ci: pin runner images (macos-26, ubuntu-24.04, windows-2025)

.github/workflows/ci.yml

@@ -46,7 +46,7 @@ env:
 jobs:
   fmt:
     name: rustfmt
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
@@ -79,7 +79,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-24.04, windows-2025]
     steps:
       - uses: actions/checkout@v7
       - name: Install system libraries (Linux)
@@ -126,7 +126,7 @@ jobs:
     # Pinned deliberately: this job must fail when the floor is exceeded, which
     # is the signal to make raising it a conscious decision.
     name: msrv (1.88)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7
@@ -164,7 +164,7 @@ jobs:
     # long before it could pass; it went green once the broken intra-doc links
     # in hyperdb-mcp and hyperdb-api-derive were fixed, so it is now wired up.
     name: doc
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7
@@ -198,7 +198,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-14, windows-latest]
+        os: [ubuntu-24.04, macos-26, windows-2025]
     steps:
       - uses: actions/checkout@v7
       - name: Free disk space (Linux only)
@@ -276,7 +276,7 @@ jobs:
     # cross-platform napi compatibility is exercised by the per-platform
     # build matrix in npm-build-publish.yml when a release ships.
     name: hyperdb-api-node (build + smoke)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@v7
@@ -287,7 +287,7 @@ jobs:
           toolchain: stable
           # Reuse the test job's Linux cache so the Cargo deps are warm
           # when both jobs run on the same SHA.
-          cache-key: test-ubuntu-latest
+          cache-key: test-ubuntu-24.04
           # See fmt job for rationale.
           rustflags: ""
       - uses: actions/setup-node@v7
@@ -328,7 +328,7 @@ jobs:
     #   hyperdb-compile-check: depends on hyperdb-api (not yet published).
     # All of the above are exercised end-to-end by release.yml at tag time.
     name: publish dry-run
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
@@ -352,7 +352,7 @@ jobs:
     # rules from deny.toml. Pairs with the `audit` job — `cargo-deny` and
     # `cargo-audit` have separate ignore mechanisms; both must agree.
     name: cargo-deny
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     # The cargo-deny-action image ships a pre-installed `stable` toolchain,
     # but its `rustup show` step honors `rust-toolchain.toml`'s override
@@ -373,7 +373,7 @@ jobs:
     # Enforces the RustSec advisory ignore list in .cargo/audit.toml.
     # Fails on any unfixed advisory for a crate in the lockfile.
     name: cargo-audit
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
@@ -390,7 +390,7 @@ jobs:
     # with Cargo.toml workspace version. Catches release-please PRs that
     # bump one but not the other.
     name: version consistency
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v7

.github/workflows/npm-build-publish.yml

@@ -59,10 +59,10 @@ jobs:
           # silently on the v0.2.2 release. Exact-string match avoids
           # the whole class of regex-escaping bugs.
           REQUIRED_JSON='[
-            "rustfmt","clippy (ubuntu-latest)","clippy (windows-latest)",
+            "rustfmt","clippy (ubuntu-24.04)","clippy (windows-2025)",
             "cargo-audit","cargo-deny",
             "version consistency","publish dry-run",
-            "test (ubuntu-latest)","test (macos-14)","test (windows-latest)",
+            "test (ubuntu-24.04)","test (macos-26)","test (windows-2025)",
             "hyperdb-api-node (build + smoke)"
           ]'
           for i in $(seq 1 "$MAX_ATTEMPTS"); do
@@ -101,7 +101,7 @@ jobs:
           # a wrong tag yields a 404 rather than a version mismatch.
           # hyperd-sha256 is the digest of the downloaded .whl archive.
           - platform: darwin-arm64
-            os: macos-14
+            os: macos-26
             target: aarch64-apple-darwin
             hyperd-slug: macos-arm64
             hyperd-wheel-tag: macosx_13_0_arm64
@@ -114,13 +114,13 @@ jobs:
           #   hyperd-wheel-tag: macosx_10_11_x86_64
           #   hyperd-sha256: "960e276028137847a3870695d9c2d5a1392c173b1e119ff1146d24a75deca71a"
           - platform: linux-x64-gnu
-            os: ubuntu-latest
+            os: ubuntu-24.04
             target: x86_64-unknown-linux-gnu
             hyperd-slug: linux-x86_64
             hyperd-wheel-tag: manylinux2014_x86_64
             hyperd-sha256: "9f5ff04c0dc3c17224b7a3f36f297775f2f49aae084da84614003cd6508213bc"
           - platform: win32-x64-msvc
-            os: windows-latest
+            os: windows-2025
             target: x86_64-pc-windows-msvc
             hyperd-slug: windows-x86_64
             hyperd-wheel-tag: win_amd64
@@ -156,11 +156,17 @@ jobs:
       - name: Build hyperdb-mcp
         env:
           TARGET: ${{ matrix.target }}
+          # Keep the macOS binary's minimum OS at hyperd's wheel floor
+          # (macosx_13_0) even though the runner is newer; ignored elsewhere.
+          MACOSX_DEPLOYMENT_TARGET: "13.0"
         run: cargo build --release --target "$TARGET" -p hyperdb-mcp
 
