From 7f69118bfd5a68c8d478b03ae85dd249d6d76a48 Mon Sep 17 00:00:00 2001
From: Shane Engelman <shane.engelman@blacklanternsecurity.com>
Date: Mon, 28 Sep 2026 11:35:25 -0700
Subject: [PATCH] ci: pin the runner image

ubuntu-latest is a label GitHub moves. The image changes under us and
a green pipeline turns red on a morning nobody touched the code.
Pinning to ubuntu-24.04 means the runner moves when we move it.

Version-tagged actions are left alone. blasthttp has no action pinned
to a branch, so the runner is the whole change.
---
 .github/workflows/cla.yml          | 2 +-
 .github/workflows/python-tests.yml | 6 +++---
 .github/workflows/rust-tests.yml   | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index ecb38fc..0aa06e5 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   CLAAssistant:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Generate token from GitHub App
         id: app-token
diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index f7a453b..addc113 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -96,7 +96,7 @@ jobs:
   version-check:
     needs: python-tests
     if: github.event_name == 'push' && github.ref == 'refs/heads/stable'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       new_version: ${{ steps.check.outputs.new_version }}
     steps:
@@ -231,7 +231,7 @@ jobs:
 
   sdist-build:
     needs: version-check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: needs.version-check.outputs.new_version == 'yes'
     steps:
       - uses: actions/checkout@v7
@@ -252,7 +252,7 @@ jobs:
       - linux-build
       - musllinux-build
       - sdist-build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       id-token: write
       contents: write
diff --git a/.github/workflows/rust-tests.yml b/.github/workflows/rust-tests.yml
index 5300acc..c96c2de 100644
--- a/.github/workflows/rust-tests.yml
+++ b/.github/workflows/rust-tests.yml
@@ -11,7 +11,7 @@ concurrency:
 
 jobs:
   rust-tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@v7
@@ -44,7 +44,7 @@ jobs:
 
   rust-publish:
     needs: rust-tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name == 'push' && github.ref == 'refs/heads/stable'
 
     steps: