From 684bc85c901b435639a6da7354ea344cd292d90e Mon Sep 17 00:00:00 2001
From: roshan-ku <roshan.kumar@intel.com>
Date: Mon, 19 Oct 2026 14:26:49 +0530
Subject: [PATCH] ci: pin build runners to ubuntu-24.04

GitHub is rolling ubuntu-latest over to Ubuntu 26.04 (gcc 15.2). On that
image the environment-check step fails to build the pinned MTL v26.09:
MTL compiles with -Werror and gcc 15 reports -Wformat-truncation in
lib/src/st2110/pipeline/st40_pipeline_rx.c, so every job that builds the
toolchain (CI, CodeQL, Coverity, Daily Build, Pull Request) fails before
reaching our code.

Pin those jobs to ubuntu-24.04, the validated platform. Scorecard builds
nothing and stays on ubuntu-latest.

Also key the environment cache on the runner image (ImageOS) in addition
to runner.os, which is only "Linux", so DPDK/MTL/FFmpeg binaries built on
one Ubuntu release are never restored onto another.
---
 .github/actions/environment-check/action.yml | 11 +++++++++--
 .github/workflows/ci.yml                     |  2 +-
 .github/workflows/codeql.yml                 |  2 +-
 .github/workflows/coverity.yml               |  2 +-
 .github/workflows/daily_build.yml            |  6 +++---
 .github/workflows/pull_request.yml           |  2 +-
 6 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/.github/actions/environment-check/action.yml b/.github/actions/environment-check/action.yml
index 2ab565a..cd46503 100644
--- a/.github/actions/environment-check/action.yml
+++ b/.github/actions/environment-check/action.yml
@@ -30,6 +30,13 @@ inputs:
 runs:
   using: composite
   steps:
+    # The cache holds binaries built against the runner's system libraries, so key it
+    # on the runner image (e.g. ubuntu24) as well; runner.os alone is just "Linux".
+    - name: Resolve runner image
+      id: runner-image
+      shell: bash
+      run: echo "name=${ImageOS:-unknown}" >> "$GITHUB_OUTPUT"
+
     - name: Restore environment cache
       id: env-cache
       uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
@@ -37,7 +44,7 @@ runs:
         path: |
           ${{ runner.temp }}/dvledtx-deps
           ${{ runner.temp }}/mtl-source
-        key: env-dpdk-${{ inputs.dpdk-version }}-mtl-${{ inputs.mtl-commit }}-ffmpeg-${{ inputs.ffmpeg-version }}-v${{ inputs.env-cache-version }}-${{ runner.os }}
+        key: env-dpdk-${{ inputs.dpdk-version }}-mtl-${{ inputs.mtl-commit }}-ffmpeg-${{ inputs.ffmpeg-version }}-v${{ inputs.env-cache-version }}-${{ runner.os }}-${{ steps.runner-image.outputs.name }}
 
     - name: Deploy cache to system
       if: steps.env-cache.outputs.cache-hit == 'true'
@@ -347,4 +354,4 @@ runs:
         path: |
           ${{ runner.temp }}/dvledtx-deps
           ${{ runner.temp }}/mtl-source
-        key: env-dpdk-${{ inputs.dpdk-version }}-mtl-${{ inputs.mtl-commit }}-ffmpeg-${{ inputs.ffmpeg-version }}-v${{ inputs.env-cache-version }}-${{ runner.os }}
+        key: env-dpdk-${{ inputs.dpdk-version }}-mtl-${{ inputs.mtl-commit }}-ffmpeg-${{ inputs.ffmpeg-version }}-v${{ inputs.env-cache-version }}-${{ runner.os }}-${{ steps.runner-image.outputs.name }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b0e0300..f890010 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ concurrency:
 jobs:
   ci:
     name: Continuous Integration
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     permissions:
       contents: read
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a12505d..6f32dfd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -33,7 +33,7 @@ concurrency:
 jobs:
   codeql:
     name: CodeQL Scan
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
     permissions:
       contents: read
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 2f493fc..8283da5 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -20,7 +20,7 @@ concurrency:
 jobs:
   coverity:
     name: Coverity Scan (${{ github.event.repository.default_branch }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     permissions:
       contents: read
diff --git a/.github/workflows/daily_build.yml b/.github/workflows/daily_build.yml
index b58e7cc..d4cf4c6 100644
--- a/.github/workflows/daily_build.yml
+++ b/.github/workflows/daily_build.yml
@@ -20,7 +20,7 @@ concurrency:
 jobs:
   build:
     name: Daily Build (${{ github.event.repository.default_branch }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     permissions:
       contents: read
@@ -74,7 +74,7 @@ jobs:
 
   afl-fuzz:
     name: Daily AFL Fuzz (${{ github.event.repository.default_branch }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # 4h of TX+RX fuzzing plus headroom for dependency install and builds.
     timeout-minutes: 258
     permissions:
@@ -105,7 +105,7 @@ jobs:
 
   libfuzzer:
     name: Daily libFuzzer (${{ github.event.repository.default_branch }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # max-seconds applies per target and sanitizer mode (TX+RX, ASan+UBSan),
     # so fuzzing takes ~4h; the rest covers the four builds.
     timeout-minutes: 258
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 2d5abad..7ebfff1 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -23,7 +23,7 @@ concurrency:
 jobs:
   pull-request:
     name: Pull Request
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 25
     permissions:
       contents: read