[ci]: switch to GitHub runners (#93164)

Switch CI from self-hosted runners to GitHub-hosted runners and fix the
follow-up issues that showed up once the hosted jobs were exercised.

- Move Linux workflows onto `ubuntu-latest-16-core-oss`, Windows
workflows onto `windows-latest-8-core-oss`, and the native mac release
lane onto `macos-15-intel`.
- Update the reusable build workflow to work in hosted environments by
relying on `runner.os` instead of label string matching, and by removing
the hardcoded `/home/runner` `fnm` path.
- Make Turbo/sccache configuration explicit for hosted runners:
  - unify on `vtest314-next-adapter-e2e-tests`
- pass `TURBO_TOKEN` via workflow env/secrets instead of assuming
runner-level env
- switch Turbo cache mode to `local:rw,remote:rw` so jobs still have
local cache behavior when remote cache is unavailable
- Update the `sccache` action defaults/docs to use the hosted-runner
secret setup (`TURBO_TOKEN`) instead of the old self-hosted token
wiring.
- Make Datadog reporting fail open so missing `DATA_DOG_API_KEY` does
not block CI.
- Fix the CLI reserved-port test so it asserts Next’s own `-p 1`
validation instead of failing earlier on hosted Linux due to
privileged-port binding.
- Replace the live `musl.cc` dependency in `native-builder.Dockerfile`
with musl sysroots imported from GHCR-hosted `rust-musl-cross` images,
keeping the existing `/opt/*-cross` layout used by the Linux native
build scripts.
- Fix the macOS native build workaround s so it applies to all
*-apple-darwin targets based on the Cargo target OS rather than the host
architecture, which avoids napi-build injecting the unsupported -Wl
linker arg when @next/swc is linked with rust-lld on hosted mac runners.

Test Plan:
- This PR's CI
- This
[build_and_deploy](https://github.com/vercel/next.js/actions/runs/24865715983/job/72801225722)
job running on every arch

Author: ztanner

.github/workflows/build_and_deploy.yml

@@ -21,8 +21,11 @@ env:
   NAPI_CLI_VERSION: 2.18.4
   TURBO_VERSION: 2.8.11
   NODE_LTS_VERSION: 20
-  TURBO_TEAM: 'vercel'
-  TURBO_CACHE: 'remote:rw'
+  TURBO_TEAM: 'vtest314-next-adapter-e2e-tests'
+  # Prefer shared remote cache across runs, but keep local cache enabled so jobs
+  # degrade gracefully if the remote cache or token is unavailable.
+  TURBO_CACHE: 'local:rw,remote:rw'
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
   # Without this environment variable, rust-lld will fail because some dependencies defaults to newer version of macOS by default.
   #
   # See https://doc.rust-lang.org/rustc/platform-support/apple-darwin.html#os-version for more details
@@ -158,11 +161,7 @@ jobs:
               target: ${{ needs.deploy-target.outputs.value == 'automated-preview' && 'x86_64-apple-darwin' }}
 
         settings:
-          - host:
-              - 'self-hosted'
-              - 'macos'
-              - 'arm64'
-
+          - host: 'macos-15-intel'
             target: 'x86_64-apple-darwin'
             # --env-mode loose is a breaking change required with turbo 2.x since Strict mode is now the default
             # TODO: we should add the relevant envs later to to switch to strict mode
@@ -171,11 +170,7 @@ jobs:
               pnpm dlx turbo@${TURBO_VERSION} run build-native-release -vvv --env-mode loose --remote-cache-timeout 90 --summarize -- --target x86_64-apple-darwin
               strip -x packages/next-swc/native/next-swc.*.node
 
-          - host:
-              - 'self-hosted'
-              - 'macos'
-              - 'arm64'
-
+          - host: 'macos-15'
             target: 'aarch64-apple-darwin'
             # --env-mode loose is a breaking change required with turbo 2.x since Strict mode is now the default
             # TODO: we should add the relevant envs later to to switch to strict mode
@@ -184,11 +179,7 @@ jobs:
               pnpm dlx turbo@${TURBO_VERSION} run build-native-release -vvv --env-mode loose --remote-cache-timeout 90 --summarize -- --target aarch64-apple-darwin
               strip -x packages/next-swc/native/next-swc.*.node
 
