chore(deps): Ubuntu 26 and refactorings

.github/workflows/ci.yaml

@@ -106,24 +106,11 @@ jobs:
       github-token: ${{ secrets.GITHUB_TOKEN }}
 
   test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     name: test
     needs:
       - build
     steps:
-      # <https://docs.docker.com/storage/containerd/>
-      # via <https://github.com/docker/setup-buildx-action/issues/257>
-      - name: Set up containerd image store
-        shell: bash
-        run: |
-          [ -f /etc/docker/daemon.json ] || echo "{}" | sudo tee /etc/docker/daemon.json
-          jq '. | .+{"features": {"containerd-snapshotter": true}}' /etc/docker/daemon.json > /tmp/docker-daemon-with-containerd.json
-          sudo mv /tmp/docker-daemon-with-containerd.json /etc/docker/daemon.json
-          cat /etc/docker/daemon.json
-          sudo systemctl restart docker
-
-          docker info -f '{{ .DriverStatus }}'
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 

.github/workflows/standard-build.yaml

@@ -117,7 +117,7 @@ on:
 jobs:
   build:
     name: build image
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write # to push the image to ghcr.io
@@ -144,19 +144,6 @@ jobs:
         with:
           persist-credentials: false
 
-      # <https://docs.docker.com/storage/containerd/>
-      # via <https://github.com/docker/setup-buildx-action/issues/257>
-      - name: Set up containerd image store
-        shell: bash
-        run: |
-          [ -f /etc/docker/daemon.json ] || echo "{}" | sudo tee /etc/docker/daemon.json
-          jq '. | .+{"features": {"containerd-snapshotter": true}}' /etc/docker/daemon.json > /tmp/docker-daemon-with-containerd.json
-          sudo mv /tmp/docker-daemon-with-containerd.json /etc/docker/daemon.json
-          cat /etc/docker/daemon.json
-          sudo systemctl restart docker
-
-          docker info -f '{{ .DriverStatus }}'
-
       - name: Set up Docker Buildx
         id: setup-buildx
         uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
@@ -386,7 +373,7 @@ jobs:
 
   image-provenance:
     name: attest image provenance
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ startsWith(github.ref, 'refs/tags/') }}
     needs:
       - build
@@ -432,7 +419,7 @@ jobs:
 
   sign-image:
     name: sign image
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ github.event_name != 'pull_request' }}
     needs:
       - build
@@ -470,7 +457,7 @@ jobs:
 
   attest-trivy-vulnerability-report:
     name: attest trivy vulnerability report
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ github.event_name != 'pull_request' && inputs.enable-trivy-scan }}
     needs:
       - build
@@ -514,7 +501,7 @@ jobs:
 
   upload-attestion-to-release:
     name: upload slsa attestations to release assets
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ startsWith(github.ref, 'refs/tags/') }}
     needs:
       - image-provenance
@@ -549,7 +536,7 @@ jobs:
 
   upload-sbom-to-release:
     name: upload image SBOMs to release assets
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - build
     permissions:

.github/workflows/standard-chart-publish.yaml

@@ -48,6 +48,16 @@ on:
         required: false
         default: true
         type: boolean
+      image-digest:
+        description: "Digest (sha256:...) of the app image to pin in the packaged chart's values.yaml before bundling, typically the build job's own output (e.g. needs.build.outputs.image-digest) rather than looked up again here. Combined with the tag already at image-tag-path as `<tag>@<digest>`. Only affects the package built for publishing - never committed back to the repo. Leave empty to publish the chart unmodified."
+        required: false
+        default: ""
+        type: string
+      image-tag-path:
+        description: "yq path to the app image tag in the chart's values.yaml, read and then overwritten with `<tag>@<digest>` when image-digest is set."
+        required: false
+        default: ".image.tag"
+        type: string
       target-branch:
         description: "Branch to diff against when detecting changed charts for linting/testing"
         required: false
@@ -119,7 +129,7 @@ on:
 jobs:
   lint:
     name: lint charts
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -206,7 +216,7 @@ jobs:
 
   install:
     name: install charts (k8s ${{ matrix.k8s-version }})
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ inputs.enable-install }}
     needs:
       - lint
@@ -334,7 +344,7 @@ jobs:
 
   publish:
     name: publish chart
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - lint
     if: ${{ github.event_name == 'release' || (github.event_name == 'pull_request' && inputs.enable-pr-release) }}
@@ -395,6 +405,23 @@ jobs:
             echo "app-version=${APP_VERSION}"
           } >> "${GITHUB_OUTPUT}"
 
