diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4b87cb7..c609bc9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -158,7 +158,6 @@ jobs:
     strategy:
       fail-fast: false
       # Uncomment this on private runners, which can't run multiple wp-env instances in parallel.
-      max-parallel: 1
       matrix:
         php: ['8.4', '8.3', '8.2']
         wp: ['latest']
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index c7cda08..6a9cf74 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -12,35 +12,19 @@ on:
 
 jobs:
   build:
-    runs-on: [public-repo]
-    container:
-      image: ghcr.io/actions/actions-runner@sha256:1ad983536759ceec39ed75a2c8f007ca8c37b66eee35ed86f13623b29a4db97d # v2.333.0
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
-        - /tmp/wp-env:/tmp/wp-env
-
+    runs-on: [self-hosted]
     permissions:
       contents: read
 
     env:
       WP_ENV_PORT: 8889
-      WP_ENV_HOME: /tmp/wp-env
+      # Must live on the shared work emptyDir mounted by ARC's dind containerMode
+      # so the dind sidecar can resolve the bind-mount source paths wp-env generates.
+      WP_ENV_HOME: /home/runner/_work/_temp/wp-env-home
 
     timeout-minutes: 30
 
     steps:
-      - name: Magic thing needed becuase of github as it bind mounts __temp
-        run: |
-          sudo apt update && sudo apt install -y acl
-          sudo setfacl -R -m u:runner:rwX /__w /github/home /github/workflow /tmp/wp-env
-          sudo setfacl -R -d -m u:runner:rwX /__w /github/home /github/workflow /tmp/wp-env
-
-      - name: Configure Docker group permissions
-        run: |
-          SOCK_GID=$(stat -c '%g' /var/run/docker.sock)
-          sudo groupmod -g $SOCK_GID -o docker
-          sudo usermod -aG $SOCK_GID runner
-
       - name: Set up Docker Compose
         uses: docker/setup-compose-action@4eb059ff7f16592f9c84d5ca339c53cb7c5064e2 # v2.3.0
         with:
@@ -77,23 +61,11 @@ jobs:
       - name: Build plugin for release
         run: npm run build:prod
 
-      - name: Fix wp-env host mapping
+      - name: Pin plugin folder name in wp-env config
         run: |
-          # Get the host path for the workspace by inspecting the container's own mounts
-          HOST_WORKSPACE_PATH=$(docker inspect $(hostname) --format '{{ range .Mounts }}{{ if eq .Destination "/__w" }}{{ .Source }}{{ end }}{{ end }}')
-
-          # Construct the full host path for the current plugin directory
-          RELATIVE_PATH=$(pwd | sed 's|^/__w||')
-          PLUGIN_HOST_PATH="${HOST_WORKSPACE_PATH}${RELATIVE_PATH}"
-
-          echo "Host Workspace: $HOST_WORKSPACE_PATH"
-          echo "Plugin Host Path: $PLUGIN_HOST_PATH"
-
-          # Update .wp-env.json (default env)
-          jq --arg path "$PLUGIN_HOST_PATH" \
+          jq --arg path "$(pwd)" \
              'del(.plugins) | .mappings["wp-content/plugins/plugin-skeleton-d"] = $path' \
              .wp-env.json > .wp-env.json.tmp && mv .wp-env.json.tmp .wp-env.json
-
           cat .wp-env.json
 
       - name: Start the Docker testing environment
@@ -120,21 +92,3 @@ jobs:
         if: always()
         run: npm run wp-env destroy -- --force
 
