.github/workflows: Migrate workflows to Blacksmith runners

.github/workflows/codeql.yml

@@ -46,7 +46,7 @@ concurrency:
 jobs:
   analyze:
     name: Analyze JavaScript and TypeScript
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
     steps:
       - name: Checkout repository

.github/workflows/dependency-review.yml

@@ -17,7 +17,7 @@ concurrency:
 jobs:
   dependency-review:
     name: Dependency review
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     steps:
       - name: Checkout repository

.github/workflows/prerelease.yml

@@ -30,7 +30,7 @@ concurrency:
 
 jobs:
   select:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     outputs:
       changed: ${{ steps.candidate.outputs.changed }}
       version: ${{ steps.candidate.outputs.version }}

.github/workflows/release.yml

@@ -46,7 +46,7 @@ concurrency:
 jobs:
   build-release:
     name: Build Linux and Windows baseline release assets
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 60
     permissions:
       attestations: write
@@ -180,7 +180,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - runner: windows-latest
+          - runner: blacksmith-4vcpu-windows-2025
             arch: x64
             build_args: --single
             expected_executables: 1
@@ -277,7 +277,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - runner: macos-14
+          - runner: blacksmith-6vcpu-macos-15
             arch: arm64
           - runner: macos-15-intel
             arch: x64
@@ -349,7 +349,7 @@ jobs:
     name: Assemble and attest release assets
     if: ${{ always() && needs.build-release.result == 'success' && needs.build-windows.result == 'success' && needs.build-darwin.result == 'success' }}
     needs: [build-release, build-windows, build-darwin]
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       attestations: write
       contents: read
@@ -440,7 +440,7 @@ jobs:
     name: Create draft GitHub Release
     if: ${{ inputs.dry_run == false }}
     needs: assemble-release
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     environment: release
     permissions:

.github/workflows/security.yml

@@ -23,7 +23,7 @@ concurrency:
 jobs:
   repository-guards:
     name: Repository guards
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 10
     steps:
       - name: Checkout repository
@@ -139,7 +139,7 @@ jobs:
 
   deep-scanners:
     name: Deep security scanners
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 30
     permissions:
       contents: read

.github/workflows/stable-startup.yml

@@ -7,12 +7,15 @@ permissions:
   contents: read
 jobs:
   startup:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
         with:
           persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: "24"
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
         with:
           version: 11.0.9