feat(ci): keep GitHub-hosted runner labels current through the updater

The workflows pin `runs-on: ubuntu-NN.NN`, so no job moves to a new Ubuntu
release behind our back, but nothing raised the pin either. A sixth job of
`🔄 Update versions` closes that: `utils/update/runner.py` reads the image
table of actions/runner-images, takes the newest x64 Ubuntu label whose
image carries no preview or beta badge, and raises every older bare
`runs-on: ubuntu-NN.NN` to it; arch-suffixed labels stay untouched. The job
opens the change as one PR over `.github/workflows`, so its CI run tests
the new image before it reaches main.

This commit carries the updater's first result: every job now runs on
ubuntu-26.04 (49 `runs-on`).

actionlint 1.7.12, the newest release, does not know `ubuntu-26.04` yet
(rhysd/actionlint#682, fix proposed in rhysd/actionlint#743), so
`.github/actionlint.yaml` declares the label until a release knows it.

act maps each `ubuntu-NN.NN` label the workflows use to the local platform
image, derived from `.github/workflows`, instead of a fixed list that did
not know ubuntu-26.04.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - ubuntu-26.04

.github/workflows/call-images-build-ci.yml

@@ -43,7 +43,7 @@ concurrency:
 jobs:
   build:
     name: 💿 Image
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write

.github/workflows/call-images-mirror-missing.yml

@@ -78,7 +78,7 @@ concurrency:
 jobs:
   sync:
     name: 🪞 Mirror
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write

.github/workflows/call-lint.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   lint:
     name: 🧹 Lint
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     env:
       INFINITO_LINT_RUNNER: host

.github/workflows/call-orchestrator.yml

@@ -343,7 +343,7 @@ jobs:
       - test-deploy-chunk-2
       - test-deploy-chunk-3
     if: ${{ always() && github.ref == 'refs/heads/main' && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       issues: write
       actions: read
@@ -374,7 +374,7 @@ jobs:
       - lint
       - security-codeql
     if: ${{ always() }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: 🛑 Fail if any upstream job failed or was cancelled
         if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}

.github/workflows/call-release-version.yml

@@ -30,7 +30,7 @@ env:
 jobs:
   check-ci-images:
     name: 🔎 Check CI images
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       missing: ${{ steps.check.outputs.missing }}
       ci_tag: ${{ steps.citag.outputs.ci_tag }}
@@ -123,7 +123,7 @@ jobs:
         needs.build-ci-images-if-missing.result == 'success' ||
         needs.build-ci-images-if-missing.result == 'skipped'
       )
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write

.github/workflows/call-test-deploy.yml

@@ -163,7 +163,7 @@ env:
 jobs:
   discover:
     name: 🔍 Chunk ${{ inputs.index }}${{ inputs.marker }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     outputs:
       apps: ${{ steps.discover.outputs.apps }}
@@ -251,7 +251,7 @@ jobs:
   deploy:
     name: "${{ matrix.label }}"
     if: needs.discover.outputs.apps != '' && needs.discover.outputs.apps != '[]'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 355
     needs: discover
 

.github/workflows/call-test-dns.yml

@@ -23,7 +23,7 @@ permissions:
 jobs:
   dns:
     name: 🌐 DNS
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
       - name: 🧹 Free disk space

.github/workflows/call-test-install-make.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   test-install-make:
     name: 🛠️ Makefile
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     env:
       NIX_CONFIG: |

.github/workflows/call-test-install-pkgmgr.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   test-install-pkgmgr:
     name: 📦 PKGMGR
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     env:
       NIX_CONFIG: |

.github/workflows/call-test-workspace.yml

@@ -21,7 +21,7 @@ permissions:
 jobs:
   prepare:
     name: 🧑‍💻 Workspace Matrix
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     outputs:
       matrix: ${{ steps.matrix.outputs.matrix }}
@@ -44,7 +44,7 @@ jobs:
 
   test-workspace:
     name: ${{ matrix.icon }} Workspace (${{ matrix.label }})
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 345
     needs: prepare
 

.github/workflows/call-test.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   test:
     name: 🧪 Test
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     env:
       INFINITO_TEST_RUNNER: host

.github/workflows/call-validation.yml

@@ -84,7 +84,7 @@ permissions:
 jobs:
   validation:
     name: ✅ Validation
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⬇️ Checkout the calling ref for its tooling
         uses: actions/checkout@v7.0.0
@@ -148,7 +148,7 @@ jobs:
   wait-fork-prereq-run:
     name: ⏳ Wait for fork run
     if: ${{ inputs.fork_prereqs }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     env:
       WAIT_REQUIRED: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && !inputs.trusted_pr }}
     steps:
@@ -194,7 +194,7 @@ jobs:
     name: 🚦 Gate Dependencies
     needs: wait-fork-prereq-run
     if: ${{ !cancelled() && inputs.fork_prereqs }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v7.0.0
       - name: ✅ Assert privileged prerequisites are ready

.github/workflows/cron-cleanup-stale.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   stale:
     name: 🏷️ Close inactive issues and pull requests
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       issues: write
       pull-requests: write
@@ -45,7 +45,7 @@ jobs:
 
   delete-stale-branches:
     name: 🌿 Delete inactive branches
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
       issues: write
@@ -65,7 +65,7 @@ jobs:
 
   cleanup-ghcr-ci-images:
     name: 📦 Delete old GHCR CI images
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write

.github/workflows/cron-collection-source.yml

@@ -18,7 +18,7 @@ jobs:
   benchmark-collection-sources:
     name: ⚖️ Time Galaxy against the git fallback
     if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     env:
       HISTORY_PATH: build/collection-source-history.json
     steps:

.github/workflows/cron-images-cleanup-ci.yml

@@ -22,7 +22,7 @@ concurrency:
 jobs:
   cleanup:
     name: 🧹 Delete old ci-* image versions
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       actions: read
       contents: read

.github/workflows/cron-images-mirror-all.yml

@@ -61,7 +61,7 @@ concurrency:
 jobs:
   sync:
     name: 🪞 Mirror
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write

.github/workflows/cron-release-highest.yml

@@ -19,7 +19,7 @@ env:
 jobs:
   check-and-trigger:
     name: 🔎 Backfill highest missing release tag
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: read

.github/workflows/cron-security-codeql.yml

@@ -34,7 +34,7 @@ jobs:
     #   - https://gh.io/supported-runners-and-hardware-resources
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       security-events: write
       packages: read

.github/workflows/cron-security-fuzz.yml

@@ -16,7 +16,7 @@ permissions:
 jobs:
   fuzz-yaml-bootstrap:
     name: 🧬 Fuzz the bootstrap YAML reader
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
       - name: ⬇️ Checkout

.github/workflows/cron-security-scorecard.yml

@@ -26,7 +26,7 @@ permissions: read-all
 jobs:
   analysis:
     name: 🔍 Scorecard analysis
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
     if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
     permissions:

.github/workflows/cron-update.yml

@@ -21,7 +21,7 @@ jobs:
   update-docker-image-versions:
     name: 🐳 Update Docker image versions
     if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@v7.0.0
@@ -68,7 +68,7 @@ jobs:
   update-version-sources:
     name: 🔖 Update declared version sources
     if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@v7.0.0
@@ -115,7 +115,7 @@ jobs:
   update-pip-pins:
     name: 🐍 Update pinned pip requirements
     if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@v7.0.0
@@ -162,7 +162,7 @@ jobs:
   update-galaxy-pins:
     name: 🌌 Update pinned Ansible collections
     if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@v7.0.0
@@ -209,7 +209,7 @@ jobs:
   update-repository-refs:
     name: 🌿 Update repository refs
     if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@v7.0.0
@@ -252,3 +252,45 @@ jobs:
           UPDATE_PR_BODY: "Automated update of semver-based git `ref:` values in `roles/*/meta/services.yml`. Upstream tags resolved via `git ls-remote --tags`."
           UPDATE_BASE_BRANCH: main
         run: bash scripts/github/update/open/role_prs.sh roles
+
+  update-runner-labels:
+    name: 🏃 Update GitHub-hosted runner labels
+    if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
+    runs-on: ubuntu-26.04
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@v7.0.0
+        with:
+          ref: main
+
+      - name: 🔧 Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: 🔄 Update runner labels
+        run: bash scripts/github/update/runner_labels.sh
+
+      - name: 🔎 Check for changes
+        id: diff
+        run: bash scripts/github/resolve/check_git_changes.sh .github/workflows
+
+      - name: ⚙️ Generate app token
+        if: steps.diff.outputs.changed == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+
+      - name: 📂 Open PR if runner labels changed
+        if: steps.diff.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+          UPDATE_BRANCH_PREFIX: update/runner-labels
+          UPDATE_COMMIT_MESSAGE: "update(ci): raise GitHub-hosted runner labels"
+          UPDATE_PR_TITLE: "update(ci): raise GitHub-hosted runner labels"
+          UPDATE_PR_BODY: "Automated raise of every `runs-on: ubuntu-NN.NN` in `.github/workflows/` to the newest GA x64 Ubuntu image listed in https://github.com/actions/runner-images. Its CI run is the proof that the stack works on the new image."
+          UPDATE_BASE_BRANCH: main
+        run: bash scripts/github/update/open/pr.sh .github/workflows

.github/workflows/entry-cancel-superseded.yml

@@ -27,7 +27,7 @@ jobs:
   cancel-branch-runs:
     name: 🚫 Cancel superseded branch runs
     if: ${{ github.event_name == 'push' && (github.ref_name != 'main' || (github.ref_name == 'main' && startsWith(github.event.head_commit.message, 'Release version '))) }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       actions: write
       contents: read
@@ -52,7 +52,7 @@ jobs:
   cancel-pull-request-runs:
     name: 🚫 Cancel superseded pull request runs
     if: ${{ github.event_name == 'pull_request_target' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       actions: write
       contents: read

.github/workflows/entry-delete-branch.yml

@@ -20,7 +20,7 @@ permissions:
 jobs:
   cancel-branch-runs:
     if: ${{ github.event.ref_type == 'branch' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       actions: write
       contents: read

.github/workflows/entry-manual-mirror-cleanup.yml

@@ -40,7 +40,7 @@ permissions:
 jobs:
   cleanup:
     name: 🗑️ Delete private GHCR mirror packages
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write

.github/workflows/entry-pr-change-orchestrate.yml

@@ -29,7 +29,7 @@ jobs:
   detect-pr-scope:
     name: 🔎 Detect PR scope
     if: ${{ github.event.pull_request.draft == false && (github.event_name == 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository) }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       scope: ${{ steps.resolve.outputs.scope }}
       run_ci_orchestrator: ${{ steps.resolve.outputs.run_ci_orchestrator }}
@@ -59,7 +59,7 @@ jobs:
       - detect-pr-scope
       - validation
     if: ${{ needs.detect-pr-scope.outputs.run_ci_orchestrator == 'false' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ✅ Confirm lightweight PR scope
         shell: bash
@@ -73,7 +73,7 @@ jobs:
       - detect-pr-scope
       - validation
     if: ${{ needs.detect-pr-scope.outputs.run_ci_orchestrator == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       whitelist: ${{ steps.resolve.outputs.whitelist }}
     steps:
@@ -124,7 +124,7 @@ jobs:
       - detect-pr-scope
       - validation
     if: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && needs.detect-pr-scope.outputs.run_ci_orchestrator == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       checkout_ref: ${{ steps.out.outputs.checkout_ref }}
       image_tag: ${{ steps.out.outputs.image_tag }}

.github/workflows/entry-pr-closed-cancel-workflows.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   cancel-pr-runs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       actions: write
       contents: read

.github/workflows/entry-pr-open-dependabot-close.yml

@@ -19,7 +19,7 @@ jobs:
   close-when-disabled:
     name: 🚫 Close Dependabot PR while gated
     if: github.event.pull_request.user.login == 'dependabot[bot]' && vars.CI_ENABLE_AUTO_UPDATES != 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: 📪 Close PR
         env:

.github/workflows/entry-push-latest.yml

@@ -21,7 +21,7 @@ permissions:
 jobs:
   run-policy:
     name: 🧭 Decide CI policy
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       pull-requests: read
@@ -59,7 +59,7 @@ jobs:
     name: ⏭️ Skip CI
     needs: run-policy
     if: needs.run-policy.outputs.should_run != 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⏭️ Explain skip
         shell: bash
@@ -72,7 +72,7 @@ jobs:
     if: needs.run-policy.outputs.should_run == 'true'
     needs: run-policy
     name: 🏷️ Detect release tag
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       is_version: ${{ steps.pick.outputs.is_version }}
       version_tag: ${{ steps.pick.outputs.version_tag }}
@@ -91,7 +91,7 @@ jobs:
     if: needs.run-policy.outputs.should_run == 'true'
     name: ⭐ Resolve new-role priority
     needs: run-policy
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       priority: ${{ steps.resolve.outputs.priority }}
     steps:
@@ -132,7 +132,7 @@ jobs:
       - run-policy
       - detect-release
       - ci-orchestrator
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       allowed: ${{ steps.guard.outputs.allowed }}
     steps:

cli/contributing/update/runner/__init__.py

@@ -0,0 +1,5 @@
+"""CLI entry point package for the GitHub-hosted runner label update."""
+
+from pathlib import Path
+
+PROJECT_ROOT: Path = Path(__file__).resolve().parents[4]

cli/contributing/update/runner/__main__.py

@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+from utils.update.fetch import document
+from utils.update.runner import IMAGES_README, bump_workflows, newest_ubuntu_label
+
+from . import PROJECT_ROOT
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description=(
+            "Raise every workflow's runs-on Ubuntu label to the newest GA "
+            "GitHub-hosted x64 image."
+        )
+    )
+    parser.add_argument(
+        "--repo-root",
+        type=Path,
+        default=PROJECT_ROOT,
+        help="Repository root whose .github/workflows are updated",
+    )
+    args = parser.parse_args()
+
+    label = newest_ubuntu_label(document(IMAGES_README))
+    if label is None:
+        print(f"No GA x64 Ubuntu label found in {IMAGES_README}.")
+        return 1
+
+    repo_root = args.repo_root.resolve()
+    changed = bump_workflows(repo_root / ".github" / "workflows", label)
+    if not changed:
+        print(f"Every workflow already runs on {label} or newer.")
+        return 0
+
+    print(f"Raised runs-on to {label} in:")
+    for path in changed:
+        print(f"- {path.relative_to(repo_root)}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

docs/contributing/actions/debugging/ci.md

@@ -49,11 +49,11 @@ Some CI failures (most notably OOM-kills such as [#162](https://github.com/infin
 
 ### GitHub-Hosted Runner Specs
 
-All [workflows](../../../../.github/workflows/) target `runs-on: ubuntu-24.04`, the GitHub-hosted standard Linux runner pinned to one Ubuntu release. GitHub still refreshes that image weekly; moving to the next release is a deliberate change of the label, and `tests/lint/repository/test_workflow_runner_pinned.py` rejects `*-latest` labels. The effective ceiling depends on the repository's visibility and plan:
+All [workflows](../../../../.github/workflows/) target `runs-on: ubuntu-26.04`, the GitHub-hosted standard Linux runner pinned to one Ubuntu release. GitHub still refreshes that image weekly. The `🏃 Update GitHub-hosted runner labels` job of [cron-update.yml](../../../../.github/workflows/cron-update.yml) opens a pull request when a newer GA x64 Ubuntu image is listed in [actions/runner-images](https://github.com/actions/runner-images), and `tests/lint/repository/test_workflow_runner_pinned.py` rejects `*-latest` labels. The effective ceiling depends on the repository's visibility and plan:
 
 | Repository / plan                        | vCPU | RAM    | SSD   |
 |------------------------------------------|------|--------|-------|
-| Public repo (this repo, `ubuntu-24.04`)  | 4    | 16 GB  | 14 GB |
+| Public repo (this repo, `ubuntu-26.04`)  | 4    | 16 GB  | 14 GB |
 | Private repo on Free / Pro / Team        | 2    | 7 GB   | 14 GB |
 | Private repo on Enterprise               | 4    | 16 GB  | 14 GB |
 
