From 2d85855366ad654e675845d39b1c2be6d1be0ccd Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 28 Oct 2026 15:59:59 +0000 Subject: [PATCH 1/4] Refactor `defaultRunnerImages` into `DEFAULT_RUNNER_IMAGES` map --- pr-checks/sync.ts | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index c205e94a72..02125504af 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -43,6 +43,13 @@ type WorkflowInputs = Partial>; /** An operating system identifier. */ type OperatingSystemIdentifier = "ubuntu" | "macos" | "windows"; +/** Mapping from {@link OperatingSystemIdentifier} to default runner image labels. */ +const DEFAULT_RUNNER_IMAGES: Record = { + ubuntu: "ubuntu-latest", + macos: "macos-latest", + windows: "windows-latest", +}; + /** * Represents an operating system matrix entry for a generated PR check workflow. * @@ -414,12 +421,6 @@ function generateJobMatrix( ); } - const defaultRunnerImages = [ - "ubuntu-latest", - "macos-latest", - "windows-latest", - ]; - for (const operatingSystemConfig of operatingSystems) { const operatingSystem = typeof operatingSystemConfig === "string" @@ -449,7 +450,7 @@ function generateJobMatrix( const runnerImagesForOs = typeof operatingSystemConfig === "string" || operatingSystemConfig["runner-image"] === undefined - ? defaultRunnerImages.filter((image) => + ? Object.values(DEFAULT_RUNNER_IMAGES).filter((image) => image.startsWith(operatingSystem), ) : [operatingSystemConfig["runner-image"]]; From 4b0f575f5a3e9f27dfda63b4c90a52c412ab23c9 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 28 Oct 2026 16:00:58 +0000 Subject: [PATCH 2/4] Replace floating occurrences of `ubuntu-latest` --- pr-checks/sync.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 02125504af..e84aaa0acc 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -463,7 +463,7 @@ function generateJobMatrix( // is removed from `defaultTestVersions`. const requiresOlderRunnerImage: DefaultTestVersion = "stable-v2.20.7"; if ( - runnerImage === "ubuntu-latest" && + runnerImage === DEFAULT_RUNNER_IMAGES["ubuntu"] && version === requiresOlderRunnerImage ) { matrix.push({ os: "ubuntu-24.04", version }); @@ -676,7 +676,7 @@ function generateValidationJob( "security-events": "read", }, "timeout-minutes": 5, - "runs-on": "ubuntu-latest", + "runs-on": DEFAULT_RUNNER_IMAGES["ubuntu"], steps: specSteps, }; From b8e636781a1e3c68def5687b19d0fea3100bc7ef Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 28 Oct 2026 16:02:23 +0000 Subject: [PATCH 3/4] Replace `-latest` with current, corresponding labels in `DEFAULT_RUNNER_IMAGES` --- .github/workflows/__all-platform-bundle.yml | 4 ++-- .github/workflows/__analysis-kinds.yml | 16 +++++++-------- .github/workflows/__analyze-ref-input.yml | 2 +- .github/workflows/__autobuild-action.yml | 6 +++--- ...obuild-direct-tracing-with-working-dir.yml | 8 ++++---- .github/workflows/__autobuild-working-dir.yml | 2 +- .github/workflows/__build-mode-autobuild.yml | 8 ++++---- .github/workflows/__build-mode-manual.yml | 2 +- .github/workflows/__build-mode-none.yml | 4 ++-- .github/workflows/__build-mode-rollback.yml | 2 +- .github/workflows/__bundle-from-nightly.yml | 2 +- .github/workflows/__bundle-from-toolcache.yml | 2 +- .github/workflows/__bundle-toolcache.yml | 6 +++--- .../workflows/__cleanup-db-cluster-dir.yml | 2 +- .github/workflows/__config-export.yml | 4 ++-- .github/workflows/__config-input.yml | 2 +- .github/workflows/__cpp-deptrace-disabled.yml | 6 +++--- .../__cpp-deptrace-enabled-on-macos.yml | 4 ++-- .github/workflows/__cpp-deptrace-enabled.yml | 6 +++--- .github/workflows/__diagnostics-export.yml | 4 ++-- .../workflows/__diagnostics-without-db.yml | 4 ++-- .../__export-file-baseline-information.yml | 6 +++--- .github/workflows/__extractor-ram-threads.yml | 2 +- .github/workflows/__global-proxy.yml | 4 ++-- .github/workflows/__go-custom-queries.yml | 4 ++-- ...indirect-tracing-workaround-diagnostic.yml | 2 +- ...ect-tracing-workaround-no-file-program.yml | 2 +- .../__go-indirect-tracing-workaround.yml | 2 +- .../workflows/__go-tracing-autobuilder.yml | 20 +++++++++---------- .../__go-tracing-custom-build-steps.yml | 20 +++++++++---------- .../__go-tracing-legacy-workflow.yml | 20 +++++++++---------- .github/workflows/__init-with-registries.yml | 6 +++--- .../workflows/__javascript-source-root.yml | 6 +++--- .github/workflows/__job-run-uuid-sarif.yml | 2 +- .github/workflows/__language-aliases.yml | 2 +- .github/workflows/__local-bundle.yml | 2 +- .../workflows/__multi-language-autodetect.yml | 16 +++++++-------- .github/workflows/__overlay-init-fallback.yml | 4 ++-- ...ackaging-codescanning-config-inputs-js.yml | 6 +++--- .../__packaging-config-inputs-js.yml | 6 +++--- .github/workflows/__packaging-config-js.yml | 6 +++--- .github/workflows/__packaging-inputs-js.yml | 6 +++--- .github/workflows/__remote-config.yml | 4 ++-- .../__resolve-environment-action.yml | 6 +++--- .github/workflows/__ruby.yml | 12 +++++------ .github/workflows/__rust.yml | 8 ++++---- .github/workflows/__split-workflow.yml | 12 +++++------ .github/workflows/__start-proxy.yml | 6 +++--- .github/workflows/__submit-sarif-failure.yml | 6 +++--- .github/workflows/__unset-environment.yml | 4 ++-- .github/workflows/__upload-ref-sha-input.yml | 2 +- .github/workflows/__upload-sarif.yml | 6 +++--- .github/workflows/__with-checkout-path.yml | 2 +- pr-checks/sync.ts | 6 +++--- 54 files changed, 157 insertions(+), 157 deletions(-) diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index 4846d13f1e..a0272b3e45 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -54,11 +54,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest - os: macos-latest-xlarge version: nightly-latest - - os: windows-latest + - os: windows-2025 version: nightly-latest name: All-platform bundle if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__analysis-kinds.yml b/.github/workflows/__analysis-kinds.yml index 5353c10956..a0a14c8c5e 100644 --- a/.github/workflows/__analysis-kinds.yml +++ b/.github/workflows/__analysis-kinds.yml @@ -34,28 +34,28 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked analysis-kinds: code-scanning - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked analysis-kinds: code-quality - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked analysis-kinds: code-scanning,code-quality - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked analysis-kinds: risk-assessment - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest analysis-kinds: code-scanning - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest analysis-kinds: code-quality - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest analysis-kinds: code-scanning,code-quality - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest analysis-kinds: risk-assessment name: Analysis kinds diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml index 7341a41740..1e899b39a6 100644 --- a/.github/workflows/__analyze-ref-input.yml +++ b/.github/workflows/__analyze-ref-input.yml @@ -54,7 +54,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: default name: "Analyze: 'ref' and 'sha' from inputs" if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__autobuild-action.yml b/.github/workflows/__autobuild-action.yml index 730a387f90..fcf5094e11 100644 --- a/.github/workflows/__autobuild-action.yml +++ b/.github/workflows/__autobuild-action.yml @@ -44,11 +44,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: macos-latest + - os: macos-26 version: linked - - os: windows-latest + - os: windows-2025 version: linked name: autobuild-action if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml index bad4921eb8..d0830846a0 100644 --- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml +++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml @@ -44,13 +44,13 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: windows-latest + - os: windows-2025 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest - - os: windows-latest + - os: windows-2025 version: nightly-latest name: Autobuild direct tracing (custom working directory) if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__autobuild-working-dir.yml b/.github/workflows/__autobuild-working-dir.yml index fac4ef9f54..489e4ed7d9 100644 --- a/.github/workflows/__autobuild-working-dir.yml +++ b/.github/workflows/__autobuild-working-dir.yml @@ -34,7 +34,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked name: Autobuild working directory if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml index 76e3f348ad..2e89573366 100644 --- a/.github/workflows/__build-mode-autobuild.yml +++ b/.github/workflows/__build-mode-autobuild.yml @@ -44,13 +44,13 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: windows-latest + - os: windows-2025 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest - - os: windows-latest + - os: windows-2025 version: nightly-latest name: Build mode autobuild if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml index bfe92c55ea..14cdc5654e 100644 --- a/.github/workflows/__build-mode-manual.yml +++ b/.github/workflows/__build-mode-manual.yml @@ -54,7 +54,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Build mode manual if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__build-mode-none.yml b/.github/workflows/__build-mode-none.yml index da7aa76383..690e7fe38c 100644 --- a/.github/workflows/__build-mode-none.yml +++ b/.github/workflows/__build-mode-none.yml @@ -34,9 +34,9 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Build mode none if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__build-mode-rollback.yml b/.github/workflows/__build-mode-rollback.yml index fcc77ea36e..0e53ba1959 100644 --- a/.github/workflows/__build-mode-rollback.yml +++ b/.github/workflows/__build-mode-rollback.yml @@ -34,7 +34,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Build