feat(actions): run workflows and report deployment checks on servers and Cloud

[Hydralerne]

Superseded by combined PR #1148. This branch is preserved in the combined history. The complete migration sequence and review fixes are included there; all 15 combined CI checks pass. Merge #1148 instead of this individual draft.

Summary

Run repository CI on connected Linux/macOS servers or temporary Cloud VMs through one Openship editor. Files in .openship/workflows/ run independently of GitHub Actions, including nested reusable workflows and Openship-issued OIDC; files in .github/workflows/ retain GitHub's controller and official runner on the selected Openship destinations. Deployments also publish configurable overall and service GitHub Checks.

Behavior

• Execute local and remote reusable workflows in the same run. Snapshot and authorize every source before approval, pin moved refs once, preserve typed inputs and nested outputs, and explicitly forward secrets. Each called job reserves its own allowed runner; coordinator records allocate no worker or VM. Permissions can only stay the same or narrow, and automatic token mappings use the leaf job's reduced grant.
• Issue five-minute, audience-bound Openship OIDC identities from an encrypted RSA key. Public discovery/JWKS expose verification data only. Recheck actor, approval, running job, destination and cancellation at issuance; deny forks and mark edited-source subjects. External services must trust the configured HTTPS Openship issuer.
• Start runner setup with existing server, dedicated managed server, or temporary Cloud pool. Reuse shared server/plan and Budget dialogs while preserving the workflow draft. Existing/dedicated servers retain normal billing; disposable jobs use the Actions balance. Nested run navigation shows called jobs once, and delayed/nested dialogs retain keyboard focus.
• Share Workflow → Run settings → Access → Checks across Actions, project settings and the deployment wizard. Discover and import one or all workflow files, retain each file's triggers, and synchronize List, Topology and YAML edits. Runner and notification-channel creation happen inline.
• Show runs as collapsible jobs/steps beside their logs, with a shared graph formatter, connected step nodes, Arrange, fit/zoom and Expand/Collapse controls. Preserve selection, view and log cursor across refreshes. Queued/waiting work uses the yellow loading indicator; pending approvals appear in a separate Approvals tab. Unexpanded skipped jobs retain their declared names in both the UI and GitHub Checks.
• Default to Only my account, Approve each run and Block fork runs. Support selected verified GitHub users or repository writers. Bind approval to the exact actor, commit, attempt and destinations, then verify the job the official runner actually receives before starting workflow code. Eligible forks always require disposable runners and approval.
• Reuse capability probes, Docker/native execution, explicit QEMU setup, capacity reservations, durable recovery, cancellation and cleanup. Per-job Linux images override the runner default. Connected Macs use their native toolchain. Cloud jobs receive disposable Linux VMs funded from a separate prepaid compute/transfer balance at provider rates.
• Resolve GitHub access through the existing local CLI, personal-token, local/custom App and Cloud connection paths. The Checks panel shows the account, repository and actual setup state. Independent Checks require a scoped App; personal clone credentials are never substituted for it. GitHub-owned Checks are not duplicated.
• Publish project/environment and service deployment Checks by default with configurable opt-out, selection and error detail. Deliver persisted outcomes through the shared scheduler with bounded, redacted summaries and idempotent retries. Reuse verified channels and the durable notification queue for completion alerts.
• Document the Openship-only setup explicitly: move YAML into .openship/workflows/, select destinations and access rules, then run manually or receive signed App events. This works with GitHub Actions disabled. Leaving a copy in .github/workflows/ keeps its GitHub triggers active.

Rollout and compatibility

Keep this PR draft until its migration dependency is resolved. Migrations 0184_action_workflow_notifications, 0185_deployment_github_checks, 0186_actions_access_policy and 0187_actions_oidc depend on separately maintained 0182_cloud_build_activity and 0183_cloud_build_exclusive_preparation. Those earlier Cloud changes are outside this PR. Reconcile the complete journal before merging; deploying later timestamps first can cause Drizzle to skip earlier migrations.

The official runner assignment gate depends on GitHub's private local ProcessChannel IPC format. Upstream binaries remain unchanged; the Worker entry point is wrapped, and runners use --ephemeral --disableupdate. Unsupported framing, cancellation, denial and timeout fail closed. Runner upgrades require the IPC and official-runner tests. Approved code on connected native destinations has the connected user's host access.