       - name: Build hyperdb-api-node
         env:
           TARGET: ${{ matrix.target }}
+          # Keep the macOS binary's minimum OS at hyperd's wheel floor
+          # (macosx_13_0) even though the runner is newer; ignored elsewhere.
+          MACOSX_DEPLOYMENT_TARGET: "13.0"
         run: cargo build --release --target "$TARGET" -p hyperdb-api-node
 
       - name: Download and verify hyperd

.github/workflows/release.yml

@@ -52,7 +52,7 @@ jobs:
   verify:
     if: github.repository == 'tableau/hyper-api-rust'
     name: verify
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 35
     steps:
       - uses: actions/checkout@v7
@@ -88,7 +88,7 @@ jobs:
           REQUIRED_JSON='[
             "rustfmt","clippy","cargo-audit","cargo-deny",
             "version consistency","publish dry-run",
-            "test (ubuntu-latest)","test (macos-14)","test (windows-latest)",
+            "test (ubuntu-24.04)","test (macos-26)","test (windows-2025)",
             "hyperdb-api-node (build + smoke)"
           ]'
           for i in $(seq 1 "$MAX_ATTEMPTS"); do
@@ -140,7 +140,7 @@ jobs:
   publish:
     name: publish to crates.io
     needs: verify
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     permissions:
       contents: write

docs/GITHUB_OPERATIONS.md

@@ -36,7 +36,7 @@ Runs on **every PR** and on **every push to `main`**. Jobs:
 
 - `rustfmt` — `cargo fmt --all --check`.
 - `clippy` — `cargo clippy --workspace --all-targets -- -D warnings` (single runner; lints are platform-independent).
-- `test` — full workspace test matrix on `ubuntu-latest`, `macos-14`, `windows-latest`.
+- `test` — full workspace test matrix on `ubuntu-24.04`, `macos-26`, `windows-2025`.
 - `publish-dry-run` — `cargo publish --dry-run` for each publishable crate so a broken publish manifest is caught before a tag is cut.
 - `cargo-deny` — license and advisory policy enforcement per [`deny.toml`](../deny.toml).
 - `cargo-audit` — RustSec advisories, `--deny warnings`.
@@ -122,9 +122,9 @@ verify-ci       ← checks that CI passed for this commit (gh api commit status)
 
 | Platform | Runner | Rust target | hyperd source |
 |---|---|---|---|
-| `darwin-arm64` | `macos-14` | `aarch64-apple-darwin` | `macos-arm64` |
-| `linux-x64-gnu` | `ubuntu-latest` | `x86_64-unknown-linux-gnu` | `linux-x86_64` |
-| `win32-x64-msvc` | `windows-latest` | `x86_64-pc-windows-msvc` | `windows-x86_64` |
+| `darwin-arm64` | `macos-26` | `aarch64-apple-darwin` | `macos-arm64` |
+| `linux-x64-gnu` | `ubuntu-24.04` | `x86_64-unknown-linux-gnu` | `linux-x86_64` |
+| `win32-x64-msvc` | `windows-2025` | `x86_64-pc-windows-msvc` | `windows-x86_64` |
 
 `darwin-x64` (Intel macOS) is currently disabled — `macos-13` GHA
 runners have been unreliable. The matrix entry is commented out in
@@ -830,7 +830,7 @@ when multiple maintainers need the pipeline to work independently.
    ```yaml
    jobs:
      release-please:
-       runs-on: ubuntu-latest
+       runs-on: ubuntu-24.04
        steps:
          - uses: actions/create-github-app-token@v2
            id: app-token