CI - Move things to a small runner

.github/workflows/attach-artifacts.yml

@@ -9,7 +9,8 @@ on:
 
 jobs:
   upload-assets:
-    runs-on: spacetimedb-linux
+    # This only downloads existing artifacts and attaches them to a GitHub release.
+    runs-on: spacetimedb-linux-small
     permissions:
       contents: write  # needed to modify releases
 

.github/workflows/check-merge-labels.yml

@@ -10,7 +10,8 @@ permissions: read-all
 jobs:
   label_checks:
     name: Check merge labels
-    runs-on: spacetimedb-linux
+    # This only inspects event labels and performs no checkout or build.
+    runs-on: spacetimedb-linux-small
     steps:
       - if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'do not merge')
         run: |

.github/workflows/check-pr-base.yml

@@ -13,7 +13,8 @@ concurrency:
 jobs:
   check_base_ref:
     name: Based on `master`
-    runs-on: spacetimedb-linux
+    # This only evaluates the event base ref and performs no build.
+    runs-on: spacetimedb-linux-small
     steps:
       - id: not_based_on_master
         if: |
@@ -26,7 +27,8 @@ jobs:
   release_dependencies:
     if: ${{ github.event_name == 'pull_request' }}
     name: Check release dependencies
-    runs-on: spacetimedb-linux
+    # This builds a small CI helper and inspects release metadata and git history.
+    runs-on: spacetimedb-linux-small
     permissions:
       contents: read
       pull-requests: read

.github/workflows/ci.yml

@@ -24,7 +24,8 @@ permissions:
 jobs:
   merge_queue_noop:
     name: Merge queue no-op/reuse
-    runs-on: spacetimedb-linux
+    # This compares git trees and builds only the small workflow-coordinator helper.
+    runs-on: spacetimedb-linux-small
     permissions:
       actions: write
       contents: read
@@ -584,7 +585,8 @@ jobs:
           - name: Windows 2/4
           - name: Windows 3/4
           - name: Windows 4/4
-    runs-on: spacetimedb-linux
+    # These no-op jobs only preserve required smoketest check names after CI reuse.
+    runs-on: spacetimedb-linux-small
     steps:
       - name: Skip duplicate merge queue smoketest
         run: echo "Merge queue commit has the same tree as the PR head; smoketest already ran for the PR."
@@ -814,7 +816,8 @@ jobs:
   codeowners_check:
     if: ${{ github.event_name == 'pull_request' }}
     name: CODEOWNERS check
-    runs-on: spacetimedb-linux
+    # This builds a small CI helper and checks changed paths and GitHub reviews.
+    runs-on: spacetimedb-linux-small
     permissions:
       contents: read
       pull-requests: read
@@ -849,7 +852,8 @@ jobs:
     needs: [merge_queue_noop, upload-build-artifacts-linux]
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
     name: Build and test wasm bindings
-    runs-on: spacetimedb-linux
+    # This reuses prebuilt core binaries and builds only the small module fixture.
+    runs-on: spacetimedb-linux-small
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
       RUST_BACKTRACE: full
@@ -873,7 +877,8 @@ jobs:
     needs: [merge_queue_noop]
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
     name: Check that packages are publishable
-    runs-on: spacetimedb-linux
+    # This builds a small CI helper and validates package metadata without compiling the workspace.
+    runs-on: spacetimedb-linux-small
     permissions: read-all
     env:
       RUST_BACKTRACE: full
@@ -901,7 +906,8 @@ jobs:
     strategy:
       matrix:
         include:
-          - { target: x86_64-unknown-linux-gnu, runner: spacetimedb-linux }
+          # The Linux update-flow test uses released artifacts and builds only its small CI driver.
+          - { target: x86_64-unknown-linux-gnu, runner: spacetimedb-linux-small }
           - { target: aarch64-apple-darwin, runner: macos-latest }
           - { target: x86_64-pc-windows-msvc, runner: windows-latest }
     runs-on: ${{ matrix.runner }}
@@ -950,7 +956,8 @@ jobs:
           - { target: x86_64-unknown-linux-gnu }
           - { target: aarch64-apple-darwin }
           - { target: x86_64-pc-windows-msvc }
-    runs-on: spacetimedb-linux
+    # These no-op jobs only preserve required update-flow check names after CI reuse.
+    runs-on: spacetimedb-linux-small
     steps:
       - name: Skip duplicate merge queue update test
         run: echo "Merge queue commit has the same tree as the PR head; update-flow already ran for the PR."
@@ -1053,7 +1060,8 @@ jobs:
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
     name: Check CLI docs
     permissions: read-all
-    runs-on: spacetimedb-linux
+    # This builds a small CI helper and regenerates documentation, not core server packages.
+    runs-on: spacetimedb-linux-small
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
       RUST_BACKTRACE: full
@@ -1319,6 +1327,7 @@ jobs:
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
     permissions:
       contents: read
+    # The .NET packaging, Godot project build, and integration test make this too heavy for a small runner.
     runs-on: spacetimedb-linux
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
@@ -1426,6 +1435,7 @@ jobs:
   csharp-testsuite:
     needs: [merge_queue_noop, lints, upload-build-artifacts-linux]
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
+    # The C# SDK build and tests saturated the small runner's CPU, so keep this on the main runner.
     runs-on: spacetimedb-linux
     timeout-minutes: 30
     env:
@@ -1549,7 +1559,8 @@ jobs:
     needs: [merge_queue_noop]
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
     name: Verify global.json files are symlinks
-    runs-on: spacetimedb-linux
+    # This builds a small CI helper and checks symlink policy without building SpacetimeDB.
+    runs-on: spacetimedb-linux-small
     permissions:
       contents: read
     env:
@@ -1590,7 +1601,8 @@ jobs:
     needs: [merge_queue_noop]
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
     name: Check smoketests/mod.rs is complete
-    runs-on: spacetimedb-linux
+    # This builds a tiny source-scanning helper and does not compile or run smoketests.
+    runs-on: spacetimedb-linux-small
     permissions:
       contents: read
     env:
@@ -1624,6 +1636,7 @@ jobs:
     needs: [merge_queue_noop]
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
     name: Docs build
+    # Building the documentation site nearly saturated a small runner and used substantial memory.
     runs-on: spacetimedb-linux
     env:
       RUST_BACKTRACE: full
@@ -1659,7 +1672,8 @@ jobs:
     needs: [merge_queue_noop, upload-build-artifacts-linux]
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
     name: TypeScript - Tests
-    runs-on: spacetimedb-linux
+    # This reuses prebuilt core binaries and builds only TypeScript SDK test fixtures.
+    runs-on: spacetimedb-linux-small
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
       RUST_BACKTRACE: full

.github/workflows/cla-gate.yml

@@ -17,7 +17,8 @@ permissions:
 jobs:
   publish-cla-gate-status:
     name: CLA status
-    runs-on: spacetimedb-linux
+    # This only evaluates GitHub status metadata and publishes a commit status.
+    runs-on: spacetimedb-linux-small
     if: github.event_name != 'status' || github.event.context == 'license/cla'
 
     steps:

.github/workflows/discord-posts.yml

@@ -11,7 +11,8 @@ permissions:
 
 jobs:
   resolvePush:
-    runs-on: spacetimedb-linux
+    # This only resolves GitHub event metadata and performs no checkout or build.
+    runs-on: spacetimedb-linux-small
     outputs:
       is_pr_merge: ${{ steps.resolve.outputs.is_pr_merge }}
       is_external: ${{ steps.resolve.outputs.is_external }}
@@ -80,7 +81,8 @@ jobs:
 
   discordNotification:
     needs: resolvePush
-    runs-on: spacetimedb-linux
+    # This only queries pull-request checks and posts a Discord notification.
+    runs-on: spacetimedb-linux-small
     if: needs.resolvePush.outputs.is_pr_merge == 'true'
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -157,7 +159,8 @@ jobs:
     needs:
       - resolvePush
       - discordNotification
-    runs-on: spacetimedb-linux
+    # This failure path only posts a Discord notification.
+    runs-on: spacetimedb-linux-small
     if: ${{ always() && (needs.resolvePush.result == 'failure' || needs.discordNotification.result == 'failure') }}
     steps:
       - name: Send failure notification
@@ -172,7 +175,8 @@ jobs:
 
   warnDirectPush:
     needs: resolvePush
-    runs-on: spacetimedb-linux
+    # This only formats commit metadata and posts a Discord warning.
+    runs-on: spacetimedb-linux-small
     if: needs.resolvePush.outputs.is_pr_merge != 'true'
     steps:
       - name: Warn about non-PR push
@@ -197,7 +201,8 @@ jobs:
 
   invokePrivate:
     needs: resolvePush
-    runs-on: spacetimedb-linux
+    # This only dispatches the private workflow through the GitHub API.
+    runs-on: spacetimedb-linux-small
     if: needs.resolvePush.outputs.is_pr_merge == 'true'
     permissions:
       contents: read

.github/workflows/docs-publish.yaml

@@ -10,7 +10,8 @@ on:
 
 jobs:
   build:
-    runs-on: spacetimedb-linux
+    # This builds and uploads the documentation site, not SpacetimeDB binaries.
+    runs-on: spacetimedb-linux-small
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3

.github/workflows/docs-update-llms.yaml

@@ -14,7 +14,8 @@ on:
 
 jobs:
   update-llms:
-    runs-on: spacetimedb-linux
+    # This builds documentation assets and updates one generated text file.
+    runs-on: spacetimedb-linux-small
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3

.github/workflows/internal-tests.yml

@@ -27,7 +27,8 @@ jobs:
     # Skip if this is an external contribution. GitHub secrets will be empty, so the step would fail anyway.
     if: ${{ (github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/master'))
       && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) }}
-    runs-on: spacetimedb-linux
+    # This builds small workflow helpers, dispatches private CI, and waits for its result.
+    runs-on: spacetimedb-linux-small
     env:
       TARGET_OWNER: clockworklabs
       TARGET_REPO: SpacetimeDBPrivate

