Cascade runs-on and make CI workflows OS-aware

[azazeal]

The reusable workflows in this repo were Linux-only by assumption: runs-on was hardcoded to ubuntu-latest in some places and derivable only from a single shared input in others, and the install step always shelled out to apt-get. That made it hard to point CI at the larger GitHub-hosted runners without piping a runner label through every leaf, and impossible to dispatch any of these workflows on non-Linux runners at all.

To that end, this PR threads runs-on through the parent workflows (code-scan.yml, goCI.yml) with a cascading default per child: the parent accepts a top-level runs-on plus per-child overrides (lint-runs-on, test-runs-on, build-runs-on, govulncheck-runs-on, codeql-runs-on), and each child resolves to ${{ inputs.<child>-runs-on || inputs.runs-on || 'ubuntu-latest' }}. Each leaf (goLint.yml, goTest.yml, goBuild.yml, govulncheck.yml, codeql-analysis.yml) accepts its own plain runs-on input.

It also makes the leaves OS-aware where they used to be Linux-specific. The Install Dependencies step now dispatches on ${RUNNER_OS} to call apt-get on Linux, brew on macOS, or choco on Windows; callers pass package names matching the runner they picked, since the workflow doesn't translate names. The redundant manual actions/cache + chmod steps in goTest.yml and codeql-analysis.yml were dropped — actions/setup-go with cache: true already handles per-OS cache paths. Steps that depend on POSIX shell features (eval, pipelines, ${GITHUB_ENV} redirects) now declare shell: bash explicitly so they run under Git Bash on Windows runners.

In codeql-analysis.yml, the leaf inputs were also renamed to drop the redundant codeql- prefix (build-cmd, build-mode, make-bootstrap, runs-on); parent workflows still expose codeql-* inputs and map them down, so callers aren't affected. A grep across Smallstep repos confirmed nothing calls codeql-analysis.yml directly — every caller goes through code-scan.yml or goCI.yml.

[Copilot]

Pull request overview

This PR extends the repository’s reusable CI workflows so callers can choose the runner label globally or per child workflow, while also simplifying the internal input names used by the CodeQL leaf workflow.

Changes:

• Added a runs-on input to each CI leaf workflow and wired it into the job definitions.
• Added cascading runner-selection inputs to goCI.yml and code-scan.yml so callers can set one default runner or override individual child workflows.
• Renamed codeql-analysis.yml inputs from codeql-* to shorter unprefixed names and updated parent mappings.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
.github/workflows/govulncheck.yml	Adds reusable runs-on input and uses it for the vulncheck job.
.github/workflows/goTest.yml	Adds reusable runs-on input and applies it to matrix setup and test jobs.
.github/workflows/goLint.yml	Adds reusable runs-on input for the lint job.
.github/workflows/goCI.yml	Adds global/per-child runner inputs and passes cascaded values to child workflows.
.github/workflows/goBuild.yml	Adds reusable runs-on input and applies it to matrix setup and build jobs.
.github/workflows/codeql-analysis.yml	Renames CodeQL leaf inputs and adds reusable runs-on support.
.github/workflows/code-scan.yml	Adds parent-level runner selection and remaps CodeQL inputs to renamed leaf inputs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.