Migrate all CI workflows to databricks-protected-runner-group

Replace `runs-on: ubuntu-latest` with the databricks-protected-runner-group
across all 5 workflow files (9 jobs total) to run CI on organization-managed
protected runners instead of GitHub-hosted public runners.

Co-authored-by: Isaac

Author: jprakash-db

.github/workflows/code-coverage.yml

@@ -7,7 +7,9 @@ on: [pull_request, workflow_dispatch]
 
 jobs:
   test-with-coverage:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
     environment: azure-prod
     env:
       DATABRICKS_SERVER_HOSTNAME: ${{ secrets.DATABRICKS_HOST }}

.github/workflows/code-quality-checks.yml

@@ -7,7 +7,9 @@ permissions:
 
 jobs:
   run-unit-tests:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
     strategy:
       matrix:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
@@ -92,7 +94,9 @@ jobs:
       - name: Run tests
         run: poetry run python -m pytest tests/unit
   run-unit-tests-with-arrow:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
     strategy:
       matrix:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
@@ -179,7 +183,9 @@ jobs:
       -   name: Run tests
           run: poetry run python -m pytest tests/unit
   check-linting:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
     strategy:
       matrix:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
@@ -232,7 +238,9 @@ jobs:
         run: poetry run black --check src
 
   check-types:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
     strategy:
       matrix:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]

.github/workflows/daily-telemetry-e2e.yml

@@ -17,7 +17,9 @@ permissions:
 
 jobs:
   telemetry-e2e-tests:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
     environment: azure-prod
 
     env:

.github/workflows/dco-check.yml

@@ -8,7 +8,9 @@ permissions:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
     steps:
       - name: Check for DCO
         id: dco-check

.github/workflows/integration.yml

@@ -11,7 +11,9 @@ permissions:
 
 jobs:
   run-non-telemetry-tests:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
     environment: azure-prod
     env:
       DATABRICKS_SERVER_HOSTNAME: ${{ secrets.DATABRICKS_HOST }}
@@ -71,7 +73,9 @@ jobs:
             -n auto
 
   run-telemetry-tests:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
     needs: run-non-telemetry-tests  # Run after non-telemetry tests complete
     environment: azure-prod
     env: