ci: run Linux jobs on hosted Ubuntu and stop uploading GitHub artifacts

.github/workflows/ci.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   secret-scan:
-    runs-on: [self-hosted, linux, dev-substrate]
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
@@ -19,20 +19,10 @@ jobs:
           TMPDIR: ${{ runner.temp }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_CONFIG: .gitleaks.toml
-          # The action's upload has no retention input, so the next step uploads the report.
           GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
-      - name: Preserve gitleaks report
-        # Upload only this run's report. The self-hosted workspace can hold an older one.
-        if: ${{ !cancelled() && steps.gitleaks.outcome != 'skipped' }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: gitleaks-results.sarif
-          path: results.sarif
-          if-no-files-found: ignore
-          retention-days: 7
 
   check:
-    runs-on: [self-hosted, linux, dev-substrate]
+    runs-on: ubuntu-latest
     needs: secret-scan
     steps:
       - uses: actions/checkout@v4
@@ -42,6 +32,8 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy,rustfmt
+      - name: Install the PAM headers bws-tui links against
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq libpam0g-dev
       - name: Install job-scoped Bun
         env:
           BUN_JOB_DIR: ${{ runner.temp }}/bun

.github/workflows/hush-ios.yml

@@ -41,11 +41,3 @@ jobs:
               raise SystemExit('Release binary contains the UI test harness')
           PY
           python3 scripts/check-sqlite.py .build/ReleaseCheck/Build/Products/Release-iphoneos/Hush.app/Hush
-      - name: Preserve test results
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: hush-ios-tests
-          path: hush-ios/.build/results/*.xcresult
-          if-no-files-found: ignore
-          retention-days: 7

.github/workflows/pr-kit.yml

@@ -19,7 +19,7 @@ jobs:
       github.actor != 'dependabot[bot]' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.user.login != 'dependabot[bot]'
-    runs-on: [self-hosted, linux, dev-substrate]
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with: