ci: cross-compile arm64 from amd64 (no GH-hosted arm runners)

- build-linux-binaries.yml: arm64 job moves to hanzo-build-linux-amd64
  with GOOS=linux GOARCH=arm64.
- build-ubuntu-arm64-release.yml: both jammy/focal jobs cross-compile
  on the amd64 self-hosted runner.
- build-macos-release.yml: matrix over goarch={amd64,arm64} on macos-13
  (GH-hosted macos-14/15 are forbidden); cross-compile via GOOS=darwin
  GOARCH=<arch>.
- build-and-test-mac-windows.yml: pin macos-latest -> macos-13.
- ci.yml: drop macos-14 from CI matrix (use macos-13).
- actionlint.yml: drop hanzo-build-linux-arm64 + ubuntu-24.04-arm from
  the self-hosted-runner whitelist.

.github/actionlint.yml

@@ -3,5 +3,3 @@ self-hosted-runner:
     - custom-arm64-focal
     - custom-arm64-jammy
     - hanzo-build-linux-amd64
-    - hanzo-build-linux-arm64
-    - ubuntu-24.04-arm

.github/workflows/build-and-test-mac-windows.yml

@@ -20,7 +20,10 @@ jobs:
       GOWORK: off
     strategy:
       matrix:
-        os: [windows-latest, macos-latest]
+        # `macos-latest` currently resolves to GH-hosted arm64 macos (forbidden);
+        # pin to `macos-13` (amd64). darwin/arm64 coverage lives in
+        # build-macos-release.yml via cross-compile.
+        os: [windows-latest, macos-13]
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project

.github/workflows/build-linux-binaries.yml

@@ -68,7 +68,7 @@ jobs:
           rm -rf ${{ github.workspace }}/luxd-pkg
 
   build-arm64-binaries-tarball:
-    runs-on: ubuntu-24.04-arm
+    runs-on: hanzo-build-linux-amd64
     permissions:
       id-token: write
       contents: read
@@ -80,8 +80,8 @@ jobs:
 
       - run: go version
 
-      - name: Build the luxd binaries (native arm64)
-        run: CGO_ENABLED=0 ./scripts/build.sh
+      - name: Build the luxd binaries (cross-compile arm64 on amd64)
+        run: CGO_ENABLED=0 GOOS=linux GOARCH=arm64 ./scripts/build.sh
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"

.github/workflows/build-macos-release.yml

@@ -22,9 +22,14 @@ on:
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
+  # Cross-compile both darwin/amd64 and darwin/arm64 on macos-13.
   build-mac:
-    # The type of runner that the job will run on
-    runs-on: macos-14
+    strategy:
+      fail-fast: false
+      matrix:
+        goarch: [amd64, arm64]
+    # The type of runner that the job will run on (GH-hosted arm64 macos forbidden).
+    runs-on: macos-13
     permissions:
       id-token: write
       contents: read
@@ -37,8 +42,8 @@ jobs:
       - run: go version
 
       # Runs a single command using the runners shell
-      - name: Build the luxd binary
-        run: CGO_ENABLED=0 ./scripts/run_task.sh build
+      - name: Build the luxd binary (cross-compile via GOOS/GOARCH)
+        run: CGO_ENABLED=0 GOOS=darwin GOARCH=${{ matrix.goarch }} ./scripts/run_task.sh build
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -56,17 +61,17 @@ jobs:
 
       - name: Create zip file with CLI-compatible naming
         run: |
-          # CLI expects: node-macos-{version}.zip containing build/luxd
+          # CLI expects: node-macos-{arch}-{version}.zip containing build/luxd
           mkdir -p build
-          7z a "node-macos-${TAG}.zip" build/luxd
+          7z a "node-macos-${{ matrix.goarch }}-${TAG}.zip" build/luxd
         env:
           TAG: ${{ env.TAG }}
 
       - name: Save as Github artifact
         uses: actions/upload-artifact@v7
         with:
-          name: build
-          path: node-macos-${{ env.TAG }}.zip
+          name: build-darwin-${{ matrix.goarch }}
+          path: node-macos-${{ matrix.goarch }}-${{ env.TAG }}.zip
 
       - name: Cleanup
         run: |

.github/workflows/build-ubuntu-arm64-release.yml

@@ -18,15 +18,15 @@ on:
 
 jobs:
   build-jammy-arm64-package:
-    runs-on: ubuntu-24.04-arm
+    runs-on: hanzo-build-linux-amd64
 
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
       - run: go version
 
-      - name: Build the luxd binaries (native arm64)
-        run: CGO_ENABLED=0 ./scripts/build.sh
+      - name: Build the luxd binaries (cross-compile arm64 on amd64)
+        run: CGO_ENABLED=0 GOOS=linux GOARCH=arm64 ./scripts/build.sh
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -63,15 +63,15 @@ jobs:
           rm -rf /tmp/luxd
 
   build-focal-arm64-package:
-    runs-on: ubuntu-24.04-arm
+    runs-on: hanzo-build-linux-amd64
 
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
       - run: go version
 
-      - name: Build the luxd binaries (native arm64)
-        run: CGO_ENABLED=0 ./scripts/build.sh
+      - name: Build the luxd binaries (cross-compile arm64 on amd64)
+        run: CGO_ENABLED=0 GOOS=linux GOARCH=arm64 ./scripts/build.sh
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"

.github/workflows/ci.yml

@@ -30,7 +30,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-14, ubuntu-22.04, ubuntu-24.04, windows-2022]
+        # GH-hosted arm64 macos forbidden; CI runs amd64 only. Release builds
+        # cover darwin/arm64 via cross-compile in build-macos-release.yml.
+        os: [macos-13, ubuntu-22.04, ubuntu-24.04, windows-2022]
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project