From ab765a47caa5733628e86eac09d41aee88f6feb9 Mon Sep 17 00:00:00 2001
From: My Name is Tito <github@mynameistito.com>
Date: Sun, 4 Oct 2026 10:17:25 +1300
Subject: [PATCH] chore(ci): pin GitHub Actions runners to Ubuntu 24.04

---
 .github/workflows/ci.yml                     | 2 +-
 .github/workflows/deploy-preview.yml         | 8 ++++----
 .github/workflows/deploy.yml                 | 2 +-
 .github/workflows/link-check.yml             | 2 +-
 .github/workflows/pr-metadata.yml            | 2 +-
 .github/workflows/release.yml                | 2 +-
 .github/workflows/update-opencode-plugin.yml | 2 +-
 .github/workflows/workflow-security.yml      | 4 ++--
 8 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2e0aa8a..2829569 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   check:
     name: ${{ matrix.task }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       CODECOV_TOKEN_AVAILABLE: ${{ secrets.CODECOV_TOKEN != '' }}
     strategy:
diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml
index 3768b05..7d49a25 100644
--- a/.github/workflows/deploy-preview.yml
+++ b/.github/workflows/deploy-preview.yml
@@ -25,7 +25,7 @@ jobs:
     name: Resolve preview pull request
     if: >-
       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request') || (github.event_name == 'pull_request_target' && github.event.action == 'closed')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       pull-requests: read
@@ -163,7 +163,7 @@ jobs:
     needs: resolve
     if: >-
       github.event_name == 'workflow_run' && needs.resolve.outputs.pull_request_number != '' && needs.resolve.outputs.trusted != 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       issues: write
       pull-requests: write
@@ -211,7 +211,7 @@ jobs:
     name: Deploy preview (review required)
     needs: resolve
     if: needs.resolve.outputs.pull_request_number != '' && needs.resolve.outputs.trusted != 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # Required reviewers protect the Cloudflare credentials when the PR author
     # does not have write access and the deployment executes pull-request code.
     environment: docs-preview
@@ -236,7 +236,7 @@ jobs:
     name: Deploy preview (trusted author)
     needs: resolve
     if: needs.resolve.outputs.pull_request_number != '' && needs.resolve.outputs.trusted == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # A write-level PR author is trusted to run pull-request code with the
     # repository's Cloudflare credentials, so no reviewer gate is needed.
     steps:
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 1e912c2..cb26264 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -17,7 +17,7 @@ jobs:
   deploy:
     if: >-
       github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout release commit
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml
index 3354e82..42508f0 100644
--- a/.github/workflows/link-check.yml
+++ b/.github/workflows/link-check.yml
@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   links:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/pr-metadata.yml b/.github/workflows/pr-metadata.yml
index f7c4843..90bc8db 100644
--- a/.github/workflows/pr-metadata.yml
+++ b/.github/workflows/pr-metadata.yml
@@ -17,7 +17,7 @@ jobs:
   metadata:
     if: >-
       (github.event.action != 'labeled' && github.event.action != 'unlabeled') || github.event.label.name == 'skip-changeset'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout trusted default-branch automation
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e1b683a..2352a9b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/update-opencode-plugin.yml b/.github/workflows/update-opencode-plugin.yml
index 024a6a9..7cb52b9 100644
--- a/.github/workflows/update-opencode-plugin.yml
+++ b/.github/workflows/update-opencode-plugin.yml
@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   update:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout main
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/workflow-security.yml b/.github/workflows/workflow-security.yml
index a4378d8..48aa665 100644
--- a/.github/workflows/workflow-security.yml
+++ b/.github/workflows/workflow-security.yml
@@ -20,7 +20,7 @@ permissions:
 
 jobs:
   actionlint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -35,7 +35,7 @@ jobs:
           pyflakes: false
 
   zizmor:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout trusted security configuration
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1