[thymikee]

Summary

• Run the publish job in release.yml on ubuntu-latest instead of a Blacksmith runner.
• Since .github/workflows: Migrate workflows to Blacksmith runners #4185 the nightly Release has failed at npm publish --provenance with a 422: Unsupported GitHub Actions runner environment: "self-hosted". Only "github-hosted" runners are supported when publishing with provenance. A stable release would fail the same way.
• Every other Blacksmith job is unchanged. The trusted-publishing setup (id-token: write, npm-publish environment, scripts/release-publish.mjs) is unchanged.

Other jobs checked

• mcp-registry (publish-mcp-registry.yml) also has id-token: write and stays on Blacksmith. It authenticates with mcp-publisher login github-oidc, which exchanges the workflow's OIDC token. It does not publish to npm and does not use sigstore provenance, so no runner-environment check applies. I found no evidence it needs a hosted runner. If the first stable release fails there, move it in a follow-up.
• No other workflow uses --provenance. The repo has no workflow guard that covers runs-on, so I added no check.

Verification

• pnpm check:affected --run passed on the exact pushed commit (exactCommit=true). The first run failed the slow-test gate on unrelated daemon tests while another worker's gate ran on the same host. The rerun passed.
• The Release workflow ran on this PR in dry-run mode: run 42185955105 is green (Plan and Build passed, the rest skipped). It skips the publish job, so it does not prove provenance. It does validate the YAML, job graph and needs.
• The post-merge nightly is the verification step. After merge, a maintainer triggers a nightly with workflow_dispatch on main and confirms every package publishes with provenance. I did not dispatch the Release workflow.

Refs #2028

🤖 Generated with Claude Code

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	6.15 MB	6.15 MB	0 B
Package (unpacked)	6.14 MB	6.14 MB	0 B
Package (download)	1.86 MB	1.86 MB	+2 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	22.1 ms	22.6 ms	+0.4 ms
CLI --help	45.0 ms	45.7 ms	+0.7 ms

[cubic-dev-ai]

No issues found across 1 file

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[apex-sentinel-staging]

Apex Sentinel

Verdict: approve

No findings.

Reviewed with this repository's own Sentinel configuration (7335965dea41).

Reply under an inline comment with @apex-sentinel-staging note ... or @apex-sentinel-staging pivot ... to re-check that finding.
Comment @apex-sentinel-staging review on this conversation to run a full review.

[thymikee]

This is ready at 1796818. All 28 checks pass, but the release dry-run skips publish, so no check exercises the changed job. The first nightly after merge is what proves npm provenance, so please dispatch one and confirm every package publishes with provenance. No conflicts. Not blocking, and you can take or leave it: the job still uses useblacksmith/checkout on a non-Blacksmith runner (https://github.com/callstack/agent-device/blob/1796818/.github/workflows/release.yml#L119). It should fall back to a plain clone, but I could not confirm that on a GitHub-hosted runner, so if the nightly fails at checkout, switch it to actions/checkout. I also could not confirm that the MCP Registry job's github-oidc login works from its Blacksmith runner, so the follow-up you noted for the first stable release still applies.