.github/workflows: Migrate workflows to Blacksmith runners

.github/workflows/go-cli.yml

@@ -13,7 +13,7 @@
 
 jobs:
   lint-and-test:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: read
     steps:
@@ -47,85 +47,85 @@
           if-no-files-found: error
 
   e2e:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: lint-and-test
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
       - uses: go-task/setup-task@v2
         with:
           version: 3.x
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - run: task coverage:e2e
       - name: Coverage summary
         if: always()
         run: go run ./cmd/devtool coverage-report artifacts/coverage/data/e2e "e2e" >> "$GITHUB_STEP_SUMMARY"
       - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: covdata-e2e
           path: artifacts/coverage/data/e2e
           if-no-files-found: error
       - if: always()
         run: task clean
 
   # Hermetic parity gate: read-configuration golden comparison + the contract
   # lane of the parity matrix (flag validation / output contract, no Docker).
   parity:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: lint-and-test
     steps:
       - uses: actions/checkout@v7
         with:
           submodules: recursive
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
       - uses: actions/setup-node@v7
         with:
           node-version: "20"
       - uses: go-task/setup-task@v2
         with:
           version: 3.x
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - run: task reference
       - run: task parity:contract
       - run: task parity:network
       # Coverage is measured separately with an instrumented Go binary. Keep the
       # functional parity run above release-like, and avoid conflating subprocess
       # coverage with the hermetic unit profile.
       - run: task coverage:parity-contract
       - name: Coverage summary
         if: always()
         run: go run ./cmd/devtool coverage-report artifacts/coverage/data/contract "parity:contract" >> "$GITHUB_STEP_SUMMARY"
       - if: always()
         run: |
           mkdir -p artifacts
           git -C reference rev-parse HEAD > artifacts/reference-commit.txt
       - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: parity-contract-network-v0.88.0
           path: artifacts/
           if-no-files-found: error
       - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: covdata-contract
           path: artifacts/coverage/data/contract
           if-no-files-found: error
 
   # "Did the repo change today?" gate for the expensive daily lanes. Manual dispatch
   # always runs; a scheduled run only proceeds when HEAD has a commit within the last
   # day (devtool daily-changed) — on a private/billed repo this skips the daily matrix
   # on quiet days. Runs on schedule/dispatch so the daily lanes' `needs:` is satisfied.
   daily-changes:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     outputs:
       run: ${{ steps.check.outputs.run }}
     steps:
@@ -161,7 +161,7 @@
       && needs.lint-and-test.result == 'success'
       && (github.event_name == 'push' || github.event_name == 'pull_request'
           || needs.daily-changes.outputs.run == 'true')
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     strategy:
       fail-fast: false
       matrix:
@@ -240,7 +240,7 @@
   parity-publish-full:
     needs: [lint-and-test, daily-changes]
     if: needs.daily-changes.outputs.run == 'true'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v7
         with:
@@ -268,7 +268,7 @@
   # publish) into the one true cross-lane number.
   parity-runtime-gate:
     if: always()
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: [lint-and-test, e2e, parity, parity-runtime, parity-publish-full]
     steps:
       - uses: actions/checkout@v7
@@ -313,17 +313,17 @@
           done
 
   cross-compile:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: lint-and-test
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
       - uses: go-task/setup-task@v2
         with:
           version: 3.x
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - run: task build:cross
       - run: ls -lh dist/

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
   # exists; on dispatch we compute the version and validate the tag is free, but
   # DO NOT tag yet (the `tag` job below tags only after the gates pass).
   prepare:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     outputs:
       version: ${{ steps.resolve.outputs.version }}
       tag: ${{ steps.resolve.outputs.tag }}
@@ -76,7 +76,7 @@ jobs:
   # Hermetic gates — the same task targets CI runs on every push/PR.
   # The release is blocked unless these pass.
   gate:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: prepare
     steps:
       - uses: actions/checkout@v7
@@ -106,7 +106,7 @@ jobs:
 
   # Runtime lane (real Docker containers). ubuntu-latest ships Docker.
   gate-runtime:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: prepare
     steps:
       - uses: actions/checkout@v7
@@ -144,7 +144,7 @@ jobs:
   # skipped (the tag already exists). The GITHUB_TOKEN push does not re-trigger the
   # workflow, so there is no second run.
   tag:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: [prepare, gate, gate-runtime]
     if: github.event_name == 'workflow_dispatch'
     steps:
@@ -160,7 +160,7 @@ jobs:
           git push origin "${{ needs.prepare.outputs.tag }}"
 
   goreleaser:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: [prepare, gate, gate-runtime, tag]
     # `tag` is skipped on the push path, so gate on explicit success/skip rather
     # than the default all-succeeded semantics.
@@ -193,7 +193,8 @@ jobs:
       # Multi-arch image build (arm64 emulated) + buildx driver for the
       # dockers:/docker_manifests: blocks in .goreleaser.yml.
       - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@v1
 
       # GHCR login. Only reached on the tag path (this workflow is push.tags),
       # never on PRs, so images are pushed exclusively from an approved tag run.
@@ -270,7 +271,7 @@ jobs:
 
   # Non-gating: perf/distribution metrics recorded per release, never blocks.
   metrics:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: [prepare, goreleaser]
     continue-on-error: true
     steps: