From 9609088c3b180de2f97ac84a3eeebc5aaa192ed4 Mon Sep 17 00:00:00 2001
From: kingchenc <kingchencp@gmail.com>
Date: Wed, 7 Oct 2026 19:58:40 +0200
Subject: [PATCH] ci: canary run on ubuntu-26.04 (do not merge)

Every ubuntu-latest in the workflows reads ubuntu-26.04, to run this repository's CI on the image ubuntu-latest moves to from 2026-10-19. A canary: not to be merged.
---
 .github/workflows/actionlint.yml    |  2 +-
 .github/workflows/bench.yml         |  2 +-
 .github/workflows/ci.yml            | 52 ++++++++++++++---------------
 .github/workflows/codeql.yml        |  2 +-
 .github/workflows/codspeed.yml      |  2 +-
 .github/workflows/follow-family.yml |  2 +-
 .github/workflows/links.yml         |  2 +-
 .github/workflows/release.yml       | 42 +++++++++++------------
 .github/workflows/scorecard.yml     |  2 +-
 .github/workflows/sync-metadata.yml |  2 +-
 .github/workflows/web-deploy.yml    |  2 +-
 .github/workflows/zizmor.yml        |  2 +-
 12 files changed, 57 insertions(+), 57 deletions(-)

diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 617a61a..ef10347 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -27,7 +27,7 @@ env:
 jobs:
   actionlint:
     name: Lint workflows
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     steps:
       - name: Checkout
diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index 6ced1bb..bdc4649 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -21,7 +21,7 @@ env:
 jobs:
   bench:
     name: Criterion benchmark
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 544c8b3..405a083 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-26.04, windows-latest, macos-latest]
         features: ["--all-features", "--no-default-features"]
     runs-on: ${{ matrix.os }}
     # The xray-cli binary (wickra-xray) and the C ABI cdylib
@@ -43,7 +43,7 @@ jobs:
   lint:
     timeout-minutes: 30
     name: Format & Clippy
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -59,7 +59,7 @@ jobs:
   msrv:
     timeout-minutes: 30
     name: MSRV workspace (1.86)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -79,7 +79,7 @@ jobs:
   msrv-node:
     timeout-minutes: 30
     name: MSRV node (1.88)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -93,7 +93,7 @@ jobs:
   supply-chain:
     timeout-minutes: 20
     name: cargo-deny
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -105,7 +105,7 @@ jobs:
 
   osv:
     name: osv-scanner
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     permissions:
       contents: read
@@ -129,7 +129,7 @@ jobs:
   # `failure`, the commit shows red and a release gate reading check runs stops.
   links:
     name: Links (advisory)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -160,7 +160,7 @@ jobs:
   # published package.
   binding-surface:
     name: Binding surface parity
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10 # static checks; if they are not done in ten minutes they are stuck
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -200,7 +200,7 @@ jobs:
 
   semver:
     name: Public API (cargo-semver-checks)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30 # backstop: it builds rustdoc JSON for each crate and its baseline
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -259,7 +259,7 @@ jobs:
   coverage:
     timeout-minutes: 30
     name: Coverage
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -294,7 +294,7 @@ jobs:
   fuzz-smoke:
     timeout-minutes: 25
     name: Fuzz (smoke)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -337,7 +337,7 @@ jobs:
   # parse-checked here instead of executed.
   examples:
     name: Examples
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 40
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -496,13 +496,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-26.04, windows-latest, macos-latest]
         python-version: ["3.9", "3.11", "3.12", "3.13"]
-        # GitHub builds no Python 3.9 for Ubuntu 26.04, the image ubuntu-latest
+        # GitHub builds no Python 3.9 for Ubuntu 26.04, the image ubuntu-26.04
         # moves to from 2026-10-19 (3.9 is end-of-life), so the floor's Linux
-        # cell runs on ubuntu-24.04; the other cells follow ubuntu-latest.
+        # cell runs on ubuntu-24.04; the other cells follow ubuntu-26.04.
         exclude:
-          - os: ubuntu-latest
+          - os: ubuntu-26.04
             python-version: "3.9"
         include:
           - os: ubuntu-24.04
@@ -547,7 +547,7 @@ jobs:
 
