Pin Ubuntu runners to 26.04

.github/workflows/asan.yml

@@ -19,7 +19,7 @@ permissions:
 jobs:
   asan:
     name: AddressSanitizer (memory + leaks)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     env:
       # Instrument the Rust code, and (via -Zbuild-std below) a freshly rebuilt
       # standard library, with AddressSanitizer. AddressSanitizer bundles

.github/workflows/cflite_batch.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   BatchFuzzing:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
     strategy:

.github/workflows/cflite_prune.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   Pruning:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
     steps:

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ permissions:
 jobs:
   semver:
     name: Semver
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -32,7 +32,7 @@ jobs:
 
   test:
     name: Test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -54,7 +54,7 @@ jobs:
 
   lint:
     name: Lint
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
@@ -87,7 +87,7 @@ jobs:
 
   docs:
     name: Documentation
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
@@ -105,7 +105,7 @@ jobs:
   # Minimal build without default features (no_std compatibility check)
   no-std:
     name: no_std build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
@@ -121,7 +121,7 @@ jobs:
   # Verify Cargo.lock is consistent with Cargo.toml
   lockfile:
     name: Lockfile
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
@@ -135,7 +135,7 @@ jobs:
   # diesel E2E tests (standalone workspace, requires Docker for Pg and MySQL)
   diesel-e2e:
     name: Diesel E2E Tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 

.github/workflows/codeql.yml

@@ -18,7 +18,7 @@ permissions:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       security-events: write

.github/workflows/coverage.yml

@@ -19,7 +19,7 @@ env:
 jobs:
   coverage:
     name: Code Coverage
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 

.github/workflows/echoes-post.yml

@@ -16,7 +16,7 @@ jobs:
     if: >-
       github.event.workflow_run.event == 'pull_request' &&
       github.event.workflow_run.conclusion == 'success'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
       actions: read

.github/workflows/echoes.yml

@@ -16,7 +16,7 @@ concurrency:
 jobs:
   scan:
     name: Echoes ${{ matrix.name }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     strategy:
       fail-fast: false

.github/workflows/refquiem-post.yml

@@ -16,7 +16,7 @@ jobs:
     if: >-
       github.event.workflow_run.event == 'pull_request' &&
       github.event.workflow_run.conclusion == 'success'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
       actions: read

.github/workflows/refquiem.yml

@@ -16,7 +16,7 @@ concurrency:
 jobs:
   scan:
     name: refquiem
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/release.yml

@@ -18,7 +18,7 @@ env:
 jobs:
   test:
     name: Test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
@@ -43,7 +43,7 @@ jobs:
   publish:
     name: Publish to crates.io
     needs: [test]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       id-token: write
     steps:

.github/workflows/schema-aware-roundtrip.yml

@@ -20,7 +20,7 @@ permissions:
 jobs:
   schema-aware-roundtrip:
     name: Schema-Aware Roundtrip Tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 

.github/workflows/sonar.yml

@@ -20,7 +20,7 @@ env:
 jobs:
   sonar:
     name: SonarQube scan
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     # Neither a fork's pull request nor a Dependabot run can read SONAR_TOKEN,
     # so the scan runs for same-repo human branches and pushes to main only.

.github/workflows/zizmor.yml

@@ -18,7 +18,7 @@ concurrency:
 jobs:
   zizmor:
     name: Audit the workflows and actions
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       security-events: write