ci: pin build runners to ubuntu-24.04

.github/actions/environment-check/action.yml

@@ -30,14 +30,21 @@ inputs:
 runs:
   using: composite
   steps:
+    # The cache holds binaries built against the runner's system libraries, so key it
+    # on the runner image (e.g. ubuntu24) as well; runner.os alone is just "Linux".
+    - name: Resolve runner image
+      id: runner-image
+      shell: bash
+      run: echo "name=${ImageOS:-unknown}" >> "$GITHUB_OUTPUT"
+
     - name: Restore environment cache
       id: env-cache
       uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: |
           ${{ runner.temp }}/dvledtx-deps
           ${{ runner.temp }}/mtl-source
-        key: env-dpdk-${{ inputs.dpdk-version }}-mtl-${{ inputs.mtl-commit }}-ffmpeg-${{ inputs.ffmpeg-version }}-v${{ inputs.env-cache-version }}-${{ runner.os }}
+        key: env-dpdk-${{ inputs.dpdk-version }}-mtl-${{ inputs.mtl-commit }}-ffmpeg-${{ inputs.ffmpeg-version }}-v${{ inputs.env-cache-version }}-${{ runner.os }}-${{ steps.runner-image.outputs.name }}
 
     - name: Deploy cache to system
       if: steps.env-cache.outputs.cache-hit == 'true'
@@ -347,4 +354,4 @@ runs:
         path: |
           ${{ runner.temp }}/dvledtx-deps
           ${{ runner.temp }}/mtl-source
-        key: env-dpdk-${{ inputs.dpdk-version }}-mtl-${{ inputs.mtl-commit }}-ffmpeg-${{ inputs.ffmpeg-version }}-v${{ inputs.env-cache-version }}-${{ runner.os }}
+        key: env-dpdk-${{ inputs.dpdk-version }}-mtl-${{ inputs.mtl-commit }}-ffmpeg-${{ inputs.ffmpeg-version }}-v${{ inputs.env-cache-version }}-${{ runner.os }}-${{ steps.runner-image.outputs.name }}

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ concurrency:
 jobs:
   ci:
     name: Continuous Integration
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     permissions:
       contents: read

.github/workflows/codeql.yml

@@ -33,7 +33,7 @@ concurrency:
 jobs:
   codeql:
     name: CodeQL Scan
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
     permissions:
       contents: read

.github/workflows/coverity.yml

@@ -20,7 +20,7 @@ concurrency:
 jobs:
   coverity:
     name: Coverity Scan (${{ github.event.repository.default_branch }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     permissions:
       contents: read

.github/workflows/daily_build.yml

@@ -20,7 +20,7 @@ concurrency:
 jobs:
   build:
     name: Daily Build (${{ github.event.repository.default_branch }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     permissions:
       contents: read
@@ -74,7 +74,7 @@ jobs:
 
   afl-fuzz:
     name: Daily AFL Fuzz (${{ github.event.repository.default_branch }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # 4h of TX+RX fuzzing plus headroom for dependency install and builds.
     timeout-minutes: 258
     permissions:
@@ -105,7 +105,7 @@ jobs:
 
   libfuzzer:
     name: Daily libFuzzer (${{ github.event.repository.default_branch }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # max-seconds applies per target and sanitizer mode (TX+RX, ASan+UBSan),
     # so fuzzing takes ~4h; the rest covers the four builds.
     timeout-minutes: 258

.github/workflows/pull_request.yml

@@ -23,7 +23,7 @@ concurrency:
 jobs:
   pull-request:
     name: Pull Request
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 25
     permissions:
       contents: read