[plan] Fix pr_runs_on_self_hosted warning in smoke-copilot-arm workflow

[github-actions]

Objective

Fix the pr_runs_on_self_hosted poutine warning in smoke-copilot-arm where a PR-triggered workflow runs on a self-hosted ARM runner, as reported in discussion #18283.

Context

The smoke-copilot-arm workflow is triggered by pull requests and runs on a self-hosted ubuntu-24.04-arm runner. This is a security concern because fork PRs can execute untrusted code on self-hosted infrastructure, potentially compromising the runner or extracting secrets.

• Tool: poutine
• Severity: Warning
• Affected file: .github/workflows/smoke-copilot-arm.md (compiles to line 278 in .lock.yml)
• Runner: ubuntu-24.04-arm (self-hosted)

Approach

Option A (Preferred): Add an environment protection rule that requires approval before the self-hosted runner job executes for PR workflows:

1. In the .github/workflows/smoke-copilot-arm.md frontmatter, add an environment field to the job that uses the self-hosted runner
2. Configure a GitHub environment (e.g., arm-runner) with required reviewers so fork PRs don't auto-execute

Option B: Restrict the workflow to only run on PRs from the same repository (not forks):

# In the workflow trigger
on:
  pull_request:
    # Restrict to non-fork PRs only

Or add a job condition:

if: github.event.pull_request.head.repo.full_name == github.repository

Option C: Switch to a GitHub-hosted ARM runner if available (ubuntu-24.04-arm as a hosted runner)

1. Open .github/workflows/smoke-copilot-arm.md
2. Locate where runs-on: ubuntu-24.04-arm is set
3. Apply the chosen fix
4. Run make recompile
5. Run make agent-finish

Files to Modify

• .github/workflows/smoke-copilot-arm.md — add environment protection or fork restriction

Acceptance Criteria

• Fork PRs cannot automatically run untrusted code on the self-hosted ARM runner
• The fix is documented with a comment explaining the security rationale
• make recompile succeeds
• make agent-finish passes
• poutine no longer reports pr_runs_on_self_hosted for this workflow

Generated by Plan Command for issue #discussion #18283

• expires on Feb 27, 2026, 6:53 AM UTC