From b21112430badd7c784e1036a4f634617f5c0171f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stefan=20Gr=C3=B6nke?= <stefan@gronke.net>
Date: Wed, 30 Sep 2026 09:24:57 +0000
Subject: [PATCH] ci: a runs-on input names the sealed job's runner

A caller on self-hosted runners passes its label, for example from an organization variable; the default stays ubuntu-latest.
---
 .github/workflows/ci.yml | 8 +++++++-
 CHANGELOG.md             | 1 +
 README.md                | 1 +
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f7a61c2..04776b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,6 +38,12 @@ on:
         description: Crate directory.
         type: string
         default: "."
+      runs-on:
+        description: >-
+          The runner label of the sealed job; a caller on self-hosted runners
+          passes its own, for example from an organization variable.
+        type: string
+        default: ubuntu-latest
 
 permissions:
   contents: read
@@ -45,7 +51,7 @@ permissions:
 jobs:
   sealed:
     name: sealed lint, test, cross-check, msrv
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runs-on }}
     steps:
       - uses: actions/checkout@v7.0.1
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index dfc59a4..3e460dd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com); releases are
 
 ### Added
 
+- `ci.yml`: `runs-on` names the runner of the sealed job (default `ubuntu-latest`), so a caller on self-hosted runners passes its label, for example `${{ vars.RUNNER_STANDARD || 'ubuntu-latest' }}`.
 - `rust-cache`: `cache-registry` (`"true"`, `"false"`, `"auto"`); `auto` skips the registry archive, restore and save alike, when `RUST_CI_CRATES_MIRROR` is set in the job environment, and the `registry-cached` output says what happened.
 - `sccache`: `namespace` puts a job's objects below the configured backend's key prefix (S3, GCS, Azure, WebDAV, Redis, Memcached, OSS, COS, or a subdirectory of `SCCACHE_DIR`), so tiers or platforms share one backend without sharing objects; it separates objects, not writers.
 - `route-git-token`: `remaps`, lines of `from=to` that fetch a dependency pinned at a URL outside the routed namespace from a repository on the host, with the token presented.
diff --git a/README.md b/README.md
index 1cf5e8f..b3811e0 100644
--- a/README.md
+++ b/README.md
@@ -68,6 +68,7 @@ jobs:
 | `features` | `""` | Feature flag for the sealed lint-and-test leg. |
 | `msrv` | `true` | Also verify the crate on its declared MSRV; skipped when `rust-version` is `msrv`. |
 | `working-directory` | `.` | Crate directory. |
+| `runs-on` | `ubuntu-latest` | The runner of the sealed job; a caller on self-hosted runners passes its label. |
 
 ## Actions