feat(ci): keep GitHub-hosted runner labels current through the updater

The workflows pin `runs-on: ubuntu-NN.NN`, so no job moves to a new Ubuntu
release behind our back, but nothing raised the pin either. A sixth job of
`🔄 Update versions` closes that: `utils/update/runner.py` reads the image
table of actions/runner-images, takes the newest x64 Ubuntu label whose
image carries no preview or beta badge, and raises every older bare
`runs-on: ubuntu-NN.NN` to it; arch-suffixed labels stay untouched. The job
opens the change as one PR over `.github/workflows`, so its CI run tests
the new image before it reaches main.

This commit carries the updater's first result: every job now runs on
ubuntu-26.04 (49 `runs-on`).

actionlint 1.7.12, the newest release, does not know `ubuntu-26.04` yet
(rhysd/actionlint#682, fix proposed in rhysd/actionlint#743), so
`.github/actionlint.yaml` declares the label until a release knows it.

act maps each `ubuntu-NN.NN` label the workflows use to the local platform
image, derived from `.github/workflows`, instead of a fixed list that did
not know ubuntu-26.04.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.github/workflows/call-images-build-ci.yml

@@ -43,7 +43,7 @@ concurrency:
 jobs:
   build:
     name: 💿 Image
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write

.github/workflows/call-images-mirror-missing.yml

@@ -78,7 +78,7 @@ concurrency:
 jobs:
   sync:
     name: 🪞 Mirror
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write

.github/workflows/call-lint.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   lint:
     name: 🧹 Lint
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     env:
       INFINITO_LINT_RUNNER: host

.github/workflows/call-orchestrator.yml

@@ -343,7 +343,7 @@ jobs:
       - test-deploy-chunk-2
       - test-deploy-chunk-3
     if: ${{ always() && github.ref == 'refs/heads/main' && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       issues: write
       actions: read
@@ -374,7 +374,7 @@ jobs:
       - lint
       - security-codeql
     if: ${{ always() }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: 🛑 Fail if any upstream job failed or was cancelled
         if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}

.github/workflows/call-release-version.yml

@@ -30,7 +30,7 @@ env:
 jobs:
   check-ci-images:
     name: 🔎 Check CI images
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       missing: ${{ steps.check.outputs.missing }}
       ci_tag: ${{ steps.citag.outputs.ci_tag }}
@@ -123,7 +123,7 @@ jobs:
         needs.build-ci-images-if-missing.result == 'success' ||
         needs.build-ci-images-if-missing.result == 'skipped'
       )
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write

.github/workflows/call-test-deploy.yml

@@ -163,7 +163,7 @@ env:
 jobs:
   discover:
     name: 🔍 Chunk ${{ inputs.index }}${{ inputs.marker }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     outputs:
       apps: ${{ steps.discover.outputs.apps }}
@@ -251,7 +251,7 @@ jobs:
   deploy:
     name: "${{ matrix.label }}"
     if: needs.discover.outputs.apps != '' && needs.discover.outputs.apps != '[]'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 355
     needs: discover
 

.github/workflows/call-test-dns.yml

@@ -23,7 +23,7 @@ permissions:
 jobs:
   dns:
     name: 🌐 DNS
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
       - name: 🧹 Free disk space

.github/workflows/call-test-install-make.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   test-install-make:
     name: 🛠️ Makefile
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     env:
       NIX_CONFIG: |

.github/workflows/call-test-install-pkgmgr.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   test-install-pkgmgr:
     name: 📦 PKGMGR
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     env:
       NIX_CONFIG: |

.github/workflows/call-test-workspace.yml

@@ -21,7 +21,7 @@ permissions:
 jobs:
   prepare:
     name: 🧑‍💻 Workspace Matrix
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     outputs:
       matrix: ${{ steps.matrix.outputs.matrix }}
@@ -44,7 +44,7 @@ jobs:
 
   test-workspace:
     name: ${{ matrix.icon }} Workspace (${{ matrix.label }})
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 345
     needs: prepare
 

.github/workflows/call-test.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   test:
     name: 🧪 Test
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     env:
       INFINITO_TEST_RUNNER: host