   python-wheel-container-smoke:
     name: Python wheel (${{ matrix.manylinux }} smoke)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -596,7 +596,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-26.04, macos-latest, windows-latest]
         node-version: ["22", "24"]
     runs-on: ${{ matrix.os }}
     steps:
@@ -659,7 +659,7 @@ jobs:
   wasm:
     timeout-minutes: 25
     name: WASM
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -712,7 +712,7 @@ jobs:
   web:
     timeout-minutes: 30
     name: Web renderer
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -742,7 +742,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-26.04, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -781,7 +781,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-26.04, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -839,7 +839,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-26.04, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -863,7 +863,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-26.04, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -888,7 +888,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-26.04, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     env:
       WKXRAY_INC: ${{ github.workspace }}/bindings/c/include
@@ -957,7 +957,7 @@ jobs:
       - csharp
       - java
       - r
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions: {}
     steps:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0718882..8192c81 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,7 +23,7 @@ permissions:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30  # backstop against a hung job, not a budget
     permissions:
       security-events: write # upload CodeQL results to code-scanning
diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml
index 571149c..ad764c4 100644
--- a/.github/workflows/codspeed.yml
+++ b/.github/workflows/codspeed.yml
@@ -39,7 +39,7 @@ jobs:
   benchmarks:
     name: Instruction counts
     # CodSpeed ships valgrind for Ubuntu 22.04/24.04 only ("Unsupported system" on
-    # 26.04, CodSpeedHQ/runner#544), so this job stays off ubuntu-latest until then.
+    # 26.04, CodSpeedHQ/runner#544), so this job stays off ubuntu-26.04 until then.
     runs-on: ubuntu-24.04
     timeout-minutes: 30 # backstop: instrumentation is far slower per iteration than a plain run
     permissions:
diff --git a/.github/workflows/follow-family.yml b/.github/workflows/follow-family.yml
index 08af549..effe9d6 100644
--- a/.github/workflows/follow-family.yml
+++ b/.github/workflows/follow-family.yml
@@ -23,7 +23,7 @@ concurrency:
 jobs:
   follow:
     name: Follow family releases
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml
index a53358e..a92d862 100644
--- a/.github/workflows/links.yml
+++ b/.github/workflows/links.yml
@@ -17,7 +17,7 @@ permissions:
 jobs:
   links:
     name: External links (lychee)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 20  # backstop against a hung job, not a budget
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ddee804..c9b5eb5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,7 +41,7 @@ jobs:
   gate:
     name: Nothing publishes before this
     needs: [python-wheels, python-sdist, node-build, cli-binaries, c-abi-build, wasm-build]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     # Generous because this job waits for ci.yml to settle on the tagged commit;
     # the wait itself is bounded to 45 minutes inside the step.
     timeout-minutes: 60
@@ -128,7 +128,7 @@ jobs:
   # name a tag.
   guard:
     name: Refuse to publish from anything but a tag
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       - name: Check the ref
@@ -153,7 +153,7 @@ jobs:
     name: Publish to crates.io
     needs: [gate, guard]
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: release
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -236,10 +236,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - { os: ubuntu-latest, target: x86_64, manylinux: auto }
-          - { os: ubuntu-latest, target: aarch64, manylinux: auto }
-          - { os: ubuntu-latest, target: x86_64, manylinux: musllinux_1_2 }
-          - { os: ubuntu-latest, target: aarch64, manylinux: musllinux_1_2 }
+          - { os: ubuntu-26.04, target: x86_64, manylinux: auto }
+          - { os: ubuntu-26.04, target: aarch64, manylinux: auto }
+          - { os: ubuntu-26.04, target: x86_64, manylinux: musllinux_1_2 }
+          - { os: ubuntu-26.04, target: aarch64, manylinux: musllinux_1_2 }
           - { os: macos-latest, target: x86_64, manylinux: auto }
           - { os: macos-latest, target: aarch64, manylinux: auto }
           - { os: windows-latest, target: x64, manylinux: auto }
@@ -287,7 +287,7 @@ jobs:
     needs: guard
     name: Build Python sdist
