ci: pin ubuntu runner to 24.04 in workflows

.github/workflows/CICD.yml

@@ -35,7 +35,7 @@ concurrency:
 jobs:
   cargo-deny:
     name: Style/cargo-deny
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@v7.0.1
       with:
@@ -52,7 +52,7 @@ jobs:
         job:
           # note: `cargo-udeps` panics when processing stdbuf/libstdbuf ("uu_stdbuf_libstdbuf"); either b/c of the 'cpp' crate or 'libstdbuf' itself
           #   ... b/c of the panic, a more limited feature set is tested (though only excluding `stdbuf`)
-          - { os: ubuntu-latest  , features: "feat_Tier1,feat_require_unix,feat_require_unix_utmpx" }
+          - { os: ubuntu-24.04  , features: "feat_Tier1,feat_require_unix,feat_require_unix_utmpx" }
           - { os: macos-latest   , features: "feat_Tier1,feat_require_unix,feat_require_unix_utmpx" }
           - { os: windows-latest , features: feat_os_windows }
     steps:
@@ -98,7 +98,7 @@ jobs:
       fail-fast: false
       matrix:
         job:
-          - { os: ubuntu-latest  , features: feat_os_unix }
+          - { os: ubuntu-24.04  , features: feat_os_unix }
 # for now, don't build it on mac & windows because the doc is only published from linux
 # + it needs a bunch of duplication for build
 # and I don't want to add a doc step in the regular build to avoid long builds
@@ -162,7 +162,7 @@ jobs:
     strategy:
       matrix:
         job:
-          - { os: ubuntu-latest , features: feat_os_unix }
+          - { os: ubuntu-24.04 , features: feat_os_unix }
     steps:
     - uses: actions/checkout@v7.0.1
       with:
@@ -249,7 +249,7 @@ jobs:
       fail-fast: false
       matrix:
         job:
-          - { os: ubuntu-latest , features: feat_os_unix }
+          - { os: ubuntu-24.04 , features: feat_os_unix }
     steps:
     - uses: actions/checkout@v7.0.1
       with:
@@ -274,7 +274,7 @@ jobs:
       fail-fast: false
       matrix:
         job:
-          - { os: ubuntu-latest  , name: feat_os_unix    , features: feat_os_unix }
+          - { os: ubuntu-24.04  , name: feat_os_unix    , features: feat_os_unix }
           # Don't fail to build if SELinux specific utils are included by some reason.
           # But we are not interested in existence of stubs
           - { os: macos-latest   , name: feat_os_unix    , features: "feat_os_unix,chcon,runcon" }
@@ -319,7 +319,7 @@ jobs:
       fail-fast: false
       matrix:
         job:
-          - { os: ubuntu-latest  , features: feat_os_unix }
+          - { os: ubuntu-24.04  , features: feat_os_unix }
           - { os: macos-latest   , features: feat_os_unix }
           - { os: windows-latest , features: feat_os_windows }
     steps:
@@ -375,20 +375,20 @@ jobs:
           # the matrix values to the job title, so those jobs read as
           # "Build (..., x86_64-unknown-linux-gnu, ..., PGO)".
           # enable openssl for performance if min_version: already tests pore-Rust checksum crates
-          - { os: ubuntu-latest  , target: arm-unknown-linux-gnueabihf , features: feat_os_unix_gnueabihf , use-cross: use-cross , skip-tests: true }
+          - { os: ubuntu-24.04  , target: arm-unknown-linux-gnueabihf , features: feat_os_unix_gnueabihf , use-cross: use-cross , skip-tests: true }
           - { os: ubuntu-24.04-arm  , target: aarch64-unknown-linux-gnu   , features: feat_os_unix_gnueabihf, pgo: PGO }
-          - { os: ubuntu-latest  , target: aarch64-unknown-linux-musl  , features: feat_os_unix_musl , use-cross: use-cross , skip-tests: true }
-          - { os: ubuntu-latest  , target: riscv64gc-unknown-linux-musl  , features: feat_os_unix_musl , use-cross: use-cross , skip-tests: true }
-          # - { os: ubuntu-latest  , target: x86_64-unknown-linux-gnu    , features: feat_selinux           , use-cross: use-cross }
-          - { os: ubuntu-latest  , target: i686-unknown-linux-gnu      , features: "feat_os_unix,test_risky_names", use-cross: use-cross }
-          - { os: ubuntu-latest  , target: i686-unknown-linux-musl     , features: feat_os_unix_musl , use-cross: use-cross }
-          - { os: ubuntu-latest  , target: x86_64-unknown-linux-gnu    , features: "feat_os_unix,test_risky_names", use-cross: use-cross, skip-publish: true }
-          - { os: ubuntu-latest  , target: x86_64-unknown-linux-gnu    , features: "feat_os_unix,openssl,uudoc"   , use-cross: no, workspace-tests: true, pgo: PGO }
-          - { os: ubuntu-latest  , target: x86_64-unknown-linux-musl   , features: feat_os_unix_musl , use-cross: use-cross }
-          - { os: ubuntu-latest  , target: x86_64-unknown-netbsd, features: "feat_os_unix", use-cross: use-cross , skip-tests: true , check-only: true }
-          # - { os: ubuntu-latest  , target: x86_64-unknown-redox        , features: feat_os_unix_redox     , use-cross: redoxer , skip-tests: true , check-only: true }
-          - { os: ubuntu-latest  , target: wasm32-wasip1, default-features: false, features: feat_wasm, skip-tests: true }
-          - { os: ubuntu-latest  , target: wasm32-wasip2, default-features: false, features: feat_wasm, skip-tests: true }
+          - { os: ubuntu-24.04  , target: aarch64-unknown-linux-musl  , features: feat_os_unix_musl , use-cross: use-cross , skip-tests: true }
+          - { os: ubuntu-24.04  , target: riscv64gc-unknown-linux-musl  , features: feat_os_unix_musl , use-cross: use-cross , skip-tests: true }
+          # - { os: ubuntu-24.04  , target: x86_64-unknown-linux-gnu    , features: feat_selinux           , use-cross: use-cross }
+          - { os: ubuntu-24.04  , target: i686-unknown-linux-gnu      , features: "feat_os_unix,test_risky_names", use-cross: use-cross }
+          - { os: ubuntu-24.04  , target: i686-unknown-linux-musl     , features: feat_os_unix_musl , use-cross: use-cross }
+          - { os: ubuntu-24.04  , target: x86_64-unknown-linux-gnu    , features: "feat_os_unix,test_risky_names", use-cross: use-cross, skip-publish: true }
+          - { os: ubuntu-24.04  , target: x86_64-unknown-linux-gnu    , features: "feat_os_unix,openssl,uudoc"   , use-cross: no, workspace-tests: true, pgo: PGO }
+          - { os: ubuntu-24.04  , target: x86_64-unknown-linux-musl   , features: feat_os_unix_musl , use-cross: use-cross }
+          - { os: ubuntu-24.04  , target: x86_64-unknown-netbsd, features: "feat_os_unix", use-cross: use-cross , skip-tests: true , check-only: true }
+          # - { os: ubuntu-24.04  , target: x86_64-unknown-redox        , features: feat_os_unix_redox     , use-cross: redoxer , skip-tests: true , check-only: true }
+          - { os: ubuntu-24.04  , target: wasm32-wasip1, default-features: false, features: feat_wasm, skip-tests: true }
+          - { os: ubuntu-24.04  , target: wasm32-wasip2, default-features: false, features: feat_wasm, skip-tests: true }
           - { os: macos-latest   , target: aarch64-apple-darwin        , features: "feat_os_unix,openssl", workspace-tests: true, pgo: PGO } # M1 CPU
           - { os: macos-latest   , target: x86_64-apple-darwin         , features: feat_os_unix, workspace-tests: true, pgo: PGO }
           - { os: windows-latest , target: i686-pc-windows-msvc        , features: feat_os_windows }
@@ -747,7 +747,7 @@ jobs:
       fail-fast: false
       matrix:
         job:
-          - { os: ubuntu-latest  , features: unix }
+          - { os: ubuntu-24.04  , features: unix }
           # FIXME: Re-enable macos code coverage
           # - { os: macos-latest   , features: macos }
           # FIXME: Re-enable Code Coverage on windows, which currently fails due to "profiler_builtins". See #6686.
@@ -803,7 +803,7 @@ jobs:
       run: |
         ## Install/setup prerequisites
         case '${{ matrix.job.os }}' in
-          ubuntu-latest)
+          ubuntu-24.04)
             # selinux and systemd headers needed to build tests
             # acl: setfacl for coverage profile-trace dir default ACL (umask 0777 tests)
             sudo apt-get -y update
@@ -873,9 +873,9 @@ jobs:
       fail-fast: false
       matrix:
         job:
-          # Linux: exercises OPENSSL_NO_VENDOR=1 (dynamic against system libcrypto). ubuntu-latest ships libssl-dev
+          # Linux: exercises OPENSSL_NO_VENDOR=1 (dynamic against system libcrypto). ubuntu-24.04 ships libssl-dev
           # binaries with OPENSSL_NO_VENDOR=0 are tested and published at build job
-          - { os: ubuntu-latest, features: "md5sum,sha1sum,sha224sum,sha256sum,sha384sum,sha512sum,cksum,openssl" }
+          - { os: ubuntu-24.04, features: "md5sum,sha1sum,sha224sum,sha256sum,sha384sum,sha512sum,cksum,openssl" }
           # macOS: vendored only — system libcrypto needs OPENSSL_DIR
           # pointing at Homebrew, which isn't worth wiring up for a smoke test.
           # MinGW(UCRT): done at make.yml as actual consumer is MSYS2 only
@@ -906,7 +906,7 @@ jobs:
   test_no_diagnostics:
     name: Build/No-diagnostics
     needs: [ min_version, deps ]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
     - uses: actions/checkout@v7
@@ -949,7 +949,7 @@ jobs:
   test_selinux:
     name: Build/SELinux
     needs: [ min_version, deps ]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@v7.0.1
       with:
@@ -981,7 +981,7 @@ jobs:
 
   test_safe_traversal:
     name: Safe Traversal Security Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [ min_version, deps ]
 
     steps:
@@ -998,7 +998,7 @@ jobs:
 
   test_libc_interposition:
     name: libc Interposition Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [ min_version, deps ]
 
     steps:
@@ -1015,7 +1015,7 @@ jobs:
 
   test_open_once:
     name: Redundant Open Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [ min_version, deps ]
 
     steps:
@@ -1032,7 +1032,7 @@ jobs:
 
   test_toctou:
     name: TOCTOU Security Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [ min_version, deps ]
 
     steps:

.github/workflows/CheckScripts.yml

@@ -25,7 +25,7 @@ concurrency:
 jobs:
   shell_check:
     name: ShellScript/Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:
@@ -43,7 +43,7 @@ jobs:
 
   shell_fmt:
     name: ShellScript/Format
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:

.github/workflows/FixPR.yml

@@ -27,7 +27,7 @@ jobs:
     strategy:
       matrix:
         job:
-          - { os: ubuntu-latest , features: feat_os_unix }
+          - { os: ubuntu-24.04 , features: feat_os_unix }
     steps:
     - uses: actions/checkout@v7.0.1
       with:

.github/workflows/GnuComment.yml

@@ -15,7 +15,7 @@ jobs:
       actions: read  #  to list workflow runs artifacts
       pull-requests: write  #  to comment on pr
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: >
       github.event.workflow_run.event == 'pull_request' &&
       (github.event.workflow_run.conclusion == 'success' ||

.github/workflows/GnuTests.yml

@@ -180,7 +180,7 @@ jobs:
 
   selinux:
     name: Run GNU tests (SELinux)
-    runs-on: ubuntu-latest # using VM's glibc
+    runs-on: ubuntu-24.04 # using VM's glibc
     steps:
     #### Get the code
     - name: Checkout code (uutils)
@@ -291,7 +291,7 @@ jobs:
 
   qemu:
     name: Run GNU tests (SMACK/ROOTFS)
-    runs-on: ubuntu-latest # using Arch glibc
+    runs-on: ubuntu-24.04 # using Arch glibc
     steps:
     - name: Checkout code (uutils)
       uses: actions/checkout@v7.0.1
@@ -335,7 +335,7 @@ jobs:
       actions: read  # to download this run's own result artifacts
       contents: read  # for actions/checkout to fetch code, and to read the reference branch
     name: Aggregate GNU test results
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Initialize workflow variables
       id: vars
@@ -605,7 +605,7 @@ jobs:
       actions: read  # to download this run's own result artifacts
       contents: write  # to push to the reference branch
     name: Publish reference GNU test results
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     ## Only one run may publish at a time.  The step below reads the currently
     ## published run id and then force-pushes; two overlapping runs could
     ## interleave those, letting an older one overwrite a newer reference.