mode rollback if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__bundle-from-nightly.yml b/.github/workflows/__bundle-from-nightly.yml index 6c414fb67e..08fb849598 100644 --- a/.github/workflows/__bundle-from-nightly.yml +++ b/.github/workflows/__bundle-from-nightly.yml @@ -34,7 +34,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked name: 'Bundle: From nightly' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__bundle-from-toolcache.yml b/.github/workflows/__bundle-from-toolcache.yml index 1a307ba2ee..79245e6651 100644 --- a/.github/workflows/__bundle-from-toolcache.yml +++ b/.github/workflows/__bundle-from-toolcache.yml @@ -34,7 +34,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: toolcache name: 'Bundle: From toolcache' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__bundle-toolcache.yml b/.github/workflows/__bundle-toolcache.yml index 96a901cf34..3f72648207 100644 --- a/.github/workflows/__bundle-toolcache.yml +++ b/.github/workflows/__bundle-toolcache.yml @@ -34,11 +34,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: macos-latest + - os: macos-26 version: linked - - os: windows-latest + - os: windows-2025 version: linked name: 'Bundle: Caching checks' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__cleanup-db-cluster-dir.yml b/.github/workflows/__cleanup-db-cluster-dir.yml index 3153041401..904932cedf 100644 --- a/.github/workflows/__cleanup-db-cluster-dir.yml +++ b/.github/workflows/__cleanup-db-cluster-dir.yml @@ -34,7 +34,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked name: Clean up database cluster directory if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml index f8d0ecf0c6..82ff82728c 100644 --- a/.github/workflows/__config-export.yml +++ b/.github/workflows/__config-export.yml @@ -34,9 +34,9 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Config export if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__config-input.yml b/.github/workflows/__config-input.yml index c015526c68..8c4544a7a5 100644 --- a/.github/workflows/__config-input.yml +++ b/.github/workflows/__config-input.yml @@ -34,7 +34,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked name: Config input if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__cpp-deptrace-disabled.yml b/.github/workflows/__cpp-deptrace-disabled.yml index e2434f4256..d84e322986 100644 --- a/.github/workflows/__cpp-deptrace-disabled.yml +++ b/.github/workflows/__cpp-deptrace-disabled.yml @@ -34,11 +34,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: 'C/C++: disabling autoinstalling dependencies (Linux)' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml index 344ed8d1ea..cca23b0895 100644 --- a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml +++ b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml @@ -34,9 +34,9 @@ jobs: fail-fast: false matrix: include: - - os: macos-latest + - os: macos-26 version: linked - - os: macos-latest + - os: macos-26 version: nightly-latest name: 'C/C++: autoinstalling dependencies is skipped (macOS)' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__cpp-deptrace-enabled.yml b/.github/workflows/__cpp-deptrace-enabled.yml index ab1a70584b..51ce4401cb 100644 --- a/.github/workflows/__cpp-deptrace-enabled.yml +++ b/.github/workflows/__cpp-deptrace-enabled.yml @@ -34,11 +34,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: 'C/C++: autoinstalling dependencies (Linux)' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml index 930ff0eb4c..d6494ac789 100644 --- a/.github/workflows/__diagnostics-export.yml +++ b/.github/workflows/__diagnostics-export.yml @@ -34,9 +34,9 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Diagnostic export if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__diagnostics-without-db.yml b/.github/workflows/__diagnostics-without-db.yml index 44c24fa683..9a1c3d6d9f 100644 --- a/.github/workflows/__diagnostics-without-db.yml +++ b/.github/workflows/__diagnostics-without-db.yml @@ -34,7 +34,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked name: Diagnostic export without database if: github.triggering_actor != 'dependabot[bot]' @@ -108,7 +108,7 @@ jobs: contents: read security-events: read timeout-minutes: 5 - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 steps: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml index a3b68dbb25..0500122576 100644 --- a/.github/workflows/__export-file-baseline-information.yml +++ b/.github/workflows/__export-file-baseline-information.yml @@ -54,11 +54,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest - - os: macos-latest + - os: macos-26 version: nightly-latest - - os: windows-latest + - os: windows-2025 version: nightly-latest name: Export file baseline information if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__extractor-ram-threads.yml b/.github/workflows/__extractor-ram-threads.yml index 5bd5c8b940..2275921b4f 100644 --- a/.github/workflows/__extractor-ram-threads.yml +++ b/.github/workflows/__extractor-ram-threads.yml @@ -34,7 +34,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked name: Extractor ram and threads options test if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml index 9244d1fc8f..0c68f0dd4e 100644 --- a/.github/workflows/__global-proxy.yml +++ b/.github/workflows/__global-proxy.yml @@ -34,9 +34,9 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Proxy test if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml index 7b4cd1305b..db7acd1ac6 100644 --- a/.github/workflows/__go-custom-queries.yml +++ b/.github/workflows/__go-custom-queries.yml @@ -54,9 +54,9 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: 'Go: Custom queries' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml index 968caf1e69..b570ae4a64 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml @@ -44,7 +44,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: default name: 'Go: diagnostic when Go is changed after init step' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml index 0f13b1e663..137583625f 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml @@ -44,7 +44,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: default name: 'Go: diagnostic when `file` is not installed' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__go-indirect-tracing-workaround.yml b/.github/workflows/__go-indirect-tracing-workaround.yml index 915835c2ab..5296e5837f 100644 --- a/.github/workflows/__go-indirect-tracing-workaround.yml +++ b/.github/workflows/__go-indirect-tracing-workaround.yml @@ -44,7 +44,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: default name: 'Go: workaround for indirect tracing' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml index a36cc43a7b..2b7005698e 100644 --- a/.github/workflows/__go-tracing-autobuilder.yml +++ b/.github/workflows/__go-tracing-autobuilder.yml @@ -46,25 +46,25 @@ jobs: include: - os: ubuntu-24.04 version: stable-v2.20.7 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.21.4 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.22.4 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.23.9 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.24.3 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.25.6 - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: macos-latest + - os: macos-26 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest - - os: macos-latest + - os: macos-26 version: nightly-latest name: 'Go: tracing with autobuilder step' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml index 05fedfb035..cc14651de7 100644 --- a/.github/workflows/__go-tracing-custom-build-steps.yml +++ b/.github/workflows/__go-tracing-custom-build-steps.yml @@ -46,25 +46,25 @@ jobs: include: - os: ubuntu-24.04 version: stable-v2.20.7 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.21.4 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.22.4 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.23.9 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.24.3 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.25.6 - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: macos-latest + - os: macos-26 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest - - os: macos-latest + - os: macos-26 version: nightly-latest name: 'Go: tracing with custom build steps' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml index 276d4cfda5..df62bf53cc 100644 --- a/.github/workflows/__go-tracing-legacy-workflow.yml +++ b/.github/workflows/__go-tracing-legacy-workflow.yml @@ -46,25 +46,25 @@ jobs: include: - os: ubuntu-24.04 version: stable-v2.20.7 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.21.4 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.22.4 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.23.9 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.24.3 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.25.6 - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: macos-latest + - os: macos-26 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest - - os: macos-latest + - os: macos-26 version: nightly-latest name: 'Go: tracing with legacy workflow' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__init-with-registries.yml b/.github/workflows/__init-with-registries.yml index 9293dcc196..2e36baddc4 100644 --- a/.github/workflows/__init-with-registries.yml +++ b/.github/workflows/__init-with-registries.yml @@ -34,11 +34,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: 'Packaging: Download using registries' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__javascript-source-root.yml b/.github/workflows/__javascript-source-root.yml index 1dcbd38a85..08c68e6f94 100644 --- a/.github/workflows/__javascript-source-root.yml +++ b/.github/workflows/__javascript-source-root.yml @@ -34,11 +34,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Custom source root