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -306,7 +306,7 @@ jobs:
     name: Publish to PyPI
     timeout-minutes: 45
     needs: [gate, python-wheels, python-sdist]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: release
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -333,7 +333,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - { host: ubuntu-latest, target: x86_64-unknown-linux-gnu }
+          - { host: ubuntu-26.04, target: x86_64-unknown-linux-gnu }
           - { host: ubuntu-24.04-arm, target: aarch64-unknown-linux-gnu }
           - { host: macos-latest, target: x86_64-apple-darwin }
           - { host: macos-latest, target: aarch64-apple-darwin }
@@ -371,7 +371,7 @@ jobs:
     name: Publish to npm
     timeout-minutes: 45
     needs: [gate, node-build]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: release
     permissions:
       contents: read
@@ -502,7 +502,7 @@ jobs:
     name: Build wickra-xray-wasm
     needs: guard
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
@@ -549,7 +549,7 @@ jobs:
     name: Publish wickra-xray-wasm to npm
     needs: [gate, wasm-build]
     timeout-minutes: 20
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: release
     permissions:
       contents: read
@@ -600,7 +600,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - { host: ubuntu-latest, target: x86_64-unknown-linux-gnu }
+          - { host: ubuntu-26.04, target: x86_64-unknown-linux-gnu }
           - { host: ubuntu-24.04-arm, target: aarch64-unknown-linux-gnu }
           - { host: macos-latest, target: x86_64-apple-darwin }
           - { host: macos-latest, target: aarch64-apple-darwin }
@@ -650,7 +650,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - { host: ubuntu-latest, target: x86_64-unknown-linux-gnu }
+          - { host: ubuntu-26.04, target: x86_64-unknown-linux-gnu }
           - { host: ubuntu-24.04-arm, target: aarch64-unknown-linux-gnu }
           - { host: macos-latest, target: x86_64-apple-darwin }
           - { host: macos-latest, target: aarch64-apple-darwin }
@@ -695,7 +695,7 @@ jobs:
     name: Publish to NuGet
     timeout-minutes: 45
     needs: [gate, c-abi-build]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: release
     permissions:
       contents: read
@@ -772,7 +772,7 @@ jobs:
     name: Publish to Maven Central
     timeout-minutes: 45
     needs: [gate, c-abi-build]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: release
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -876,7 +876,7 @@ jobs:
     name: Mirror the Go module to wickra-xray-go
     timeout-minutes: 45
     needs: [gate, c-abi-build]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -990,7 +990,7 @@ jobs:
         java-publish,
         go-mirror,
       ]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
     outputs:
@@ -1104,7 +1104,7 @@ jobs:
         java-publish,
         github-release,
       ]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       id-token: write
       attestations: write
@@ -1178,7 +1178,7 @@ jobs:
     timeout-minutes: 45
     needs: [github-release, attestations]
     if: always() && needs.github-release.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
     steps:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index fcd808e..f538ffa 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -18,7 +18,7 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecard analysis
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 20  # backstop against a hung job, not a budget
     permissions:
       security-events: write # upload the SARIF result to code-scanning
diff --git a/.github/workflows/sync-metadata.yml b/.github/workflows/sync-metadata.yml
index c82bd2a..e4400db 100644
--- a/.github/workflows/sync-metadata.yml
+++ b/.github/workflows/sync-metadata.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   audit:
     name: metadata audit
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10  # backstop against a hung job, not a budget
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/web-deploy.yml b/.github/workflows/web-deploy.yml
index c777229..5c44348 100644
--- a/.github/workflows/web-deploy.yml
+++ b/.github/workflows/web-deploy.yml
@@ -33,7 +33,7 @@ jobs:
   deploy:
     name: Build + deploy the web renderer
     timeout-minutes: 30
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write # the signed commit to the pages branch
     steps:
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 9f44c60..e303a3d 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -25,7 +25,7 @@ permissions:
 jobs:
   zizmor:
     name: Audit workflows
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10  # backstop against a hung job, not a budget
     permissions:
       security-events: write # upload SARIF to code-scanning