ci: run CI on GitHub-hosted runners again (#26057)

for now we're only doing this on private repos

---------

Co-authored-by: JPeer264 <jan.peer@sentry.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: 3 people

.github/actions/install-dependencies/action.yml

@@ -1,64 +1,30 @@
 name: 'Install pnpm dependencies'
-description: 'Installs pnpm dependencies into node_modules folders on the Namespace cache volume.'
+description: 'Installs pnpm dependencies and caches them.'
+
+outputs:
+  cache_key:
+    description: 'The dependency cache key'
+    value: ${{ steps.compute_lockfile_hash.outputs.hash }}
 
 runs:
   using: 'composite'
   steps:
-    - name: List dependency paths
-      id: paths
-      run: |
-        {
-          echo 'paths<<EOF'
-          node -e 'const { workspaces } = require("./package.json"); for (const dir of [".", ...workspaces]) console.log(require("path").resolve(dir, "node_modules"))'
-          echo '~/.cache/mongodb-binaries'
-          echo '~/.cache/prisma'
-          echo 'EOF'
-        } >> "$GITHUB_OUTPUT"
-      shell: bash
-
-    - name: Mount dependency cache
-      uses: ./.github/actions/mount-pnpm-store
-      with:
-        path: ${{ steps.paths.outputs.paths }}
-
     - name: Install pnpm
       uses: ./.github/actions/install-pnpm
 
-    # When the node_modules layout changes, `pnpm install` keeps the `.bin` scripts of the workspace packages, which
-    # then point into a folder that the new layout does not have. Branches that change `nodeLinker` share this cache
-    # volume, so start from empty node_modules folders when the layout on the volume differs, or when an earlier
-    # install already left such broken `.bin` scripts behind.
-    - name: Remove node_modules of another layout
-      run: |
-        mapfile -t dirs < <(grep '/node_modules$' <<< "$DEPENDENCY_PATHS")
-        expected=$(pnpm config get node-linker)
-        if [[ "$expected" == undefined ]]; then
-          expected=isolated
-        fi
-        actual=$(node -p 'try { JSON.parse(require("fs").readFileSync("node_modules/.modules.yaml", "utf8")).nodeLinker ?? "" } catch { "" }')
-        if [[ -n "$actual" && "$actual" != "$expected" ]]; then
-          reason="The node_modules folders use the $actual layout, but nodeLinker is $expected."
-        else
-          broken=$(node "$GITHUB_ACTION_PATH/find-broken-bin.mjs" "${dirs[@]}")
-          if [[ -n "$broken" ]]; then
-            reason="The target of $broken does not exist."
-          fi
-        fi
-        if [[ -n "$reason" ]]; then
-          echo "$reason Removing the node_modules folders."
-          for dir in "${dirs[@]}"; do
-            if [[ -d "$dir" ]]; then
-              # The folders are mounted from the cache volume, so empty them instead of removing them
-              find "$dir/" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
-            fi
-          done
-        fi
-      env:
-        DEPENDENCY_PATHS: ${{ steps.paths.outputs.paths }}
+    - name: Compute dependency cache key
+      id: compute_lockfile_hash
+      run: node ./scripts/dependency-hash-key.js >> "$GITHUB_OUTPUT"
       shell: bash
 
-    # The cache volume can hold node_modules of another commit or branch. This is a no-op when they match
-    # pnpm-lock.yaml.
+    - name: Check dependency cache
+      uses: actions/cache@v6.1.0
+      id: cache_dependencies
+      with:
+        path: ${{ env.CACHED_DEPENDENCY_PATHS }}
+        key: ${{ steps.compute_lockfile_hash.outputs.hash }}
+
     - name: Install dependencies
+      if: steps.cache_dependencies.outputs.cache-hit != 'true'
       run: pnpm install --frozen-lockfile
       shell: bash

.github/actions/install-dependencies/find-broken-bin.mjs

@@ -1,5 +1,5 @@
 name: 'Install Playwright dependencies'
-description: 'Installs Playwright browsers and system dependencies, keeping both on the Namespace cache volume.'
+description: 'Installs Playwright dependencies and caches them.'
 inputs:
   browsers:
     description: 'What browsers to install.'
@@ -26,28 +26,43 @@ runs:
       shell: bash
       working-directory: ${{ inputs.cwd }}
 
-    - name: Mount Playwright cache
-      uses: namespacelabs/nscloud-cache-action@1124a6f3ce44e5cf84cc22111530961f4d2a15f9 # v1.7.0
+    - name: Restore cached playwright binaries
+      uses: actions/cache/restore@v6.1.0
+      id: playwright-cache
       if: steps.playwright-version.outputs.version != ''
       with:
-        cache: |
-          playwright
-          apt
+        path: |
+          ~/.cache/ms-playwright
+        # Bump the iteration when bumping runner images to use a new cache
+        key: playwright-${{ runner.os }}-iteration-1-${{ steps.playwright-version.outputs.version }}
 