if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__job-run-uuid-sarif.yml b/.github/workflows/__job-run-uuid-sarif.yml index b24ab39005..5d49830cdd 100644 --- a/.github/workflows/__job-run-uuid-sarif.yml +++ b/.github/workflows/__job-run-uuid-sarif.yml @@ -34,7 +34,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Job run UUID added to SARIF if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__language-aliases.yml b/.github/workflows/__language-aliases.yml index 731d975ce3..1e5c17395a 100644 --- a/.github/workflows/__language-aliases.yml +++ b/.github/workflows/__language-aliases.yml @@ -34,7 +34,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked name: Language aliases if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__local-bundle.yml b/.github/workflows/__local-bundle.yml index 8e448080f3..bc384bdf11 100644 --- a/.github/workflows/__local-bundle.yml +++ b/.github/workflows/__local-bundle.yml @@ -54,7 +54,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked name: Local CodeQL bundle if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index d54b24a1ef..fd252d6de7 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -58,35 +58,35 @@ jobs: version: stable-v2.20.7 - os: macos-15-xlarge version: stable-v2.20.7 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.21.4 - os: macos-15-xlarge version: stable-v2.21.4 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.22.4 - os: macos-15-xlarge version: stable-v2.22.4 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.23.9 - os: macos-latest-xlarge version: stable-v2.23.9 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.24.3 - os: macos-latest-xlarge version: stable-v2.24.3 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.25.6 - os: macos-latest-xlarge version: stable-v2.25.6 - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - os: macos-latest-xlarge version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - os: macos-latest-xlarge version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest - os: macos-latest-xlarge version: nightly-latest diff --git a/.github/workflows/__overlay-init-fallback.yml b/.github/workflows/__overlay-init-fallback.yml index b6c99efcef..a2c320fb53 100644 --- a/.github/workflows/__overlay-init-fallback.yml +++ b/.github/workflows/__overlay-init-fallback.yml @@ -34,9 +34,9 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Overlay database init fallback if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 27139c8314..070d7e3910 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -54,11 +54,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: 'Packaging: Config and input passed to the CLI' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index 9844c43488..3465616dbf 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -54,11 +54,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: 'Packaging: Config and input' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index 916e892765..0e7b828c0a 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -54,11 +54,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: 'Packaging: Config file' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index 01ddb5dc31..80c792069d 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -54,11 +54,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: 'Packaging: Action input' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml index e1c3785f6a..485a4904c8 100644 --- a/.github/workflows/__remote-config.yml +++ b/.github/workflows/__remote-config.yml @@ -54,9 +54,9 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Remote config file if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__resolve-environment-action.yml b/.github/workflows/__resolve-environment-action.yml index 11a31fdabc..7a4e284d72 100644 --- a/.github/workflows/__resolve-environment-action.yml +++ b/.github/workflows/__resolve-environment-action.yml @@ -34,11 +34,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Resolve environment if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__ruby.yml b/.github/workflows/__ruby.yml index 98f8ec6a2a..833e49789e 100644 --- a/.github/workflows/__ruby.yml +++ b/.github/workflows/__ruby.yml @@ -34,17 +34,17 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: macos-latest + - os: macos-26 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: macos-latest + - os: macos-26 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest - - os: macos-latest + - os: macos-26 version: nightly-latest name: Ruby analysis if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__rust.yml b/.github/workflows/__rust.yml index d3b5a8a5b8..83cdbf6771 100644 --- a/.github/workflows/__rust.yml +++ b/.github/workflows/__rust.yml @@ -36,13 +36,13 @@ jobs: include: - os: ubuntu-24.04 version: stable-v2.20.7 - - os: ubuntu-latest + - os: ubuntu-26.04 version: stable-v2.22.1 - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Rust