anchore · wagoodman · Nov 7, 2025 · Nov 10, 2025 · Nov 10, 2025 · Nov 10, 2025
diff --git a/.github/actions/bootstrap/action.yaml b/.github/actions/bootstrap/action.yaml
@@ -13,7 +13,7 @@ inputs:
   cache-key-prefix:
     description: "Prefix all cache keys with this value"
     required: true
-    default: "181053ac82"
+    default: "53ac821810"
   download-test-fixture-cache:
     description: "Download test fixture cache from OCI and github actions"
     required: true

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -6,6 +6,7 @@
 name: "CodeQL Security Scan"
 
 on:
+  workflow_dispatch:
   push:
     branches:
       # only run when there are pushes to the main branch (not on PRs)
@@ -20,7 +21,8 @@ permissions:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-22.04-4core-16gb
+    # Runner definition: repo(anchore/workflows)/.github/runs-on.yml
+    runs-on: runs-on=${{ github.run_id }}/runner=small-arm
     if: github.repository == 'anchore/syft' # only run for main repo
     permissions:
       security-events: write
@@ -51,7 +53,7 @@ jobs:
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file. 
+        # By default, queries listed here will override any specified in a config file.
         # Prefix the list here with "+" to use these queries and those in the config file.
         # queries: ./path/to/local/query, your-org/your-repo/queries@main
 

diff --git a/.github/workflows/detect-schema-changes.yaml b/.github/workflows/detect-schema-changes.yaml
@@ -27,7 +27,8 @@ env:
 jobs:
   label:
     name: "Label changes"
-    runs-on: ubuntu-22.04
+    # Runner definition: repo(anchore/workflows)/.github/runs-on.yml
+    runs-on: runs-on=${{ github.run_id }}/runner=small-arm
     permissions:
       contents: read
       pull-requests: write

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -21,8 +21,9 @@ on:
 jobs:
   quality-gate:
     environment: release
-    runs-on: ubuntu-24.04
     if: ${{ github.event.inputs.phase == 'all' }}
+    # Runner definition: repo(anchore/workflows)/.github/runs-on.yml
+    runs-on: runs-on=${{ github.run_id }}/runner=tiny
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
         with:
@@ -128,8 +129,9 @@ jobs:
 
   release:
     needs: [quality-gate]
-    runs-on: ubuntu-24.04
     if: ${{ github.event.inputs.phase == 'all' }}
+    # Runner definition: repo(anchore/workflows)/.github/runs-on.yml
+    runs-on: runs-on=${{ github.run_id }}/runner=release
     permissions:
       contents: write
       packages: write

diff --git a/.github/workflows/test-fixture-cache-publish.yaml b/.github/workflows/test-fixture-cache-publish.yaml
@@ -14,7 +14,8 @@ jobs:
   Publish:
     name: "Publish test fixture image cache"
     # we use this runner to get enough storage space for docker images and fixture cache
-    runs-on: ubuntu-22.04-4core-16gb
+    # Runner definition: repo(anchore/workflows)/.github/runs-on.yml
+    runs-on: runs-on=${{ github.run_id }}/runner=build/disk=large
     if: github.repository == 'anchore/syft' # only run for main repo
     permissions:
       packages: write

diff --git a/.github/workflows/update-anchore-dependencies.yml b/.github/workflows/update-anchore-dependencies.yml
@@ -12,7 +12,8 @@ permissions:
 
 jobs:
   update:
-    runs-on: ubuntu-latest
+    # Runner definition: repo(anchore/workflows)/.github/runs-on.yml
+    runs-on: runs-on=${{ github.run_id }}/runner=small-arm
     if: github.repository_owner == 'anchore' # only run for main repo (not forks)
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1

diff --git a/.github/workflows/update-bootstrap-tools.yml b/.github/workflows/update-bootstrap-tools.yml
@@ -10,7 +10,8 @@ permissions:
 
 jobs:
   update-bootstrap-tools:
-    runs-on: ubuntu-latest
+    # Runner definition: repo(anchore/workflows)/.github/runs-on.yml
+    runs-on: runs-on=${{ github.run_id }}/runner=small
     if: github.repository == 'anchore/syft' # only run for main repo
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1
@@ -28,16 +29,16 @@ jobs:
         run: |
           make update-tools
           make list-tools
-          
+
           export NO_COLOR=1
           delimiter="$(openssl rand -hex 8)"
-          
+
           {
             echo "status<<${delimiter}"
             make list-tool-updates
             echo "${delimiter}"
           } >> $GITHUB_OUTPUT
-          
+
           {
             echo "### Tool version status"
             echo "\`\`\`"

diff --git a/.github/workflows/update-cpe-dictionary-index.yml b/.github/workflows/update-cpe-dictionary-index.yml
@@ -13,7 +13,8 @@ env:
 
 jobs:
   upgrade-cpe-dictionary-index:
-    runs-on: ubuntu-latest
+    # Runner definition: repo(anchore/workflows)/.github/runs-on.yml
+    runs-on: runs-on=${{ github.run_id }}/runner=small-arm
     permissions:
       contents: read
       packages: write

diff --git a/.github/workflows/update-spdx-license-list.yaml b/.github/workflows/update-spdx-license-list.yaml
@@ -13,7 +13,8 @@ env:
 
 jobs:
   upgrade-spdx-license-list:
-    runs-on: ubuntu-latest
+    # Runner definition: repo(anchore/workflows)/.github/runs-on.yml
+    runs-on: runs-on=${{ github.run_id }}/runner=small-arm
     if: github.repository == 'anchore/syft' # only run for main repo
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v6.0.1

diff --git a/.github/workflows/validate-github-actions.yaml b/.github/workflows/validate-github-actions.yaml
@@ -1,6 +1,7 @@
 name: "Validate GitHub Actions"
 
 on:
+  workflow_dispatch:
   pull_request:
     paths:
       - '.github/workflows/**'
@@ -18,7 +19,8 @@ permissions:
 jobs:
   zizmor:
     name: "Lint"
-    runs-on: ubuntu-latest
+    # Runner definition: repo(anchore/workflows)/.github/runs-on.yml
+    runs-on: runs-on=${{ github.run_id }}/runner=small-arm
     permissions:
       contents: read
       security-events: write  # for uploading SARIF results