ci: run CI on self-hosted vps-ovh runner

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ permissions:
 jobs:
   lint:
     name: Lint (ruff)
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, vps-ovh, zab-queryme]
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
@@ -32,7 +32,7 @@ jobs:
 
   typecheck:
     name: Typecheck (mypy)
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, vps-ovh, zab-queryme]
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
@@ -48,7 +48,7 @@ jobs:
 
   test:
     name: Test (pytest)
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, vps-ovh, zab-queryme]
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
@@ -64,7 +64,7 @@ jobs:
 
   deps-audit:
     name: Dependency audit (pip-audit)
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, vps-ovh, zab-queryme]
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
@@ -80,23 +80,31 @@ jobs:
 
   secret-scan:
     name: Secret scan (trufflehog)
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, vps-ovh, zab-queryme]
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
         with:
+          # Full history so the native trufflehog git scan covers the whole
+          # repository, not just the tip commit.
           fetch-depth: 0
+      - name: Install trufflehog
+        # The trufflesecurity/trufflehog@main action runs via `docker run`,
+        # which exits 125 on the JIT self-hosted runner (no Docker daemon).
+        # Use the native binary instead — pinned, installed in-job, no docker.sock.
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh \
+            | sh -s -- -b "$RUNNER_TEMP/bin" v3.90.10
+          "$RUNNER_TEMP/bin/trufflehog" --version
       - name: TruffleHog scan
-        uses: trufflesecurity/trufflehog@main
-        with:
-          path: ./
-          base: ""
-          head: HEAD
-          extra_args: --results=verified,unknown
+        # Equivalent scan to the action (verified+unknown), over full git
+        # history, failing on a detected secret. No Docker dependency.
+        run: |
+          "$RUNNER_TEMP/bin/trufflehog" git file://. --fail --no-update --results=verified,unknown
 
   lockfile-check:
     name: Lockfile check (uv lock --check)
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, vps-ovh, zab-queryme]
     timeout-minutes: 3
     steps:
       - uses: actions/checkout@v4
@@ -109,7 +117,7 @@ jobs:
 
   codeowners-check:
     name: CODEOWNERS present
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, vps-ovh, zab-queryme]
     timeout-minutes: 2
     steps:
       - uses: actions/checkout@v4

pyproject.toml

@@ -21,6 +21,7 @@ dev = [
     "pre-commit>=4.0.0",
     "pip-audit>=2.7.0",
     "detect-secrets>=1.5.0",
+    "pip>=26.1.2",
 ]
 
 [tool.hatch.build.targets.wheel]