From e61d01503095fe28c5d3d57ecc44a930f288ecac Mon Sep 17 00:00:00 2001
From: AojdevStudio <aojdevstudio@users.noreply.github.com>
Date: Wed, 28 Oct 2026 06:05:22 -0500
Subject: [PATCH 1/2] ci: run Linux jobs on hosted Ubuntu and stop uploading
 GitHub artifacts

---
 .github/workflows/ci.yml       | 14 ++------------
 .github/workflows/hush-ios.yml |  8 --------
 .github/workflows/pr-kit.yml   |  2 +-
 3 files changed, 3 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 59f6658..e31e1ad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   secret-scan:
-    runs-on: [self-hosted, linux, dev-substrate]
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
@@ -19,20 +19,10 @@ jobs:
           TMPDIR: ${{ runner.temp }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_CONFIG: .gitleaks.toml
-          # The action's upload has no retention input, so the next step uploads the report.
           GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
-      - name: Preserve gitleaks report
-        # Upload only this run's report. The self-hosted workspace can hold an older one.
-        if: ${{ !cancelled() && steps.gitleaks.outcome != 'skipped' }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: gitleaks-results.sarif
-          path: results.sarif
-          if-no-files-found: ignore
-          retention-days: 7
 
   check:
-    runs-on: [self-hosted, linux, dev-substrate]
+    runs-on: ubuntu-latest
     needs: secret-scan
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/hush-ios.yml b/.github/workflows/hush-ios.yml
index ddb87f2..9d1d921 100644
--- a/.github/workflows/hush-ios.yml
+++ b/.github/workflows/hush-ios.yml
@@ -41,11 +41,3 @@ jobs:
               raise SystemExit('Release binary contains the UI test harness')
           PY
           python3 scripts/check-sqlite.py .build/ReleaseCheck/Build/Products/Release-iphoneos/Hush.app/Hush
-      - name: Preserve test results
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: hush-ios-tests
-          path: hush-ios/.build/results/*.xcresult
-          if-no-files-found: ignore
-          retention-days: 7
diff --git a/.github/workflows/pr-kit.yml b/.github/workflows/pr-kit.yml
index 6c3a8e2..4cc8018 100644
--- a/.github/workflows/pr-kit.yml
+++ b/.github/workflows/pr-kit.yml
@@ -19,7 +19,7 @@ jobs:
       github.actor != 'dependabot[bot]' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.user.login != 'dependabot[bot]'
-    runs-on: [self-hosted, linux, dev-substrate]
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:

From 39374ca75e7bfe7cde751c4e7078c6d4acda39dd Mon Sep 17 00:00:00 2001
From: AojdevStudio <aojdevstudio@users.noreply.github.com>
Date: Wed, 28 Oct 2026 06:10:48 -0500
Subject: [PATCH 2/2] ci: install libpam0g-dev on hosted Ubuntu for the bws-tui
 link step

---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e31e1ad..342677d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,6 +32,8 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy,rustfmt
+      - name: Install the PAM headers bws-tui links against
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq libpam0g-dev
       - name: Install job-scoped Bun
         env:
           BUN_JOB_DIR: ${{ runner.temp }}/bun