Move the remaining native Linux CI jobs off EC2 (pytorch#22108)

Moves the Linux jobs that write their own steps, so the `linux_job_v3`
migration in pytorch#22245 onward does not reach them.

`stale.yml` and the two artifact-to-S3 jobs do no ExecuTorch work, so
they move to `ubuntu-latest` and assume `role/arc` through OIDC rather
than the EC2 instance role they used to inherit.

`apple.yml`'s `test-demo-ios` also moves to `ubuntu-latest`. It cannot
go to OSDC, since `mobile_job.yml` resolves its actions by relative
path, but it does no work locally either — it uploads two archives to
AWS Device Farm and polls for the result, and `mobile_job.yml` already
authenticates through OIDC. test-infra's own `test_mobile_job.yml`
exercises it on `ubuntu-latest`.

The two Cadence Xtensa workflows moved to pytorch#22718: hifi4 works on OSDC
but vision hits a Cadence licence-key mismatch there, and that should
not block these three.

Authored with Claude Code.

cc @digantdesai @freddan80 @per @zingo @oscarandersson8218 @mansnils
@Sebastian-Larsson @robell @rascani

Author: huydhn

.github/workflows/_test_backend.yml

@@ -90,7 +90,13 @@ jobs:
   package-golden-artifacts:
     if: ${{ inputs.run-linux && inputs.save-goldens }}
     needs: test-backend-linux
-    runs-on: linux.2xlarge
+    # Repackaging artifacts needs no ExecuTorch toolchain, so this runs on a
+    # GitHub-hosted runner rather than moving to OSDC; the S3 upload that used
+    # to ride on the EC2 instance role assumes role/arc through OIDC instead.
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - name: Download model test artifacts
         uses: actions/download-artifact@v4
@@ -124,6 +130,13 @@ jobs:
             echo "No golden artifacts found."
           fi
 
+      - name: Configure AWS credentials
+        if: ${{ hashFiles('golden_artifacts_*.zip') != '' }}
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::308535385114:role/arc
+          aws-region: us-east-1
+
       - name: Upload golden artifacts to S3
         uses: seemethere/upload-artifact-s3@v5
         if: ${{ hashFiles('golden_artifacts_*.zip') != '' }}

.github/workflows/apple.yml

@@ -126,7 +126,13 @@ jobs:
   # Upload the test demo app to S3
   upload-demo-ios:
     needs: build-demo-ios
-    runs-on: linux.2xlarge
+    # Moving an artifact from GitHub to S3 needs no ExecuTorch toolchain, so
+    # this runs on a GitHub-hosted runner rather than moving to OSDC; the upload
+    # that used to ride on the EC2 instance role assumes role/arc through OIDC.
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - name: Download the artifacts from GitHub
         uses: actions/download-artifact@v4
@@ -142,6 +148,12 @@ jobs:
           set -eux
           ls -lah ./
 
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::308535385114:role/arc
+          aws-region: us-east-1
+
       - name: Upload the artifacts to S3
         uses: seemethere/upload-artifact-s3@v5
         with:
@@ -163,8 +175,8 @@ jobs:
     uses: pytorch/test-infra/.github/workflows/mobile_job.yml@main
     with:
       device-type: ios
-      # For iOS testing, the runner just needs to call AWS Device Farm, so there is no need to run this on macOS
-      runner: linux.2xlarge
+      # For iOS testing, the runner just needs to call AWS Device Farm, so there is no need to run this on macOS.
+      runner: ubuntu-latest
       test-infra-ref: main
       # This is the ARN of ExecuTorch project on AWS
       project-arn: arn:aws:devicefarm:us-west-2:308535385114:project:02a2cf0f-6d9b-45ee-ba1a-a086587469e6

.github/workflows/stale.yml

@@ -14,7 +14,8 @@ on:
 jobs:
   stale:
     if: ${{ github.repository == 'pytorch/executorch' }}
-    runs-on: linux.large
+    # Pure GitHub API work, so it needs neither an EC2 nor an OSDC runner.
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: write