ci: add guarded Nexus Linux runner selection

[neuralnexus]

Summary

• Adds variable-driven Nexus selection for the workflow jobs below.
• Nexus is considered only for push, schedule, or workflow_dispatch on the repository default branch.
• Pull requests (including same-repository PRs), tags, non-default refs, and all other events keep the GitHub-hosted fallback.
• If a selector variable is unset, the job stays on its listed hosted runner.
• Existing job topology is unchanged; only runner routing and the preferred hosted fallback change.
• No source, dependency, or application behavior is changed.

Runner routing

Workflow / job	Nexus selector variable	Hosted fallback
ci.yml / checks	NEXUS_RUNS_ON_LINUX	ubuntu-26.04
security-dast.yml / zap-baseline	NEXUS_RUNS_ON_LINUX_DOCKER	ubuntu-26.04
security-sast.yml / dependency-review	NEXUS_RUNS_ON_LINUX	ubuntu-26.04
security-sast.yml / codeql	NEXUS_RUNS_ON_LINUX_CODEQL	ubuntu-26.04
security-sast.yml / secret-scan	NEXUS_RUNS_ON_LINUX_PRIVILEGED	ubuntu-26.04
security-sast.yml / secret-scan-history	NEXUS_RUNS_ON_LINUX_PRIVILEGED	ubuntu-26.04

• NEXUS_RUNS_ON_LINUX selects the generic Linux/X64 Nexus fleet.
• NEXUS_RUNS_ON_LINUX_CODEQL selects the validated CodeQL-capable Linux/X64 Nexus fleet.
• NEXUS_RUNS_ON_LINUX_DOCKER selects the validated Docker-capable Linux/X64 Nexus fleet.
• NEXUS_RUNS_ON_LINUX_PRIVILEGED selects the validated privileged-install Linux/X64 Nexus fleet.

Validation

• The diff is limited to 3 root-level GitHub Actions workflow files; every non-routing line, if any, matches a reviewed validation repair.
• Every Nexus expression uses the canonical default-branch trust gate and a GitHub-hosted fallback.
• git diff --check passes.
• actionlint passes across the repository workflows.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	hexyr-com	40458ed	Commit Preview URL Branch Preview URL	Aug 25 2026, 08:11 AM