Pin runner images by martincostello · Pull Request #3065 · App-vNext/Polly

martincostello · 2026-05-10T09:24:04Z

Pin runner images to a specific OS, rather than using latest.

Pin runner images to a specific OS, rather than using `latest`.

Keep the job names as `-latest`.

codecov · 2026-05-10T09:34:21Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.16%. Comparing base (647d683) to head (0bde17c).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3065   +/-   ##
=======================================
  Coverage   96.16%   96.16%           
=======================================
  Files         310      310           
  Lines        7136     7136           
  Branches     1005     1005           
=======================================
  Hits         6862     6862           
  Misses        221      221           
  Partials       53       53

Flag	Coverage Δ
linux	`96.16% <ø> (ø)`
macos	`96.16% <ø> (ø)`
windows	`96.15% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copilot

Pull request overview

Pins GitHub Actions runner images to explicit OS versions across the repository workflows, reducing drift from *-latest image changes and improving build/release determinism.

Changes:

Replaced ubuntu-latest with ubuntu-24.04 in multiple workflows.
Updated the main build.yml workflow to use a new matrix shape and pinned runner labels for macOS/Windows/Linux.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
.github/workflows/updater-approve.yml	Pins the updater approval job to `ubuntu-24.04`.
.github/workflows/update-dotnet-sdk.yml	Pins the security-label job to `ubuntu-24.04`.
.github/workflows/stale.yml	Pins the stale bot workflow to `ubuntu-24.04`.
.github/workflows/release.yml	Pins the release workflow runner to `ubuntu-24.04`.
.github/workflows/ossf-scorecard.yml	Pins the OSSF Scorecard job to `ubuntu-24.04`.
.github/workflows/on-push-do-docs.yml	Pins docs update workflow to `ubuntu-24.04`.
.github/workflows/nuget-packages-published.yml	Pins publish/notify jobs to `ubuntu-24.04`.
.github/workflows/mutation-tests.yml	Pins mutation test jobs to `ubuntu-24.04`.
.github/workflows/lint.yml	Pins lint job to `ubuntu-24.04`.
.github/workflows/gh-pages.yml	Pins docs build/publish jobs to `ubuntu-24.04`.
.github/workflows/dependency-review.yml	Pins dependency review job to `ubuntu-24.04`.
.github/workflows/dependabot-approve.yml	Pins dependabot approval workflow to `ubuntu-24.04`.
.github/workflows/code-ql.yml	Pins CodeQL jobs to `ubuntu-24.04`.
.github/workflows/build.yml	Switches to pinned runners via a matrix; updates artifact naming/flags; pins signing and publish jobs to explicit runners.
.github/workflows/after-release.yml	Pins after-release jobs to `ubuntu-24.04`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Frulfump · 2026-05-10T12:01:03Z

-            os_name: linux
-          - os: windows-latest
-            os_name: windows
+          - job-name: macos-latest


Should the job name change as well?

No because otherwise the required statuses won't match and I can't update them so I've intentionally left them as latest.

Updated [Polly](https://github.com/App-vNext/Polly) from 8.6.6 to 8.7.0. <details> <summary>Release notes</summary> _Sourced from [Polly's releases](https://github.com/App-vNext/Polly/releases)._ ## 8.7.0 ## Highlights * Adds caller cancellation token propagation in hedging and timeout strategies by @DaRosenberg in App-vNext/Polly#3094 * Telemetry refactoring by @martincostello in App-vNext/Polly#2985 ## What's Changed * Update zizmor to 1.22.0 by @martincostello in App-vNext/Polly#2955 * Increase test timeout by @martincostello in App-vNext/Polly#2956 * Disable secrets-outside-env audit by @martincostello in App-vNext/Polly#2969 * Update zizmor to 1.23.1 by @martincostello in App-vNext/Polly#2970 * Update .NET NuGet packages by @martincostello in App-vNext/Polly#2982 * Add AGENTS.md by @martincostello in App-vNext/Polly#2983 * Fix typo in HTTP client integrations documentation by @alexravenna in App-vNext/Polly#2984 * Remove unused constant by @martincostello in App-vNext/Polly#2986 * Fix non-deterministic branch coverage in HedgingExecutionContext hedging delay tests by @Copilot in App-vNext/Polly#2997 * Bump GitHubActionsTestLogger to 3.0.2 by @martincostello in App-vNext/Polly#3000 * Bump actionlint to v1.7.12 by @martincostello in App-vNext/Polly#3006 * Bump sign by @martincostello in App-vNext/Polly#3008 * Move Public API baselines by @martincostello in App-vNext/Polly#3016 * Formatting tweaks by @martincostello in App-vNext/Polly#3017 * Formatting tweaks by @martincostello in App-vNext/Polly#3018 * Remove ZIZMOR_VERSION by @martincostello in App-vNext/Polly#3025 * Assert nullable has result by @martincostello in App-vNext/Polly#3028 * Update deprecated action input by @martincostello in App-vNext/Polly#3035 * Move dependabot to Friday by @martincostello in App-vNext/Polly#3044 * Fix tag comment by @martincostello in App-vNext/Polly#3045 * Fix dependabot group by @martincostello in App-vNext/Polly#3047 * Pin runner images by @martincostello in App-vNext/Polly#3065 * Bump Refit to 10.2.0 by @martincostello in App-vNext/Polly#3096 * Disable Azure deployments by @martincostello in App-vNext/Polly#3105 ## New Contributors * @alexravenna made their first contribution in App-vNext/Polly#2984 * @DaRosenberg made their first contribution in App-vNext/Polly#3094 **Full Changelog**: App-vNext/Polly@8.6.6...8.7.0 Commits viewable in [compare view](App-vNext/Polly@8.6.6...8.7.0). </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Polly&package-manager=nuget&previous-version=8.6.6&new-version=8.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Updated [Polly](https://github.com/App-vNext/Polly) from 8.6.6 to 8.7.0. <details> <summary>Release notes</summary> _Sourced from [Polly's releases](https://github.com/App-vNext/Polly/releases)._ ## 8.7.0 ## Highlights * Adds caller cancellation token propagation in hedging and timeout strategies by @DaRosenberg in App-vNext/Polly#3094 * Telemetry refactoring by @martincostello in App-vNext/Polly#2985 ## What's Changed * Update zizmor to 1.22.0 by @martincostello in App-vNext/Polly#2955 * Increase test timeout by @martincostello in App-vNext/Polly#2956 * Disable secrets-outside-env audit by @martincostello in App-vNext/Polly#2969 * Update zizmor to 1.23.1 by @martincostello in App-vNext/Polly#2970 * Update .NET NuGet packages by @martincostello in App-vNext/Polly#2982 * Add AGENTS.md by @martincostello in App-vNext/Polly#2983 * Fix typo in HTTP client integrations documentation by @alexravenna in App-vNext/Polly#2984 * Remove unused constant by @martincostello in App-vNext/Polly#2986 * Fix non-deterministic branch coverage in HedgingExecutionContext hedging delay tests by @Copilot in App-vNext/Polly#2997 * Bump GitHubActionsTestLogger to 3.0.2 by @martincostello in App-vNext/Polly#3000 * Bump actionlint to v1.7.12 by @martincostello in App-vNext/Polly#3006 * Bump sign by @martincostello in App-vNext/Polly#3008 * Move Public API baselines by @martincostello in App-vNext/Polly#3016 * Formatting tweaks by @martincostello in App-vNext/Polly#3017 * Formatting tweaks by @martincostello in App-vNext/Polly#3018 * Remove ZIZMOR_VERSION by @martincostello in App-vNext/Polly#3025 * Assert nullable has result by @martincostello in App-vNext/Polly#3028 * Update deprecated action input by @martincostello in App-vNext/Polly#3035 * Move dependabot to Friday by @martincostello in App-vNext/Polly#3044 * Fix tag comment by @martincostello in App-vNext/Polly#3045 * Fix dependabot group by @martincostello in App-vNext/Polly#3047 * Pin runner images by @martincostello in App-vNext/Polly#3065 * Bump Refit to 10.2.0 by @martincostello in App-vNext/Polly#3096 * Disable Azure deployments by @martincostello in App-vNext/Polly#3105 ## New Contributors * @alexravenna made their first contribution in App-vNext/Polly#2984 * @DaRosenberg made their first contribution in App-vNext/Polly#3094 **Full Changelog**: App-vNext/Polly@8.6.6...8.7.0 Commits viewable in [compare view](App-vNext/Polly@8.6.6...8.7.0). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Pin runner images

2da76a5

Pin runner images to a specific OS, rather than using `latest`.

martincostello added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 10, 2026

Fix required statuses

0bde17c

Keep the job names as `-latest`.

martincostello marked this pull request as ready for review May 10, 2026 09:31

Copilot AI review requested due to automatic review settings May 10, 2026 09:31

martincostello enabled auto-merge (squash) May 10, 2026 09:31

Copilot started reviewing on behalf of martincostello May 10, 2026 09:32 View session

Copilot AI reviewed May 10, 2026

View reviewed changes

Comment thread .github/workflows/build.yml

Comment thread .github/workflows/build.yml

Comment thread .github/workflows/build.yml

Comment thread .github/workflows/build.yml

martincostello merged commit bb790b9 into main May 10, 2026
32 checks passed

martincostello deleted the pin-runner-labels branch May 10, 2026 09:40

Frulfump reviewed May 10, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Pin runner images#3065

Pin runner images#3065
martincostello merged 2 commits into
mainfrom
pin-runner-labels

martincostello commented May 10, 2026

Uh oh!

codecov Bot commented May 10, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Frulfump May 10, 2026

Uh oh!

martincostello May 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

martincostello commented May 10, 2026

Uh oh!

codecov Bot commented May 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Frulfump May 10, 2026

Choose a reason for hiding this comment

Uh oh!

martincostello May 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov Bot commented May 10, 2026 •

edited

Loading