diff --git a/.github/workflows/ai_pr_review.yml b/.github/workflows/ai_pr_review.yml index 3a79ae92..3a8ff740 100644 --- a/.github/workflows/ai_pr_review.yml +++ b/.github/workflows/ai_pr_review.yml @@ -19,7 +19,7 @@ concurrency: jobs: review: - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 # Run if: # - PR opened (same-repo only — fork PRs are skipped here at the workflow diff --git a/.github/workflows/build-wheels.yml b/.github/workflows/build-wheels.yml index 6ffb4919..86497cca 100644 --- a/.github/workflows/build-wheels.yml +++ b/.github/workflows/build-wheels.yml @@ -26,7 +26,7 @@ jobs: matrix: include: - arch: x86_64 - runner: ubuntu-latest + runner: ubuntu-24.04 container: quay.io/pypa/manylinux_2_28_x86_64 artifact: wheels-linux-x86_64 - arch: aarch64 @@ -143,7 +143,7 @@ jobs: build-sdist: name: Build source distribution if: ${{ !inputs.linux_only }} - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 diff --git a/.github/workflows/ci-gate.yml b/.github/workflows/ci-gate.yml index 3e28c6cc..66c9b7e0 100644 --- a/.github/workflows/ci-gate.yml +++ b/.github/workflows/ci-gate.yml @@ -10,7 +10,7 @@ permissions: {} jobs: ci-gate: name: CI Gate - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - name: Require ready-for-ci label on PRs if: >- diff --git a/.github/workflows/docs-tests.yml b/.github/workflows/docs-tests.yml index 1ac47e01..bcf86feb 100644 --- a/.github/workflows/docs-tests.yml +++ b/.github/workflows/docs-tests.yml @@ -84,7 +84,7 @@ jobs: || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && (github.event.action != 'labeled' && github.event.action != 'unlabeled' || github.event.label.name == 'ready-for-ci')) - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 @@ -157,7 +157,7 @@ jobs: || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && (github.event.action != 'labeled' && github.event.action != 'unlabeled' || github.event.label.name == 'ready-for-ci')) - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 @@ -231,7 +231,7 @@ jobs: || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && (github.event.action != 'labeled' && github.event.action != 'unlabeled' || github.event.label.name == 'ready-for-ci')) - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 55b8be73..6ad866f3 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -31,7 +31,7 @@ concurrency: jobs: format-lint: name: Ruff + Black - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Python @@ -47,7 +47,7 @@ jobs: typecheck: name: Mypy - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Python @@ -70,7 +70,7 @@ jobs: # SKIPPED, and GitHub treats a skipped required check as satisfied. lint-gate: name: Lint Gate - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 needs: [format-lint, typecheck] if: always() steps: diff --git a/.github/workflows/lwdid-data-canary.yml b/.github/workflows/lwdid-data-canary.yml index 2f56bf64..5e27405b 100644 --- a/.github/workflows/lwdid-data-canary.yml +++ b/.github/workflows/lwdid-data-canary.yml @@ -26,7 +26,7 @@ permissions: jobs: lwdid-real-data: name: Prop 99 / Walmart real-data canary - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 diff --git a/.github/workflows/mmm-interop.yml b/.github/workflows/mmm-interop.yml index aa20a30f..4b901789 100644 --- a/.github/workflows/mmm-interop.yml +++ b/.github/workflows/mmm-interop.yml @@ -62,7 +62,7 @@ jobs: || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && (github.event.action != 'labeled' && github.event.action != 'unlabeled' || github.event.label.name == 'ready-for-ci')) - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 @@ -99,7 +99,7 @@ jobs: || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && (github.event.action != 'labeled' && github.event.action != 'unlabeled' || github.event.label.name == 'ready-for-ci')) - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 diff --git a/.github/workflows/notebooks.yml b/.github/workflows/notebooks.yml index ab16ed72..77753876 100644 --- a/.github/workflows/notebooks.yml +++ b/.github/workflows/notebooks.yml @@ -42,7 +42,7 @@ jobs: || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && (github.event.action != 'labeled' && github.event.action != 'unlabeled' || github.event.label.name == 'ready-for-ci')) - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 @@ -112,7 +112,7 @@ jobs: || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && (github.event.action != 'labeled' && github.event.action != 'unlabeled' || github.event.label.name == 'ready-for-ci')) - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ab6523e5..772b93a3 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -16,7 +16,7 @@ jobs: publish: name: Publish to PyPI needs: build - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 environment: pypi permissions: id-token: write diff --git a/.github/workflows/rust-test.yml b/.github/workflows/rust-test.yml index d76c22c2..c48c0f96 100644 --- a/.github/workflows/rust-test.yml +++ b/.github/workflows/rust-test.yml @@ -101,7 +101,7 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-latest, macos-latest, windows-latest, ubuntu-24.04-arm] + os: [ubuntu-24.04, macos-latest, windows-latest, ubuntu-24.04-arm] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 @@ -140,13 +140,13 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-latest, macos-latest, windows-latest, ubuntu-24.04-arm] + os: [ubuntu-24.04, macos-latest, windows-latest, ubuntu-24.04-arm] python-version: ['3.11', '3.13', '3.14', '3.15'] include: # Python 3.9 floor guard (single Linux leg): mypy >= 2.2 can no # longer type-check with python_version = "3.9", so this runtime # leg is the floor's only continuous CI coverage. - - os: ubuntu-latest + - os: ubuntu-24.04 python-version: '3.9' steps: @@ -264,7 +264,7 @@ jobs: || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && (github.event.action != 'labeled' && github.event.action != 'unlabeled' || github.event.label.name == 'ready-for-ci')) - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 diff --git a/docs/dev-status.md b/docs/dev-status.md index c6eb4407..ad81dcdf 100644 --- a/docs/dev-status.md +++ b/docs/dev-status.md @@ -156,6 +156,24 @@ Linux. - **Long-term:** revert to the `@` operator when numpy ≥ 2.3 becomes the minimum supported version. +## GitHub-hosted runners pinned to `ubuntu-24.04` + +Every workflow's Linux job uses `runs-on: ubuntu-24.04`, not `ubuntu-latest` (pinned +2026-10-25). GitHub is migrating `ubuntu-latest` to Ubuntu 26.04 gradually (2026-10-19 to +2026-11-19); this repository's runs flipped on 2026-10-24 (#867's review ran on 24.04 on +10-23, #868's on 26.04 on 10-24) and two things broke on the new image: + +- `openai/codex-action`'s `drop-sudo` safety strategy fails before codex starts (`runner is + not a member of the sudo group` / `Could not restrict access to + /run/dbus/system_bus_socket`; upstream + [codex-action#188](https://github.com/openai/codex-action/issues/188)), so the AI PR + review job died in under a second and posted nothing. +- `actions/python-versions` ships Python 3.9 builds for Ubuntu 22.04 and 24.04 only, so the + 3.9 floor leg of the test matrix (and the 3.9 wheel-test leg) cannot set up on 26.04. + +Un-pin only after both are fixed upstream and verified on a throwaway branch. The ARM +matrix entries already used the GitHub-hosted `ubuntu-24.04-arm` label and are unchanged. + ## MMM tutorial environments (notebooks 29 / 30) The two executed MMM calibration tutorials need frameworks that CANNOT share one