Skip to content

ci: pin ubuntu-latest jobs to ubuntu-24.04 - #205

Merged
nelsonduarte merged 1 commit into
mainfrom
ci/pin-ubuntu-24.04
Oct 16, 2026
Merged

nelsonduarte merged 1 commit into
mainfrom
ci/pin-ubuntu-24.04

Conversation

@nelsonduarte

Copy link
Copy Markdown
Owner

Why

GitHub starts migrating the ubuntu-latest label to Ubuntu 26 on 2026-10-19, with the rollout running until 2026-11-19 (actions/runner-images#14748, also annotated on our runs). During the rollout each run can land on a different image. Pinning means the image changes when we choose to move it, not mid-rollout.

The logs of recent runs show all of the jobs below already run on ubuntu-24.04, so there is no behaviour change today.

Jobs pinned to ubuntu-24.04 (8)

Workflow Job
tests.yml pytest
codeql.yml analyze
security-deps.yml audit
release.yml bump-and-tag
build.yml release
publish.yml resolve, aur, copr

Unchanged: the jobs already pinned to ubuntu-22.04 (appimage, snap and the Linux entry of the build matrix) and the windows-latest winget job. The required check context, pytest (Ubuntu, Python 3.14), is unchanged. The docstring of tests/test_ocr_tessdata.py now names ubuntu-24.04.

When to revert

Move these jobs to ubuntu-26.04 once each one has been validated there, in particular the "Install Qt system deps" step of tests.yml and the jobs that use the image's own python (release in build.yml, bump-and-tag in release.yml, aur in publish.yml).

Verification

  • The parsed YAML tree differs from the base only in the 8 runs-on keys.
  • actionlint 1.7.12 reports nothing on the 6 workflows.
  • pip-audit --strict passes on both requirements files on Linux, on 2026-10-16.
  • The full test suite gives the same result with and without the change, on Windows and on Linux.

🤖 Generated with Claude Code

GitHub starts migrating the ubuntu-latest label to Ubuntu 26 on
2026-10-19, with the rollout running until 2026-11-19 (source:
actions/runner-images#14748 and the annotation on our runs). Pinning
the image means it changes when we choose, not in the middle of a
rollout where each run can land on a different image.

Pinned jobs (8):
- tests: pytest
- codeql: analyze
- security-deps: audit
- release: bump-and-tag
- build: release
- publish: resolve, aur, copr

The logs of recent runs show all of these jobs already run on
ubuntu-24.04, so there is no behaviour change today.

Unchanged: the jobs already pinned to ubuntu-22.04 (appimage, snap and
the Linux entry of the build matrix) and the windows-latest winget job.
The required check context, "pytest (Ubuntu, Python 3.14)", is
unchanged.

The docstring of tests/test_ocr_tessdata.py now names ubuntu-24.04
instead of ubuntu-latest.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying pdfapps with  Cloudflare Pages  Cloudflare Pages

Latest commit: cc3500b
Status: ✅  Deploy successful!
Preview URL: https://56c31655.pdfapps.pages.dev
Branch Preview URL: https://ci-pin-ubuntu-24-04.pdfapps.pages.dev

View logs

@github-actions

Copy link
Copy Markdown
Contributor

Python dependencies security check

pip-audit: requirements.txt

No known vulnerabilities.

pip-audit: flatpak/requirements-pinned.txt

No known vulnerabilities.

Outdated check (informational)

Package Pin Latest on PyPI Status
PySide6 PySide6>=6.11.1,<6.12 6.12.0 outdated
pypdf pypdf>=6.19.0 6.21.0 outdated
cryptography cryptography>=50.0.1 50.0.2 outdated
qtawesome qtawesome>=1.4.2 1.4.2 up-to-date
pillow pillow>=12.3.0 12.3.0 up-to-date
pymupdf pymupdf>=1.28.0 1.28.2 outdated
pytesseract pytesseract>=0.3.13 0.3.13 up-to-date
python-docx python-docx>=1.2.0 1.2.0 up-to-date
python-pptx python-pptx>=1.0.2 1.0.2 up-to-date
openpyxl openpyxl>=3.1.5 3.1.5 up-to-date
beautifulsoup4 beautifulsoup4>=4.15.0 4.15.0 up-to-date
ebooklib ebooklib>=0.20 0.20 up-to-date
lxml lxml>=6.1.3 6.1.3 up-to-date
urllib3 urllib3>=2.8.0 2.8.0 up-to-date
idna idna>=3.18 3.20 outdated
pyinstaller pyinstaller>=6.22.3 6.22.3 up-to-date

Auto-generated by security-deps workflow. Merge is blocked only when pip-audit --strict reports vulnerabilities.

@nelsonduarte
nelsonduarte merged commit 11b9bdb into main Oct 16, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant