chore: pin Ubuntu CI runners to 26.04

Author: BartWaardenburg

.github/actionlint.yaml

@@ -0,0 +1,4 @@
+# GitHub-hosted Ubuntu 26.04 is ahead of actionlint 1.7.12's runner catalog.
+self-hosted-runner:
+  labels:
+    - ubuntu-26.04

.github/workflows/ci.yml

@@ -8,7 +8,7 @@ permissions:
   contents: read
 jobs:
   verify:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     strategy:
       matrix:
@@ -38,7 +38,7 @@ jobs:
 
   workflows:
     name: Workflow syntax and security
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

.github/workflows/release-published.yml

@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   verify:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     steps:
       - name: Check release tag before checkout

.github/workflows/release.yml

@@ -24,7 +24,7 @@ env:
 
 jobs:
   context:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
       contents: read
@@ -59,7 +59,7 @@ jobs:
 
   prepare:
     needs: validation
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     permissions:
       contents: read
@@ -95,7 +95,7 @@ jobs:
   stage:
     if: ${{ !inputs.dry_run }}
     needs: prepare
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     environment: release
     permissions:
@@ -149,7 +149,7 @@ jobs:
 
   public-package:
     needs: [prepare, stage]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 40
     permissions:
       contents: read

docs/ci.md

@@ -7,7 +7,7 @@ permissions:
   contents: read
 jobs:
   verdicts:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v4
         with: