- /dev/null
+++ b/.github/scripts/sync-runner-names.mjs
@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+/**
+ * Regenerate .github/workflows/reusable-runner-names.yml from .github/runners.yaml.
+ *
+ * After editing the catalog:
+ *   node .github/scripts/sync-runner-names.mjs
+ *   node --test .github/scripts/test/runner-names.test.mjs
+ */
+import { writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { REUSABLE_WORKFLOW, RUNNERS_YAML, loadRunners, renderReusableWorkflow, repoRoot } from './lib/runner-names.mjs'
+
+const runners = loadRunners()
+writeFileSync(join(repoRoot, REUSABLE_WORKFLOW), renderReusableWorkflow(runners), 'utf8')
+console.log(`wrote ${REUSABLE_WORKFLOW} (${runners.length} targets from ${RUNNERS_YAML})`)
diff --git a/.github/scripts/validate-runner-names.mjs b/.github/scripts/validate-runner-names.mjs
new file mode 100644
index 0000000000..1958dd323e
--- /dev/null
+++ b/.github/scripts/validate-runner-names.mjs
@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+/**
+ * Fail if CI workflows hardcode catalog runner targets or drift from the
+ * generated reusable-runner-names workflow.
+ *
+ * Usage: node .github/scripts/validate-runner-names.mjs
+ */
+import {
+  REUSABLE_WORKFLOW,
+  assertReusableMatchesCatalog,
+  findHardcodedLabelViolations,
+  findMissingRunnerNamesNeeds,
+  listAddonWorkflows,
+  loadRunners,
+  readRepoFile,
+} from './lib/runner-names.mjs'
+
+function main() {
+  const runners = loadRunners()
+  const errors = []
+
+  try {
+    assertReusableMatchesCatalog(runners, readRepoFile(REUSABLE_WORKFLOW))
+  } catch (error) {
+    errors.push(error.message)
+  }
+
+  for (const file of listAddonWorkflows()) {
+    const source = readRepoFile(file)
+    for (const finding of findHardcodedLabelViolations(file, source, runners)) {
+      errors.push(`${finding.file}:${finding.line} hardcodes runner target ${finding.target}: ${finding.text}`)
+    }
+    for (const finding of findMissingRunnerNamesNeeds(file, source)) {
+      errors.push(`${finding.file}: ${finding.message}`)
+    }
+  }
+
+  if (errors.length > 0) {
+    console.error(`validate-runner-names: ${errors.length} finding(s):`)
+    for (const error of errors) console.error(`  ${error}`)
+    process.exit(1)
+  }
+
+  console.log(`validate-runner-names: ok (${runners.length} targets, ${listAddonWorkflows().length} workflow(s))`)
+}
+
+main()
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b2da00dc19..32dfac6550 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -43,6 +43,11 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  runner_names:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/reusable-runner-names.yml
+
   ubuntu-latest-cmake:
     runs-on: ubuntu-latest
 
@@ -267,8 +272,8 @@ jobs:
             sd-${{ env.BRANCH_NAME }}-${{ steps.commit.outputs.short }}-bin-${{ steps.system-info.outputs.OS_TYPE }}-${{ steps.system-info.outputs.OS_NAME }}-${{ steps.system-info.outputs.OS_VERSION }}-${{ steps.system-info.outputs.CPU_ARCH }}.zip
 
   windows-latest-cmake:
-    runs-on: windows-2022
-
+    needs: runner_names
+    runs-on: ${{ needs.runner_names.outputs.windows_2022 }}
     env:
       VULKAN_VERSION: 1.4.328.1
 
