fix(semgrep): run the package-manager scan on Depot everywhere

[posthog]

Problem

• Who it hurts: every engineer shipping to public repos (notably PostHog/posthog). The Semgrep Package Managers required check now queues longer than it runs.
• Queue p95 rose week over week while the scan itself did not get slower.
• Root cause: runs-on picked the Depot runner only for private repos, so public repos stayed on the shared GitHub-hosted ubuntu-latest pool. Load on that pool grew and runner availability absorbed the difference.
• Nothing is broken — zero failures in both windows. This is queue contention, not a scan regression.

-        runs-on: ${{ github.event.repository.private && 'depot-ubuntu-latest' || 'ubuntu-latest' }}
+        runs-on: depot-ubuntu-latest

Changes

• Always run the package-manager scan on depot-ubuntu-latest, dropping the private-only condition so public repos leave the contended shared pool.
• Update the surrounding comment to state the new behaviour.

Trade-off

• This trades free GitHub-hosted minutes for paid Depot minutes on every public repo that runs this required check. That cost caps the net benefit and is the main thing to weigh before merge.

---

Created with PostHog Desktop from this inbox report.

[posthog]

🦔 ReviewHog reviewed this pull request

Found 1 must fix, 0 should fix, 0 consider.

Published 1 finding (view the review).

Resolved comments: 1 left for you

[posthog]

ReviewHog Alpha 🦔 If you find any issues helpful - please reply "valid", "invalid", etc., for evaluation purposes 🙏

[posthog]

ReviewHog Report

Found 1 must fix.

[posthog]

Depot is not enabled for every public repository

Why we think it's a valid issue

• Checked: the PR diff, the full workflow file, the sibling workflow semgrep.yml, a repo-wide grep for depot, CLAUDE.md, and the git history of both semgrep workflows.
• Found: .github/workflows/semgrep.yml:20 still carries the identical ${{ github.event.repository.private && 'depot-ubuntu-latest' || 'ubuntu-latest' }} expression, and the PR does not touch it. The conditional is therefore a deliberate, repeated pattern in this repo, not a one-off leftover. Its sibling comment at semgrep.yml:16 repeats the same reason.
• Found: the deleted comment at .github/workflows/semgrep-package-managers.yml:16-19 records the constraint as a statement of fact, not as a guess. The PR removes the guard and the reason together. The PR body weighs only the cost trade-off (paid Depot minutes against free GitHub minutes). It gives no evidence that Depot access now covers every public repo.
• Found: the workflow declares on: pull_request and merge_group with no workflow_call trigger, so it runs org-wide as a required workflow against each target repo. Commit 9c9ec54 confirms this failure mode is real: it describes an unrelated exit code that "reds this required check in whichever repo it ran against".
• Found: timeout-minutes: 15 at line 21 does not limit this risk. That budget counts run time after a runner picks the job up. It does not count queue time. A job whose runs-on label matches no available runner stays queued until GitHub cancels it, roughly 24 hours later.
• Impact: in any repo that the Depot runner group does not cover, this required check never starts. The pull request stays blocked for up to a day, then the check ends in a non-success state and keeps blocking. Because this file is an org-wide required workflow, the blast radius is every affected repo at once, and recovery needs a second change to this repo. The premise is confirmed by the repo itself rather than speculative, so it clears the bar.
• Impact: the fix is cheap to verify before merge. Confirm Depot runner-group access for every target repo, or keep the fallback expression.

Issue description

The removed comment states that some public repositories cannot use Depot. Those repositories will not find a runner with this label. Their required check can remain queued and block merges.

Suggested fix

Grant the Depot runner group access to every target repository before this change merges. If that is not possible, keep the existing fallback for repositories without Depot access.

Prompt to fix with AI (copy-paste)

## Context
@.github/workflows/semgrep-package-managers.yml#L19

<issue_description>
The removed comment states that some public repositories cannot use Depot. Those repositories will not find a runner with this label. Their required check can remain queued and block merges.
</issue_description>

<issue_validation>
- **Checked:** the PR diff, the full workflow file, the sibling workflow `semgrep.yml`, a repo-wide grep for `depot`, `CLAUDE.md`, and the git history of both semgrep workflows.
- **Found:** `.github/workflows/semgrep.yml:20` still carries the identical `${{ github.event.repository.private && 'depot-ubuntu-latest' || 'ubuntu-latest' }}` expression, and the PR does not touch it. The conditional is therefore a deliberate, repeated pattern in this repo, not a one-off leftover. Its sibling comment at `semgrep.yml:16` repeats the same reason.
- **Found:** the deleted comment at `.github/workflows/semgrep-package-managers.yml:16-19` records the constraint as a statement of fact, not as a guess. The PR removes the guard and the reason together. The PR body weighs only the cost trade-off (paid Depot minutes against free GitHub minutes). It gives no evidence that Depot access now covers every public repo.
- **Found:** the workflow declares `on: pull_request` and `merge_group` with no `workflow_call` trigger, so it runs org-wide as a required workflow against each target repo. Commit 9c9ec54 confirms this failure mode is real: it describes an unrelated exit code that "reds this required check in whichever repo it ran against".
- **Found:** `timeout-minutes: 15` at line 21 does not limit this risk. That budget counts run time after a runner picks the job up. It does not count queue time. A job whose `runs-on` label matches no available runner stays queued until GitHub cancels it, roughly 24 hours later.
- **Impact:** in any repo that the Depot runner group does not cover, this required check never starts. The pull request stays blocked for up to a day, then the check ends in a non-success state and keeps blocking. Because this file is an org-wide required workflow, the blast radius is every affected repo at once, and recovery needs a second change to this repo. The premise is confirmed by the repo itself rather than speculative, so it clears the bar.
- **Impact:** the fix is cheap to verify before merge. Confirm Depot runner-group access for every target repo, or keep the fallback expression.
</issue_validation>

## Task
Investigate the issue and solve it

<potential_solution>
Grant the Depot runner group access to every target repository before this change merges. If that is not possible, keep the existing fallback for repositories without Depot access.
</potential_solution>

[posthog]

This is a real risk worth resolving before merge, but it needs a human decision rather than an automated fix.

The change pins the job to depot-ubuntu-latest unconditionally. Because this workflow runs org-wide as a required check (it triggers on pull_request and merge_group with no workflow_call), any target repo whose runner set does not include a Depot runner will never find a match for that label. timeout-minutes: 15 does not help — it only counts run time once a runner picks up the job, not queue time, so such a job stays queued until GitHub cancels it (~24h) and blocks merges the whole time. The blast radius is every affected repo at once.

The premise looks solid: the sibling workflow .github/workflows/semgrep.yml still uses the same ${{ github.event.repository.private && 'depot-ubuntu-latest' || 'ubuntu-latest' }} fallback, and its comment there states outright that not every public repo has Depot enabled. This PR removed that guard and its explaining comment without evidence that Depot coverage now spans every public repo.

What a human needs to decide: confirm the Depot runner group grants access to every target/public repo in the org — if so, the hardcoded label is safe (and semgrep.yml should arguably be updated the same way for consistency); if not, keep the fallback expression here as semgrep.yml still does. I can't verify Depot org coverage from the code, and this is a CI/workflow file, so I'm not making the change unattended.