Repository navigation
ci: pin runs-on to ubuntu-24.04 and actions by SHA - #377
Merged
Merged
Conversation
ubuntu-latest moves to Ubuntu 26 on 2026-10-19, which can break builds without warning. Every GitHub-hosted job now runs on ubuntu-24.04 (self-hosted groups and the arm64 runner are unchanged), and every third-party action is pinned by full commit SHA with a version comment. Actions still on the Node 20 runtime are bumped to their current SHA-pinned release (Node 24); actions already past Node 20 are pinned at their current major. Refs CryptOS-PKI/.github#28 Signed-off-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>
Bugs5382
marked this pull request as ready for review
October 14, 2026 15:32
github-actions
Bot
added
the
skip-changelog
Contributor
Author
|
Approved. Hosted jobs pinned to ubuntu-24.04 and actions pinned by SHA. Refs CryptOS-PKI/.github#28 |
Bugs5382
enabled auto-merge (squash)
October 14, 2026 15:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
ubuntu-latestmoves to Ubuntu 26 on 2026-10-19, which can break buildswithout warning. Pinned runners and actions keep CI reproducible; versions
are bumped by hand in planned PRs (no Dependabot or Renovate).
Every GitHub-hosted job now runs on
ubuntu-24.04(the arm64 runner and anyself-hosted group are unchanged). Every third-party action is pinned by full
commit SHA with a
# vX.Y.Zcomment, resolved from the action's own releasetag (dereferencing the annotated tag to its commit). Actions still on the
Node 20 runtime are bumped to their current release and pinned there, since
pinning a Node 20 action by SHA does not fix the deprecation risk; actions
already past Node 20 are pinned at their current major, not bumped further.
One exception:
CryptOS-PKI/.github/.github/workflows/asset-metadata.yml@mainis a same-org reusable workflow call with no release to pin to, so it is
left as-is.
Refs CryptOS-PKI/.github#28
Verification
How this was verified
actionlintover the full.github/workflows/tree: clean.action.ymlat both its old and new ref toconfirm the runtime (
node20vsnode24) before deciding whether to bumppast the pinned major or just pin the existing one.
breaking changes, and checked this repo's actual usage against them (for
example,
actions/download-artifact's v5 breaking change only affectsdownloads by artifact ID, and every use here downloads by
name).