ci: migrate workflows to ubuntu-latest runners

.github/actions/setup-env/action.yml

@@ -9,20 +9,20 @@
 #   2. golangci-lint binary + analysis cache keyed on Makefile +
 #      .golangci.yml. Analysis cache is the win (~10s warm vs ~90s).
 #
-#   3. pnpm store (path resolved at runtime) keyed on all three
-#      lockfiles. The three pnpm projects (clients/ts, tests/e2e/sdk,
-#      docs) share one store via hardlinks. Path is dynamic because
+#   3. pnpm store (path resolved at runtime) keyed on the root
+#      lockfile — the three pnpm projects (clients/ts, tests/e2e/sdk,
+#      docs) share one workspace lockfile + store. Path is dynamic because
 #      pnpm's documented default ~/.local/share/pnpm/store only
 #      applies when $HOME and the project tree share a mount; on some
 #      runners it falls back to a workspace-relative path. Hard-coding
 #      the default silently fails the save with a Path Validation
 #      Error.
 #
 #   4. Playwright browser cache (~/.cache/ms-playwright) keyed on the
-#      docs lockfile. ~130 MB Chromium download otherwise re-fetched
+#      root lockfile. ~130 MB Chromium download otherwise re-fetched
 #      every run. See #132.
 #
-#   5. Astro content-collection cache (docs/.astro/) keyed on docs
+#   5. Astro content-collection cache (docs/.astro/) keyed on the root
 #      lockfile + astro.config.mjs. Speeds up warm `astro build` —
 #      unchanged content skips the parse + transform pipeline. See
 #      #132.
@@ -95,20 +95,20 @@ runs:
       id: pnpm-cache
       with:
         path: ${{ steps.pnpm-store.outputs.path }}
-        key: pnpm-${{ runner.os }}-${{ hashFiles('clients/ts/pnpm-lock.yaml', 'tests/e2e/sdk/pnpm-lock.yaml', 'docs/pnpm-lock.yaml') }}
+        key: pnpm-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
         restore-keys: |
           pnpm-${{ runner.os }}-
 
     # Playwright Chromium binary (~130 MB) lives outside the pnpm store at
     # ~/.cache/ms-playwright. Without this cache, every CI run cold-pulls
     # Chromium during install-playwright-docs — adds 30-60s per run. Keyed
-    # on docs/pnpm-lock.yaml since that's where the Playwright version is
-    # locked. Closes the Playwright half of #132.
+    # on the root pnpm-lock.yaml since that's where the Playwright version
+    # is locked. Closes the Playwright half of #132.
     - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       id: playwright-cache
       with:
         path: ~/.cache/ms-playwright
-        key: playwright-${{ runner.os }}-${{ hashFiles('docs/pnpm-lock.yaml') }}
+        key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
         restore-keys: |
           playwright-${{ runner.os }}-
 
@@ -123,7 +123,7 @@ runs:
       id: astro-cache
       with:
         path: docs/.astro
-        key: astro-${{ runner.os }}-${{ hashFiles('docs/pnpm-lock.yaml', 'docs/astro.config.mjs') }}
+        key: astro-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'docs/astro.config.mjs') }}
         restore-keys: |
           astro-${{ runner.os }}-
 

.github/workflows/admin-approval.yml

@@ -62,7 +62,7 @@ jobs:
     # entries — the posted commit status is the merge gate; this
     # job name just advertises the workflow.
     name: Evaluate admin reviews
-    runs-on: [wave-rf-runners]
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       # Fetch Dependabot's update-type so the bypass below can scope

.github/workflows/ci.yml

@@ -28,8 +28,9 @@ jobs:
     # build artifacts stay hot across phases. Parallelism lives in the
     # Makefile.
     name: CI
-    runs-on: [wave-rf-runners]
-    # Warm: ~2 min. Cold: ~5-8 min. 45 leaves headroom + a hung-job cap.
+    runs-on: ubuntu-latest
+    # Public-repo ubuntu-latest (4-core). Warm: ~5-10 min. Cold: ~15.
+    # 45 leaves headroom + a hung-job cap.
     timeout-minutes: 45
     steps:
       # Composite actions can't self-checkout — checkout first.
@@ -84,21 +85,21 @@ jobs:
         uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ steps.setup.outputs.pnpm-store-path }}
-          key: pnpm-${{ runner.os }}-${{ hashFiles('clients/ts/pnpm-lock.yaml', 'tests/e2e/sdk/pnpm-lock.yaml', 'docs/pnpm-lock.yaml') }}
+          key: pnpm-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
 
       - name: Save Playwright browser cache
         if: steps.setup.outputs.playwright-cache-hit != 'true'
         uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.cache/ms-playwright
-          key: playwright-${{ runner.os }}-${{ hashFiles('docs/pnpm-lock.yaml') }}
+          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
 
