ci: run the workflows on the runplane runners

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   go:
-    runs-on: ubuntu-latest
+    runs-on: runplane
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
@@ -38,7 +38,7 @@ jobs:
           GOCACHE: /tmp/go-root-cache
 
   web:
-    runs-on: ubuntu-latest
+    runs-on: runplane
     defaults:
       run:
         working-directory: web
@@ -58,15 +58,20 @@ jobs:
       - run: pnpm build
 
   shell:
-    runs-on: ubuntu-latest
+    runs-on: runplane
     steps:
       - uses: actions/checkout@v7
+      - name: Install shellcheck
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -y -q --no-install-recommends shellcheck
       - run: shellcheck -s sh install.sh kernel/build.sh deploy/*.sh
       - name: install.sh dry runs on Ubuntu, Debian, and Fedora
         run: sh deploy/test-install.sh
 
   # A real container mode install on the runner VM: Docker, Sysbox, the
-  # systemd units, the service, and the uninstall.
+  # systemd units, the service, and the uninstall. runplane sandboxes have no
+  # systemd, thus this job uses a GitHub-hosted runner.
   install:
     runs-on: ubuntu-24.04
     steps:

.github/workflows/images.yml

@@ -2,9 +2,8 @@
 # ghcr.io/<owner>/<repo>/runner-ubuntu-24.04 and -26.04. runplane pulls the
 # "latest" tag. A weekly build gets the new packages and tool versions.
 #
-# The arm64 builds use the ubuntu-24.04-arm runners. For a private repository
-# without these runners, change the runner to ubuntu-24.04 and add
-# docker/setup-qemu-action (the arm64 build is then much slower).
+# The builds use the runplane runners. QEMU builds the architecture that the
+# runner does not have, which makes that build much slower.
 name: Images
 
 on:
@@ -27,14 +26,15 @@ jobs:
       matrix:
         image: [ubuntu-24.04, ubuntu-26.04]
         arch: [amd64, arm64]
-    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
+    runs-on: runplane
     permissions:
       contents: read
       packages: write
     steps:
       - uses: actions/checkout@v7
       - name: Image name
         run: echo "IMAGE=ghcr.io/${GITHUB_REPOSITORY,,}/runner-${{ matrix.image }}" >> "$GITHUB_ENV"
+      - uses: docker/setup-qemu-action@v4
       - uses: docker/setup-buildx-action@v4
       - uses: docker/login-action@v4
         if: github.event_name != 'pull_request'
@@ -82,7 +82,7 @@ jobs:
     strategy:
       matrix:
         image: [ubuntu-24.04, ubuntu-26.04]
-    runs-on: ubuntu-24.04
+    runs-on: runplane
     permissions:
       contents: read
       packages: write

.github/workflows/kernel.yml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       matrix:
         arch: [x86_64, aarch64]
-    runs-on: ubuntu-24.04
+    runs-on: runplane
     steps:
       - uses: actions/checkout@v7
       - name: Install the build packages

.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
     uses: ./.github/workflows/kernel.yml
 
   build:
-    runs-on: ubuntu-latest
+    runs-on: runplane
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
@@ -59,7 +59,7 @@ jobs:
 
   publish:
     needs: [build, kernel]
-    runs-on: ubuntu-latest
+    runs-on: runplane
     permissions:
       contents: write
     steps:

README.md

@@ -319,4 +319,4 @@ A person who can change the release files can also change the `install.sh` of th
 
 **Caution:** Do not change the key after the first release. A binary with the earlier key cannot do a self-update to a release with a new key. On these servers, run the install command of the new release again.
 
-The `images.yml` workflow pushes the base images to GHCR each week and after each change in `images/`. The arm64 images use the `ubuntu-24.04-arm` runners of GitHub. After the first push, set the visibility of each image package on GHCR to public. Then servers pull the base images without a login, and VM mode does not need Docker. To do a check, run `docker logout ghcr.io && docker pull ghcr.io/<owner>/<repo>/runner-ubuntu-24.04:latest`.
+The `images.yml` workflow pushes the base images to GHCR each week and after each change in `images/`. The builds use the `runplane` label. QEMU builds the architecture that the runner does not have. After the first push, set the visibility of each image package on GHCR to public. Then servers pull the base images without a login, and VM mode does not need Docker. To do a check, run `docker logout ghcr.io && docker pull ghcr.io/<owner>/<repo>/runner-ubuntu-24.04:latest`.