-      - name: Cleanup Workspace & Home to avoid pollution
-        if: always()
-        run: |
-          # Wipes the actual code, build artifacts, and hidden files
-          sudo rm -rf ./* .[!.]* 2>/dev/null || true
-
-          # Deletes everything inside _temp EXCEPT the locked mount points
-          sudo find /__w/_temp/ -mindepth 1 -maxdepth 1 ! -name '_github_home' ! -name '_github_workflow' -exec rm -rf {} +
-
-          # Empties the contents of the locked directories without deleting the folders themselves
-          sudo rm -rf /github/home/* || true
-          sudo rm -rf /github/home/.* 2>/dev/null || true
-
-          sudo rm -rf /github/workflow/* || true
-          sudo rm -rf /github/workflow/.* 2>/dev/null || true
-
-          # Empty the wp-env directory
-          sudo rm -rf /tmp/wp-env/* || true
diff --git a/.github/workflows/reusable-e2e.yml b/.github/workflows/reusable-e2e.yml
index de7ef52..39ac0c7 100644
--- a/.github/workflows/reusable-e2e.yml
+++ b/.github/workflows/reusable-e2e.yml
@@ -14,37 +14,17 @@ permissions:
 jobs:
   e2e:
     name: Playwright E2E Tests
-    runs-on: [public-repo]
-    container:
-      image: ghcr.io/actions/actions-runner@sha256:1ad983536759ceec39ed75a2c8f007ca8c37b66eee35ed86f13623b29a4db97d # v2.333.0
-      # We use --add-host to get the host IP, and we will use socat to forward
-      # localhost:8889 to the host so Playwright and WordPress agree on "localhost".
-      options: --add-host=host.docker.internal:host-gateway
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
-        - /tmp/wp-env:/tmp/wp-env
-        - /tmp/playwright-cache:/tmp/playwright-cache
-
+    runs-on: [self-hosted]
     timeout-minutes: 30
 
     env:
       WP_ENV_PORT: 8889
-      WP_ENV_HOME: /tmp/wp-env
       PLAYWRIGHT_BROWSERS_PATH: /tmp/playwright-cache
+      # Must live on the shared work emptyDir mounted by ARC's dind containerMode
+      # so the dind sidecar can resolve the bind-mount source paths wp-env generates.
+      WP_ENV_HOME: /home/runner/_work/_temp/wp-env-home
 
     steps:
-      - name: Magic thing needed becuase of github as it bind mounts __temp
-        run: |
-          sudo apt update && sudo apt install -y acl socat
-          sudo setfacl -R -m u:runner:rwX /__w /github/home /github/workflow /tmp/wp-env /tmp/playwright-cache
-          sudo setfacl -R -d -m u:runner:rwX /__w /github/home /github/workflow /tmp/wp-env /tmp/playwright-cache
-
-      - name: Configure Docker group permissions
-        run: |
-          SOCK_GID=$(stat -c '%g' /var/run/docker.sock)
-          sudo groupmod -g $SOCK_GID -o docker
-          sudo usermod -aG $SOCK_GID runner
-
       - name: Set up Docker Compose
         uses: docker/setup-compose-action@4eb059ff7f16592f9c84d5ca339c53cb7c5064e2 # v2.3.0
         with:
@@ -79,23 +59,11 @@ jobs:
       - name: Build development assets
         run: npm run build:dev
 
-      - name: Fix wp-env host mapping
+      - name: Pin plugin folder name in wp-env config
         run: |
-          # Get the host path for the workspace by inspecting the container's own mounts
-          HOST_WORKSPACE_PATH=$(docker inspect $(hostname) --format '{{ range .Mounts }}{{ if eq .Destination "/__w" }}{{ .Source }}{{ end }}{{ end }}')
-
-          # Construct the full host path for the current plugin directory
-          RELATIVE_PATH=$(pwd | sed 's|^/__w||')
-          PLUGIN_HOST_PATH="${HOST_WORKSPACE_PATH}${RELATIVE_PATH}"
-
-          echo "Host Workspace: $HOST_WORKSPACE_PATH"
-          echo "Plugin Host Path: $PLUGIN_HOST_PATH"
-
-          # Update .wp-env.test.json
-          jq --arg path "$PLUGIN_HOST_PATH" \
+          jq --arg path "$(pwd)" \
              'del(.plugins) | .mappings["wp-content/plugins/plugin-skeleton-d"] = $path' \
              .wp-env.test.json > .wp-env.test.json.tmp && mv .wp-env.test.json.tmp .wp-env.test.json
-
           cat .wp-env.test.json
 
       - name: Start the Docker testing environment
@@ -111,27 +79,7 @@ jobs:
           npx playwright install
 
       - name: Run E2E tests
-        run: |
-          # Forward localhost traffic from the CI container to the Host machine
-          # where the WordPress Docker container is actually listening.
-          # This ensures Playwright and WordPress both agree the domain is "localhost:8889".
-          if ss -tlnp | grep -q ":${WP_ENV_PORT} "; then
-            echo "ERROR: Port ${WP_ENV_PORT} already in use"
-            exit 1
-          fi
-
-          socat TCP4-LISTEN:${WP_ENV_PORT},fork,bind=127.0.0.1 TCP4:host.docker.internal:${WP_ENV_PORT} &
-          SOCAT_PID=$!
-
-          sleep 2
-          if ! kill -0 "$SOCAT_PID" 2>/dev/null; then
-            echo "ERROR: socat failed to start"
-            exit 1
-          fi
-
-          echo "socat running (PID: $SOCAT_PID) on port ${WP_ENV_PORT}"
-
-          npm run test:e2e
+        run: npm run test:e2e
 
       - name: Upload E2E test results as artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -146,22 +94,3 @@ jobs:
         if: always()
         run: npm run wp-env:test destroy -- --force
 
-      - name: Cleanup Workspace & Home to avoid pollution
-        if: always()
-        run: |
-          # Wipes the actual code, build artifacts, and hidden files
-          sudo rm -rf ./* .[!.]* 2>/dev/null || true
-
-          # Deletes everything inside _temp EXCEPT the locked mount points
-          sudo find /__w/_temp/ -mindepth 1 -maxdepth 1 ! -name '_github_home' ! -name '_github_workflow' -exec rm -rf {} +
-
-          # Empties the contents of the locked directories without deleting the folders themselves
-          sudo rm -rf /github/home/* || true
-          sudo rm -rf /github/home/.* 2>/dev/null || true
-
-          sudo rm -rf /github/workflow/* || true
-          sudo rm -rf /github/workflow/.* 2>/dev/null || true
-
-          # Empty the wp-env directory
-          sudo rm -rf /tmp/wp-env/* || true
-          sudo rm -rf /tmp/playwright-cache/* || true
diff --git a/.github/workflows/reusable-jest.yml b/.github/workflows/reusable-jest.yml
index 26eb1f0..aa8e542 100644
--- a/.github/workflows/reusable-jest.yml
+++ b/.github/workflows/reusable-jest.yml
@@ -15,9 +15,7 @@ permissions:
 jobs:
   jest:
     name: Jest Unit Tests${{ inputs.coverage && ' with coverage' || '' }}
-    runs-on: [public-repo]
-    container:
-      image: ghcr.io/actions/actions-runner@sha256:1ad983536759ceec39ed75a2c8f007ca8c37b66eee35ed86f13623b29a4db97d # v2.333.0
+    runs-on: [self-hosted]
     timeout-minutes: 10
 
     steps:
@@ -58,18 +56,3 @@ jobs:
           retention-days: 7
           if-no-files-found: ignore
 
-      - name: Cleanup Workspace & Home to avoid pollution
-        if: always()
-        run: |
-          # Wipes the actual code, build artifacts, and hidden files
-          sudo rm -rf ./* .[!.]* 2>/dev/null || true
-
-          # Deletes everything inside _temp EXCEPT the locked mount points
-          sudo find /__w/_temp/ -mindepth 1 -maxdepth 1 ! -name '_github_home' ! -name '_github_workflow' -exec rm -rf {} +
-
-          # Empties the contents of the locked directories without deleting the folders themselves
-          sudo rm -rf /github/home/* || true
-          sudo rm -rf /github/home/.* 2>/dev/null || true
-
-          sudo rm -rf /github/workflow/* || true
-          sudo rm -rf /github/workflow/.* 2>/dev/null || true
diff --git a/.github/workflows/reusable-lint-css-js.yml b/.github/workflows/reusable-lint-css-js.yml
index 02ee887..2a27731 100644
--- a/.github/workflows/reusable-lint-css-js.yml
+++ b/.github/workflows/reusable-lint-css-js.yml
@@ -9,9 +9,7 @@ permissions:
 jobs:
   lint-js:
     name: JS Lint & TypeScript
-    runs-on: [public-repo]
-    container:
-      image: ghcr.io/actions/actions-runner@sha256:1ad983536759ceec39ed75a2c8f007ca8c37b66eee35ed86f13623b29a4db97d # v2.333.0
+    runs-on: [self-hosted]
     timeout-minutes: 20
 
     steps:
@@ -57,18 +55,3 @@ jobs:
           echo "One or more checks failed. See logs above for details."
           exit 1
 
-      - name: Cleanup Workspace & Home to avoid pollution
-        if: always()
-        run: |
-          # Wipes the actual code, build artifacts, and hidden files
-          sudo rm -rf ./* .[!.]* 2>/dev/null || true
-
-          # Deletes everything inside _temp EXCEPT the locked mount points
-          sudo find /__w/_temp/ -mindepth 1 -maxdepth 1 ! -name '_github_home' ! -name '_github_workflow' -exec rm -rf {} +
-
-          # Empties the contents of the locked directories without deleting the folders themselves
-          sudo rm -rf /github/home/* || true
-          sudo rm -rf /github/home/.* 2>/dev/null || true
-
-          sudo rm -rf /github/workflow/* || true
-          sudo rm -rf /github/workflow/.* 2>/dev/null || true
diff --git a/.github/workflows/reusable-phpcs.yml b/.github/workflows/reusable-phpcs.yml
index a6a7938..bc9c1e6 100644
--- a/.github/workflows/reusable-phpcs.yml
+++ b/.github/workflows/reusable-phpcs.yml
@@ -14,9 +14,7 @@ permissions:
 jobs:
   phpcs:
     name: PHPCS Coding Standards
-    runs-on: [public-repo]
-    container:
-      image: ghcr.io/actions/actions-runner@sha256:1ad983536759ceec39ed75a2c8f007ca8c37b66eee35ed86f13623b29a4db97d # v2.333.0
+    runs-on: [self-hosted]
     timeout-minutes: 20
 
     steps:
@@ -57,18 +55,3 @@ jobs:
         if: ${{ always() && steps.phpcs.outcome == 'failure' }}
         run: cs2pr ./tests/_output/phpcs-report.xml
 
-      - name: Cleanup Workspace & Home to avoid pollution
-        if: always()
-        run: |
-          # Wipes the actual code, build artifacts, and hidden files
-          sudo rm -rf ./* .[!.]* 2>/dev/null || true
-
-          # Deletes everything inside _temp EXCEPT the locked mount points
-          sudo find /__w/_temp/ -mindepth 1 -maxdepth 1 ! -name '_github_home' ! -name '_github_workflow' -exec rm -rf {} +
-
-          # Empties the contents of the locked directories without deleting the folders themselves
-          sudo rm -rf /github/home/* || true
-          sudo rm -rf /github/home/.* 2>/dev/null || true
-
-          sudo rm -rf /github/workflow/* || true
-          sudo rm -rf /github/workflow/.* 2>/dev/null || true
diff --git a/.github/workflows/reusable-phpstan.yml b/.github/workflows/reusable-phpstan.yml
index d5fd05f..2e13e41 100644
--- a/.github/workflows/reusable-phpstan.yml
+++ b/.github/workflows/reusable-phpstan.yml
@@ -14,9 +14,7 @@ permissions:
 jobs:
   phpstan:
     name: PHPStan Static Analysis
-    runs-on: [public-repo]
-    container:
-      image: ghcr.io/actions/actions-runner@sha256:1ad983536759ceec39ed75a2c8f007ca8c37b66eee35ed86f13623b29a4db97d # v2.333.0
+    runs-on: [self-hosted]
     timeout-minutes: 20
 
     steps:
@@ -60,18 +58,3 @@ jobs:
           path: tests/_output
           key: phpstan-result-cache-${{ runner.os }}-date-${{ steps.get-date.outputs.date }}
 