-    # `--with-deps` names packages that the runner image already has (glib, mesa, nss, ...), and `apt-get install` would
-    # upgrade them to the latest Ubuntu update. That is half of the download on a cold cache, and the image versions work.
-    - name: Keep installed apt packages
-      if: steps.playwright-version.outputs.version != ''
-      run: echo 'APT::Get::Upgrade "false";' | sudo tee /etc/apt/apt.conf.d/99-no-upgrade > /dev/null
+    # We always install all browsers, if uncached
+    # `npx` runs outside the repo, so it can't pick up a `playwright` that a parallel `pnpm install` is still linking.
+    - name: Install Playwright dependencies (uncached)
+      env:
+        PLAYWRIGHT_VERSION: ${{ steps.playwright-version.outputs.version }}
+      run: npx -y "playwright@$PLAYWRIGHT_VERSION" install chromium webkit firefox --with-deps
+      if: steps.playwright-version.outputs.version != '' && steps.playwright-cache.outputs.cache-hit != 'true'
       shell: bash
+      working-directory: ${{ runner.temp }}
 
-    # Downloads only the browsers and apt packages that are not on the cache volume yet. `npx` runs outside the repo,
-    # so it can't pick up a `playwright` that a parallel `pnpm install` is still linking.
-    - name: Install Playwright
-      if: steps.playwright-version.outputs.version != ''
+    - name: Install Playwright system dependencies only (cached)
       env:
         PLAYWRIGHT_BROWSERS: ${{ inputs.browsers || 'chromium webkit firefox' }}
         PLAYWRIGHT_VERSION: ${{ steps.playwright-version.outputs.version }}
-      run: npx -y "playwright@$PLAYWRIGHT_VERSION" install --with-deps $PLAYWRIGHT_BROWSERS
+      run: npx -y "playwright@$PLAYWRIGHT_VERSION" install-deps $PLAYWRIGHT_BROWSERS
+      if: steps.playwright-version.outputs.version != '' && steps.playwright-cache.outputs.cache-hit == 'true'
       shell: bash
       working-directory: ${{ runner.temp }}
+
+    # Only store cache on develop branch
+    - name: Store cached playwright binaries
+      uses: actions/cache/save@v6.1.0
+      if:
+        steps.playwright-version.outputs.version != '' && github.event_name == 'push' && github.ref ==
+        'refs/heads/develop'
+      with:
+        path: |
+          ~/.cache/ms-playwright
+        # Bump the iteration when bumping runner images to use a new cache
+        key: playwright-${{ runner.os }}-iteration-1-${{ steps.playwright-version.outputs.version }}

.github/actions/install-playwright/action.yml

@@ -46,9 +46,6 @@ runs:
       uses: denoland/setup-deno@v2.0.5
       with:
         deno-version: ${{ inputs.deno-version || 'v2.8.3' }}
-    # Keeps the pnpm store on the cache volume for the `pnpm install` of the test application
-    - name: Mount pnpm store
-      uses: ./.github/actions/mount-pnpm-store
     - name: Install pnpm
       uses: ./.github/actions/install-pnpm
 

.github/actions/mount-pnpm-store/action.yml

@@ -1,13 +1,30 @@
 name: 'Restore dependency & build cache'
-description: 'Installs dependencies from the Namespace cache volume and restores the build output.'
+description: 'Restore the dependency & build cache.'
+
+inputs:
+  dependency_cache_key:
+    description: 'The dependency cache key'
+    required: true
 
 runs:
   using: 'composite'
   steps:
+    - name: Install pnpm
+      uses: ./.github/actions/install-pnpm
+
+    - name: Check dependency cache
+      id: dep-cache
+      uses: actions/cache/restore@v6.1.0
+      with:
+        path: ${{ env.CACHED_DEPENDENCY_PATHS }}
+        key: ${{ inputs.dependency_cache_key }}
+
     - name: Restore build artifacts
       uses: actions/download-artifact@v7
       with:
         name: build-output
 
     - name: Install dependencies
-      uses: ./.github/actions/install-dependencies
+      if: steps.dep-cache.outputs.cache-hit != 'true'
+      run: pnpm install --frozen-lockfile
+      shell: bash

.github/actions/prepare-e2e-test/action.yml

@@ -23,7 +23,7 @@ concurrency:
 
 jobs:
   auto-fix-issue:
-    runs-on: namespace-profile-sentry-javascript
+    runs-on: ubuntu-latest
     environment: ci-triage
     permissions:
       # Required to create a new branch and commit the fix

.github/actions/restore-cache/action.yml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   release:
-    runs-on: namespace-profile-sentry-javascript-small
+    runs-on: ubuntu-24.04
     name: 'Prepare a new version'
 
     steps: