From 0f369a4b0d3a70a9d03b7040e6401d2bd7df0abe Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Sun, 23 Aug 2026 12:16:14 +0100
Subject: [PATCH] Use hosted compilation for stable releases

---
 .github/workflows/build-release-candidate.yml         |  9 +++++----
 .../internal/subsystems/deployment-installability.md  | 11 +++++++----
 scripts/installtests/build_release_assets_test.go     |  2 +-
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/build-release-candidate.yml b/.github/workflows/build-release-candidate.yml
index 1e79ebaca..2731dcc93 100644
--- a/.github/workflows/build-release-candidate.yml
+++ b/.github/workflows/build-release-candidate.yml
@@ -76,10 +76,11 @@ permissions:
 jobs:
   compile-release-payload:
     name: Compile Exact-SHA Release Payload
-    # SignPath Foundation validates every job leading up to an OSS signing
-    # request. Keep stable signed candidates entirely on GitHub-hosted runners;
-    # prerelease and explicitly unsigned candidates retain the fast PVE lane.
-    runs-on: ${{ inputs.require_windows_signing && 'ubuntu-24.04' || fromJSON('["self-hosted","Linux","X64","pulse-pve-compile"]') }}
+    # Stable exact-SHA candidates favor the reproducible hosted lane. The PVE
+    # matrix remains fast for prereleases, but two stable rehearsals lost
+    # different compiler processes under runner resource pressure. Hosted
+    # provenance is also mandatory when a stable candidate reaches SignPath.
+    runs-on: ${{ !contains(inputs.version, '-') && 'ubuntu-24.04' || fromJSON('["self-hosted","Linux","X64","pulse-pve-compile"]') }}
     timeout-minutes: 20
     steps:
       - name: Checkout repository
diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md
index c0a4a0def..1b846a788 100644
--- a/docs/release-control/v6/internal/subsystems/deployment-installability.md
+++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md
@@ -1626,10 +1626,13 @@ exact uploaded artifact through the GitHub Actions API, and GitHub validates
 that nested permission even when a prerelease skips Authenticode signing.
 SignPath Foundation also requires every job leading up to an open-source
 signing request to execute on GitHub-hosted runners. Stable signed candidates
-therefore route release preparation, exact-SHA compilation, the parallel
-frontend bundle, and backend qualification through GitHub-hosted runners until
-the signing request is on record. Prerelease and explicitly unsigned candidates
-retain the credential-free PVE acceleration path; post-signing container
+therefore route release preparation, the parallel frontend bundle, and backend
+qualification through GitHub-hosted runners until the signing request is on
+record. All stable candidates route exact-SHA compilation through the hosted
+lane: rehearsals `32631653966` and `32635525554` lost different matrix compiler
+processes on the PVE runner without compiler diagnostics after substantial
+progress, while the same targets build independently. Prereleases retain the
+credential-free PVE compilation path for speed; post-signing container
 qualification may also use PVE because it cannot affect the submitted Windows
 artifact.
 
diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go
index 0856b88aa..9a9c2b825 100644
--- a/scripts/installtests/build_release_assets_test.go
+++ b/scripts/installtests/build_release_assets_test.go
@@ -2360,7 +2360,7 @@ func TestReleasePipelinePromotesOneImmutableCandidate(t *testing.T) {
 	}
 
 	for _, needle := range []string{
-		`inputs.require_windows_signing && 'ubuntu-24.04'`,
+		`!contains(inputs.version, '-') && 'ubuntu-24.04'`,
 		"pulse-pve-compile",
 		`./scripts/build-release-binaries.sh "${{ inputs.version }}"`,
 		`release-compiled-${{ github.sha }}-${{ inputs.version }}`,