.github/workflows/call-validation.yml

@@ -84,7 +84,7 @@ permissions:
 jobs:
   validation:
     name: ✅ Validation
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⬇️ Checkout the calling ref for its tooling
         uses: actions/checkout@v7.0.0
@@ -148,7 +148,7 @@ jobs:
   wait-fork-prereq-run:
     name: ⏳ Wait for fork run
     if: ${{ inputs.fork_prereqs }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     env:
       WAIT_REQUIRED: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && !inputs.trusted_pr }}
     steps:
@@ -194,7 +194,7 @@ jobs:
     name: 🚦 Gate Dependencies
     needs: wait-fork-prereq-run
     if: ${{ !cancelled() && inputs.fork_prereqs }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v7.0.0
       - name: ✅ Assert privileged prerequisites are ready

.github/workflows/cron-cleanup-stale.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   stale:
     name: 🏷️ Close inactive issues and pull requests
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       issues: write
       pull-requests: write
@@ -45,7 +45,7 @@ jobs:
 
   delete-stale-branches:
     name: 🌿 Delete inactive branches
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
       issues: write
@@ -65,7 +65,7 @@ jobs:
 
   cleanup-ghcr-ci-images:
     name: 📦 Delete old GHCR CI images
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write

.github/workflows/cron-collection-source.yml

@@ -18,7 +18,7 @@ jobs:
   benchmark-collection-sources:
     name: ⚖️ Time Galaxy against the git fallback
     if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     env:
       HISTORY_PATH: build/collection-source-history.json
     steps:

.github/workflows/cron-images-cleanup-ci.yml

@@ -22,7 +22,7 @@ concurrency:
 jobs:
   cleanup:
     name: 🧹 Delete old ci-* image versions
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       actions: read
       contents: read

.github/workflows/cron-images-mirror-all.yml

@@ -61,7 +61,7 @@ concurrency:
 jobs:
   sync:
     name: 🪞 Mirror
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write

.github/workflows/cron-release-highest.yml

@@ -19,7 +19,7 @@ env:
 jobs:
   check-and-trigger:
     name: 🔎 Backfill highest missing release tag
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: read

.github/workflows/cron-security-codeql.yml

@@ -34,7 +34,7 @@ jobs:
     #   - https://gh.io/supported-runners-and-hardware-resources
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       security-events: write
       packages: read

.github/workflows/cron-security-fuzz.yml

@@ -16,7 +16,7 @@ permissions:
 jobs:
   fuzz-yaml-bootstrap:
     name: 🧬 Fuzz the bootstrap YAML reader
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
       - name: ⬇️ Checkout

.github/workflows/cron-security-scorecard.yml

@@ -26,7 +26,7 @@ permissions: read-all
 jobs:
   analysis:
     name: 🔍 Scorecard analysis
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
     if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
     permissions:

.github/workflows/cron-update.yml

@@ -21,7 +21,7 @@ jobs:
   update-docker-image-versions:
     name: 🐳 Update Docker image versions
     if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@v7.0.0
@@ -68,7 +68,7 @@ jobs:
   update-version-sources:
     name: 🔖 Update declared version sources
     if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@v7.0.0
@@ -115,7 +115,7 @@ jobs:
   update-pip-pins:
     name: 🐍 Update pinned pip requirements
     if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@v7.0.0
@@ -162,7 +162,7 @@ jobs:
   update-galaxy-pins:
     name: 🌌 Update pinned Ansible collections
     if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@v7.0.0
@@ -209,7 +209,7 @@ jobs:
   update-repository-refs:
     name: 🌿 Update repository refs
     if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@v7.0.0
@@ -252,3 +252,45 @@ jobs:
           UPDATE_PR_BODY: "Automated update of semver-based git `ref:` values in `roles/*/meta/services.yml`. Upstream tags resolved via `git ls-remote --tags`."
           UPDATE_BASE_BRANCH: main
         run: bash scripts/github/update/open/role_prs.sh roles
+
+  update-runner-labels:
+    name: 🏃 Update GitHub-hosted runner labels
+    if: vars.CI_ENABLE_AUTO_UPDATES == 'true'
+    runs-on: ubuntu-26.04
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@v7.0.0
+        with:
+          ref: main
+
+      - name: 🔧 Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: 🔄 Update runner labels
+        run: bash scripts/github/update/runner_labels.sh
+
+      - name: 🔎 Check for changes
+        id: diff
+        run: bash scripts/github/resolve/check_git_changes.sh .github/workflows
+
+      - name: ⚙️ Generate app token
+        if: steps.diff.outputs.changed == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ secrets.BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+
+      - name: 📂 Open PR if runner labels changed
+        if: steps.diff.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+          UPDATE_BRANCH_PREFIX: update/runner-labels
+          UPDATE_COMMIT_MESSAGE: "update(ci): raise GitHub-hosted runner labels"
+          UPDATE_PR_TITLE: "update(ci): raise GitHub-hosted runner labels"
+          UPDATE_PR_BODY: "Automated raise of every `runs-on: ubuntu-NN.NN` in `.github/workflows/` to the newest GA x64 Ubuntu image listed in https://github.com/actions/runner-images. Its CI run is the proof that the stack works on the new image."
+          UPDATE_BASE_BRANCH: main
+        run: bash scripts/github/update/open/pr.sh .github/workflows