@@ -388,8 +393,8 @@ jobs:
             sd-${{ env.BRANCH_NAME }}-${{ steps.commit.outputs.short }}-bin-win-${{ matrix.build }}-x64.zip
 
   windows-latest-cmake-hip:
-    runs-on: windows-2022
-
+    needs: runner_names
+    runs-on: ${{ needs.runner_names.outputs.windows_2022 }}
     env:
       HIPSDK_INSTALLER_VERSION: "25.Q3"
       GPU_TARGETS: "gfx1151;gfx1200;gfx1201;gfx1100;gfx1101;gfx1102;gfx1030;gfx1031;gfx1032"
@@ -693,3 +698,4 @@ jobs:
                 });
               }
             }
+
diff --git a/.github/workflows/reusable-runner-names.yml b/.github/workflows/reusable-runner-names.yml
new file mode 100644
index 0000000000..e4963b9aa9
--- /dev/null
+++ b/.github/workflows/reusable-runner-names.yml
@@ -0,0 +1,27 @@
+# AUTO-GENERATED by .github/scripts/sync-runner-names.mjs
+# Source of truth: .github/runners.yaml
+# Do not edit this file by hand.
+
+name: Runner names
+
+on:
+  workflow_call:
+    outputs:
+      windows_2022:
+        description: "Windows Server 2022 hosted x64"
+        value: ${{ jobs.export.outputs.windows_2022 }}
+
+permissions:
+  contents: read
+
+jobs:
+  export:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      windows_2022: ${{ steps.export.outputs.windows_2022 }}
+    steps:
+      - name: Export runner labels
+        id: export
+        run: |
+          echo 'windows_2022=windows-2022' >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/runner-names-validate.yml b/.github/workflows/runner-names-validate.yml
new file mode 100644
index 0000000000..e170af1d30
--- /dev/null
+++ b/.github/workflows/runner-names-validate.yml
@@ -0,0 +1,32 @@
+name: Runner names validate
+
+# Enforces the runner-label catalog: the generated reusable workflow stays in
+# sync with .github/runners.yaml, and no wired workflow hardcodes a catalog
+# runner target. See .github/RUNNERS.md.
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - '.github/runners.yaml'
+      - '.github/workflows/**'
+      - '.github/scripts/**'
+  pull_request:
+    paths:
+      - '.github/runners.yaml'
+      - '.github/workflows/**'
+      - '.github/scripts/**'
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate runner-name catalog (in sync + no hardcoded labels)
+        run: node .github/scripts/validate-runner-names.mjs
+      - name: Unit tests
+        run: node --test .github/scripts/test/runner-names.test.mjs

From d3f773af481e87232a3983463b543eb7916b110b Mon Sep 17 00:00:00 2001
From: Oluwatobi Adelegan <69557328+tobi-legan@users.noreply.github.com>
Date: Tue, 8 Sep 2026 18:19:51 +0100
Subject: [PATCH 11/13] QVAC-24629 infra: cancel superseded CI runs on push and
 dispatch (#38)

build.yml's group fell back to github.run_id whenever head_ref was empty, so pushes and dispatches never cancelled. Key on the PR number, then on the publish predicate, then the ref. Anything that publishes is exempt and keyed per run: every publish gate has a branch-free disjunct (github.event.inputs.create_release == 'true'), so a create_release dispatch publishes from any ref and must never be superseded mid-uploadReleaseAsset. runner-names-validate gains a block.
---
 .github/workflows/build.yml                 | 22 ++++++++++++++++++++-
 .github/workflows/runner-names-validate.yml |  7 +++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 32dfac6550..2707731593 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -38,8 +38,28 @@ on:
 env:
   BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
 
+# Dedupe per PR and per branch: a re-push or re-dispatch supersedes the
+# in-flight run. The previous group fell back to github.run_id whenever
+# head_ref was empty — i.e. on every push and workflow_dispatch — which made
+# the group unique per run, so those runs never cancelled.
+#
+# Anything that PUBLISHES is exempt and keyed per run instead, so it can never
+# be superseded. The exemption keys on the publish predicate rather than on the
+# branch, because every publish gate here has a branch-free disjunct:
+#
+#   release job (645)     if: (github.event_name == 'push' && github.ref == 'refs/heads/master') || github.event.inputs.create_release == 'true'
+#   docker push (226)   push: (github.event_name == 'push' && github.ref == 'refs/heads/master') || github.event.inputs.create_release == 'true'
+#   Create release (683)  if: github.event_name == 'workflow_dispatch' || github.ref_name == 'master'
+#   Upload release (692)  if: github.event_name == 'workflow_dispatch' || github.ref_name == 'master'
+#
+# So a `create_release: true` dispatch publishes from ANY ref, not just master.
+# Keying the exemption on the branch alone would leave that path cancellable:
+# `Upload release` creates the release and then loops uploadReleaseAsset one
+# zip at a time, so a cancel in between leaves a published release with a
+# partial asset set — and the tag-immutability ruleset means the tag cannot be
+# deleted or moved to redo it cleanly.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || ((github.event.inputs.create_release == 'true' || github.ref_name == 'master') && github.run_id) || github.ref }}
   cancel-in-progress: true
 
