fix(ci): restrict CodSpeed walltime runner

Resolve the runner label from a repository-controlled variable so dispatchers cannot select hosted or sensitive self-hosted runners.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: CBenoit

.github/workflows/codspeed.yml

@@ -7,11 +7,6 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
   workflow_dispatch:
-    inputs:
-      walltime_runner:
-        description: Approved Linux runner label for wall-time measurements
-        required: false
-        type: string
 
 permissions:
   contents: read
@@ -64,8 +59,8 @@ jobs:
 
   walltime:
     name: CodSpeed walltime
-    if: github.event_name == 'workflow_dispatch' && inputs.walltime_runner != '' && vars.CODSPEED_ENABLED == 'true'
-    runs-on: ${{ inputs.walltime_runner }}
+    if: github.event_name == 'workflow_dispatch' && vars.CODSPEED_ENABLED == 'true' && vars.CODSPEED_WALLTIME_RUNNER != ''
+    runs-on: ${{ vars.CODSPEED_WALLTIME_RUNNER }}
 
     steps:
       - uses: actions/checkout@v6

xtask/README.md

@@ -127,7 +127,9 @@ Compilation and corpus fetching occur before the CodSpeed action and are exclude
 
 The `CodSpeed` workflow runs simulation for pushes and pull requests only after maintainers set the `CODSPEED_ENABLED` repository variable to `true` and enable the repository in CodSpeed.
 It authenticates through GitHub OIDC and requires no repository secret for this public repository.
-The wall-time job is manual only and runs only when its dispatcher supplies a known, approved Linux runner label.
+The wall-time job is manual only and runs only when maintainers set the repository-controlled `CODSPEED_WALLTIME_RUNNER` variable to a known, approved Linux runner label.
+Dispatchers cannot select or override the wall-time runner.
+The job is skipped unless `CODSPEED_ENABLED` is `true` and `CODSPEED_WALLTIME_RUNNER` is nonempty.
 Use a dedicated stable runner for wall time; shared hosted runners are too noisy for performance decisions.
 The public capture cache uses the existing manifest-hash cache key and is digest-verified before use.
 Do not upload captures, decrypted payloads, TLS key material, screenshots, or generated replay output; CodSpeed receives measurements and may retain symbol-bearing profiles, not raw replay payloads.