-      - name: Cleanup Workspace & Home to avoid pollution
-        if: always()
-        run: |
-          # Wipes the actual code, build artifacts, and hidden files
-          sudo rm -rf ./* .[!.]* 2>/dev/null || true
-
-          # Deletes everything inside _temp EXCEPT the locked mount points
-          sudo find /__w/_temp/ -mindepth 1 -maxdepth 1 ! -name '_github_home' ! -name '_github_workflow' -exec rm -rf {} +
-
-          # Empties the contents of the locked directories without deleting the folders themselves
-          sudo rm -rf /github/home/* || true
-          sudo rm -rf /github/home/.* 2>/dev/null || true
-
-          sudo rm -rf /github/workflow/* || true
-          sudo rm -rf /github/workflow/.* 2>/dev/null || true
diff --git a/.github/workflows/reusable-phpunit.yml b/.github/workflows/reusable-phpunit.yml
index a853c7f..b82520f 100644
--- a/.github/workflows/reusable-phpunit.yml
+++ b/.github/workflows/reusable-phpunit.yml
@@ -29,34 +29,18 @@ permissions:
 jobs:
   phpunit:
     name: PHPUnit (PHP ${{ inputs.php-version }}, WP ${{ inputs.wp-version }})${{ inputs.coverage && ' with coverage' || '' }}${{ inputs.multisite && ' multisite' || '' }}
-    runs-on: [public-repo]
-    container:
-      image: ghcr.io/actions/actions-runner@sha256:1ad983536759ceec39ed75a2c8f007ca8c37b66eee35ed86f13623b29a4db97d # v2.333.0
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
-        - /tmp/wp-env:/tmp/wp-env
-
+    runs-on: [self-hosted]
     timeout-minutes: 30
 
     env:
       WP_ENV_PHP_VERSION: ${{ inputs.php-version }}
       WP_ENV_CORE: ${{ inputs.wp-version == 'trunk' && 'WordPress/WordPress' || format('https://wordpress.org/wordpress-{0}.zip', inputs.wp-version) }}
       WP_ENV_PORT: 8889
-      WP_ENV_HOME: /tmp/wp-env
+      # Must live on the shared work emptyDir mounted by ARC's dind containerMode
+      # so the dind sidecar can resolve the bind-mount source paths wp-env generates.
+      WP_ENV_HOME: /home/runner/_work/_temp/wp-env-home
 
     steps:
-      - name: Magic thing needed becuase of github as it bind mounts __temp
-        run: |
-          sudo apt update && sudo apt install -y acl
-          sudo setfacl -R -m u:runner:rwX /__w /github/home /github/workflow /tmp/wp-env
-          sudo setfacl -R -d -m u:runner:rwX /__w /github/home /github/workflow /tmp/wp-env
-
-      - name: Configure Docker group permissions
-        run: |
-          SOCK_GID=$(stat -c '%g' /var/run/docker.sock)
-          sudo groupmod -g $SOCK_GID -o docker
-          sudo usermod -aG $SOCK_GID runner
-
       - name: Set up Docker Compose
         uses: docker/setup-compose-action@4eb059ff7f16592f9c84d5ca339c53cb7c5064e2 # v2.3.0
         with:
@@ -96,25 +80,11 @@ jobs:
       - name: Build development assets
         run: npm run build:dev
 
-      - name: Fix wp-env host mapping
+      - name: Pin plugin folder name in wp-env config
         run: |
-          # Get the host path for the workspace by inspecting the container's own mounts
-          HOST_WORKSPACE_PATH=$(docker inspect $(hostname) --format '{{ range .Mounts }}{{ if eq .Destination "/__w" }}{{ .Source }}{{ end }}{{ end }}')
-
-          # Construct the full host path for the current plugin directory
-          # We strip the internal /__w prefix and append it to the host workspace path
-          RELATIVE_PATH=$(pwd | sed 's|^/__w||')
-          PLUGIN_HOST_PATH="${HOST_WORKSPACE_PATH}${RELATIVE_PATH}"
-
-          echo "Host Workspace: $HOST_WORKSPACE_PATH"
-          echo "Plugin Host Path: $PLUGIN_HOST_PATH"
-
-          # 1. Remove the "plugins" field to prevent broken automatic mounts
-          # 2. Add the host mapping
-          jq --arg path "$PLUGIN_HOST_PATH" \
+          jq --arg path "$(pwd)" \
              'del(.plugins) | .mappings["wp-content/plugins/plugin-skeleton-d"] = $path' \
              .wp-env.test.json > .wp-env.test.json.tmp && mv .wp-env.test.json.tmp .wp-env.test.json
-
           cat .wp-env.test.json
 
