ci: pin every GitHub-hosted Linux job to ubuntu-24.04

.github/workflows/ai_pr_review.yml

@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   review:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     # Run if:
     # - PR opened (same-repo only — fork PRs are skipped here at the workflow

.github/workflows/build-wheels.yml

@@ -26,7 +26,7 @@ jobs:
       matrix:
         include:
           - arch: x86_64
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
             container: quay.io/pypa/manylinux_2_28_x86_64
             artifact: wheels-linux-x86_64
           - arch: aarch64
@@ -143,7 +143,7 @@ jobs:
   build-sdist:
     name: Build source distribution
     if: ${{ !inputs.linux_only }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 

.github/workflows/ci-gate.yml

@@ -10,7 +10,7 @@ permissions: {}
 jobs:
   ci-gate:
     name: CI Gate
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Require ready-for-ci label on PRs
         if: >-

.github/workflows/docs-tests.yml

@@ -84,7 +84,7 @@ jobs:
       || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci')
       && (github.event.action != 'labeled' && github.event.action != 'unlabeled'
       || github.event.label.name == 'ready-for-ci'))
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -157,7 +157,7 @@ jobs:
       || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci')
       && (github.event.action != 'labeled' && github.event.action != 'unlabeled'
       || github.event.label.name == 'ready-for-ci'))
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -231,7 +231,7 @@ jobs:
       || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci')
       && (github.event.action != 'labeled' && github.event.action != 'unlabeled'
       || github.event.label.name == 'ready-for-ci'))
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

.github/workflows/lint.yml

@@ -31,7 +31,7 @@ concurrency:
 jobs:
   format-lint:
     name: Ruff + Black
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Set up Python
@@ -47,7 +47,7 @@ jobs:
 
   typecheck:
     name: Mypy
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Set up Python
@@ -70,7 +70,7 @@ jobs:
   # SKIPPED, and GitHub treats a skipped required check as satisfied.
   lint-gate:
     name: Lint Gate
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [format-lint, typecheck]
     if: always()
     steps:

.github/workflows/lwdid-data-canary.yml

@@ -26,7 +26,7 @@ permissions:
 jobs:
   lwdid-real-data:
     name: Prop 99 / Walmart real-data canary
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

.github/workflows/mmm-interop.yml

@@ -62,7 +62,7 @@ jobs:
       || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci')
       && (github.event.action != 'labeled' && github.event.action != 'unlabeled'
       || github.event.label.name == 'ready-for-ci'))
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -99,7 +99,7 @@ jobs:
       || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci')
       && (github.event.action != 'labeled' && github.event.action != 'unlabeled'
       || github.event.label.name == 'ready-for-ci'))
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

.github/workflows/notebooks.yml

@@ -42,7 +42,7 @@ jobs:
       || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci')
       && (github.event.action != 'labeled' && github.event.action != 'unlabeled'
       || github.event.label.name == 'ready-for-ci'))
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -112,7 +112,7 @@ jobs:
       || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci')
       && (github.event.action != 'labeled' && github.event.action != 'unlabeled'
       || github.event.label.name == 'ready-for-ci'))
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

.github/workflows/publish.yml

@@ -16,7 +16,7 @@ jobs:
   publish:
     name: Publish to PyPI
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     environment: pypi
     permissions:
       id-token: write

.github/workflows/rust-test.yml

@@ -101,7 +101,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest, ubuntu-24.04-arm]
+        os: [ubuntu-24.04, macos-latest, windows-latest, ubuntu-24.04-arm]
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -140,13 +140,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest, ubuntu-24.04-arm]
+        os: [ubuntu-24.04, macos-latest, windows-latest, ubuntu-24.04-arm]
         python-version: ['3.11', '3.13', '3.14', '3.15']
         include:
           # Python 3.9 floor guard (single Linux leg): mypy >= 2.2 can no
           # longer type-check with python_version = "3.9", so this runtime
           # leg is the floor's only continuous CI coverage.
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             python-version: '3.9'
 
     steps:
@@ -264,7 +264,7 @@ jobs:
       || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci')
       && (github.event.action != 'labeled' && github.event.action != 'unlabeled'
       || github.event.label.name == 'ready-for-ci'))
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 

docs/dev-status.md

@@ -156,6 +156,24 @@ Linux.
 - **Long-term:** revert to the `@` operator when numpy ≥ 2.3 becomes the minimum supported
   version.
 
+## GitHub-hosted runners pinned to `ubuntu-24.04`
+
+Every workflow's Linux job uses `runs-on: ubuntu-24.04`, not `ubuntu-latest` (pinned
+2026-10-25). GitHub is migrating `ubuntu-latest` to Ubuntu 26.04 gradually (2026-10-19 to
+2026-11-19); this repository's runs flipped on 2026-10-24 (#867's review ran on 24.04 on
+10-23, #868's on 26.04 on 10-24) and two things broke on the new image:
+
+- `openai/codex-action`'s `drop-sudo` safety strategy fails before codex starts (`runner is
+  not a member of the sudo group` / `Could not restrict access to
+  /run/dbus/system_bus_socket`; upstream
+  [codex-action#188](https://github.com/openai/codex-action/issues/188)), so the AI PR
+  review job died in under a second and posted nothing.
+- `actions/python-versions` ships Python 3.9 builds for Ubuntu 22.04 and 24.04 only, so the
+  3.9 floor leg of the test matrix (and the 3.9 wheel-test leg) cannot set up on 26.04.
+
+Un-pin only after both are fixed upstream and verified on a throwaway branch. The ARM
+matrix entries already used the GitHub-hosted `ubuntu-24.04-arm` label and are unchanged.
+
 ## MMM tutorial environments (notebooks 29 / 30)
 
 The two executed MMM calibration tutorials need frameworks that CANNOT share one