ci: pin runs-on to ubuntu-24.04 and actions by SHA (#377)

ubuntu-latest moves to Ubuntu 26 on 2026-10-19, which can break builds
without warning. Every GitHub-hosted job now runs on ubuntu-24.04
(self-hosted groups and the arm64 runner are unchanged), and every
third-party action is pinned by full commit SHA with a version
comment. Actions still on the Node 20 runtime are bumped to their
current SHA-pinned release (Node 24); actions already past Node 20
are pinned at their current major.

Refs CryptOS-PKI/.github#28

Signed-off-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>
Co-authored-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>

Author: Bugs5382

.github/workflows/action-lint.yaml

@@ -22,13 +22,13 @@ jobs:
   actionlint:
     name: 🧹 Actionlint
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: 🐹 Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version: "stable"
       - name: 🧹 Run actionlint

.github/workflows/ci-go.yml

@@ -34,14 +34,14 @@ jobs:
   go-validation:
     name: Go validation (format, lint, vet, test, build)
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version-file: go.mod
           cache: true

.github/workflows/ci-kind-acme.yml

@@ -32,20 +32,20 @@ jobs:
   kind-acme:
     name: cert-manager gets a CryptOS certificate over ACME
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 25
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Cache kind, kubectl and manifests
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ~/.cache/cryptos-e2e-kind
           key: kind-acme-${{ runner.arch }}-${{ hashFiles('test/kind/versions.env') }}

.github/workflows/cron-cleanup-runs.yml

@@ -28,7 +28,7 @@ concurrency:
 jobs:
   cleanup:
     name: Prune old and failed runs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     env:
       GH_TOKEN: ${{ github.token }}

.github/workflows/job-dco.yaml

@@ -25,7 +25,7 @@ jobs:
   dco:
     name: ✍️ DCO sign-off
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - name: ✍️ Check every commit is signed off by its author

.github/workflows/job-gitleaks.yaml

@@ -24,11 +24,11 @@ jobs:
   gitleaks:
     name: 🔒 Gitleaks (secret scan)
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
         with:
           fetch-depth: 0
       - name: Install gitleaks

.github/workflows/job-golic.yaml

@@ -21,17 +21,17 @@ jobs:
   golic:
     name: 🔏 License headers
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
           go-version: 'stable'
       - name: Install Task
-        uses: arduino/setup-task@v2
+        uses: arduino/setup-task@c0bc642852239c2689f73f4ea6459c29405f3c52  # v3.0.0
         with:
           # Pin an exact, existing go-task version. setup-task's `3.x` range
           # resolution mis-computes a nonexistent version (observed: v3.52.0 ->

.github/workflows/job-label-checker.yaml

@@ -27,7 +27,7 @@ jobs:
   autolabel:
     name: Autolabel
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       # Map the conventional-commit prefix in the PR title to a categorizing
@@ -65,7 +65,7 @@ jobs:
     # Run even if autolabel was skipped/failed; the label may already be present
     # from the PR title.
     if: always() && github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       pull-requests: read

.github/workflows/job-label-sync.yaml

@@ -13,11 +13,11 @@ permissions:
 jobs:
   labeler:
     name: Sync labels
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: crazy-max/ghaction-github-labeler@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d  # v6.0.0
         with:
           yaml-file: .github/labels.yml
           skip-delete: false

.github/workflows/job-license-check.yaml

@@ -20,11 +20,11 @@ jobs:
   npm:
     name: npm dependency licenses
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Detect package.json
         id: manifest
@@ -33,7 +33,7 @@ jobs:
 
       - name: Setup Node
         if: steps.manifest.outputs.found == 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version: lts/*
 
@@ -51,11 +51,11 @@ jobs:
   go:
     name: Go dependency licenses
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Detect go.mod
         id: manifest
@@ -64,7 +64,7 @@ jobs:
 
       - name: Setup Go
         if: steps.manifest.outputs.found == 'true'
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version: 'stable'