.github/workflows/NotifyTracking.yml

@@ -36,7 +36,7 @@ jobs:
       && github.event.workflow_run.head_branch == github.event.repository.default_branch
       && github.event.workflow_run.conclusion != 'cancelled'
       && github.event.workflow_run.conclusion != 'skipped'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     ## The 'secrets' context is not available in a step's 'if:', so fold the
     ## check into a job-level env var, which is.
     env:

.github/workflows/SizeComment.yml

@@ -15,7 +15,7 @@ jobs:
       actions: read  #  to list workflow runs artifacts
       pull-requests: write  #  to comment on pr
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: >
       github.event.workflow_run.event == 'pull_request'
     steps:

.github/workflows/android.yml

@@ -34,7 +34,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest] # , macos-latest
+        os: [ubuntu-24.04] # , macos-latest
         cores: [4] # , 6
         ram: [4096]
         api-level: [28]

.github/workflows/audit.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   audit:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7.0.1
         with:

.github/workflows/benchmarks.yml

@@ -27,7 +27,7 @@ concurrency:
 jobs:
   detects-benchmarks:
     name: Detect changes on crates
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       package: ${{ steps.detect.outputs.package }}
     steps:
@@ -67,7 +67,7 @@ jobs:
     needs: detects-benchmarks
     if: needs.detects-benchmarks.outputs.package != '[]'
     name: Run ${{ matrix.type }} benchmarks for ${{ matrix.package }} (CodSpeed)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
     env:
       CARGO_INCREMENTAL: 0

.github/workflows/check-toml.yml

@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7.0.1
         with:

.github/workflows/code-quality.yml

@@ -31,7 +31,7 @@ jobs:
       fail-fast: false
       matrix:
         job:
-          - { os: ubuntu-latest , features: feat_os_unix }
+          - { os: ubuntu-24.04 , features: feat_os_unix }
     steps:
     - uses: actions/checkout@v7.0.1
       with:
@@ -71,11 +71,11 @@ jobs:
       fail-fast: false
       matrix:
         job:
-          - { os: ubuntu-latest  , features: all             , workspace: true }
+          - { os: ubuntu-24.04  , features: all             , workspace: true }
           - { os: macos-latest   , features: all             , workspace: true }
           - { os: windows-latest , features: feat_os_windows }
-          - { os: ubuntu-latest  , features: feat_wasm , target: wasm32-wasip1 }
-          - { os: ubuntu-latest  , features: feat_wasm , target: wasm32-wasip2 }
+          - { os: ubuntu-24.04  , features: feat_wasm , target: wasm32-wasip1 }
+          - { os: ubuntu-24.04  , features: feat_wasm , target: wasm32-wasip2 }
     steps:
     - uses: actions/checkout@v7.0.1
       with:
@@ -158,7 +158,7 @@ jobs:
     strategy:
       matrix:
         job:
-          - { os: ubuntu-latest , features: feat_os_unix }
+          - { os: ubuntu-24.04 , features: feat_os_unix }
     steps:
     - uses: actions/checkout@v7.0.1
       with:
@@ -195,7 +195,7 @@ jobs:
 
   style_empty_assertions:
     name: Style/Empty assertions check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7.0.1
@@ -211,7 +211,7 @@ jobs:
 
   python:
     name: Style/Python
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Clone repository
         uses: actions/checkout@v7.0.1
@@ -235,7 +235,7 @@ jobs:
 
   pre_commit:
     name: Pre-commit hooks
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7.0.1

.github/workflows/copilot-code-review.yml

@@ -15,7 +15,7 @@ permissions:
 jobs:
   copilot-setup-steps:
     # Copilot code review only supports Ubuntu x64 runners.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7.0.1
         with:

.github/workflows/devcontainer.yml

@@ -19,7 +19,7 @@ concurrency:
 jobs:
   test:
     name: Verify devcontainer
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
     - uses: actions/checkout@v7.0.1