       - name: Save Astro content cache
         if: steps.setup.outputs.astro-cache-hit != 'true'
         uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: docs/.astro
-          key: astro-${{ runner.os }}-${{ hashFiles('docs/pnpm-lock.yaml', 'docs/astro.config.mjs') }}
+          key: astro-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'docs/astro.config.mjs') }}
 
       # Coverage in the job-summary panel. See #133 for post-launch
       # reporting decisions.

.github/workflows/cleanup-ghcr.yml

@@ -18,7 +18,7 @@ permissions:
 jobs:
   cleanup:
     name: Prune dev-<sha> tags
-    runs-on: [wave-rf-runners]
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Cleanup

.github/workflows/dependabot-automerge.yml

@@ -24,7 +24,7 @@ permissions:
 jobs:
   auto-merge:
     if: github.actor == 'dependabot[bot]'
-    runs-on: [wave-rf-runners]
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Checkout main (trusted composite-action source)

.github/workflows/goreleaser-validate.yml

@@ -29,7 +29,7 @@ concurrency:
 jobs:
   validate:
     name: Validate snapshot build
-    runs-on: [wave-rf-runners]
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

.github/workflows/housekeeping.yml

@@ -33,7 +33,7 @@ concurrency:
 jobs:
   housekeeping:
     name: PR housekeeping
-    runs-on: [wave-rf-runners]
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Checkout main (board-config + composite-action source)

.github/workflows/publish-dev.yml

@@ -36,7 +36,7 @@ concurrency:
 jobs:
   publish:
     name: Build + push :dev image
-    runs-on: [wave-rf-runners]
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -49,6 +49,14 @@ jobs:
         with:
           go-version-file: "go.mod"
 
+      # dockers_v2 builds the linux/amd64+arm64 manifest via `docker buildx`;
+      # the GitHub-hosted runner's default docker driver can't build
+      # multi-platform images, so create a docker-container builder. No QEMU
+      # needed — Dockerfile.goreleaser stages are $BUILDPLATFORM-pinned /
+      # COPY-only by design.
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
       - name: Login to GitHub Container Registry
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:

.github/workflows/publish-npm.yml

@@ -42,7 +42,7 @@ jobs:
   dev:
     name: Dev snapshot (@dev)
     if: github.ref == 'refs/heads/main'
-    runs-on: [wave-rf-runners]
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -93,7 +93,7 @@ jobs:
   release:
     name: Release (sdk-v* tag)
     if: startsWith(github.ref, 'refs/tags/sdk-v')
-    runs-on: [wave-rf-runners]
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       contents: write # create the GitHub Release

.github/workflows/release.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   release:
     name: Release
-    runs-on: [wave-rf-runners]
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -23,6 +23,14 @@ jobs:
         with:
           go-version-file: "go.mod"
 
+      # dockers_v2 builds the linux/amd64+arm64 manifest via `docker buildx`;
+      # the GitHub-hosted runner's default docker driver can't build
+      # multi-platform images, so create a docker-container builder. No QEMU
+      # needed — Dockerfile.goreleaser stages are $BUILDPLATFORM-pinned /
+      # COPY-only by design. Mirrors publish-dev.yml.
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
       - name: Login to GitHub Container Registry
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:

.github/workflows/triage.yml

@@ -27,7 +27,7 @@ concurrency:
 jobs:
   classify:
     name: Classify and label
-    runs-on: [wave-rf-runners]
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     # Skip re-triggering on our own label edits.
     if: github.actor != 'github-actions[bot]' && github.event.issue.pull_request == null

internal/ingest/sweeper_test.go

@@ -177,11 +177,14 @@ func TestFindGapSequence(t *testing.T) {
 		return &jetstream.RawStreamMsg{Time: now.Add(-20 * time.Minute)}, nil
 	}
 	// boundary at seq 60: seqs 1..60 are before cutoff, 61..100 are within window.
+	// Minute (not second) margins: the impl recomputes cutoff at call time, so
+	// parallel-subtest scheduling delay eats into the margin — 1s margins flaked
+	// on loaded 2-core CI runners (#283).
 	boundaryAt60 := func(_ context.Context, seq uint64, _ ...jetstream.GetMsgOpt) (*jetstream.RawStreamMsg, error) {
 		if seq <= 60 {
-			return &jetstream.RawStreamMsg{Time: cutoff.Add(-time.Duration(61-seq) * time.Second)}, nil
+			return &jetstream.RawStreamMsg{Time: cutoff.Add(-time.Duration(61-seq) * time.Minute)}, nil
 		}
-		return &jetstream.RawStreamMsg{Time: cutoff.Add(time.Duration(int64(seq-60)) * time.Second)}, nil //nolint:gosec // test-only, values are small
+		return &jetstream.RawStreamMsg{Time: cutoff.Add(time.Duration(int64(seq-60)) * time.Minute)}, nil //nolint:gosec // test-only, values are small
 	}
 	// seqs 40..60 missing (already purged), <40 are old, >60 are within window.
 	sparseSequences := func(_ context.Context, seq uint64, _ ...jetstream.GetMsgOpt) (*jetstream.RawStreamMsg, error) {