From 6f1e7d8f99edb907ff25a5446bb903585b9ff8d0 Mon Sep 17 00:00:00 2001
From: Nomads_Reach <144523850+NomadsReach@users.noreply.github.com>
Date: Mon, 17 Aug 2026 15:51:49 -0400
Subject: [PATCH] Route GNS build to isolated CO-SERVER runner

---
 .github/workflows/gns-transport.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/gns-transport.yml b/.github/workflows/gns-transport.yml
index b63b596..02692b5 100644
--- a/.github/workflows/gns-transport.yml
+++ b/.github/workflows/gns-transport.yml
@@ -10,14 +10,19 @@ on:
       - "server/native_transport/**"
       - ".github/workflows/gns-transport.yml"
 
+permissions:
+  contents: read
+
 jobs:
   linux:
     name: Linux native GNS bridge
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: [self-hosted, Linux, X64, co-server]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
 
-      - name: Verify build dependencies (pre-provisioned on the self-hosted runner)
+      - name: Verify build dependencies
         run: |
           missing=0
           for tool in cmake ninja protoc; do