       - name: Start the Docker testing environment
@@ -158,21 +128,3 @@ jobs:
         if: always()
         run: npm run wp-env:test destroy -- --force
 
-      - name: Cleanup Workspace & Home to avoid pollution
-        if: always()
-        run: |
-          # Wipes the actual code, build artifacts, and hidden files
-          sudo rm -rf ./* .[!.]* 2>/dev/null || true
-
-          # Deletes everything inside _temp EXCEPT the locked mount points
-          sudo find /__w/_temp/ -mindepth 1 -maxdepth 1 ! -name '_github_home' ! -name '_github_workflow' -exec rm -rf {} +
-
-          # Empties the contents of the locked directories without deleting the folders themselves
-          sudo rm -rf /github/home/* || true
-          sudo rm -rf /github/home/.* 2>/dev/null || true
-
-          sudo rm -rf /github/workflow/* || true
-          sudo rm -rf /github/workflow/.* 2>/dev/null || true
-
-          # Empty the wp-env directory
-          sudo rm -rf /tmp/wp-env/* || true
diff --git a/.github/workflows/reusable-wp-playground-pr-preview.yml b/.github/workflows/reusable-wp-playground-pr-preview.yml
index 14e55e7..93efb81 100644
--- a/.github/workflows/reusable-wp-playground-pr-preview.yml
+++ b/.github/workflows/reusable-wp-playground-pr-preview.yml
@@ -29,22 +29,13 @@ permissions:
 jobs:
   playground-preview:
     name: Post Playground Preview
-    runs-on: [public-repo]
-    container:
-      image: ghcr.io/actions/actions-runner@sha256:1ad983536759ceec39ed75a2c8f007ca8c37b66eee35ed86f13623b29a4db97d # v2.333.0
+    runs-on: [self-hosted]
     permissions:
       actions: read
       contents: write
       pull-requests: write
 
     steps:
-      - name: Install GH cli
-        run: |
-          curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo gpg --dearmor -o /usr/share/keyrings/githubcli-archive-keyring.gpg
-          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
-          sudo apt-get update
-          sudo apt install -y gh
-
       - name: Extract PR metadata and artifact info
         id: pr-metadata
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -122,18 +113,3 @@ jobs:
           pr-number: ${{ steps.pr-metadata.outputs.pr-number }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Cleanup Workspace & Home to avoid pollution
-        if: always()
-        run: |
-          # Wipes the actual code, build artifacts, and hidden files
-          sudo rm -rf ./* .[!.]* 2>/dev/null || true
-
-          # Deletes everything inside _temp EXCEPT the locked mount points
-          sudo find /__w/_temp/ -mindepth 1 -maxdepth 1 ! -name '_github_home' ! -name '_github_workflow' -exec rm -rf {} +
-
-          # Empties the contents of the locked directories without deleting the folders themselves
-          sudo rm -rf /github/home/* || true
-          sudo rm -rf /github/home/.* 2>/dev/null || true
-
-          sudo rm -rf /github/workflow/* || true
-          sudo rm -rf /github/workflow/.* 2>/dev/null || true
diff --git a/.github/workflows/test-private-workflows.yml b/.github/workflows/test-private-workflows.yml
index 0b6b6f3..0be4d25 100644
--- a/.github/workflows/test-private-workflows.yml
+++ b/.github/workflows/test-private-workflows.yml
@@ -23,7 +23,7 @@ permissions:
 jobs:
   detect:
     name: Detect Changes
-    runs-on: ubuntu-24.04
+    runs-on: [self-hosted]
     if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     permissions:
       contents: read