From 7b07460e6a0c2e135c72986b7bdba5858ffc76d3 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 24 Jul 2026 15:33:08 +0000
Subject: [PATCH] ci: Pin GitHub Actions runners to versioned OS labels

Floating `-latest` labels can silently change OS versions and break CI.
Pin to the current GA equivalents from actions/runner-images:
`ubuntu-24.04`, `macos-15`, and `windows-2025`.

Closes [#936](https://github.com/getsentry/sentry-rust/issues/936)
Closes [RUST-125](https://linear.app/getsentry/issue/RUST-125/pin-github-runners)

Co-authored-by: Daniel Szoke <szokeasaurusrex@users.noreply.github.com>
---
 .github/workflows/check.yml   | 4 ++--
 .github/workflows/ci.yml      | 4 ++--
 .github/workflows/danger.yml  | 2 +-
 .github/workflows/doc.yml     | 2 +-
 .github/workflows/lint.yml    | 2 +-
 .github/workflows/release.yml | 2 +-
 .github/workflows/test.yml    | 2 +-
 .github/workflows/weekly.yml  | 4 ++--
 8 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 887ffab95..cf9eb83b3 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -11,7 +11,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-24.04, macos-15, windows-2025]
         rust: [stable, 1.88.0]
 
     name: Check compile errors using Rust ${{ matrix.rust }} on ${{ matrix.os }}
@@ -57,7 +57,7 @@ jobs:
   embedded-esp-idf-check:
     # This checks the `sentry-core` and `sentry` crates on ESP-IDF.
     name: Check ESP-IDF compile errors
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout sources
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c89e5a172..d8a1bcbbb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
 
   codecov:
     name: Code Coverage
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -53,7 +53,7 @@ jobs:
 
   required:
     name: Check required jobs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ always() }}
     # Keep this list in sync with all CI jobs that should be required.
     # `codecov` is intentionally excluded from this aggregator.
diff --git a/.github/workflows/danger.yml b/.github/workflows/danger.yml
index 5641cc23a..a54302d0c 100644
--- a/.github/workflows/danger.yml
+++ b/.github/workflows/danger.yml
@@ -11,6 +11,6 @@ permissions:
 
 jobs:
   danger:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: getsentry/github-workflows/danger@26f565c05d0dd49f703d238706b775883037d76b # v3
diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 046dbb82b..bc932a991 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -9,7 +9,7 @@ env:
 jobs:
   doc:
     name: Build documentation
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       RUSTDOCFLAGS: -Dwarnings
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 9aabb8f55..4c772c9f6 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -9,7 +9,7 @@ env:
 jobs:
   lint:
     name: Run lint checks
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout sources
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 824dc9a74..b202114f1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: "Release a new version"
     steps:
       - name: Get auth token
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c8c43953c..c2793d90f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,7 +11,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-24.04, macos-15, windows-2025]
         rust: [stable, 1.88.0]
 
     name: Run tests using Rust ${{ matrix.rust }} on ${{ matrix.os }}
diff --git a/.github/workflows/weekly.yml b/.github/workflows/weekly.yml
index 057640e60..2ae099002 100644
--- a/.github/workflows/weekly.yml
+++ b/.github/workflows/weekly.yml
@@ -15,7 +15,7 @@ jobs:
       matrix:
         rust: [nightly, beta]
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.repository_owner == 'getsentry'
 
     steps:
@@ -32,7 +32,7 @@ jobs:
 
   weekly-audit:
     name: Audit
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.repository_owner == 'getsentry'
 
     steps: