pr_runs_on_self_hosted: ARM64 hosted runner labels misdetected as self-hosted

[clouatre]

Describe the bug

pr_runs_on_self_hosted flags GitHub-hosted ARM64 runner labels as self-hosted. The affected labels are:

• ubuntu-24.04-arm (GA Aug 2025)
• ubuntu-22.04-arm (GA Aug 2025)
• ubuntu-26.04-arm (public preview, Jun 2026)
• windows-11-arm (GA Aug 2025)
• windows-11-vs2026-arm (public preview, Jun 2026)

These are GitHub's own hosted runner images, not self-hosted infrastructure. See GitHub's runner reference for the authoritative label list.

The detection lives in job_uses_self_hosted_runner in opa/rego/poutine/utils.rego, which matches runs_on against:

(?i)^((ubuntu-(([0-9]{2})\.04|latest(-(4|8|16)-cores)?|slim)|macos-([0-9]{2}|latest)(-x?large)?|windows-(20[0-9]{2}|latest(-8-cores)?)|(buildjet|warp)-[a-z0-9-]+))$

No alternative in this pattern accounts for arm64-suffixed labels on either the Linux (-arm) or Windows (11(-vsNNNN)?-arm) side.

The regex has been modified since arm64 runners entered public preview without arm64 labels being added:

• Add large ubuntu and windows runner #293 (May 2025): added -cores suffixes for larger runners
• Add ubuntu-slim as built-in GitHub Actions runner #383 (Jan 2026): added ubuntu-slim

#383 landed five months after arm64 reached general availability.

To Reproduce

Tested against poutine v1.1.6 (latest release).

Any repo with a workflow triggered on pull_request containing:

jobs:
  build:
    runs-on: ubuntu-24.04-arm

or

jobs:
  build:
    runs-on: windows-11-arm

poutine analyze_local . reports pr_runs_on_self_hosted for that job.

Concrete example: the clouatre-labs/aptu-github-app repo has 21 jobs across 11 workflows using runs-on: ubuntu-24.04-arm. All are flagged.

Expected behavior

GitHub-hosted arm64 labels should be recognized as hosted runners, not flagged as self-hosted:

• ubuntu-22.04-arm, ubuntu-24.04-arm, ubuntu-26.04-arm
• windows-11-arm, windows-11-vs2026-arm

Suggested fix

Extend the ubuntu- and windows- alternatives to account for arm64 labels:

ubuntu-(([0-9]{2})\.04(-arm)?|latest(-(4|8|16)-cores)?|slim)|macos-([0-9]{2}|latest)(-x?large)?|windows-(20[0-9]{2}|latest(-8-cores)?|11(-vs[0-9]{4})?-arm)|(buildjet|warp)-[a-z0-9-]+

Key changes:

• ubuntu-(([0-9]{2})\.04(-arm)?|...) -- adds optional -arm suffix to versioned Ubuntu labels
• windows-(...|11(-vs[0-9]{4})?-arm) -- adds windows-11-arm and windows-11-vs2026-arm (the -vsNNNN segment sits between 11 and -arm, matching the label format announced in the Jun 2026 changelog)

The test suite in opa/opa_test.go has no arm64 test cases, and scanner/testdata/.github/workflows/allowed_pr_runner.yml has no arm64 runner entries. Both should be updated alongside the regex change.

For reference, actionlint's allGitHubHostedRunnerLabels maintains an exhaustive list of GitHub-hosted runner labels and could serve as a cross-reference.

Workaround

rulesConfig.pr_runs_on_self_hosted.allowed_runners or a repo-wide skip: - rule: pr_runs_on_self_hosted in .poutine.yml. Mentioned as context, not as a substitute for fixing the detection.