From 212571a260a828e28c23e21a477aa3d15da9a72d Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 26 Oct 2026 04:58:07 +0000
Subject: [PATCH 1/2] build(deps): update dependency ubuntu to v26

---
 .github/workflows/ci.yml                | 4 ++--
 .github/workflows/codeql.yml            | 2 +-
 .github/workflows/dependency-review.yml | 2 +-
 .github/workflows/release.yml           | 6 +++---
 .github/workflows/verify-doppler.yml    | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b932cd2..2af73eb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ concurrency:
 jobs:
   quality:
     name: Fast repository checks
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -52,7 +52,7 @@ jobs:
     name: required
     if: always()
     needs: [quality, windows-fast]
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e86e756..4e62829 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   selection:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
       contents: read
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 22bca6c..7e40fcb 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -10,7 +10,7 @@ permissions:
 jobs:
   dependency-review:
     name: Dependency review
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a4a1fb5..1c2b14c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -79,7 +79,7 @@ jobs:
     name: Qualify the release revision
     if: always()
     needs: [quality, test, i686-smoke, arm64, verifier, api, proofs]
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
       contents: read
@@ -116,7 +116,7 @@ jobs:
   quality:
     name: Release repository checks
     needs: resolve
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     permissions:
       contents: read
@@ -334,7 +334,7 @@ jobs:
       fail-fast: false
       matrix:
         layer: ${{ fromJSON(needs.quality.outputs.proofs) }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     permissions:
       contents: read
diff --git a/.github/workflows/verify-doppler.yml b/.github/workflows/verify-doppler.yml
index 9992374..7128eb2 100644
--- a/.github/workflows/verify-doppler.yml
+++ b/.github/workflows/verify-doppler.yml
@@ -20,7 +20,7 @@ jobs:
     if: >-
       github.event_name == 'workflow_dispatch' &&
       github.ref == 'refs/heads/main'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     environment: release
     permissions:

From ee5c1adc4abc692a68ab2847d507f033be4e630f Mon Sep 17 00:00:00 2001
From: Yasunobu <42543015+P4suta@users.noreply.github.com>
Date: Mon, 26 Oct 2026 14:08:22 +0900
Subject: [PATCH 2/2] fix(ci): validate Ubuntu 26.04 runner updates

---
 .github/actionlint.yaml      |  3 +++
 .github/workflows/codeql.yml | 20 +++++++++++---------
 2 files changed, 14 insertions(+), 9 deletions(-)
 create mode 100644 .github/actionlint.yaml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..978712b
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - ubuntu-26.04
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4e62829..b54b1ab 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -15,11 +15,12 @@ concurrency:
 
 jobs:
   selection:
+    name: Select analysis languages
     runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
-      contents: read
-      pull-requests: read
+      contents: read  # Read source for path selection.
+      pull-requests: read  # Compare the pull request's changed paths.
     outputs:
       languages: ${{ steps.changes.outputs.changes }}
     steps:
@@ -44,11 +45,13 @@ jobs:
     name: Analyze (${{ matrix.language }})
     needs: [selection]
     if: needs.selection.outputs.languages != '[]'
-    runs-on: ${{ matrix.language == 'rust' && 'windows-2022' || 'ubuntu-24.04' }}
+    runs-on: ${{ matrix.language == 'rust' && 'windows-2022' || 'ubuntu-26.04' }}
     timeout-minutes: 45
     permissions:
-      contents: read
-      security-events: write
+      contents: read  # Read the source to analyze.
+      security-events: write  # Upload the analysis results.
+    env:
+      RUSTUP_TOOLCHAIN: "1.99.1"
     strategy:
       fail-fast: false
       matrix:
@@ -57,10 +60,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
-      - if: matrix.language == 'rust'
-        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8  # v1
-        with:
-          toolchain: "1.99.1"
+      - name: Install pinned Rust toolchain
+        if: matrix.language == 'rust'
+        run: rustup toolchain install 1.99.1 --profile minimal
       - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
         with:
           languages: ${{ matrix.language }}