rig/changelog.d/144.md

### Fixed

- CI's `check` job installs `shellcheck` where the image lacks it, so a runner on rig's defaults runs rig's own workflows (#144)

### Added

- `ubuntu-latest-full` in the default runner label map — GitHub's full tool surface, pulled only when a job asks for it (#144)
fix(ci): the check job installs the tools its image does not ship rig's own `ci / check` failed 9 times out of 27 ci.yml tasks on the first Forgejo runner, every one on `shellcheck: command not found`. `ubuntu-latest` maps to catthehacker's SLIM act image, and workflows written for GitHub reasonably assume GitHub's tool surface. Measured before choosing (2026-08-01, streaming ghcr layer blobs rather than pulling): the parity image is 18.67 GB on the wire and 54.52 GB extracted, against a box-class ci tenant with ~34-40 GB free. There is no cheap middle — runner-22.04 is the same slim class, tool for tool, and ships no shellcheck either. `apt-get install -y shellcheck` costs 7s and yields the same ShellCheck 0.8.0 that full-22.04 carries. So the slim default stays and the workflow equips itself. The `command -v` short-circuit keeps either forge from paying for the other; the sudo is a no-op on the act path and load-bearing on GitHub's. `ubuntu-latest-full` ships in the default map beside it: a mapping pulls nothing until a job matches it, and Forgejo freezes labels at registration, so a label absent then cannot be added without re-registering. A plain converge now warns when a runner carries a SUPERSEDED default — matched against the exact strings rig has shipped, so a map the operator chose stays silent. The message says plainly that nothing is broken. Refs #144 2026-08-01 21:22:01 +00:00			`### Fixed`

			- CI's `check` job installs `shellcheck` where the image lacks it, so a runner on rig's defaults runs rig's own workflows (#144)

			`### Added`

			- `ubuntu-latest-full` in the default runner label map — GitHub's full tool surface, pulled only when a job asks for it (#144)