Explicit ubuntu 24.04 runner versions

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
   # below explicitly opt manual runs back into running everything.
   changes:
     name: Detect Changes
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       builds: ${{ steps.filter.outputs.builds }}
       tests:  ${{ steps.filter.outputs.tests }}
@@ -145,7 +145,7 @@ jobs:
   # This job is an aggregate job
   ci:
     name: CI
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # List all the jobs that need to succeed for the CI to pass
     needs:
       - changes

.github/workflows/cpp-tools.yml

@@ -11,7 +11,7 @@ permissions:
 jobs:
   clang-format:
     name: clang-format
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     continue-on-error: false
     timeout-minutes: 15
 
@@ -52,7 +52,7 @@ jobs:
 
   clang-tidy:
     name: clang-tidy
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     continue-on-error: false
     timeout-minutes: 45
 

.github/workflows/docs.yml

@@ -58,7 +58,7 @@ jobs:
   build:
     name: Generate and verify docs
     if: github.event_name == 'release' || inputs.build_docs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       project_number: ${{ steps.build_docs.outputs.project_number }}
       artifact_name: ${{ steps.artifact_meta.outputs.name }}
@@ -168,7 +168,7 @@ jobs:
     # CI enables this only for trusted main pushes. Release events always
     # check credentials before publishing. PR jobs never receive deploy keys.
     if: github.event_name == 'release' || inputs.check_credentials
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Verify docs deploy credentials
         env:
@@ -187,7 +187,7 @@ jobs:
     name: Publish (S3 + CloudFront)
     needs: [build, credentials]
     if: github.event_name == 'release' && github.event.release.prerelease == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Download docs artifact
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

.github/workflows/license_check.yml

@@ -6,7 +6,7 @@ on:
 jobs:
   license-check:
     name: License Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:

.github/workflows/link_check.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   check-links:
     name: Link Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:

.github/workflows/make-release.yml

@@ -348,7 +348,7 @@ jobs:
   # ---------- Release Job ----------
   release:
     name: Create GitHub Release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
       - build
     permissions:

.github/workflows/rust-release-check.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   rust-release-check:
     name: Rust Release Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout (with submodules)
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/tests.yml

@@ -472,7 +472,7 @@ jobs:
   coverage:
     name: Code Coverage
     if: inputs.run_coverage
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # A debug build instrumented with --coverage is far heavier (RAM + disk)
     # than the release builds. Cap the wall-clock so a stuck/OOM build fails
     # fast and visibly instead of hanging toward the 6h default.