[harlan-zw]

🔗 Linked issue

No linked issue.

❓ Type of change

• 📖 Documentation
• 🐞 Bug fix
• 👌 Enhancement
• ✨ New feature
• 🧹 Chore
• ⚠️ Breaking change

📚 Description

Making this repository public exposes registered self-hosted runners to modified fork workflows. Move every job to GitHub-hosted runners and pin shared CI to a commit. Add the MIT license declared in package.json and a publication runbook.

📝 Migration

After merging, remove this repository's runner pools on both hosts and its remaining runner registrations. Follow the publication runbook before changing visibility.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-06 15:40 UTC.

GitHub merged this pull request.

• Logged (25/100): The PR diagram routes same-repository branch PRs through the retired workstation pool, contradicting the change it illustrates. View code
  • Ask an agent to verify and fix this finding
• Logged (15/100): This change makes the deploy workflow's security-rationale comment factually wrong without updating it. View code
  • Ask an agent to verify and fix this finding
• Logged (10/100): The heartbeat wrapper script and its unit test are dead code left behind by a cleanup chore. View code
  • Ask an agent to verify and fix this finding

db607494-99b8-4575-8300-b22acf3cef53

Selected findings run after merge and open separate pull requests.

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results

[harlan-zw]

🤖 Harlan Agent Kit completed the publication audit. These checks are outside CI:

• Reviewed Gitleaks results for tracked files and local Git history. No confirmed credential leak.
• Scanned 1,458 retained Actions logs, 203 artifacts, and available issue and PR discussion text.
• Downloaded 377 attachments. Scanned SVG files and OCR text from all 291 raster images.
• Compared ten current local credential values against downloaded records and attachment text. No matches.
• All 1,287 retained-record scanner hits were commit-based cache keys.

Expired records were unavailable. OCR can miss small text, encoded values, and QR codes.

Before publication, verify hosted production deployment. Then apply runner PR harlan-zw/hogwild-gh-runner#15 and remove remaining registrations.