Restore GitHub-hosted runners

.github/workflows/codeql.yml

@@ -17,7 +17,7 @@ permissions:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     concurrency:
       group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ matrix.language }}
       cancel-in-progress: true

.github/workflows/first-time-pr.yml

@@ -26,7 +26,7 @@ jobs:
     name: Welcome first-time contributor
     permissions:
       pull-requests: write # for gh pr edit --add-label and posting the welcome comment
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     if: >-
       github.event.action == 'opened' &&
       github.repository_owner == 'open-telemetry' &&

.github/workflows/promote-pull-request-dashboard.yml

@@ -20,7 +20,7 @@ concurrency:
 jobs:
   promote:
     name: Open stable promotion pull request
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     steps:
       - name: Enforce main branch
         env:

.github/workflows/pull-request-dashboard-deploy-webhook.yml

@@ -24,7 +24,7 @@ concurrency:
 jobs:
   deploy:
     if: github.repository == 'open-telemetry/shared-workflows'
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     environment: protected
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/pull-request-dashboard-drain.yml

@@ -26,7 +26,7 @@ jobs:
       copilot-requests: write
       id-token: write
     environment: protected
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     timeout-minutes: 50
     env:
       DISPATCHER_GENERATION: ${{ inputs.dispatcher_generation }}

.github/workflows/pull-request-dashboard-repo.yml

@@ -42,7 +42,7 @@ jobs:
       contents: write
       copilot-requests: write
     environment: protected
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     outputs:
       initial_backfill_complete: ${{ steps.dashboard-update.outputs.initial_backfill_complete }}
     steps:
@@ -227,7 +227,7 @@ jobs:
     permissions:
       contents: write
     environment: protected
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     timeout-minutes: 50
     env:
       PUBLISHER_LOCK_OWNER: ${{ github.run_id }}-${{ github.run_attempt }}-publish

.github/workflows/pull-request-dashboard-test.yml

@@ -17,7 +17,7 @@ concurrency:
 
 jobs:
   test:
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/pull-request-dashboard.yml

@@ -49,7 +49,7 @@ jobs:
     # Targeted refreshes go straight to the reusable workflow, which resolves
     # its own configuration. Only backfills need a matrix resolved up front.
     if: inputs.head_sha == '' && (inputs.repository == '' || inputs.pr_number == '')
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     permissions:
       contents: read
     environment: protected
@@ -115,7 +115,7 @@ jobs:
     # Check and status events for a fork head carry no pull request number, so
     # the head commit has to be resolved before the reusable workflow runs.
     if: inputs.head_sha != '' && inputs.pr_number == ''
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     permissions:
       contents: read
     environment: protected

.github/workflows/release.yml

@@ -25,7 +25,7 @@ concurrency:
 jobs:
   release:
     name: Cut new release
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     permissions:
       contents: write # to create the tag and the GitHub Release
     steps:

.github/workflows/scorecard.yml

@@ -25,7 +25,7 @@ jobs:
   # https://github.com/ossf/scorecard-action#workflow-restrictions
   analysis:
     name: OSSF Scorecard Analysis
-    runs-on: ${{ (github.repository == 'open-telemetry/shared-workflows' || inputs['use-cncf-hosted-runner']) && 'cncf-ubuntu-2-8-x86' || 'ubuntu-latest' }}
+    runs-on: ${{ inputs['use-cncf-hosted-runner'] && 'cncf-ubuntu-2-8-x86' || 'ubuntu-latest' }}
     permissions:
       contents: read # for actions/checkout
       id-token: write # Needed for GitHub OIDC token since publish_results is true
@@ -52,7 +52,7 @@ jobs:
   upload:
     name: Upload to code scanning
     needs: analysis
-    runs-on: ${{ (github.repository == 'open-telemetry/shared-workflows' || inputs['use-cncf-hosted-runner']) && 'cncf-ubuntu-2-8-x86' || 'ubuntu-latest' }}
+    runs-on: ${{ inputs['use-cncf-hosted-runner'] && 'cncf-ubuntu-2-8-x86' || 'ubuntu-latest' }}
     permissions:
       contents: read # for actions/checkout, so that upload-sarif can fingerprint results
       security-events: write # Needed for Code scanning upload

.github/workflows/survey-on-merged-pr.yml

@@ -23,7 +23,7 @@ env:
 jobs:
   comment-on-pr:
     name: Add survey to PR if author is not a member
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     if: >-
       github.event.pull_request.merged == true &&
       github.repository_owner == 'open-telemetry' &&

.github/workflows/workflow-failure-issue.yml

@@ -16,7 +16,7 @@ jobs:
     if: github.repository_owner == 'open-telemetry'
     permissions:
       issues: write # needed to open, comment on, and close workflow failure issues
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     steps:
       - name: Open issue or add comment if issue already open
         env:

.github/workflows/zizmor.yml

@@ -34,7 +34,7 @@ concurrency:
 jobs:
   zizmor:
     name: Zizmor Security Analysis
-    runs-on: ${{ (github.repository == 'open-telemetry/shared-workflows' || inputs['use-cncf-hosted-runner']) && 'cncf-ubuntu-2-8-x86' || 'ubuntu-latest' }}
+    runs-on: ${{ inputs['use-cncf-hosted-runner'] && 'cncf-ubuntu-2-8-x86' || 'ubuntu-latest' }}
     permissions:
       contents: read
       security-events: write  # for zizmor to upload SARIF results

scorecard/README.md

@@ -31,7 +31,7 @@ jobs:
 
 Pin `<sha-or-tag>` to a commit SHA or release tag in this repository. No secrets are required.
 
-For reusable workflow callers, the optional Boolean `use-cncf-hosted-runner` input defaults to `false`. When it is `true`, both Scorecard jobs run on `cncf-ubuntu-2-8-x86`; when it is `false` or omitted, both jobs run on `ubuntu-latest`. Runs triggered directly in `open-telemetry/shared-workflows` always use `cncf-ubuntu-2-8-x86`. The mapping is fixed; callers cannot provide another runner label.
+The optional Boolean `use-cncf-hosted-runner` input defaults to `false`. When it is `true`, both Scorecard jobs run on `cncf-ubuntu-2-8-x86`; when it is `false` or omitted, both jobs run on `ubuntu-latest`. Runs triggered directly in this repository use `ubuntu-latest`. The mapping is fixed; callers cannot provide another runner label.
 
 ## What gets filtered
 

zizmor/README.md

@@ -32,7 +32,7 @@ jobs:
 
 Pin `<sha-or-tag>` to a commit SHA or release tag in this repository. No secrets are required. The workflow uses zizmor's `regular` persona by default.
 
-For reusable workflow callers, the optional Boolean `use-cncf-hosted-runner` input defaults to `false`. When it is `true`, the Zizmor job runs on `cncf-ubuntu-2-8-x86`; when it is `false` or omitted, the job runs on `ubuntu-latest`. Runs triggered directly in `open-telemetry/shared-workflows` always use `cncf-ubuntu-2-8-x86`. The mapping is fixed; callers cannot provide another runner label.
+The optional Boolean `use-cncf-hosted-runner` input defaults to `false`. When it is `true`, the Zizmor job runs on `cncf-ubuntu-2-8-x86`; when it is `false` or omitted, the job runs on `ubuntu-latest`. Runs triggered directly in this repository use `ubuntu-latest`. The mapping is fixed; callers cannot provide another runner label.
 
 To use a different persona, pass the `persona` input: