ci: name the Ubuntu image instead of asking for the queue

`ubuntu-latest` is the only runner label in this repository that waits for a
runner. Between 07:00 and 14:00 UTC its median queue is 15.8 minutes for a
single-job lane and 33.4 for CI, while `ubuntu-24.04`, `ubuntu-24.04-arm`,
`windows-2025` and `macos-15` all sit at 0.3 minutes in the same window and
`macos-latest` and `windows-latest` at 0.1. Outside 07:00-14:00 every label
including `ubuntu-latest` is at 0.1, so this is contention during working
hours, not a property of the work.

The sharpest control is one `gitoxide-helper-admission` run fanning out to
three operating systems from a single `created_at`: median queue 15.0 / 0.1 /
0.1 minutes. It is not the `-latest` alias, since two of those three are
aliases. It is not our own `concurrency` groups, since every workflow's median
`run_started_at - created_at` is 0.0. It is not a self-hosted split, since
`runner_group_name` reads `GitHub Actions` on both sides.

`ubuntu-latest` resolves to `ubuntu24` today — image `ubuntu24/20260823.283` —
so naming `ubuntu-24.04` asks for the same machine and changes no behaviour.
Thirteen jobs across the release and packaging workflows already pin it; these
eight were the ones still on the alias.

`windows-latest` and `macos-latest` are deliberately left alone. They cost
nothing to wait for, and pinning them would be a real image change for no
measured gain.

What this costs is the automatic image upgrade: when GitHub moves `latest`,
these labels move by hand. The test that holds the rule says so.

Refs #4480

Author: Astro-Han

.github/workflows/ci.yml

@@ -42,7 +42,10 @@ jobs:
   # Renaming it would leave that check unreported on every open pull request
   # until the rename merged, and nothing could merge while it was unreported.
   test:
-    runs-on: ubuntu-latest
+    # Pinned, not `ubuntu-latest`, and the two resolve to the same image today.
+    # `ubuntu-latest` is the only label in this repository that queues:
+    # `ci-workflow-policy.test.mjs` holds the rule and the measurements.
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/copilot-auto-review.yml

@@ -33,7 +33,7 @@ jobs:
       github.event.pull_request.draft == false &&
       !endsWith(github.event.pull_request.user.login, '[bot]') &&
       !contains(github.event.pull_request.labels.*.name, 'copilot-skip')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
 
     steps:

.github/workflows/dependency-audit.yml

@@ -50,7 +50,7 @@ concurrency:
 
 jobs:
   audit:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
       - name: Check out the repository

.github/workflows/gitoxide-helper-admission.yml

@@ -57,7 +57,7 @@ jobs:
       fail-fast: false
       matrix:
         os:
-          - ubuntu-latest
+          - ubuntu-24.04
           - macos-latest
           - windows-latest
     steps:

.github/workflows/issue-pr-lifecycle.yml

@@ -46,7 +46,7 @@ concurrency:
 jobs:
   lifecycle:
     if: github.repository == 'apache/maka'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
 
     steps:

.github/workflows/pr-effort-label.yml

@@ -46,7 +46,7 @@ concurrency:
 
 jobs:
   label:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
     steps:

.github/workflows/release.yml

@@ -34,7 +34,7 @@ concurrency:
 
 jobs:
   release-identity:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     outputs:
       version: ${{ steps.identity.outputs.version }}
@@ -364,7 +364,7 @@ jobs:
     # One draft release carries both platforms, so it is created once, after
     # every platform has been packaged and verified.
     needs: [release-identity, desktop, cli-macos-arm64]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:
       contents: write

.github/workflows/runtime-host-peer-admission.yml

@@ -53,7 +53,7 @@ concurrency:
 jobs:
   test:
     name: quality
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

scripts/ci-workflow-policy.test.mjs

@@ -375,6 +375,37 @@ test('the recovery lane pairs its path filter with a nightly run and a main push
   assert.match(readWorkflow('windows-recovery.yml'), /\n {4}name: windows_recovery/u);
 });
 
+test('no lane asks for the one runner label that queues', () => {
+  // Measured across a full day of runs, `ubuntu-latest` is the only label here
+  // that waits for a runner. Between 07:00 and 14:00 UTC its median queue is
+  // 15.8 minutes for a single-job lane and 33.4 for CI, while every pinned
+  // label sits at 0.3 and `macos-latest` and `windows-latest` at 0.1. The
+  // sharpest control is one `gitoxide-helper-admission` run fanning out to
+  // three operating systems from one `created_at`: 15.0 / 0.1 / 0.1 minutes.
+  // So it is not the `-latest` alias, and the other two are deliberately left
+  // alone — they cost nothing and pinning them would change the image.
+  //
+  // `ubuntu-latest` resolves to the same image as `ubuntu-24.04` today, which
+  // is why this costs no coverage. What it does cost is the automatic image
+  // upgrade: when GitHub moves `latest`, these labels move by hand.
+  for (const name of readdirSync(WORKFLOW_DIR).filter((file) => file.endsWith('.yml'))) {
+    // Comments stripped, so explaining the rule in a workflow cannot break it,
+    // and matrix entries included, since a runner named in a matrix leg costs
+    // the same wait as one named on `runs-on`.
+    const declarations = readWorkflow(name)
+      .replaceAll(/^[ \t]*#.*$/gmu, '')
+      .match(/^[ \t]*(?:runs-on:|runner:|-)[ \t]*\S+$/gmu);
+
+    for (const declaration of declarations ?? []) {
+      assert.doesNotMatch(
+        declaration,
+        /\bubuntu-latest\b/u,
+        `${name}: ubuntu-latest queues for a runner; name the image instead`,
+      );
+    }
+  }
+});
+
 test('the recovery lane keeps every run kind out of one shared concurrency group', () => {
   const workflow = readWorkflow('windows-recovery.yml');