ci: internal jobs skip on the public forge instead of waiting for a hive-ci runner

A job-level if: is evaluated by whichever runner picks the job up. The
public forge's copy has only a nixos runner, so a job guarded by
if: vars.PUBLIC_FORGE != 'true' and pinned to runs-on: [hive-ci] never
gets picked up there to evaluate the guard at all - it just sits queued.

runs-on now carries the same PUBLIC_FORGE variable: hive-ci internally,
nixos on the public copy. There the nixos runner picks the job up,
evaluates the existing if:, and skips it immediately. Internally
PUBLIC_FORGE is unset, so runs-on still resolves to hive-ci and nothing
changes.

.forgejo/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
   check:
     name: nix flake check
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     # 30 min is well above a cold-cache rebuild (~15 min observed) and well
     # under the runner's 3h cap
     timeout-minutes: 30
@@ -23,7 +23,7 @@ jobs:
   tracker-tags:
     name: tracker-tag lint
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
@@ -33,7 +33,7 @@ jobs:
   comment-blocks:
     name: comment-block lint
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
@@ -43,7 +43,7 @@ jobs:
   doc-refs:
     name: doc-pointer lint
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
@@ -53,7 +53,7 @@ jobs:
   attribution-trailers:
     name: attribution-trailer lint
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
@@ -65,7 +65,7 @@ jobs:
   dashboard-descriptions:
     name: dashboard-description lint
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
@@ -77,7 +77,7 @@ jobs:
   shellcheck:
     name: shellcheck
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v3
@@ -94,7 +94,7 @@ jobs:
   prose-lint:
     name: prose lint (vale)
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
@@ -107,7 +107,7 @@ jobs:
   prose-lint-errors:
     name: prose lint (vale, errors)
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3

.forgejo/workflows/coverage.yml

@@ -18,7 +18,7 @@ jobs:
   coverage:
     name: cargo llvm-cov
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     # Above the 30 min `nix flake check` allows, because instrumented
     # builds are slower than the ordinary ones and this starts from a
     # cache that the normal jobs never populate.

.forgejo/workflows/flake-update.yml

@@ -23,7 +23,7 @@ jobs:
   update:
     name: nix flake update
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v3