workflows: pin runner to ubuntu-24.04

Pin workflow runners to ubuntu-24.04 to avoid deprecation warnings and
breaking changes when ubuntu-latest migrates to Ubuntu 26.

Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>

.github/workflows/buf-breaking.yml

@@ -20,7 +20,7 @@ jobs:
   breaking:
     name: Detect breaking API changes
     if: ${{ !github.event.repository.private }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
     steps:

.github/workflows/build-test-images.yml

@@ -33,7 +33,7 @@ jobs:
     permissions:
       packages: write
     name: "Build volume test images"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
 
     defaults:

.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
 
     strategy:
       matrix:
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+        os: [ubuntu-24.04, ubuntu-24.04-arm, macos-latest, windows-latest]
         exclude:
           - os: ${{ github.event.repository.private && 'ubuntu-24.04-arm' || '' }}
           - os: ${{ github.event.repository.private && 'macos-latest' || '' }}
@@ -52,7 +52,7 @@ jobs:
   #
   project:
     name: Project Checks
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
 
     steps:
@@ -85,7 +85,7 @@ jobs:
   #
   protos:
     name: Protobuf
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
 
     defaults:
@@ -111,7 +111,7 @@ jobs:
 
   man:
     name: Manpages
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
 
     steps:
@@ -127,7 +127,7 @@ jobs:
   crossbuild:
     name: Crossbuild Binaries
     needs: [project, linters, protos, man]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     strategy:
       fail-fast: false
@@ -205,7 +205,7 @@ jobs:
 
     strategy:
       matrix:
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+        os: [ubuntu-24.04, ubuntu-24.04-arm, macos-latest, windows-latest]
         go-version: ["1.27.2"] # 1.26 is not supported due to k8s 1.38 requiring 1.27
         exclude:
           - os: ${{ github.event.repository.private && 'ubuntu-24.04-arm' || '' }}
@@ -600,7 +600,7 @@ jobs:
   integration-vm:
     name: VM integration
     if: github.event_name != 'merge_group'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     needs: [project, linters, protos, man]
 
@@ -689,7 +689,7 @@ jobs:
   tests-cri-in-userns:
     name: "CRI-in-UserNS"
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 40
     needs: [project, linters, protos, man]
 
@@ -787,7 +787,7 @@ jobs:
   # See https://github.com/orgs/community/discussions/26822
   results:
     name: Report required job statuses
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # List job dependencies which are required to pass status checks in order to be merged via merge queue.
     needs: [linters, project, protos, binaries, integration-linux, integration-windows, tests-cri-in-userns, tests-mac-os, node-e2e]
     if: ${{ always() }}

.github/workflows/codeql.yml

@@ -23,8 +23,8 @@ jobs:
     strategy:
       fail-fast: false
 
-    # CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
-    runs-on: ubuntu-latest
+    # CodeQL runs on ubuntu-24.04, windows-latest, and macos-latest
+    runs-on: ubuntu-24.04
 
     timeout-minutes: 30
 

.github/workflows/fuzz.yml

@@ -9,7 +9,7 @@ jobs:
   ci_fuzz:
     name: CI Fuzz
     if: github.repository == 'containerd/containerd'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
     - name: Build Fuzzers
@@ -37,7 +37,7 @@ jobs:
   go_test_fuzz:
     name : go test -fuzz
     if: github.repository == 'containerd/containerd'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/images.yml

@@ -15,7 +15,7 @@ permissions: # added using https://github.com/step-security/secure-workflows
 jobs:
   mirror:
     name: "Mirror Image"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
 
     permissions:

.github/workflows/nightly.yml

@@ -13,7 +13,7 @@ jobs:
   linux:
     name: Linux
     if: github.repository == 'containerd/containerd' || (github.event_name == 'pull_request' && !github.event.repository.private)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
 
     defaults:

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
   check:
     name: Check Signed Tag
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && !github.event.repository.private
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     outputs:
       stringver: ${{ steps.contentrel.outputs.stringver }}
@@ -66,7 +66,7 @@ jobs:
   build:
     name: Build Release Binaries
     if: ${{ !github.event.repository.private }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     strategy:
       matrix:
@@ -139,7 +139,7 @@ jobs:
       contents: write
       id-token: write
       attestations: write
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     needs: [build, check]
     steps:

.github/workflows/scorecards.yml

@@ -15,7 +15,7 @@ jobs:
   analysis:
     name: Scorecards analysis
     if: github.repository == 'containerd/containerd'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       # Needed to upload the results to code-scanning dashboard.
       security-events: write

.github/workflows/stale.yml

@@ -13,7 +13,7 @@ jobs:
   stale:
     # Prevents triggering on forks or other repos
     if: github.repository == 'containerd/containerd'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     permissions:
       issues: write

.github/workflows/windows-hyperv-periodic.yml

@@ -42,7 +42,7 @@ jobs:
         - win_ver: ltsc2022
           AZURE_IMG: "MicrosoftWindowsServer:WindowsServer:2022-datacenter-smalldisk-g2:latest"
           AZURE_RESOURCE_GROUP: ctrd-integration-ltsc2022-${{ github.run_id }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/windows-periodic.yml

@@ -41,7 +41,7 @@ jobs:
         - win_ver: ltsc2022
           AZURE_IMG: "MicrosoftWindowsServer:WindowsServer:2022-datacenter-smalldisk-g2:latest"
           AZURE_RESOURCE_GROUP: ctrd-integration-ltsc2022-${{ github.run_id }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1