 jobs:
diff --git a/.github/workflows/runner-names-validate.yml b/.github/workflows/runner-names-validate.yml
index e170af1d30..1467cf86cf 100644
--- a/.github/workflows/runner-names-validate.yml
+++ b/.github/workflows/runner-names-validate.yml
@@ -20,6 +20,13 @@ on:
 permissions:
   contents: read
 
+# Dedupe per PR and per branch: a newer push supersedes the in-flight
+# validation (this workflow has no workflow_dispatch trigger). master is
+# exempt on purpose — pushes to the default branch must not cancel each other.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.ref == 'refs/heads/master' && github.run_id) || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   validate:
     runs-on: ubuntu-latest

From 54bfafe8e22a6a83ffec294b716cd204fb0c03c6 Mon Sep 17 00:00:00 2001
From: Oluwatobi Adelegan <69557328+tobi-legan@users.noreply.github.com>
Date: Thu, 24 Sep 2026 18:27:49 +0100
Subject: [PATCH 12/13] QVAC-24501 fix: unignore .github/scripts/test and add
 the tests CI already runs (#45)

* QVAC-24501 fix: unignore .github/scripts/test and add the tests CI already runs

runner-names-validate.yml has always had this step:

  - name: Unit tests
    run: node --test .github/scripts/test/runner-names.test.mjs

but that file is not in the repo, and `node --test` on a missing path exits 1.
The workflow has therefore failed on every run since infra/runner-label-catalog
introduced it on 2026-09-01 - master included, and throughout the QVAC-24629
concurrency branch. Run 34256435445 on master shows the shape:

  validate-runner-names: ok (1 targets, 1 workflow(s))
  ##[error]Process completed with exit code 1

The validator passes. The step after it is what fails. A check that is
permanently red is also a silent one: nothing here has ever been enforced by a
green run.

ROOT CAUSE

.gitignore line 3 is a bare `test/`. An unanchored directory pattern matches at
ANY depth, so it covers .github/scripts/test/ as well as the local build scratch
dir it is grouped with (build*/, cmake-build-*/, .cache/). Whoever added the
workflow step almost certainly wrote the test file too and git silently refused
it. None of the other five engine repos carry this rule.

Kept the broad rule rather than anchoring it to /test/ - a nested test/
elsewhere in the tree may rely on it - and re-included just the CI path. The
directory itself has to be re-included, because git cannot re-include a file
whose parent directory is excluded. Verified: test/x.cpp and examples/test/y.cpp
are both still ignored, .github/scripts/test/ is not.

THE TESTS

Ported from qvac-ext-bergamot-translator, whose lib/runner-names.mjs is
identical to this one apart from the repo name and the ADDON_WORKFLOWS set, and
which is hosted-only like this repo. Adapted to this catalog (windows_2022),
plus two assertions specific to it:

- The catalog stays hosted-only. This repo runs entirely on GitHub images and
  has no reusable-authorize-self-hosted.yml, so a self-hosted entry appearing
  here would put fork PRs on a self-hosted runner with no fork-ci gate. The
  self-hosted engine repos all carry that gate; this one has nothing to carry
  it with. Checked the guard fires rather than passing vacuously.
- The validated allowlist is non-empty and still contains build.yml. A wired
  workflow missing from ADDON_WORKFLOWS is not checked at all, which would make
  every other assertion in this file vacuous.

  node --test .github/scripts/test/runner-names.test.mjs -> 11 passed, 0 failed
  node .github/scripts/validate-runner-names.mjs -> ok (1 targets, 1 workflow(s))