+      - name: Pin app image tag to its digest
+        if: ${{ inputs.image-digest != '' }}
+        working-directory: ${{ inputs.chart-path }}
+        env:
+          IMAGE_DIGEST: ${{ inputs.image-digest }}
+          TAG_PATH: ${{ inputs.image-tag-path }}
+        run: |
+          # only ever touches this job's own checked-out working copy - never
+          # committed back. helm package (next step) bundles whatever's on
+          # disk here, so the published chart ends up pinned to the exact
+          # image the caller's build job produced, without values.yaml in
+          # the repo ever changing or a second, possibly-racy lookup of what
+          # the tag currently resolves to.
+          TAG="$(yq "${TAG_PATH}" values.yaml)"
+          yq -i "${TAG_PATH} = \"${TAG}@${IMAGE_DIGEST}\"" values.yaml
+          echo "Pinned ${TAG_PATH} in values.yaml: ${TAG} -> ${TAG}@${IMAGE_DIGEST}"
+
       - name: Package chart
         id: package
         env:

.github/workflows/standard-lint.yaml

@@ -62,7 +62,7 @@ on:
 jobs:
   megalinter:
     name: MegaLinter
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ github.event_name == 'pull_request' }}
     permissions:
       issues: write # for megalinter to post PR comments via the issue comments API
@@ -96,9 +96,24 @@ jobs:
             megalinter-reports
             mega-linter.log
 
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-26.04
+    if: ${{ github.event_name == 'pull_request' }}
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Run actionlint
+        uses: kjanat/actionlint@08bb2c4f0d039744455b87aef1c647fb8b66d37b # v1.17.0
+
   dependency-review:
     name: dependency review
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     # can only run on PRs or the error is:
     # "Both a base ref and head ref must be provided, either via the `base_ref`/`head_ref` config options, or by running a `pull_request`/`pull_request_target` workflow."
     if: ${{ github.event_name == 'pull_request' }}
@@ -114,7 +129,7 @@ jobs:
 
   gradle-wrapper-validation:
     name: validate gradle wrapper
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ inputs.enable-validate-gradle-wrapper }}
     permissions:
       contents: read
@@ -128,7 +143,7 @@ jobs:
 
   base-image-signature-verification:
     name: verify Dockerfile base image signature
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ inputs.enable-verify-base-image-signature }}
     permissions:
       contents: read
@@ -153,7 +168,7 @@ jobs:
 
   codeql-analyze:
     name: CodeQL analyze
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ inputs.enable-codeql }}
     permissions:
       actions: read # required by github/codeql-action to upload SARIF results
@@ -217,7 +232,7 @@ jobs:
 
   zizmor:
     name: zizmor scan
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ github.event_name == 'pull_request' }}
     permissions:
       security-events: write # for uploading zizmor SARIF results

.github/workflows/standard-release.yaml

@@ -28,7 +28,7 @@ on:
 jobs:
   release:
     name: release
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     # run only on pushes. The semantic release default config allows releases
     # to only be created from the default branch ('master'). The ci.yaml
     # is configured to only run on pushes to master as well.

.github/workflows/standard-schedule.yaml

@@ -27,7 +27,7 @@ env:
 jobs:
   check-links:
     name: check links using lychee
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       issues: write # to open/update the link check report issue
     steps:
@@ -74,7 +74,7 @@ jobs:
 
   trivy-scan:
     name: scan images with trivy
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       matrix:
         image: ${{ fromJSON(inputs.images) }}

.mega-linter.yml

@@ -9,6 +9,7 @@ DISABLE_LINTERS:
   - SPELL_LYCHEE
   - REPOSITORY_OSV_SCANNER
   - ACTION_ZIZMOR
+  - ACTION_ACTIONLINT
 
 ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
   - GITHUB_TOKEN