feat(ci-cd)!: default runs-on to the GitHub-hosted runner

[Laffs2k5]

Closes the last loose end from the self-hosted runner migration: the runs-on input still fell back to the pool that is about to be torn down.

Problem

All three reusable workflows declared runs-on with default: "", and each job resolved it as:

runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }}

Once the dsb-builder VMSS is scaled to 0 and deleted, that fallback points at a runner group with no runners. A caller that omits the input would queue indefinitely rather than fail — with nothing in the run output to explain why.

Change

• default: "" → default: "builder-app-platform-ghr-ubuntu-large" in ci-cd-default.yml, ci-cd-build-deploy-maven-lib.yml and maven-artifacts-pruner.yml.
• The fromJSON([...]) fallback is removed from all nine job-level expressions rather than re-pointed, so the dead pool is not referenced anywhere in the workflows.
• Per-app overrides (matrix.app-vars.runs-on) are untouched and still win over the global input.
• Input descriptions and the two now-stale # ... else the self-hosted default comments updated to match.

Blast radius: none today

Every caller in the org passes runs-on explicitly — 72/72 caller workflow files across 69 active repos, verified 2026-10-05 by fetching every .github/workflows/ file in dsb-norge and checking the input. So no existing pipeline changes behaviour. What changes is what a new repo gets when it omits the line, which is the point of the change.

This is the Phase 6 default flip described in github-hosted-runners-implementation-plan.md.

Breaking change

Marked ! because a caller relying on the empty default to reach the self-hosted pool must now pass runs-on explicitly. No such caller exists in dsb-norge, and external consumers of this public repo could never have used the old default — the pool was DSB-internal.

Release

Releases here are git tags. After merge this needs a new v4.21 tag and the moving v4 tag advanced, otherwise callers on @v4 won't pick it up.

Review notes

• Nothing to run — these workflows have no CI of their own, and runs-on only resolves at call time.
• Worth eyeballing that all nine job expressions changed and none were missed: grep -rn "dsb-builder" .github/workflows/ should return only the three explanatory comments.
• The CLAUDE.md touch-up is a separate commit from the functional change.

🤖 Generated with Claude Code