.github/workflows/llm-benchmark-periodic.yml

@@ -50,7 +50,8 @@ concurrency:
 jobs:
   prepare_matrix:
     name: Prepare benchmark matrix
-    runs-on: spacetimedb-linux
+    # This only parses workflow inputs into a JSON matrix and performs no benchmark work.
+    runs-on: spacetimedb-linux-small
     outputs:
       languages: ${{ steps.matrix.outputs.languages }}
     steps:

.github/workflows/pr_approval_check.yml

@@ -29,7 +29,8 @@ concurrency:
 jobs:
   publish-approval-status:
     name: Set approval status
-    runs-on: spacetimedb-linux
+    # This disabled metadata-only job performs no checkout or build when re-enabled.
+    runs-on: spacetimedb-linux-small
     # Disabled until we can spend some more focus on making this work consistently.
     # See https://github.com/clockworklabs/SpacetimeDB/pull/4673.
     if: false

.github/workflows/release.yml

@@ -60,7 +60,8 @@ concurrency:
 jobs:
   validate-release-invoker:
     name: Validate release invoker
-    runs-on: spacetimedb-linux
+    # This only validates workflow inputs and the invoking actor.
+    runs-on: spacetimedb-linux-small
     steps:
       - name: Reject direct public release invocations
         env:
@@ -80,7 +81,8 @@ jobs:
   # try to fail during this step to prevent partial releases.
   build-cargo-release:
     needs: validate-release-invoker
-    runs-on: spacetimedb-linux
+    # This compiles only the small release automation binary for downstream jobs.
+    runs-on: spacetimedb-linux-small
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -109,7 +111,8 @@ jobs:
 
   release-crates:
     needs: build-cargo-release
-    runs-on: spacetimedb-linux
+    # This packages and publishes crates with the prebuilt release helper; it does not build the workspace.
+    runs-on: spacetimedb-linux-small
     if: ${{ inputs.release_crates }}
     env:
       CARGO_TERM_COLOR: always
@@ -151,7 +154,8 @@ jobs:
 
   release-csharp:
     needs: build-cargo-release
-    runs-on: spacetimedb-linux
+    # This packages the C# SDK and generated DLLs rather than building the core server.
+    runs-on: spacetimedb-linux-small
     if: ${{ inputs.release_csharp }}
     env:
       CARGO_TERM_COLOR: always
@@ -230,7 +234,8 @@ jobs:
 
   release-cpp:
     needs: build-cargo-release
-    runs-on: spacetimedb-linux
+    # This updates and publishes the generated C++ SDK repository without a core build.
+    runs-on: spacetimedb-linux-small
     if: ${{ inputs.release_cpp }}
     env:
       CARGO_TERM_COLOR: always
@@ -286,7 +291,8 @@ jobs:
 
   release-npm:
     needs: build-cargo-release
-    runs-on: spacetimedb-linux
+    # This installs and publishes the TypeScript SDK with the prebuilt release helper.
+    runs-on: spacetimedb-linux-small
     if: ${{ inputs.release_npm }}
     env:
       CARGO_TERM_COLOR: always
@@ -380,7 +386,8 @@ jobs:
 
   update-mirror-latest-version:
     needs: validate-release-invoker
-    runs-on: spacetimedb-linux
+    # This only verifies S3 objects and updates the latest-version marker.
+    runs-on: spacetimedb-linux-small
     if: ${{ !inputs.dry_run && inputs.update_mirror_latest_version }}
 
     steps:
@@ -422,7 +429,8 @@ jobs:
       - release-npm
       - release-docker
       - update-mirror-latest-version
-    runs-on: spacetimedb-linux
+    # This only publishes existing artifacts and dispatches the release announcement.
+    runs-on: spacetimedb-linux-small
     if: >-
       ${{
         always()

.github/workflows/retry-cla-assistant.yml

@@ -31,7 +31,8 @@ permissions:
 jobs:
   retry-cla:
     name: Retry CLA Assistant if it is the only blocker
-    runs-on: spacetimedb-linux
+    # This builds a small CI helper and only queries or retries CLA checks.
+    runs-on: spacetimedb-linux-small
 
     steps:
       - name: Check out trusted base code

.github/workflows/tag-release.yml

@@ -30,7 +30,8 @@ jobs:
   # Internal/team announcement (simple)
   announce-release:
     name: Announce GitHub release (Internal)
-    runs-on: spacetimedb-linux
+    # This only formats release metadata and posts a Discord notification.
+    runs-on: spacetimedb-linux-small
     if: >-
       ${{
         github.event_name == 'release'
@@ -52,7 +53,8 @@ jobs:
   # Public announcement with full release notes
   public-discord-notification:
     name: Announce GitHub release (Public)
-    runs-on: spacetimedb-linux
+    # This only formats release notes and posts them to Discord.
+    runs-on: spacetimedb-linux-small
     steps:
       - name: Send Discord notification
         env: