ci: pin runners to ubuntu-24.04 ahead of the ubuntu-latest move

2026-11-07 04:12:04 +00:00 · 2026-10-08 07:58:54 +02:00
1 parent e63be67b5a
commit 22c8fe2e8d
@@ -26,7 +26,7 @@ permissions:
 jobs:
  coach-eval:
    name: Coach eval — deterministic floor (always) + live judge (opt-in)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    timeout-minutes: 15

    # Map the opt-in secret to a job-level env so the live-judge steps can gate
@@ -36,7 +36,7 @@ concurrency:
 jobs:
  analyze:
    name: Analyse javascript-typescript
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
@@ -11,7 +11,7 @@ permissions:

 jobs:
  auto-merge:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    if: github.actor == 'dependabot[bot]'
    permissions:
      contents: write
@@ -39,7 +39,7 @@ concurrency:
 jobs:
  release-policy:
    name: Validate release policy
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      actions: read
@@ -121,7 +121,7 @@ jobs:
      matrix:
        include:
          - platform: linux/amd64
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
            cache_scope: amd64
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
@@ -313,7 +313,7 @@ jobs:
  # the registry instead of on one cross-emulated runner.
  merge:
    name: Merge multi-arch manifest
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    if: github.event_name != 'pull_request'
    needs: [build]
    timeout-minutes: 10
@@ -449,7 +449,7 @@ jobs:
  promote:
    name: Promote verified image to Coolify
    needs: [merge, verify-published-image]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read
@@ -24,7 +24,7 @@ jobs:
  # mobile route sweep landed, and a slow runner tipped them over; three
  # shards with a 30-minute cap leave room for both.
  shard:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    timeout-minutes: 30
    strategy:
      fail-fast: false
@@ -128,7 +128,7 @@ jobs:
  # that name and answers for both shards: it fails when any shard failed or
  # was cancelled, so a half-green matrix cannot satisfy the gate.
  e2e:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    needs: shard
    if: always()
    timeout-minutes: 5
@@ -21,7 +21,7 @@ permissions:
 jobs:
  env-check:
    name: pnpm check-env against .env.production.example
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Checkout
@@ -22,7 +22,7 @@ jobs:
  # job timeout only needs to catch a container that never boots. Each shard
  # boots its own Postgres testcontainer.
  shard:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    timeout-minutes: 40
    strategy:
      fail-fast: false
@@ -67,7 +67,7 @@ jobs:
  # carries that name and answers for every shard: it fails when any shard
  # failed or was cancelled, so a half-green matrix cannot satisfy the gate.
  integration:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    needs: shard
    if: always()
    timeout-minutes: 5
@@ -12,7 +12,7 @@ permissions:
 jobs:
  knip:
    name: Dead-code gate
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    timeout-minutes: 10

    steps:
@@ -16,7 +16,7 @@ jobs:
  # future contributor reintroduces the pattern.
  grep:
    name: Forbidden marker grep
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -45,7 +45,7 @@ permissions:
 jobs:
  verify:
    name: Pull and smoke-test exact published image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    timeout-minutes: 10
    env:
      IMAGE_REF: ${{ inputs.image_ref }}
@@ -25,7 +25,7 @@ permissions: read-all
 jobs:
  analysis:
    name: Score supply-chain practices
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      # Write the findings into the repository's code-scanning alerts.
@@ -17,7 +17,7 @@ permissions:
 jobs:
  quality:
    name: Lint, Typecheck & Test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    if: github.event_name != 'schedule'

    steps:
@@ -100,7 +100,7 @@ jobs:
  # published image daily.
  dependency-audit:
    name: Dependency Audit
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    # Runs on pull requests too, but advisory: an advisory published against a
    # dependency the branch did not touch must not block the branch. The push
    # run on main and the daily schedule stay blocking, and a tag is only ever
@@ -130,7 +130,7 @@ jobs:

  secret-scan:
    name: Secret Scanning
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    if: github.event_name != 'schedule'

    steps:
@@ -145,7 +145,7 @@ jobs:

  docker-security:
    name: Container Security
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'

    steps:
@@ -45,7 +45,7 @@ permissions:
 jobs:
  journey:
    name: Sign in, write a reading, read it back
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    timeout-minutes: 10

    steps:
@@ -30,7 +30,7 @@ concurrency:
 jobs:
  filesystem:
    name: Lockfile (including dev dependencies)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read
@@ -95,7 +95,7 @@ jobs:

  published-image:
    name: Published image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read