No workflow or catalog change. QVAC-24501's runner repoint does not apply here:
every runs-on in this repo is ubuntu-latest, macos-latest or windows-2022, so
there is no unroutable self-hosted label of the kind fixed in fabric-llm and
ext-ggml. This closes the guardrail gap instead.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: trim comments to the non-obvious bits

The gitignore rationale belongs in the commit and PR, not inline next to a
one-line negation. The hosted-only test's comment restated its own name and
assert message.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/scripts/test/runner-names.test.mjs | 127 +++++++++++++++++++++
 .gitignore                                 |   2 +
 2 files changed, 129 insertions(+)
 create mode 100644 .github/scripts/test/runner-names.test.mjs

diff --git a/.github/scripts/test/runner-names.test.mjs b/.github/scripts/test/runner-names.test.mjs
new file mode 100644
index 0000000000..4d7e44af1e
--- /dev/null
+++ b/.github/scripts/test/runner-names.test.mjs
@@ -0,0 +1,127 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { spawnSync } from 'node:child_process'
+import { join } from 'node:path'
+import {
+  REUSABLE_WORKFLOW,
+  RUNNERS_YAML,
+  assertReusableMatchesCatalog,
+  findHardcodedLabelViolations,
+  findMissingRunnerNamesNeeds,
+  listAddonWorkflows,
+  loadRunners,
+  outputValue,
+  parseRunnersYaml,
+  readRepoFile,
+  renderReusableWorkflow,
+  repoRoot,
+  runsOnExpression,
+} from '../lib/runner-names.mjs'
+
+test('runners.yaml parses with unique keys/targets', () => {
+  const runners = loadRunners()
+  assert.ok(runners.length >= 1)
+  assert.equal(new Set(runners.map((e) => e.key)).size, runners.length)
+  assert.equal(new Set(runners.map((e) => e.target ?? e.label)).size, runners.length)
+})
+
+test('the catalog still describes this repo: hosted images only', () => {
+  for (const entry of loadRunners()) {
+    const labels = entry.kind === 'array' ? entry.labels : [entry.label]
+    assert.ok(
+      !labels.includes('self-hosted'),
+      `${entry.key} is self-hosted; this repo has no authorize gate (see .github/RUNNERS.md)`,
+    )
+  }
+})
+
+test('array vs scalar output value + runs-on expression', () => {
+  const [scalar] = parseRunnersYaml('windows_2022: windows-2022\n')
+  assert.equal(outputValue(scalar), 'windows-2022')
+  assert.equal(runsOnExpression(scalar), '${{ needs.runner_names.outputs.windows_2022 }}')
+
+  const [arr] = parseRunnersYaml('gpu: [self-hosted, Linux, X64]\n')
+  assert.equal(outputValue(arr), '["self-hosted","Linux","X64"]')
+  assert.equal(runsOnExpression(arr), '${{ fromJSON(needs.runner_names.outputs.gpu) }}')
+})
+
+test('parseRunnersYaml rejects quoted values and junk', () => {
+  assert.throws(() => parseRunnersYaml('k: "windows-2022"\n'), /invalid/)
+  assert.throws(() => parseRunnersYaml('k: [self-hosted, "Linux"]\n'), /bare/)
+  assert.throws(() => parseRunnersYaml('k: a\nk: b\n'), /duplicate runner key/)
+  assert.throws(() => parseRunnersYaml('not yaml at all\n'), /invalid/)
+})
+
+test('reusable-runner-names.yml matches the catalog', () => {
+  const runners = loadRunners()
+  assert.doesNotThrow(() => assertReusableMatchesCatalog(runners, readRepoFile(REUSABLE_WORKFLOW)))
+  const rendered = renderReusableWorkflow(runners)
+  assert.match(rendered, /AUTO-GENERATED/)
+  assert.match(rendered, /runs-on: ubuntu-latest/)
+  assert.doesNotMatch(rendered, /actions\/checkout/)
+})
+
+test('CI workflows do not hardcode catalog runner targets', () => {
+  const runners = loadRunners()
+  const findings = []
+  for (const file of listAddonWorkflows()) {
+    const source = readRepoFile(file)
+    findings.push(...findHardcodedLabelViolations(file, source, runners))
+    findings.push(...findMissingRunnerNamesNeeds(file, source))
+  }
+  assert.deepEqual(findings, [], JSON.stringify(findings, null, 2))
+})
+
+test('the validated allowlist is not empty', () => {
+  // A workflow absent from ADDON_WORKFLOWS is not checked, so a stale list
+  // makes every other assertion here vacuous.
+  const wired = listAddonWorkflows()
+  assert.ok(wired.length >= 1)
+  assert.ok(wired.includes('.github/workflows/build.yml'))
+})
+
+test('detector catches scalar/array hardcoded runs-on but not matrix.os identities', () => {
+  const runners = parseRunnersYaml(
+    'windows_2022: windows-2022\nmacos_12: macos-12\nubuntu_2004: ubuntu-20.04\ngpu: [self-hosted, Linux, X64]\n',
+  )
+  const source = [
+    'jobs:',
+    '  a:',
+    '    runs-on: windows-2022',
+    '  b:',
+    '    runs-on: [self-hosted, Linux, X64]',
+    '  c:',
+    "    runs-on: ${{ matrix.os == 'macos-12' && needs.runner_names.outputs.macos_12 || needs.runner_names.outputs.ubuntu_2004 }}",
+    '  d:',
+    '    runs-on: ${{ matrix.os }}',
+    '  e:',
+    '    runs-on: ubuntu-latest',
+    '',
+  ].join('\n')
+  const findings = findHardcodedLabelViolations('x.yml', source, runners)
+  assert.deepEqual(
+    findings.map((f) => [f.line, f.target]).sort((a, b) => a[0] - b[0]),
+    [
+      [3, 'windows-2022'],
+      [5, '[self-hosted,Linux,X64]'],
+    ],
+  )
+})
+
+test('detector flags a quoted catalog label used as a value in an expression', () => {
+  const runners = parseRunnersYaml('windows_2022: windows-2022\n')
+  const source = ['jobs:', '  a:', "    runs-on: ${{ inputs.win && 'windows-2022' || 'ubuntu-latest' }}", ''].join('\n')
+  assert.equal(findHardcodedLabelViolations('x.yml', source, runners).length, 1)
+})
+
+test('validate-runner-names.mjs exits 0', () => {
+  const result = spawnSync(process.execPath, [join(repoRoot, '.github/scripts/validate-runner-names.mjs')], {
+    encoding: 'utf8',
+    cwd: repoRoot,
+  })
+  assert.equal(result.status, 0, `stdout=${result.stdout}\nstderr=${result.stderr}`)
+})
+
+test('catalog path constant is correct', () => {
+  assert.equal(RUNNERS_YAML, '.github/runners.yaml')
+})
diff --git a/.gitignore b/.gitignore
index b0e3af83f6..9af9974eeb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,8 @@
 build*/
 cmake-build-*/
 test/
+# `test/` is unanchored, so it also swallowed .github/scripts/test/, which CI runs.
+!.github/scripts/test/
 .vscode/
 .idea/
 .cache/

From e3817ac6e195bba5a6bf5414bb5be210b46df46e Mon Sep 17 00:00:00 2001
From: Proletter <40578159+Proletter@users.noreply.github.com>
Date: Wed, 7 Oct 2026 11:10:18 +0100
Subject: [PATCH 13/13] infra[notask]: run check approvals when a pr is
 retargeted or reopened (#50)

---
 .github/workflows/check-approvals.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/check-approvals.yml b/.github/workflows/check-approvals.yml
index c093d4f47e..f827c729e8 100644
--- a/.github/workflows/check-approvals.yml
+++ b/.github/workflows/check-approvals.yml
@@ -4,7 +4,7 @@ on:
   issue_comment:
     types: [created]
   pull_request_target:
-    types: [opened, synchronize]
+    types: [opened, synchronize, reopened, edited]
     branches: [main, master]
 
 permissions:
@@ -29,7 +29,7 @@ jobs:
         github.event.issue.pull_request != null
       ) || (
         github.event_name == 'pull_request_target' &&
-        (github.event.action == 'opened' || github.event.action == 'synchronize')
+        contains(fromJSON('["opened", "synchronize", "reopened", "edited"]'), github.event.action)
       )
     steps:
       - name: Install @qvac/ci