1.4.0: the ubuntu-latest migration lane

.github/workflows/ci.yml

@@ -134,6 +134,38 @@
         env:
           GITHUB_TOKEN: ${{ github.token }}
 
+  migration:
+    # Deliberately floating. Every other job here pins its image; this one is the
+    # lane's subject, and reading ImageOS off a runner that GitHub is in the
+    # middle of re-pointing is the half no test can reach.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+
+      - name: plan the announced ubuntu-latest move against the live manifests
+        run: node src/cli.mjs plan --from ubuntu-latest
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+
+      # The exit code is deliberately not asserted: it is 1 while the window is
+      # ahead of this runner and 0 once the move has reached it, so pinning it
+      # would turn the rollout itself into a red build. What must hold on every
+      # run is that the lane resolved the label and named its source.
+      - name: guard --fail-on-migration on a real floating runner
+        run: |
+          set +e
+          out="$(node src/cli.mjs guard --tools node --fail-on-migration 30 --no-update-lock 2>&1)"
+          code=$?
+          printf '%s\n' "$out"
+          echo "exit $code"
+          grep -q 'ubuntu-latest' <<<"$out" || { echo 'the migration lane said nothing'; exit 1; }
+          grep -q 'actions/runner-images#14748' <<<"$out" || { echo 'no source named'; exit 1; }
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+
   runners:
     runs-on: ubuntu-24.04
     steps:

action.yml

@@ -20,6 +20,10 @@ inputs:
     description: 'Fail if a pinned runs-on label browns out or retires within this many days. Empty disables the check.'
     required: false
     default: ''
+  fail-on-migration:
+    description: 'Report, and fail on, an announced migration of a floating runs-on label (ubuntu-latest) starting within this many days. Empty disables the check.'
+    required: false
+    default: ''
   fail-on-deprecation:
     description: 'Fail if this self-hosted runner version loses support within this many days. Needs a token with administration read; empty disables.'
     required: false
@@ -39,7 +43,7 @@ inputs:
   version:
     description: 'npm version of runner-drift to run.'
     required: false
-    default: '1.3.0'
+    default: '1.4.0'
   package:
     description: 'Override the npm spec, e.g. a local .tgz built in the same job. Mainly for testing this action before the version it requests exists on npm.'
     required: false
@@ -77,6 +81,7 @@ runs:
         RD_FAIL_ON_UNKNOWN: ${{ inputs.fail-on-unknown }}
         RD_FAIL_ON: ${{ inputs.fail-on }}
         RD_FAIL_ON_RETIREMENT: ${{ inputs.fail-on-retirement }}
+        RD_FAIL_ON_MIGRATION: ${{ inputs.fail-on-migration }}
         RD_FAIL_ON_DEPRECATION: ${{ inputs.fail-on-deprecation }}
         RD_TOOLS: ${{ inputs.tools }}
         RD_LOCK_FILE: ${{ inputs.lock-file }}
@@ -98,6 +103,7 @@ runs:
             args=(guard --lock-file "$LOCK_ABS" --workflows "$WF_ABS")
             if [ -n "$RD_FAIL_ON" ]; then args+=(--fail-on "$RD_FAIL_ON"); fi
             if [ -n "$RD_FAIL_ON_RETIREMENT" ]; then args+=(--fail-on-retirement "$RD_FAIL_ON_RETIREMENT"); fi
+            if [ -n "$RD_FAIL_ON_MIGRATION" ]; then args+=(--fail-on-migration "$RD_FAIL_ON_MIGRATION"); fi
             if [ -n "$RD_FAIL_ON_DEPRECATION" ]; then args+=(--fail-on-deprecation "$RD_FAIL_ON_DEPRECATION"); fi
             if [ -n "$RD_TOOLS" ]; then args+=(--tools "$RD_TOOLS"); fi
             printf 'lock-file=%s\n' "$RD_LOCK_FILE" >> "$GITHUB_OUTPUT"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "runner-drift",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Detect and attribute GitHub Actions runner-image tool drift: lock the tool versions your CI actually uses, diff them on every image bump, and plan a runner label migration before the deprecation deadline.",
   "type": "module",
   "bin": {
@@ -32,6 +32,8 @@
     "runner-images",
     "deprecation",
     "ubuntu-22.04",
+    "ubuntu-latest",
+    "ubuntu-26.04",
     "drift",
     "migration",
     "actions"

runner-lock.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "label": "ubuntu-24.04",
   "imageOS": "ubuntu24",
-  "imageVersion": "20260720.247.2",
+  "imageVersion": "20260907.300.1",
   "tools": {
     "Node.js": {
       "versions": [
@@ -12,5 +12,5 @@
       "command": "node --version"
     }
   },
-  "updatedAt": "2026-08-05T05:13:56.107Z"
+  "updatedAt": "2026-09-20T11:17:35.354Z"
 }