-          - host:
-              - 'self-hosted'
-              - 'windows'
-              - 'x64'
-
+          - host: 'windows-latest-8-core-oss'
             # --env-mode loose is a breaking change required with turbo 2.x since Strict mode is now the default
             # TODO: we should add the relevant envs later to to switch to strict mode
             build: |
@@ -197,11 +188,7 @@ jobs:
               pnpm dlx turbo@${TURBO_VERSION} run build-native-release -vvv --env-mode loose --remote-cache-timeout 90 --summarize -- --target x86_64-pc-windows-msvc
             target: 'x86_64-pc-windows-msvc'
 
-          - host:
-              - 'self-hosted'
-              - 'windows'
-              - 'x64'
-
+          - host: 'windows-latest-8-core-oss'
             target: 'aarch64-pc-windows-msvc'
             # --env-mode loose is a breaking change required with turbo 2.x since Strict mode is now the default
             # TODO: we should add the relevant envs later to to switch to strict mode
@@ -210,12 +197,7 @@ jobs:
               npm i -g "@napi-rs/cli@${NAPI_CLI_VERSION}"
               pnpm dlx turbo@${TURBO_VERSION} run build-native-no-plugin-release -vvv --env-mode loose --remote-cache-timeout 90 --summarize -- --target aarch64-pc-windows-msvc
 
-          - host:
-              - 'self-hosted'
-              - 'linux'
-              - 'x64'
-              - 'metal'
-
+          - host: 'ubuntu-latest-16-core-oss'
             target: 'x86_64-unknown-linux-gnu'
             # [NOTE] If you want to update / modify build steps, check these things:
             # - We use docker images to pin the glibc version to link against,
@@ -241,12 +223,7 @@ jobs:
               strip native/next-swc.*.node
               objdump -T native/next-swc.*.node | grep GLIBC_
 
-          - host:
-              - 'self-hosted'
-              - 'linux'
-              - 'x64'
-              - 'metal'
-
+          - host: 'ubuntu-latest-16-core-oss'
             target: 'x86_64-unknown-linux-musl'
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:stable-2023-09-17-alpine
             build: |
@@ -262,12 +239,7 @@ jobs:
               npm run build-native-release -- --target x86_64-unknown-linux-musl
               strip native/next-swc.*.node
 
-          - host:
-              - 'self-hosted'
-              - 'linux'
-              - 'x64'
-              - 'metal'
-
+          - host: 'ubuntu-latest-16-core-oss'
             target: 'aarch64-unknown-linux-gnu'
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:stable-2023-09-17-aarch64
             build: |
@@ -288,12 +260,7 @@ jobs:
               llvm-strip -x native/next-swc.*.node
               objdump -T native/next-swc.*.node | grep GLIBC_
 
-          - host:
-              - 'self-hosted'
-              - 'linux'
-              - 'x64'
-              - 'metal'
-
+          - host: 'ubuntu-latest-16-core-oss'
             target: 'aarch64-unknown-linux-musl'
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:stable-2023-09-17-alpine
             build: |
@@ -310,23 +277,17 @@ jobs:
               npm run build-native-release -- --target aarch64-unknown-linux-musl
               llvm-strip -x native/next-swc.*.node
 
-    name: stable - ${{ matrix.settings.target }} - node@16
+    name: stable - ${{ matrix.settings.target }} - node@20
     runs-on: ${{ matrix.settings.host }}
-    timeout-minutes: 45
+    timeout-minutes: ${{ contains(matrix.settings.target, 'apple-darwin') && 90 || 45 }}
     steps:
       # https://github.com/actions/virtual-environments/issues/1187
       - name: tune linux network
         run: sudo ethtool -K eth0 tx off rx off
-        if: ${{ matrix.settings.host == 'ubuntu-latest' }}
-      - name: tune linux network
-        run: sudo ethtool -K eth0 tx off rx off
-        if: ${{ matrix.settings.host == 'ubuntu-latest' }}
-      - name: tune windows network
-        run: Disable-NetAdapterChecksumOffload -Name * -TcpIPv4 -UdpIPv4 -TcpIPv6 -UdpIPv6
-        if: ${{ matrix.settings.host == 'windows-latest' }}
+        if: ${{ matrix.settings.host == 'ubuntu-latest-16-core-oss' }}
       - name: tune mac network
         run: sudo sysctl -w net.link.generic.system.hwcksum_tx=0 && sudo sysctl -w net.link.generic.system.hwcksum_rx=0
-        if: ${{ matrix.settings.host == 'macos-latest' }}
+        if: ${{ startsWith(matrix.settings.host, 'macos-15') }}
       # we use checkout here instead of the build cache since
       # it can fail to restore in different OS'
       - uses: actions/checkout@v4
@@ -342,10 +303,12 @@ jobs:
           node-version: ${{ env.NODE_LTS_VERSION }}
           check-latest: true
 
+      - name: Prepare corepack
+        if: ${{ matrix.settings.host != 'windows-latest-8-core-oss' }}
+        run: npm i -g corepack@0.31
+
       - name: Setup corepack
-        run: |
-          npm i -g corepack@0.31
-          corepack enable
+        run: corepack enable
 
       # we always want to run this to set environment variables
       - name: Install Rust
@@ -388,10 +351,10 @@ jobs:
           # put the command in an environment variable to avoid escaping issues
           DOCKER_CMD: ${{ matrix.settings.build }}
         run: |
-          docker run -v "/var/run/docker.sock":"/var/run/docker.sock" \
+          docker run --rm -v "/var/run/docker.sock":"/var/run/docker.sock" \
             -e CI -e RUST_BACKTRACE -e NAPI_CLI_VERSION -e CARGO_TERM_COLOR -e CARGO_INCREMENTAL \
             -e CARGO_PROFILE_RELEASE_LTO -e CARGO_REGISTRIES_CRATES_IO_PROTOCOL -e TURBO_API \
-            -e TURBO_TEAM -e TURBO_TOKEN -e TURBO_VERSION -e TURBO_CACHE="remote:rw" \
+            -e TURBO_TEAM -e TURBO_TOKEN -e TURBO_VERSION -e TURBO_CACHE="local:rw,remote:rw" \
             -v ${{ env.HOME }}/.cargo/git:/root/.cargo/git \
             -v ${{ env.HOME }}/.cargo/registry:/root/.cargo/registry \
             -v ${{ github.workspace }}:/build \
@@ -457,11 +420,7 @@ jobs:
       matrix:
         target: [web, nodejs]
 
-    runs-on:
-      - 'self-hosted'
-      - 'linux'
-      - 'x64'
-      - 'metal'
+    runs-on: ubuntu-latest-16-core-oss
 
     steps:
       - uses: actions/checkout@v4
@@ -709,6 +668,7 @@ jobs:
           path: turbopack-bin-size
 
       - name: Upload to Datadog
+        if: ${{ env.DATADOG_API_KEY != '' }}
         run: |
           ls -al turbopack-bin-size
 

.github/workflows/build_and_test.yml

@@ -81,7 +81,7 @@ jobs:
     with:
       skipInstallBuild: 'yes'
       stepName: 'build-native-windows'
-      runs_on_labels: '["windows","self-hosted","x64"]'
+      runs_on_labels: '["windows-latest-8-core-oss"]'
       buildNativeTarget: 'x86_64-pc-windows-msvc'
 
     secrets: inherit
@@ -711,7 +711,7 @@ jobs:
       nodeVersion: ${{ matrix.node }}
       afterBuild: node run-tests.js --type unit
       stepName: 'test-unit-windows-${{ matrix.node }}'
-      runs_on_labels: '["windows","self-hosted","x64"]'
+      runs_on_labels: '["windows-latest-8-core-oss"]'
       buildNativeTarget: 'x86_64-pc-windows-msvc'
 
     secrets: inherit
@@ -884,7 +884,7 @@ jobs:
           test/e2e/app-dir/proxy-runtime-nodejs/proxy-runtime-nodejs.test.ts \
           test/development/app-dir/segment-explorer/segment-explorer.test.ts
       stepName: 'test-dev-windows'
-      runs_on_labels: '["windows","self-hosted","x64"]'
+      runs_on_labels: '["windows-latest-8-core-oss"]'
       buildNativeTarget: 'x86_64-pc-windows-msvc'
     secrets: inherit
 
@@ -914,7 +914,7 @@ jobs:
           test/integration/create-next-app/index.test.ts \
           test/integration/create-next-app/package-manager/pnpm.test.ts
       stepName: 'test-integration-windows'
-      runs_on_labels: '["windows","self-hosted","x64"]'
+      runs_on_labels: '["windows-latest-8-core-oss"]'
       buildNativeTarget: 'x86_64-pc-windows-msvc'
     secrets: inherit
 
@@ -944,7 +944,7 @@ jobs:
           test/e2e/app-dir/non-root-project-monorepo/non-root-project-monorepo.test.ts \
           test/e2e/app-dir/proxy-runtime-nodejs/proxy-runtime-nodejs.test.ts
       stepName: 'test-prod-windows'
-      runs_on_labels: '["windows","self-hosted","x64"]'
+      runs_on_labels: '["windows-latest-8-core-oss"]'
       buildNativeTarget: 'x86_64-pc-windows-msvc'
     secrets: inherit
 

.github/workflows/build_reusable.yml

@@ -68,7 +68,7 @@ on:
         description: 'List of runner labels'
         required: false
         type: string
-        default: '["self-hosted", "linux", "x64", "metal"]'
+        default: '["ubuntu-latest-16-core-oss"]'
       buildNativeTarget:
         description: 'Target for build-native step'
         required: false
@@ -101,9 +101,11 @@ env:
   # disable backtrace for test snapshots
   RUST_BACKTRACE: 0
 
-  TURBO_TEAM: 'vtest314-next-e2e-tests'
-  TURBO_CACHE: 'remote:rw'
-  TURBO_TOKEN: ${{ secrets.TURBO_REMOTE_CACHE_TOKEN }}
+  TURBO_TEAM: 'vtest314-next-adapter-e2e-tests'
+  # Prefer shared remote cache across runs, but keep local cache enabled so jobs
+  # degrade gracefully if the remote cache or token is unavailable.
+  TURBO_CACHE: 'local:rw,remote:rw'
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
 
   NEXT_TELEMETRY_DISABLED: 1
   # allow not skipping install-native postinstall script if we don't have a binary available already
@@ -147,7 +149,7 @@ jobs:
     steps:
       # enforce consistent line endings for git on windows
       - name: Configure git to use LF endings
-        if: ${{ contains(fromJson(inputs.runs_on_labels), 'windows') }}
+        if: ${{ runner.os == 'Windows' }}
         run: |
           git config --global core.autocrlf false
           git config --global core.eol lf
@@ -167,9 +169,10 @@ jobs:
       - name: Install fnm
         if: steps.check-fnm.outputs.found != 'true'
         run: |
+          export FNM_DIR="${HOME}/.local/share/fnm"
           curl -fsSL https://fnm.vercel.app/install | bash
-          export PATH="/home/runner/.local/share/fnm:$PATH"
-          echo "/home/runner/.local/share/fnm" >> $GITHUB_PATH
+          export PATH="$FNM_DIR:$PATH"
+          echo "$FNM_DIR" >> $GITHUB_PATH
           fnm env --json | jq -r 'to_entries|map("\(.key)=\(.value|tostring)")|.[]' | xargs -I {} echo "{}" >> $GITHUB_ENV
 
       - name: Normalize input step names into path key
@@ -202,7 +205,7 @@ jobs:
           which node
           node --version
       - name: Prepare corepack
-        if: ${{ contains(fromJson(inputs.runs_on_labels), 'ubuntu-latest') }}
+        if: ${{ runner.os == 'Linux' }}
         run: |
           npm i -g corepack@0.31
       - run: corepack enable
@@ -353,7 +356,7 @@ jobs:
           path: packages/next/dist/compiled/next-server/report.*.html
 
       - name: Upload test report to datadog
-        if: ${{ inputs.afterBuild && always() && !github.event.pull_request.head.repo.fork }}
+        if: ${{ inputs.afterBuild && always() && !github.event.pull_request.head.repo.fork && env.DATADOG_API_KEY != '' }}
         run: |
           # Add a `test.type` tag to distinguish between turbopack and next.js runs
           # Add a `nextjs.test_session.name` tag to help identify the job

.github/workflows/integration_tests_reusable.yml

@@ -56,7 +56,7 @@ jobs:
     secrets: inherit
 
   generate-matrices:
-    runs-on: [self-hosted, linux, x64, metal]
+    runs-on: ubuntu-latest-16-core-oss
     steps:
       - id: out
         run: |
@@ -147,7 +147,7 @@ jobs:
   collect_nextjs_development_integration_stat:
     needs: [test-e2e, test-integration]
     name: Next.js integration test development status report
-    runs-on: [self-hosted, linux, x64, metal]
+    runs-on: ubuntu-latest-16-core-oss
     if: always()
     permissions:
       pull-requests: write

.github/workflows/pull_request_stats.yml

@@ -18,8 +18,11 @@ env:
   NODE_LTS_VERSION: 20
   TEST_CONCURRENCY: 6
 
-  TURBO_TEAM: 'vercel'
-  TURBO_CACHE: 'remote:rw'
+  TURBO_TEAM: 'vtest314-next-adapter-e2e-tests'
+  # Prefer shared remote cache across runs, but keep local cache enabled so jobs
+  # degrade gracefully if the remote cache or token is unavailable.
+  TURBO_CACHE: 'local:rw,remote:rw'
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
   NEXT_TELEMETRY_DISABLED: 1
   # we build a dev binary for use in CI so skip downloading
   # canary next-swc binaries in the monorepo
@@ -47,11 +50,7 @@ jobs:
       fail-fast: false
       matrix:
         bundler: [webpack, turbopack]
-    runs-on:
-      - 'self-hosted'
-      - 'linux'
-      - 'x64'
-      - 'metal'
+    runs-on: ubuntu-latest-16-core-oss
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/setup-nextjs-build.yml

@@ -16,11 +16,7 @@ on:
 jobs:
   build_nextjs:
     name: Build Next.js for the turbopack integration test
-    runs-on:
-      - 'self-hosted'
-      - 'linux'
-      - 'x64'
-      - 'metal'
+    runs-on: ubuntu-latest-16-core-oss
     outputs:
       output1: ${{ steps.build-next-swc-turbopack-patch.outputs.success }}
     steps:

.github/workflows/test-turbopack-rust-bench-test.yml

@@ -4,7 +4,7 @@ on:
     inputs:
       runner:
         type: string
-        default: '["self-hosted", "linux", "x64", "metal"]'
+        default: '["ubuntu-latest-16-core-oss"]'
       os:
         type: string
         default: 'linux'
@@ -17,6 +17,8 @@ env:
   TURBOPACK_BENCH_PROGRESS: '1'
 
   NODE_LTS_VERSION: 20
+  TURBO_TEAM: 'vtest314-next-adapter-e2e-tests'
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
 
 jobs:
   test:

.github/workflows/test_e2e_deploy_release.yml

@@ -240,6 +240,7 @@ jobs:
           merge-multiple: true
 
       - name: Upload test report to datadog
+        if: ${{ env.DATADOG_API_KEY != '' }}
         run: |
           if [ -d ./test/test-junit-report ]; then
             DD_ENV=ci npx @datadog/datadog-ci@2.23.1 junit upload --tags test.type:deploy --service nextjs ./test/test-junit-report