@@ -70,7 +70,7 @@ For the authoritative specs, see the upstream docs for [standard hosted runners]
 Pick the profile that matches the runner you want to mimic:
 
 ```sh
-# Public repo runner (ubuntu-24.04, 4 vCPU / 16 GB): the default CI target
+# Public repo runner (ubuntu-26.04, 4 vCPU / 16 GB): the default CI target
 INFINITO_MEM_LIMIT=16g INFINITO_MEMSWAP_LIMIT=16g INFINITO_CPUS=4 make <target>
 
 # Private repo runner on Free/Pro/Team (2 vCPU / 7 GB)

scripts/github/update/runner_labels.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "${SCRIPT_DIR}/../../.." && pwd)"
+
+cd "${REPO_ROOT}"
+python3 -m cli.contributing.update.runner "$@"

scripts/tests/deploy/act/workflow.sh

@@ -54,10 +54,10 @@ else
 fi
 
 cmd=(act "${ACT_EVENT}" -W "${_act_workflow}")
-cmd+=(-P "ubuntu-latest=${ACT_PLATFORM_IMAGE}")
+_act_workflows_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)/.github/workflows"
-cmd+=(-P "ubuntu-24.04=${ACT_PLATFORM_IMAGE}")
+while read -r _act_label; do
-cmd+=(-P "ubuntu-22.04=${ACT_PLATFORM_IMAGE}")
+	cmd+=(-P "${_act_label}=${ACT_PLATFORM_IMAGE}")
-cmd+=(-P "ubuntu-20.04=${ACT_PLATFORM_IMAGE}")
+done < <(grep -rhE 'runs-on:' "${_act_workflows_dir}" | grep -oE 'ubuntu-[0-9]+\.[0-9]+' | sort -u)
 
 if [[ -n "${ACT_JOB}" ]]; then
 	cmd+=(-j "${ACT_JOB}")

tests/unit/python/utils/update/test_runner.py

@@ -0,0 +1,71 @@
+from __future__ import annotations
+
+import tempfile
+import unittest
+from pathlib import Path
+
+from utils.cache.files import read_text
+from utils.update.runner import bump_text, bump_workflows, newest_ubuntu_label
+
+_BADGE = "<br>![Endpoint Badge](https://img.shields.io/endpoint?url=x)"
+_PREVIEW = "[![preview](https://img.shields.io/badge/preview-0969DA)](https://x)"
+_README = "\n".join(
+    [
+        "| Image | Architecture | YAML Label | Included Software |",
+        "| --------------------|--------------|---------------------|------------------|",
+        f"| Ubuntu 28.04 {_PREVIEW}{_BADGE} | x64 | `ubuntu-28.04` | [ubuntu-28.04] |",
+        f"| Ubuntu 26.04{_BADGE} | x64 | `ubuntu-26.04` | [ubuntu-26.04] |",
+        f"| Ubuntu 26.04 Arm64{_BADGE} | arm64 | `ubuntu-26.04-arm` | [x] |",
+        f"| Ubuntu 24.04{_BADGE} | x64 | `ubuntu-latest` or `ubuntu-24.04` | [x] |",
+        f"| Ubuntu Slim{_BADGE} | x64 | `ubuntu-slim` | [ubuntu-slim] |",
+        f"| macOS 26 Arm64{_BADGE} | arm64 | `macos-26` | [macOS-26-arm64] |",
+    ]
+)
+
+
+class TestNewestUbuntuLabel(unittest.TestCase):
+    def test_picks_newest_ga_x64_label(self) -> None:
+        self.assertEqual("ubuntu-26.04", newest_ubuntu_label(_README))
+
+    def test_none_without_an_ubuntu_row(self) -> None:
+        self.assertIsNone(newest_ubuntu_label("| Image | x |\n| macOS | arm64 |"))
+
+
+class TestBumpText(unittest.TestCase):
+    def test_raises_older_and_keeps_newer(self) -> None:
+        text = (
+            "jobs:\n"
+            "  a:\n    runs-on: ubuntu-22.04\n"
+            "  b:\n    runs-on: ubuntu-24.04\n"
+            "  c:\n    runs-on: ubuntu-28.04\n"
+            "  d:\n    runs-on: ubuntu-24.04-arm\n"
+            "# runs on ubuntu-24.04 elsewhere\n"
+        )
+        self.assertEqual(
+            "jobs:\n"
+            "  a:\n    runs-on: ubuntu-26.04\n"
+            "  b:\n    runs-on: ubuntu-26.04\n"
+            "  c:\n    runs-on: ubuntu-28.04\n"
