From 1b500b9dd9a89f25b512f0387fd13837ee70d3c2 Mon Sep 17 00:00:00 2001
From: phlax <phlax@users.noreply.github.com>
Date: Mon, 7 Nov 2022 17:34:14 +0000
Subject: [PATCH] ci: Pin images in github actions (#23860)

Prevent bitrot on release branches

Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: phlax <phlax@users.noreply.github.com>
---
 .github/workflows/check-deps.yml   | 2 +-
 .github/workflows/codeql-daily.yml | 4 ++--
 .github/workflows/codeql-push.yml  | 4 ++--
 .github/workflows/depsreview.yml   | 2 +-
 .github/workflows/pr_notifier.yml  | 2 +-
 .github/workflows/stale.yml        | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/check-deps.yml b/.github/workflows/check-deps.yml
index 97e1ede11b910..fce8d594eb941 100644
--- a/.github/workflows/check-deps.yml
+++ b/.github/workflows/check-deps.yml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     if: github.repository == 'envoyproxy/envoy'
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/codeql-daily.yml b/.github/workflows/codeql-daily.yml
index 7c069f5bd8cf8..bbf63f40354dc 100644
--- a/.github/workflows/codeql-daily.yml
+++ b/.github/workflows/codeql-daily.yml
@@ -10,8 +10,8 @@ jobs:
     strategy:
       fail-fast: false
 
-    # CodeQL runs on ubuntu-latest and windows-latest
-    runs-on: ubuntu-latest
+    # CodeQL runs on ubuntu-20.04
+    runs-on: ubuntu-20.04
 
     steps:
     - name: Checkout repository
diff --git a/.github/workflows/codeql-push.yml b/.github/workflows/codeql-push.yml
index a8b4ecd183865..38c86b86f5316 100644
--- a/.github/workflows/codeql-push.yml
+++ b/.github/workflows/codeql-push.yml
@@ -16,8 +16,8 @@ jobs:
     strategy:
       fail-fast: false
 
-    # CodeQL runs on ubuntu-latest and windows-latest
-    runs-on: ubuntu-latest
+    # CodeQL runs on ubuntu-20.04
+    runs-on: ubuntu-20.04
     if: github.repository == 'envoyproxy/envoy'
 
     steps:
diff --git a/.github/workflows/depsreview.yml b/.github/workflows/depsreview.yml
index 32c743e90bc60..1d1030c6e0d17 100644
--- a/.github/workflows/depsreview.yml
+++ b/.github/workflows/depsreview.yml
@@ -3,7 +3,7 @@ on: [pull_request]
 
 jobs:
   dependency-review:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     if: github.repository == 'envoyproxy/envoy'
     steps:
       - name: 'Checkout Repository'
diff --git a/.github/workflows/pr_notifier.yml b/.github/workflows/pr_notifier.yml
index d3c796599b61b..2d23af4bc21b2 100644
--- a/.github/workflows/pr_notifier.yml
+++ b/.github/workflows/pr_notifier.yml
@@ -6,7 +6,7 @@ on:
 jobs:
   pr_notifier:
     name: PR Notifier
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     if: github.repository == 'envoyproxy/envoy'
     steps:
     - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 571f3fc5758b5..30dba70d329b2 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -9,7 +9,7 @@ jobs:
       issues: write  # for actions/stale to close stale issues
       pull-requests: write  # for actions/stale to close stale PRs
     name: Prune Stale
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     if: github.repository == 'envoyproxy/envoy'
 
     steps: