[vvillait88]

Summary

Moves every workflow to Ubuntu 26.04 runners: Blacksmith ubuntu-2404 labels to ubuntu-2604 (same size and architecture), and the GitHub-hosted publish job from ubuntu-latest (which GitHub is moving to 26.04 through 2026-11-19, so pinning it makes the image explicit) to ubuntu-26.04. The publish job stays on a GitHub-hosted runner. The rest of the org's repos are moving to the same image, so every repo builds on one OS.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

• grep finds no ubuntu-2404, 24.04 or ubuntu-latest left under .github/.
• actionlint reports nothing from this change apart from its own runner-label list not knowing ubuntu-26.04.
• This PR's CI and Security runs execute on the new image. The latest publish already ran on ubuntu-26.04 (ubuntu-latest resolved to it), so the next tag changes nothing.

Checklist

• Tests cover the new behavior, and the suite passes (no behavior change; run in CI on the new image, not locally)
• Lint, format, and type checks pass (CI)
• Docs and README examples updated if the public surface changed (not changed)
• No secrets, credentials, or personal data in the diff or the tests

🤖 Generated with Claude Code

[vvillait88]

Review (fresh-context reviewer, read-only) at head b23ea854e

Verdict: approve. No defects. One body nit.

Labels

• 4 runs-on lines (ci, node-compat, security osv, publish): Blacksmith blacksmith-2vcpu-ubuntu-2404-arm to blacksmith-2vcpu-ubuntu-2604-arm (same size and arch), and publish from ubuntu-latest to ubuntu-26.04 (both GitHub-hosted x64). No other line changed.
• Read all 7 .github/ files at the head sha: zero 2404, 24.04, ubuntu-latest or 22.04.
• The Blacksmith label is in use: hivemind main's 2604-arm jobs passed today, and this PR's own jobs report labels=["blacksmith-2vcpu-ubuntu-2604-arm"].

Publish workflow

• It stays GitHub-hosted, which OIDC trusted publishing and provenance need.
• It has already published from 26.04. GitHub is moving ubuntu-latest to 26.04 between 2026-10-19 and 2026-11-19 (actions/runner-images announcement 14748). This repo's last publish, v2.9.4 on 2026-10-25 (run 40149268984), logged Image: ubuntu-26.04 and succeeded. So this PR pins what the release path already runs on, and the next tag is not a first run.
• The job uses actions/checkout, oven-sh/setup-bun, actions/setup-node (Node 26, downloaded rather than taken from the image, since the image caches only 22 and 24), npm from that Node, and the preinstalled gh for the release. gh is 2.103.2 on both images.
• Removed from the 26.04 image (Fastlane, Julia, Lerna, Mercurial, Miniconda, Newman, Parcel, Pulumi, Sphinx, MediaInfo, Haveged): none of them is used here.

CI

Green on the new image: ci, node-compat (22, 24, 26), Dependency Scan, CodeQL. CodeQL is GitHub default setup on ubuntu-latest and is not in this repo's workflows.

What first runs on 26.04 after merge

• publish.yml runs at the next v* tag. Its image is already proven, as above.

Body nit

The Summary says ubuntu-latest is "still 24.04", and the Test plan says the publish workflow "first runs on it at the next release tag". Both were already false: the last publish ran on ubuntu-26.04. Suggest: "pins the publish job to ubuntu-26.04, which ubuntu-latest already resolves to during GitHub's rollout". Separately, "the suite passes locally" is ticked although the parenthetical says CI ran it, not a local run. Untick it or reword it to match. The template headings are all present, and there are no em-dashes in the title or body.

[vvillait88]

Answered: the body now says ubuntu-latest is moving to 26.04 through 2026-11-19 (the latest publish already ran on it), and the suite tick says it ran in CI, not locally.