Independent workflows use pinned act, support reusable workflows and Openship-issued OIDC, and reject protected environments and attestations. .github/workflows/ uses GitHub for those environment/attestation features. Reusable imports are bounded at 10 workflow levels, 50 called files, 2 MiB of combined source and 256 total concrete jobs. Windows and GHES destinations are unsupported. Scaling workflows need suitable privileged Linux/KVM hosts; importing a release workflow does not establish that an ordinary Cloud VM can run it.

App permissions follow the selected integration: independent checkout/Checks need repository access and Checks write; GitHub runner management also needs Actions and Administration write, and workflow commits need Contents and Workflows write. Outbound Check reporting does not need a public endpoint; push/rerun events need reachable signed webhooks. Existing independent workflows retain their prior behavior until saved with an explicit access policy; GitHub workflows without a policy require review. Existing branch rules requiring build:<service> must select the new project/environment Check names after their first report.

GitHub provides completed job-log downloads, not a public live-log stream. The run UI links to GitHub for its live output. Independent Openship execution streams masked logs through its durable event journal.

Validation

New live verification: the private Openship-only sample ran three workflow levels on native Mac and temporary Cloud Linux, with private checkout, real Node tests, typed inputs, forwarded/masked secrets, nested outputs, restart recovery and GitHub Checks. GitHub Actions stayed at zero runs. Both new VMs and the quota-limited test namespace were confirmed removed. A real Mac worker also requested an OIDC token over HTTPS, verified its RSA signature/JWKS and called-workflow claims, and was denied after completion. The committed head was rerun successfully (identity Check). Provider-specific AWS/Azure/GCP trust is not configured by this PR.

See execution evidence, including links to live Checks and exact limits. Current extension regressions: 196 platform, 30 HTTP/native/remote API, 140 dashboard and 19 database tests pass; worker tests, Go race/vet, API/dashboard typechecks, SDK/CLI assembly and error-boundary audit pass. API and dashboard typechecks also pass in the synchronized developer checkout. Browser coverage includes all destination choices and shared dialogs in light/dim/mobile/Arabic. Generated references cover 806 HTTP routes. Signing keys participate in the transfer cipher registry and the shared post-import cache invalidation boundary. 78 boot/API/transfer unit cases and 19 real instance cases pass, including key re-encryption and cache replacement. All 15 GitHub CI checks pass on 849475d0, including full API startup and the instance control-plane gate.

Tests use an isolated checkout, excluding unrelated changes in the shared workspace.

• Latest fix: 71 focused tests pass (42 platform, 29 HTTP/native/remote Actions), plus API typecheck, formatting and documentation checks. A real Mac rerun confirms the skipped dependent job keeps its declared name in GitHub.
• Openship-only live verification: private sample repository, containing a real Node project and only .openship/workflows/ci.yml. GitHub Actions is disabled. Native macOS success, expected failure, cancellation, dependency outputs, masked live logs, controller recreation and cleanup pass. GitHub reports each result through Checks, with zero GitHub Actions runs. GitHub's original signed push was replayed through isolated HTTP ingress; forged signatures were rejected and duplicate delivery produced one run. The temporary Linux Cloud run also passes both jobs (test Check, dependency Check); both VMs were removed. All three test VMs, including the failed first attempt, and the isolated namespace were confirmed deleted. The first Cloud attempt timed out while pulling the Ubuntu image and encountered temporary provider API errors during cleanup. Retrying with node:22-bookworm and a ten-minute job limit completed in about two minutes. No customer database or production deployment was used.
• Official runner live verification: Mac reusable workflow/artifacts/draft release, revoked access blocked before Worker, and Cloud Docker/services execution. No VM or runner registration was allocated before approval; test resources were removed.
• CI: all 15 checks passed on 36e0190d, including real Docker/SSH/managed Actions and native macOS. The instance-control job initially returned an unexpected 500, then passed both its local reproduction and the failed-job rerun. CI for the current commit is reported by GitHub.
• UI: fixture-backed browser checks cover light/dim/dark, mobile, RTL, runner summaries, inline channel verification/retry, per-file triggers, graph layout, approvals and log/selection continuity. A sidebar useId hydration warning also reproduces on the unchanged ce551159 UI and remains outside this change.
• Broader feature validation: authorization, admission/revocation races, storage protocols, scheduling, billing, deployment Checks and migration preservation are covered by module/HTTP tests and the real execution gates. The Go race suite/vet and worker packaging for Linux/macOS x64/arm64 passed. Documentation validates 212 pages, 494 MCP tools, 616 SDK methods, 806 HTTP routes, 674 CLI paths, 297 CLI examples and 129 typed SDK examples.

No production deployment was performed.