ci: install gh on the review runner, pinned by version and sha256

.github/workflows/expo-code-review.yml

@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   review:
-    runs-on: ubuntu-latest
+    runs-on: expo-large
     # Trigger policy lives in .expo-code-review/config.jsonc (review.trigger); `ecr ci`
     # self-gates on it (and honors the ai-review:skip label). This coarse gate just
     # avoids spinning up a runner for a PR that explicitly opted out. Uses the array
@@ -49,6 +49,29 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
 
+      # `ecr ci` reads the whole PR through `gh`, which GitHub-hosted images ship and
+      # ours do not. Pinned by version AND sha256: this binary runs with GH_TOKEN and
+      # the model credential in its environment, so "whatever the image happens to
+      # ship" is a worse answer than one we can name. Installs into $HOME, never the
+      # workspace — resolveTrustedTool refuses a `gh` found inside the reviewed tree.
+      - name: Install gh
+        env:
+          GH_VERSION: "2.97.0"
+          GH_SHA256: "a2c9b8497e1f85b1ad0dfcb78b5a622e098801b8e461e459e88e1ee12f018112"
+        run: |
+          set -euo pipefail
+          tarball="gh_${GH_VERSION}_linux_amd64.tar.gz"
+          curl -fsSL --retry 3 -o "$RUNNER_TEMP/$tarball" \
+            "https://github.com/cli/cli/releases/download/v${GH_VERSION}/${tarball}"
+          echo "${GH_SHA256}  $RUNNER_TEMP/$tarball" | sha256sum -c -
+          mkdir -p "$HOME/.local/bin"
+          tar -xzf "$RUNNER_TEMP/$tarball" -C "$RUNNER_TEMP"
+          install -m 0755 "$RUNNER_TEMP/gh_${GH_VERSION}_linux_amd64/bin/gh" "$HOME/.local/bin/gh"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Check gh is available
+        run: gh --version
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 

.github/workflows/ref-check.yml

@@ -10,10 +10,16 @@ permissions:
 
 jobs:
   ref-check:
-    runs-on: ubuntu-latest
+    runs-on: expo-small
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      # ref-check is a python3 script. GitHub-hosted images ship python3; a
+      # self-hosted one is not guaranteed to, so ask for it explicitly.
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
       - name: Validate LLP references and metadata
         run: ./ref-check --verbose

.github/workflows/release.yml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: expo-small
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

.github/workflows/test.yml

@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: expo-small
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5