+            "  d:\n    runs-on: ubuntu-24.04-arm\n"
+            "# runs on ubuntu-24.04 elsewhere\n",
+            bump_text(text, "ubuntu-26.04"),
+        )
+
+
+class TestBumpWorkflows(unittest.TestCase):
+    def test_rewrites_only_changed_files(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "old.yml").write_text("runs-on: ubuntu-24.04\n", encoding="utf-8")
+            (root / "new.yml").write_text("runs-on: ubuntu-26.04\n", encoding="utf-8")
+
+            changed = bump_workflows(root, "ubuntu-26.04")
+
+            self.assertEqual([root / "old.yml"], changed)
+            self.assertEqual(
+                "runs-on: ubuntu-26.04\n", read_text(str(root / "old.yml"))
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()

utils/update/runner.py

@@ -0,0 +1,77 @@
+"""Bump the pinned GitHub-hosted Ubuntu runner label of every workflow job.
+
+GitHub lists its hosted images in the runner-images README; the newest x64
+Ubuntu label whose image carries no preview or beta badge is the target.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+IMAGES_README = "https://raw.githubusercontent.com/actions/runner-images/main/README.md"
+
+_LABEL = re.compile(r"`ubuntu-(\d{2})\.(\d{2})`")
+_RUNS_ON = re.compile(r"(runs-on:\s*)ubuntu-(\d{2})\.(\d{2})(?![\w.-])")
+_PRERELEASE = re.compile(r"preview|beta", re.IGNORECASE)
+
+
+def newest_ubuntu_label(readme: str) -> str | None:
+    """Return the newest GA x64 Ubuntu label listed in the images table.
+
+    Args:
+        readme: text of the runner-images README.
+    """
+    versions: list[tuple[int, int]] = []
+    for row in readme.splitlines():
+        cells = [cell.strip() for cell in row.split("|")]
+        if len(cells) < 5 or not cells[1].startswith("Ubuntu"):
+            continue
+        if _PRERELEASE.search(cells[1]) or cells[2] != "x64":
+            continue
+        versions += [
+            (int(major), int(minor)) for major, minor in _LABEL.findall(cells[3])
+        ]
+    if not versions:
+        return None
+    major, minor = max(versions)
+    return f"ubuntu-{major:02d}.{minor:02d}"
+
+
+def bump_text(text: str, label: str) -> str:
+    """Raise every older ``runs-on: ubuntu-NN.NN`` in *text* to *label*.
+
+    Args:
+        text: workflow source.
+        label: target label, ``ubuntu-NN.NN``.
+    """
+    target = tuple(int(part) for part in label.removeprefix("ubuntu-").split("."))
+
+    def _raise(match: re.Match[str]) -> str:
+        if (int(match.group(2)), int(match.group(3))) < target:
+            return match.group(1) + label
+        return match.group(0)
+
+    return _RUNS_ON.sub(_raise, text)
+
+
+def bump_workflows(workflows_dir: Path, label: str) -> list[Path]:
+    """Rewrite the workflows under *workflows_dir* to *label*; return the changed files.
+
+    Args:
+        workflows_dir: directory holding the workflow YAML files.
+        label: target label, ``ubuntu-NN.NN``.
+    """
+    changed: list[Path] = []
+    for path in sorted(workflows_dir.glob("*.y*ml")):
+        text = path.read_text(  # nocheck: cache-read — read-then-write of the same file; cached read would go stale
+            encoding="utf-8"
+        )
+        bumped = bump_text(text, label)
+        if bumped != text:
+            path.write_text(bumped, encoding="utf-8")
+            changed.append(path)
+    return changed