.gitea/workflows/nightly.yml

@@ -43,7 +43,13 @@ env:
 
 jobs:
   deploy-staging:
-    runs-on: self-hosted
+    # `ubuntu-latest` matches our self-hosted runner's advertised label
+    # (the runner has labels: ubuntu-latest / ubuntu-24.04 / ubuntu-22.04).
+    # `self-hosted` would never match — no runner advertises it — so the
+    # job parks in the queue forever. ADR-011's "single-tenant" promise
+    # is at the repo level; sharing this runner between CI and deploys
+    # for the same repo is within that boundary.
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 

.gitea/workflows/release.yml

@@ -45,7 +45,9 @@ env:
 
 jobs:
   deploy-production:
-    runs-on: self-hosted
+    # See nightly.yml — same rationale: `ubuntu-latest` matches the
+    # advertised label of our single-tenant self-hosted runner.
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4