chore(ci): pin GitHub Actions runners to Ubuntu 24.04

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   check:
     name: ${{ matrix.task }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       CODECOV_TOKEN_AVAILABLE: ${{ secrets.CODECOV_TOKEN != '' }}
     strategy:

.github/workflows/deploy-preview.yml

@@ -25,7 +25,7 @@ jobs:
     name: Resolve preview pull request
     if: >-
       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request') || (github.event_name == 'pull_request_target' && github.event.action == 'closed')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       pull-requests: read
@@ -163,7 +163,7 @@ jobs:
     needs: resolve
     if: >-
       github.event_name == 'workflow_run' && needs.resolve.outputs.pull_request_number != '' && needs.resolve.outputs.trusted != 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       issues: write
       pull-requests: write
@@ -211,7 +211,7 @@ jobs:
     name: Deploy preview (review required)
     needs: resolve
     if: needs.resolve.outputs.pull_request_number != '' && needs.resolve.outputs.trusted != 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # Required reviewers protect the Cloudflare credentials when the PR author
     # does not have write access and the deployment executes pull-request code.
     environment: docs-preview
@@ -236,7 +236,7 @@ jobs:
     name: Deploy preview (trusted author)
     needs: resolve
     if: needs.resolve.outputs.pull_request_number != '' && needs.resolve.outputs.trusted == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # A write-level PR author is trusted to run pull-request code with the
     # repository's Cloudflare credentials, so no reviewer gate is needed.
     steps:

.github/workflows/deploy.yml

@@ -17,7 +17,7 @@ jobs:
   deploy:
     if: >-
       github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout release commit
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/link-check.yml

@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   links:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/pr-metadata.yml

@@ -17,7 +17,7 @@ jobs:
   metadata:
     if: >-
       (github.event.action != 'labeled' && github.event.action != 'unlabeled') || github.event.label.name == 'skip-changeset'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout trusted default-branch automation
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/release.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/update-opencode-plugin.yml

@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   update:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout main
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/workflow-security.yml

@@ -20,7 +20,7 @@ permissions:
 
 jobs:
   actionlint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -35,7 +35,7 @@ jobs:
           pyflakes: false
 
   zizmor:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout trusted security configuration
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1