analysis if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml index 512058a598..0cb63b85cc 100644 --- a/.github/workflows/__split-workflow.yml +++ b/.github/workflows/__split-workflow.yml @@ -54,17 +54,17 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: macos-latest + - os: macos-26 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: macos-latest + - os: macos-26 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest - - os: macos-latest + - os: macos-26 version: nightly-latest name: Split workflow if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__start-proxy.yml b/.github/workflows/__start-proxy.yml index edc6aa1cc5..e6906cbc3c 100644 --- a/.github/workflows/__start-proxy.yml +++ b/.github/workflows/__start-proxy.yml @@ -34,11 +34,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: macos-latest + - os: macos-26 version: linked - - os: windows-latest + - os: windows-2025 version: linked name: Start proxy if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__submit-sarif-failure.yml b/.github/workflows/__submit-sarif-failure.yml index 36f7be4eb6..b7edd62fc0 100644 --- a/.github/workflows/__submit-sarif-failure.yml +++ b/.github/workflows/__submit-sarif-failure.yml @@ -34,11 +34,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Submit SARIF after failure if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml index 8a8796d9a7..6ef214e709 100644 --- a/.github/workflows/__unset-environment.yml +++ b/.github/workflows/__unset-environment.yml @@ -54,9 +54,9 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: Test unsetting environment variables if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml index 76e8f4e3c0..079bc65971 100644 --- a/.github/workflows/__upload-ref-sha-input.yml +++ b/.github/workflows/__upload-ref-sha-input.yml @@ -54,7 +54,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: default name: "Upload-sarif: 'ref' and 'sha' from inputs" if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/__upload-sarif.yml b/.github/workflows/__upload-sarif.yml index 77fa0264e5..c35fb3f597 100644 --- a/.github/workflows/__upload-sarif.yml +++ b/.github/workflows/__upload-sarif.yml @@ -54,13 +54,13 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: default analysis-kinds: code-scanning - - os: ubuntu-latest + - os: ubuntu-26.04 version: default analysis-kinds: code-quality - - os: ubuntu-latest + - os: ubuntu-26.04 version: default analysis-kinds: code-scanning,code-quality name: Test different uses of `upload-sarif` diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml index 59a8edc9d1..d3c849c739 100644 --- a/.github/workflows/__with-checkout-path.yml +++ b/.github/workflows/__with-checkout-path.yml @@ -54,7 +54,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked name: Use a custom `checkout_path` if: github.triggering_actor != 'dependabot[bot]' diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index e84aaa0acc..2a42eef294 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -45,9 +45,9 @@ type OperatingSystemIdentifier = "ubuntu" | "macos" | "windows"; /** Mapping from {@link OperatingSystemIdentifier} to default runner image labels. */ const DEFAULT_RUNNER_IMAGES: Record = { - ubuntu: "ubuntu-latest", - macos: "macos-latest", - windows: "windows-latest", + ubuntu: "ubuntu-26.04", + macos: "macos-26", + windows: "windows-2025", }; /** From c8bf9adf8afb442a0b9ed0b8a1ffca33b1e87be2 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Thu, 29 Oct 2026 16:25:19 +0000 Subject: [PATCH 4/4] Update hard-coded `latest` runner labels --- .../__per-language-bundle-validation.yml | 18 +++++++++--------- .github/workflows/codeql.yml | 4 ++-- .github/workflows/codescanning-config-cli.yml | 6 +++--- .../workflows/debug-artifacts-failure-safe.yml | 4 ++-- .github/workflows/debug-artifacts-safe.yml | 4 ++-- .github/workflows/post-release-mergeback.yml | 10 +++++----- .github/workflows/pr-checks.yml | 8 ++++---- .github/workflows/prepare-release.yml | 2 +- .github/workflows/python312-windows.yml | 2 +- .github/workflows/query-filters.yml | 2 +- .github/workflows/rebuild.yml | 4 ++-- .github/workflows/rollback-release.yml | 2 +- .github/workflows/test-codeql-bundle-all.yml | 2 +- .github/workflows/update-bundle.yml | 2 +- .github/workflows/update-release-branch.yml | 4 ++-- .../checks/per-language-bundle-validation.yml | 18 +++++++++--------- 16 files changed, 46 insertions(+), 46 deletions(-) diff --git a/.github/workflows/__per-language-bundle-validation.yml b/.github/workflows/__per-language-bundle-validation.yml index ee779ab40b..177f4a0d8f 100644 --- a/.github/workflows/__per-language-bundle-validation.yml +++ b/.github/workflows/__per-language-bundle-validation.yml @@ -35,37 +35,37 @@ jobs: matrix: include: - language: actions - os: ubuntu-latest + os: ubuntu-26.04 version: linked expected-extractors: actions javascript - language: cpp - os: ubuntu-latest + os: ubuntu-26.04 version: linked build-mode: manual build-command: gcc -o main main.c - language: csharp - os: ubuntu-latest + os: ubuntu-26.04 version: linked build-mode: none - language: go - os: ubuntu-latest + os: ubuntu-26.04 version: linked build-mode: autobuild - language: java - os: ubuntu-latest + os: ubuntu-26.04 version: linked build-mode: none - language: javascript - os: ubuntu-latest + os: ubuntu-26.04 version: linked - language: python - os: ubuntu-latest + os: ubuntu-26.04 version: linked - language: ruby - os: ubuntu-latest + os: ubuntu-26.04 version: linked - language: rust - os: ubuntu-latest + os: ubuntu-26.04 version: linked - language: swift os: macos-latest-xlarge diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f27de17fd8..451238b668 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -22,7 +22,7 @@ jobs: # Identify the CodeQL tool versions to use in the analysis job. check-codeql-versions: if: github.triggering_actor != 'dependabot[bot]' - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 outputs: versions: ${{ steps.compare.outputs.versions }} @@ -106,7 +106,7 @@ jobs: analyze-other: if: github.triggering_actor != 'dependabot[bot]' - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 strategy: fail-fast: false diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml index 7820319486..b1194460d3 100644 --- a/.github/workflows/codescanning-config-cli.yml +++ b/.github/workflows/codescanning-config-cli.yml @@ -41,11 +41,11 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: linked - - os: ubuntu-latest + - os: ubuntu-26.04 version: default - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest # Code-Scanning config not created because environment variable is not set diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index 38c4045d33..c9599e446c 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -47,7 +47,7 @@ jobs: # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`). # We could install that older version on the newer runners, or use the older runner. # We do the latter here. This can be removed once we stop supporting `v2.20.7`. - runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }} + runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }} steps: - name: Dump GitHub event @@ -91,7 +91,7 @@ jobs: timeout-minutes: 45 permissions: contents: read - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 steps: - name: Download all artifacts uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 610e1aab8a..4e2035b9ee 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -45,7 +45,7 @@ jobs: # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`). # We could install that older version on the newer runners, or use the older runner. # We do the latter here. This can be removed once we stop supporting `v2.20.7`. - runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }} + runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }} steps: - name: Check out repository @@ -84,7 +84,7 @@ jobs: timeout-minutes: 45 permissions: contents: read - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 steps: - name: Download all artifacts uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 76ef6e555f..4e9a0c7a77 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -10,7 +10,7 @@ on: workflow_dispatch: inputs: baseBranch: - description: 'The base branch to merge into' + description: "The base branch to merge into" default: main required: false @@ -24,7 +24,7 @@ defaults: jobs: merge-back: - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 environment: Automation if: github.repository == 'github/codeql-action' env: @@ -41,16 +41,16 @@ jobs: - name: Dump GitHub context env: - GITHUB_CONTEXT: '${{ toJson(github) }}' + GITHUB_CONTEXT: "${{ toJson(github) }}" run: echo "${GITHUB_CONTEXT}" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - fetch-depth: 0 # ensure we have all tags and can push commits + fetch-depth: 0 # ensure we have all tags and can push commits - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - cache: 'npm' + cache: "npm" - name: Install JavaScript dependencies run: npm ci diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 5d2b1576f7..cb6bf9e07a 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -25,7 +25,7 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-latest, macos-latest, windows-latest] + os: [ubuntu-26.04, macos-26, windows-2025] node-version: [20, 24] permissions: contents: read @@ -71,7 +71,7 @@ jobs: run: npm test - name: Lint - if: always() && matrix.os != 'windows-latest' + if: always() && matrix.os != 'windows-2025' run: npm run lint-ci - name: Upload sarif @@ -81,7 +81,7 @@ jobs: # paired `push` run that the queue branch creates use that ref, so gate on the ref itself # rather than the event. The same results are uploaded by the `pull_request` run and again # by the `push` run on `main`. - if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/') + if: matrix.os == 'ubuntu-26.04' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/') with: sarif_file: eslint.sarif category: eslint @@ -93,7 +93,7 @@ jobs: if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 timeout-minutes: 10 concurrency: diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 8ece992d48..8073c44c32 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -29,7 +29,7 @@ defaults: jobs: prepare: name: "Release info" - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 if: github.repository == 'github/codeql-action' permissions: diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml index ab169499e2..b56b1c827d 100644 --- a/.github/workflows/python312-windows.yml +++ b/.github/workflows/python312-windows.yml @@ -29,7 +29,7 @@ jobs: contents: read # We currently need `security-events: read` to access feature flags. security-events: read - runs-on: windows-latest + runs-on: windows-2025 steps: - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml index 1891f4195b..745e84b2e8 100644 --- a/.github/workflows/query-filters.yml +++ b/.github/workflows/query-filters.yml @@ -25,7 +25,7 @@ jobs: name: Query Filters Tests if: github.triggering_actor != 'dependabot[bot]' timeout-minutes: 45 - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 permissions: contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository. steps: diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index 1c174ac7a3..c37910a779 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -12,7 +12,7 @@ defaults: jobs: rebuild: name: Rebuild Action - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch' env: @@ -33,7 +33,7 @@ jobs: uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - cache: 'npm' + cache: "npm" - name: Remove label if: github.event_name == 'pull_request' diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index 14a8490b8c..81353bfb4f 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -34,7 +34,7 @@ jobs: rollback: name: "Create rollback release" if: github.repository == 'github/codeql-action' - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 timeout-minutes: 45 # Don't set the deployment environment for test runs diff --git a/.github/workflows/test-codeql-bundle-all.yml b/.github/workflows/test-codeql-bundle-all.yml index 477fdf0524..cf63b1caa5 100644 --- a/.github/workflows/test-codeql-bundle-all.yml +++ b/.github/workflows/test-codeql-bundle-all.yml @@ -27,7 +27,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-26.04 version: nightly-latest name: 'CodeQL Bundle All' if: github.triggering_actor != 'dependabot[bot]' diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index 43708f573c..d7d90b749a 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -20,7 +20,7 @@ defaults: jobs: update-bundle: if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-') - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 permissions: contents: write # needed to push commits pull-requests: write # needed to create pull requests diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml index 981a38eaca..6ceb30c42b 100644 --- a/.github/workflows/update-release-branch.yml +++ b/.github/workflows/update-release-branch.yml @@ -26,7 +26,7 @@ jobs: update: name: "Update release branch" timeout-minutes: 45 - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 if: github.event_name == 'workflow_dispatch' needs: [prepare] env: @@ -79,7 +79,7 @@ jobs: backport: name: "Create backport" timeout-minutes: 45 - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 environment: Automation needs: [prepare] if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }} diff --git a/pr-checks/checks/per-language-bundle-validation.yml b/pr-checks/checks/per-language-bundle-validation.yml index ad18736739..942611d628 100644 --- a/pr-checks/checks/per-language-bundle-validation.yml +++ b/pr-checks/checks/per-language-bundle-validation.yml @@ -3,38 +3,38 @@ description: Validates extraction and analysis using each per-language CodeQL bu matrix: include: - language: actions - os: ubuntu-latest + os: ubuntu-26.04 version: linked # Actions also needs the JavaScript extractor. expected-extractors: actions javascript - language: cpp - os: ubuntu-latest + os: ubuntu-26.04 version: linked build-mode: manual build-command: gcc -o main main.c - language: csharp - os: ubuntu-latest + os: ubuntu-26.04 version: linked build-mode: none - language: go - os: ubuntu-latest + os: ubuntu-26.04 version: linked build-mode: autobuild - language: java - os: ubuntu-latest + os: ubuntu-26.04 version: linked build-mode: none - language: javascript - os: ubuntu-latest + os: ubuntu-26.04 version: linked - language: python - os: ubuntu-latest + os: ubuntu-26.04 version: linked - language: ruby - os: ubuntu-latest + os: ubuntu-26.04 version: linked - language: rust - os: ubuntu-latest + os: ubuntu-26.04 version: linked - language: swift os: macos-latest-xlarge