From 81733f4909d737a7541130d040f708f213d9a40b Mon Sep 17 00:00:00 2001
From: Shane Engelman <shane.engelman@blacklanternsecurity.com>
Date: Mon, 28 Sep 2026 11:51:06 -0700
Subject: [PATCH] ci: pin the runner image

ubuntu-latest is a label GitHub moves. The image changes under us and
a green pipeline turns red on a morning nobody touched the code.
Pinning to ubuntu-24.04 means the runner moves when we move it.

Action refs are untouched; the version-tagged ones stay as they are
and Dependabot keeps watching them.
---
 .github/workflows/benchmark.yml       | 2 +-
 .github/workflows/codeql.yml          | 2 +-
 .github/workflows/distro_tests.yml    | 2 +-
 .github/workflows/docs_updater.yml    | 2 +-
 .github/workflows/tests.yml           | 8 ++++----
 .github/workflows/version_updater.yml | 4 ++--
 6 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 6d36ec88bb..b5c0d460eb 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   benchmark:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
     - uses: actions/checkout@v7
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7117a72e89..a2de1b5cee 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,7 +27,7 @@ jobs:
     #   - https://gh.io/supported-runners-and-hardware-resources
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-24.04' }}
     permissions:
       # required for all workflows
       security-events: write
diff --git a/.github/workflows/distro_tests.yml b/.github/workflows/distro_tests.yml
index 66ca3f03a4..86905cd445 100644
--- a/.github/workflows/distro_tests.yml
+++ b/.github/workflows/distro_tests.yml
@@ -8,7 +8,7 @@ concurrency:
 
 jobs:
   test-distros:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: ${{ matrix.os }}
     strategy:
diff --git a/.github/workflows/docs_updater.yml b/.github/workflows/docs_updater.yml
index ee4e5253f9..96eed38d72 100644
--- a/.github/workflows/docs_updater.yml
+++ b/.github/workflows/docs_updater.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   update_docs:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
         with:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index d81333f76b..86380a9984 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -12,7 +12,7 @@ concurrency:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       # if one python version fails, let the others finish
       fail-fast: false
@@ -53,7 +53,7 @@ jobs:
           verbose: true
   publish_code:
     needs: test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/stable')
     continue-on-error: true
     steps:
@@ -201,7 +201,7 @@ jobs:
       BBOT_VERSION: ${{ steps.version.outputs.BBOT_VERSION }}
   tag_commit:
     needs: publish_code
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name == 'push' && (github.ref == 'refs/heads/stable' || github.ref == 'refs/heads/dev')
     steps:
       - uses: actions/checkout@v7
@@ -222,7 +222,7 @@ jobs:
           git push origin "$VERSION"
 
   publish_docs:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name == 'push' && (github.ref == 'refs/heads/stable' || github.ref == 'refs/heads/dev')
     steps:
       - uses: actions/checkout@v7
diff --git a/.github/workflows/version_updater.yml b/.github/workflows/version_updater.yml
index 6805c9a04c..6b5ccce315 100644
--- a/.github/workflows/version_updater.yml
+++ b/.github/workflows/version_updater.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   update-nuclei-version:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
         with:
@@ -59,7 +59,7 @@ jobs:
           author: blsaccess <info@blacklanternsecurity.com>
           assignees: "TheTechromancer"
   update-trufflehog-version:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
         with: