fix(actions): pin the remaining named-residual workflows off ubuntu-latest

[seonghobae]

Summary

docs/product-technical-gap-baseline.md's earlier starved-ubuntu-latest entry deliberately scoped its fix to opencode-review-dispatch.yml (the file with direct, confirmed live evidence at the time) and explicitly named 5 residual files to revisit "if queuing symptoms recur on them specifically": pr-review-autofix.yml, pr-review-fix-scheduler.yml, hourly-review-repair.yml, codeql-pr.yml, codeql-scan-dispatch.yml. They did recur (a severe, hours-long org-wide Actions stall today) and all 5 were confirmed still on ubuntu-latest, plus a 6th, python-security.yml, found independently while investigating the same symptom.

Pinned all 6 files (10 job occurrences total) to ubuntu-24.04, matching the already-validated pattern used by every other central required workflow (security-scan.yml, sast-semgrep.yml, agent-review-runtime-quality-ci.yml, pr-review-merge-scheduler.yml, strix.yml, opencode-review.yml, noema-review.yml, opencode-review-dispatch.yml). Added tests/test_scheduler_and_codeql_dispatch_runner_image_contract.py covering all 6, following the same contract-test shape as the existing security/review/scheduler runner-image tests.

Important caveat, recorded in the gap-baseline doc

This fix does NOT explain today's dominant congestion. A direct queue query showed the org's actual in-progress job count (5-6) is far below the documented 60-job ceiling, while 307 runs sat queued — and the single largest contributors (Required PR Review Merge Scheduler, Security Scan, SAST Semgrep, Agent Review Runtime Quality CI) were already pinned to ubuntu-24.04 before this pass and equally stuck. GitHub's own status page showed no active incident. The 5-6-vs-60 in-progress gap remains unexplained; flagged for follow-up rather than claimed as resolved by this fix.

Verification

• coverage run -m pytest tests: 2838 passed, 1 skipped, 21 subtests passed.
• The pre-existing 98.3% docstring gap (review_admission_controller.py/pr_review_merge_scheduler_core.py/audit_codeql_default_setup_rollout.py) is unrelated — .github#1883, in review, fixes it separately; none of those files are touched here.
• interrogate on the new test file: 100%.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 18 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 7a1192e5-c95b-44fe-b645-97bb681e2343

📥 Commits

Reviewing files that changed from the base of the PR and between 8272e4f and 7bd5b02.

📒 Files selected for processing (8)

• .github/workflows/codeql-pr.yml
• .github/workflows/codeql-scan-dispatch.yml
• .github/workflows/hourly-review-repair.yml
• .github/workflows/pr-review-autofix.yml
• .github/workflows/pr-review-fix-scheduler.yml
• .github/workflows/python-security.yml
• docs/product-technical-gap-baseline.md
• tests/test_scheduler_and_codeql_dispatch_runner_image_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Stack verification found the new runner-image contract test failed Ruff I001 because the import block had an extra separator. Fixed in the parent writer at exact head 7bd5b02ddb84d7887c5d9984bd144302235cdfdf; focused test 6 passed, Ruff and diff checks pass. Child #1888 then adopted this head by normal merge and retargeted onto this PR.