From 54cc622137227c761b11f00280f7f674f14ee166 Mon Sep 17 00:00:00 2001 From: Stefan Steiner Date: Mon, 5 Oct 2026 11:45:51 -0700 Subject: [PATCH] ci: pin runner images (macos-26, ubuntu-24.04, windows-2025) Replace the floating ubuntu-latest/windows-latest labels and the deprecated macos-14 with explicit images so required-check names and the OS behind shipped npm binaries only change by deliberate edit. Pin MACOSX_DEPLOYMENT_TARGET=13.0 on the npm builds so the newer macOS host does not raise the binaries' minimum OS. Required status checks in branch protection must be renamed to match. --- .github/workflows/ci.yml | 22 +++++++++++----------- .github/workflows/npm-build-publish.yml | 16 +++++++++++----- .github/workflows/release.yml | 6 +++--- docs/GITHUB_OPERATIONS.md | 10 +++++----- 4 files changed, 30 insertions(+), 24 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 64c9715..fa3aa46 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -46,7 +46,7 @@ env: jobs: fmt: name: rustfmt - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - uses: actions/checkout@v7 @@ -79,7 +79,7 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-latest, windows-latest] + os: [ubuntu-24.04, windows-2025] steps: - uses: actions/checkout@v7 - name: Install system libraries (Linux) @@ -126,7 +126,7 @@ jobs: # Pinned deliberately: this job must fail when the floor is exceeded, which # is the signal to make raising it a conscious decision. name: msrv (1.88) - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 30 steps: - uses: actions/checkout@v7 @@ -164,7 +164,7 @@ jobs: # long before it could pass; it went green once the broken intra-doc links # in hyperdb-mcp and hyperdb-api-derive were fixed, so it is now wired up. name: doc - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 30 steps: - uses: actions/checkout@v7 @@ -198,7 +198,7 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-latest, macos-14, windows-latest] + os: [ubuntu-24.04, macos-26, windows-2025] steps: - uses: actions/checkout@v7 - name: Free disk space (Linux only) @@ -276,7 +276,7 @@ jobs: # cross-platform napi compatibility is exercised by the per-platform # build matrix in npm-build-publish.yml when a release ships. name: hyperdb-api-node (build + smoke) - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 25 steps: - uses: actions/checkout@v7 @@ -287,7 +287,7 @@ jobs: toolchain: stable # Reuse the test job's Linux cache so the Cargo deps are warm # when both jobs run on the same SHA. - cache-key: test-ubuntu-latest + cache-key: test-ubuntu-24.04 # See fmt job for rationale. rustflags: "" - uses: actions/setup-node@v7 @@ -328,7 +328,7 @@ jobs: # hyperdb-compile-check: depends on hyperdb-api (not yet published). # All of the above are exercised end-to-end by release.yml at tag time. name: publish dry-run - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 15 steps: - uses: actions/checkout@v7 @@ -352,7 +352,7 @@ jobs: # rules from deny.toml. Pairs with the `audit` job — `cargo-deny` and # `cargo-audit` have separate ignore mechanisms; both must agree. name: cargo-deny - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 10 # The cargo-deny-action image ships a pre-installed `stable` toolchain, # but its `rustup show` step honors `rust-toolchain.toml`'s override @@ -373,7 +373,7 @@ jobs: # Enforces the RustSec advisory ignore list in .cargo/audit.toml. # Fails on any unfixed advisory for a crate in the lockfile. name: cargo-audit - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - uses: actions/checkout@v7 @@ -390,7 +390,7 @@ jobs: # with Cargo.toml workspace version. Catches release-please PRs that # bump one but not the other. name: version consistency - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 5 steps: - uses: actions/checkout@v7 diff --git a/.github/workflows/npm-build-publish.yml b/.github/workflows/npm-build-publish.yml index 1193f5c..fff0240 100644 --- a/.github/workflows/npm-build-publish.yml +++ b/.github/workflows/npm-build-publish.yml @@ -59,10 +59,10 @@ jobs: # silently on the v0.2.2 release. Exact-string match avoids # the whole class of regex-escaping bugs. REQUIRED_JSON='[ - "rustfmt","clippy (ubuntu-latest)","clippy (windows-latest)", + "rustfmt","clippy (ubuntu-24.04)","clippy (windows-2025)", "cargo-audit","cargo-deny", "version consistency","publish dry-run", - "test (ubuntu-latest)","test (macos-14)","test (windows-latest)", + "test (ubuntu-24.04)","test (macos-26)","test (windows-2025)", "hyperdb-api-node (build + smoke)" ]' for i in $(seq 1 "$MAX_ATTEMPTS"); do @@ -101,7 +101,7 @@ jobs: # a wrong tag yields a 404 rather than a version mismatch. # hyperd-sha256 is the digest of the downloaded .whl archive. - platform: darwin-arm64 - os: macos-14 + os: macos-26 target: aarch64-apple-darwin hyperd-slug: macos-arm64 hyperd-wheel-tag: macosx_13_0_arm64 @@ -114,13 +114,13 @@ jobs: # hyperd-wheel-tag: macosx_10_11_x86_64 # hyperd-sha256: "960e276028137847a3870695d9c2d5a1392c173b1e119ff1146d24a75deca71a" - platform: linux-x64-gnu - os: ubuntu-latest + os: ubuntu-24.04 target: x86_64-unknown-linux-gnu hyperd-slug: linux-x86_64 hyperd-wheel-tag: manylinux2014_x86_64 hyperd-sha256: "9f5ff04c0dc3c17224b7a3f36f297775f2f49aae084da84614003cd6508213bc" - platform: win32-x64-msvc - os: windows-latest + os: windows-2025 target: x86_64-pc-windows-msvc hyperd-slug: windows-x86_64 hyperd-wheel-tag: win_amd64 @@ -156,11 +156,17 @@ jobs: - name: Build hyperdb-mcp env: TARGET: ${{ matrix.target }} + # Keep the macOS binary's minimum OS at hyperd's wheel floor + # (macosx_13_0) even though the runner is newer; ignored elsewhere. + MACOSX_DEPLOYMENT_TARGET: "13.0" run: cargo build --release --target "$TARGET" -p hyperdb-mcp - name: Build hyperdb-api-node env: TARGET: ${{ matrix.target }} + # Keep the macOS binary's minimum OS at hyperd's wheel floor + # (macosx_13_0) even though the runner is newer; ignored elsewhere. + MACOSX_DEPLOYMENT_TARGET: "13.0" run: cargo build --release --target "$TARGET" -p hyperdb-api-node - name: Download and verify hyperd diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 36828c1..37f0856 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -52,7 +52,7 @@ jobs: verify: if: github.repository == 'tableau/hyper-api-rust' name: verify - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 35 steps: - uses: actions/checkout@v7 @@ -88,7 +88,7 @@ jobs: REQUIRED_JSON='[ "rustfmt","clippy","cargo-audit","cargo-deny", "version consistency","publish dry-run", - "test (ubuntu-latest)","test (macos-14)","test (windows-latest)", + "test (ubuntu-24.04)","test (macos-26)","test (windows-2025)", "hyperdb-api-node (build + smoke)" ]' for i in $(seq 1 "$MAX_ATTEMPTS"); do @@ -140,7 +140,7 @@ jobs: publish: name: publish to crates.io needs: verify - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 45 permissions: contents: write diff --git a/docs/GITHUB_OPERATIONS.md b/docs/GITHUB_OPERATIONS.md index bda37d1..fe9692b 100644 --- a/docs/GITHUB_OPERATIONS.md +++ b/docs/GITHUB_OPERATIONS.md @@ -36,7 +36,7 @@ Runs on **every PR** and on **every push to `main`**. Jobs: - `rustfmt` — `cargo fmt --all --check`. - `clippy` — `cargo clippy --workspace --all-targets -- -D warnings` (single runner; lints are platform-independent). -- `test` — full workspace test matrix on `ubuntu-latest`, `macos-14`, `windows-latest`. +- `test` — full workspace test matrix on `ubuntu-24.04`, `macos-26`, `windows-2025`. - `publish-dry-run` — `cargo publish --dry-run` for each publishable crate so a broken publish manifest is caught before a tag is cut. - `cargo-deny` — license and advisory policy enforcement per [`deny.toml`](../deny.toml). - `cargo-audit` — RustSec advisories, `--deny warnings`. @@ -122,9 +122,9 @@ verify-ci ← checks that CI passed for this commit (gh api commit status) | Platform | Runner | Rust target | hyperd source | |---|---|---|---| -| `darwin-arm64` | `macos-14` | `aarch64-apple-darwin` | `macos-arm64` | -| `linux-x64-gnu` | `ubuntu-latest` | `x86_64-unknown-linux-gnu` | `linux-x86_64` | -| `win32-x64-msvc` | `windows-latest` | `x86_64-pc-windows-msvc` | `windows-x86_64` | +| `darwin-arm64` | `macos-26` | `aarch64-apple-darwin` | `macos-arm64` | +| `linux-x64-gnu` | `ubuntu-24.04` | `x86_64-unknown-linux-gnu` | `linux-x86_64` | +| `win32-x64-msvc` | `windows-2025` | `x86_64-pc-windows-msvc` | `windows-x86_64` | `darwin-x64` (Intel macOS) is currently disabled — `macos-13` GHA runners have been unreliable. The matrix entry is commented out in @@ -830,7 +830,7 @@ when multiple maintainers need the pipeline to work independently. ```yaml jobs: release-please: - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - uses: actions/create-github-app-token@v2 id: app-token