.github/workflows/entry-cancel-superseded.yml

@@ -27,7 +27,7 @@ jobs:
   cancel-branch-runs:
     name: 🚫 Cancel superseded branch runs
     if: ${{ github.event_name == 'push' && (github.ref_name != 'main' || (github.ref_name == 'main' && startsWith(github.event.head_commit.message, 'Release version '))) }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       actions: write
       contents: read
@@ -52,7 +52,7 @@ jobs:
   cancel-pull-request-runs:
     name: 🚫 Cancel superseded pull request runs
     if: ${{ github.event_name == 'pull_request_target' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       actions: write
       contents: read

.github/workflows/entry-delete-branch.yml

@@ -20,7 +20,7 @@ permissions:
 jobs:
   cancel-branch-runs:
     if: ${{ github.event.ref_type == 'branch' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       actions: write
       contents: read

.github/workflows/entry-manual-mirror-cleanup.yml

@@ -40,7 +40,7 @@ permissions:
 jobs:
   cleanup:
     name: 🗑️ Delete private GHCR mirror packages
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write

.github/workflows/entry-pr-change-orchestrate.yml

@@ -29,7 +29,7 @@ jobs:
   detect-pr-scope:
     name: 🔎 Detect PR scope
     if: ${{ github.event.pull_request.draft == false && (github.event_name == 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository) }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       scope: ${{ steps.resolve.outputs.scope }}
       run_ci_orchestrator: ${{ steps.resolve.outputs.run_ci_orchestrator }}
@@ -59,7 +59,7 @@ jobs:
       - detect-pr-scope
       - validation
     if: ${{ needs.detect-pr-scope.outputs.run_ci_orchestrator == 'false' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ✅ Confirm lightweight PR scope
         shell: bash
@@ -73,7 +73,7 @@ jobs:
       - detect-pr-scope
       - validation
     if: ${{ needs.detect-pr-scope.outputs.run_ci_orchestrator == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       whitelist: ${{ steps.resolve.outputs.whitelist }}
     steps:
@@ -124,7 +124,7 @@ jobs:
       - detect-pr-scope
       - validation
     if: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && needs.detect-pr-scope.outputs.run_ci_orchestrator == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       checkout_ref: ${{ steps.out.outputs.checkout_ref }}
       image_tag: ${{ steps.out.outputs.image_tag }}

.github/workflows/entry-pr-closed-cancel-workflows.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   cancel-pr-runs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       actions: write
       contents: read

.github/workflows/entry-pr-open-dependabot-close.yml

@@ -19,7 +19,7 @@ jobs:
   close-when-disabled:
     name: 🚫 Close Dependabot PR while gated
     if: github.event.pull_request.user.login == 'dependabot[bot]' && vars.CI_ENABLE_AUTO_UPDATES != 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: 📪 Close PR
         env:

.github/workflows/entry-push-latest.yml

@@ -21,7 +21,7 @@ permissions:
 jobs:
   run-policy:
     name: 🧭 Decide CI policy
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       pull-requests: read
@@ -59,7 +59,7 @@ jobs:
     name: ⏭️ Skip CI
     needs: run-policy
     if: needs.run-policy.outputs.should_run != 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: ⏭️ Explain skip
         shell: bash
@@ -72,7 +72,7 @@ jobs:
     if: needs.run-policy.outputs.should_run == 'true'
     needs: run-policy
     name: 🏷️ Detect release tag
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       is_version: ${{ steps.pick.outputs.is_version }}
       version_tag: ${{ steps.pick.outputs.version_tag }}
@@ -91,7 +91,7 @@ jobs:
     if: needs.run-policy.outputs.should_run == 'true'
     name: ⭐ Resolve new-role priority
     needs: run-policy
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       priority: ${{ steps.resolve.outputs.priority }}
     steps:
@@ -132,7 +132,7 @@ jobs:
       - run-policy
       - detect-release
       - ci-orchestrator
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       allowed: ${{ steps.guard.outputs.allowed }}
     steps: