From 3bfe8b27fa62cb0c25a83de7d741350e05c00a40 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 15 Aug 2026 12:25:40 +0200 Subject: [PATCH 01/11] ci: use reusable install-go action Signed-off-by: Sebastiaan van Stijn --- .github/actions/install-go/action.yml | 2 +- .github/workflows/ci.yml | 13 ++++--------- .github/workflows/codeql.yml | 4 +--- 3 files changed, 6 insertions(+), 13 deletions(-) diff --git a/.github/actions/install-go/action.yml b/.github/actions/install-go/action.yml index d3311aac..3e506405 100644 --- a/.github/actions/install-go/action.yml +++ b/.github/actions/install-go/action.yml @@ -3,7 +3,7 @@ description: "Reusable action to install Go, so there is one place to bump Go ve inputs: go-version: required: true - default: "1.24.3" + default: "1.24.x" description: "Go version to install" runs: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 519be07e..4baec34a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,7 +29,7 @@ jobs: path: src/github.com/containerd/nri fetch-depth: 25 - - uses: ./src/github.com/containerd/nri/.github/actions/install-go + - uses: $/.github/actions/install-go - uses: containerd/project-checks@v1.2.2 with: @@ -42,12 +42,7 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: ./.github/actions/install-go - - # needed for wasm plugins - - uses: actions/setup-go@v5 - with: - go-version-file: go.mod + - uses: $/.github/actions/install-go - name: Set env shell: bash @@ -82,7 +77,7 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: ./.github/actions/install-go + - uses: $/.github/actions/install-go with: go-version: ${{ matrix.go-version }} @@ -106,7 +101,7 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: ./.github/actions/install-go + - uses: $/.github/actions/install-go with: go-version: ${{ matrix.go-version }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 442c7386..ef8665b7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -27,9 +27,7 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 - - uses: actions/setup-go@v5 - with: - go-version-file: go.mod + - uses: $/.github/actions/install-go - name: Initialize CodeQL uses: github/codeql-action/init@v2 From 2a66ab245d06f969e8e5f723e51936b016f00e1e Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 15 Aug 2026 11:33:47 +0200 Subject: [PATCH 02/11] ci: update actions/checkout@v7.0.1 Signed-off-by: Sebastiaan van Stijn --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/codeql.yml | 2 +- .github/workflows/codespell.yml | 2 +- .github/workflows/images.yml | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4baec34a..017c960c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,7 +24,7 @@ jobs: echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV echo "${{ github.workspace }}/bin" >> $GITHUB_PATH - - uses: actions/checkout@v4 + - uses: actions/checkout@v7.0.1 with: path: src/github.com/containerd/nri fetch-depth: 25 @@ -41,7 +41,7 @@ jobs: timeout-minutes: 5 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-go - name: Set env @@ -76,7 +76,7 @@ jobs: os: [ubuntu-22.04] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-go with: go-version: ${{ matrix.go-version }} @@ -100,7 +100,7 @@ jobs: go-version: ["1.24.x"] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-go with: go-version: ${{ matrix.go-version }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ef8665b7..9194ab00 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -25,7 +25,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-go diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index b80fef70..4f37674e 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -16,6 +16,6 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7.0.1 - name: Codespell uses: codespell-project/actions-codespell@v2 diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index 44ac9c47..c014dfb9 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -38,7 +38,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v7.0.1 - name: Install cosign if: github.event_name != 'pull_request' From ebdebf68ef55b29478e421b0dd0686ce8b15589d Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 15 Aug 2026 11:35:20 +0200 Subject: [PATCH 03/11] ci: update actions/setup-go@v7.0.0 Signed-off-by: Sebastiaan van Stijn --- .github/actions/install-go/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/install-go/action.yml b/.github/actions/install-go/action.yml index 3e506405..2e4b60df 100644 --- a/.github/actions/install-go/action.yml +++ b/.github/actions/install-go/action.yml @@ -10,7 +10,7 @@ runs: using: composite steps: - name: "Setup Go" - uses: actions/setup-go@v5 + uses: actions/setup-go@v7.0.0 with: go-version: ${{ inputs.go-version }} cache: false # see actions/setup-go#368 From 3d0359bc626aa753952db6a4be6e27f5b777903b Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 15 Aug 2026 11:38:59 +0200 Subject: [PATCH 04/11] ci: update docker actions Signed-off-by: Sebastiaan van Stijn --- .github/workflows/images.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index c014dfb9..10ce4b14 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -47,11 +47,11 @@ jobs: cosign-release: 'v2.5.3' - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4.2.0 - name: Log in to registry if: github.event_name == 'push' - uses: docker/login-action@v3 + uses: docker/login-action@v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -81,7 +81,7 @@ jobs: - name: Build and push image id: build-and-push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7.3.0 with: context: . file: ./plugins/Dockerfile From 6597f73197f3be16f806d660459a7fedaf4a4798 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 15 Aug 2026 11:40:56 +0200 Subject: [PATCH 05/11] ci: update golangci/golangci-lint-action@v9.3.0 Signed-off-by: Sebastiaan van Stijn --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 017c960c..e6ebc774 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -86,9 +86,9 @@ jobs: run: | echo "${{ github.workspace }}/bin" >> $GITHUB_PATH - - uses: golangci/golangci-lint-action@v8 + - uses: golangci/golangci-lint-action@v9.3.0 with: - version: v2.4 + version: v2.12 tests: name: Tests From de3aa56e53c9a1cb05e16d0da866258b61f218a3 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 15 Aug 2026 11:42:32 +0200 Subject: [PATCH 06/11] ci: update sigstore/cosign-installer@v4.1.2 Signed-off-by: Sebastiaan van Stijn --- .github/workflows/images.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index 10ce4b14..ea307cf6 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -42,7 +42,7 @@ jobs: - name: Install cosign if: github.event_name != 'pull_request' - uses: sigstore/cosign-installer@v3 + uses: sigstore/cosign-installer@v4.1.2 with: cosign-release: 'v2.5.3' From c2b379ff45193e226bc05e3b0309b1f6d1320340 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 15 Aug 2026 11:46:30 +0200 Subject: [PATCH 07/11] ci: update github/codeql-action v4.37.7 Signed-off-by: Sebastiaan van Stijn --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9194ab00..f88a1ef4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,7 +30,7 @@ jobs: - uses: $/.github/actions/install-go - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@v4.37.7 - name: Install protoc and plugins run: | @@ -40,4 +40,4 @@ jobs: - run: make - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@v4.37.7 From b54c44fb715a67278294f4b390d241034688c54c Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 15 Aug 2026 11:47:27 +0200 Subject: [PATCH 08/11] ci: update codespell-project/actions-codespell@v2.2 Signed-off-by: Sebastiaan van Stijn --- .github/workflows/codespell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index 4f37674e..ab777708 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -18,4 +18,4 @@ jobs: - name: Checkout uses: actions/checkout@v7.0.1 - name: Codespell - uses: codespell-project/actions-codespell@v2 + uses: codespell-project/actions-codespell@v2.2 From 8d0729900bcf9f09c1e08b8c0641ac1252d0b4d7 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 15 Aug 2026 11:55:00 +0200 Subject: [PATCH 09/11] ci: set default permissions, concurrency, and fix zizmor linting Set the default permissions to `contents: read`. For public repositories this is effectively equivalent for workflows that only need to check out the repository, but unlike `permissions: {}`, it also allows workflows to access repository contents when running in private forks. Also set default workflow concurrency and address the remaining zizmor lint warnings. Signed-off-by: Sebastiaan van Stijn --- .github/workflows/ci.yml | 14 ++++++++++++++ .github/workflows/codeql.yml | 12 ++++++++---- .github/workflows/codespell.yml | 6 ++++++ .github/workflows/images.yml | 17 +++++++++-------- 4 files changed, 37 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e6ebc774..57255db6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,6 +9,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: checks: @@ -28,6 +32,7 @@ jobs: with: path: src/github.com/containerd/nri fetch-depth: 25 + persist-credentials: false - uses: $/.github/actions/install-go @@ -42,6 +47,9 @@ jobs: steps: - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - uses: $/.github/actions/install-go - name: Set env @@ -77,6 +85,9 @@ jobs: steps: - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - uses: $/.github/actions/install-go with: go-version: ${{ matrix.go-version }} @@ -101,6 +112,9 @@ jobs: steps: - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - uses: $/.github/actions/install-go with: go-version: ${{ matrix.go-version }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f88a1ef4..876e9c28 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -2,15 +2,17 @@ name: "CodeQL Scan" on: push: - branches: - - main + branches: [ main ] pull_request: - branches: - - main + branches: [ main ] permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: CodeQL-Build: if: github.repository == 'containerd/nri' @@ -26,6 +28,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v7.0.1 + with: + persist-credentials: false - uses: $/.github/actions/install-go diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index ab777708..48f98b39 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -9,6 +9,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: codespell: name: Check for spelling errors @@ -17,5 +21,7 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7.0.1 + with: + persist-credentials: false - name: Codespell uses: codespell-project/actions-codespell@v2.2 diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index ea307cf6..fbc42684 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -2,19 +2,18 @@ name: Publish Container Images on: push: - branches: - - main + branches: [main] tags: - v[0-9]+.[0-9]+.[0-9]+ pull_request: +permissions: + contents: read + concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -permissions: - contents: read - jobs: build-and-push: name: Build and Push (${{ matrix.image }}) @@ -39,6 +38,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v7.0.1 + with: + persist-credentials: false - name: Install cosign if: github.event_name != 'pull_request' @@ -60,13 +61,13 @@ jobs: - name: Determine image tag name id: tag run: | - if [ "${{ github.ref_type }}" = "tag" ]; then - tag="${{ github.ref_name }}" + if [ "${GITHUB_REF_TYPE}" = "tag" ]; then + tag="${GITHUB_REF_NAME}" else if [ "${{ github.event_name }}" = "pull_request" ]; then tag="pr-${{ github.event.pull_request.number }}" else - case "${{ github.ref_name }}" in + case "${GITHUB_REF_NAME}" in main) tag="unstable" ;; From d58850caa8cd24ca33893dc543852dfe49e1596f Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 15 Aug 2026 12:07:25 +0200 Subject: [PATCH 10/11] ci: pin all actions by sha Signed-off-by: Sebastiaan van Stijn --- .github/actions/install-go/action.yml | 2 +- .github/workflows/ci.yml | 12 ++++++------ .github/workflows/codeql.yml | 6 +++--- .github/workflows/codespell.yml | 4 ++-- .github/workflows/images.yml | 10 +++++----- 5 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/actions/install-go/action.yml b/.github/actions/install-go/action.yml index 2e4b60df..ca14b749 100644 --- a/.github/actions/install-go/action.yml +++ b/.github/actions/install-go/action.yml @@ -10,7 +10,7 @@ runs: using: composite steps: - name: "Setup Go" - uses: actions/setup-go@v7.0.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version }} cache: false # see actions/setup-go#368 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 57255db6..d3658e87 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,7 +28,7 @@ jobs: echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV echo "${{ github.workspace }}/bin" >> $GITHUB_PATH - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: src/github.com/containerd/nri fetch-depth: 25 @@ -36,7 +36,7 @@ jobs: - uses: $/.github/actions/install-go - - uses: containerd/project-checks@v1.2.2 + - uses: containerd/project-checks@d7751f3c375b8fe4a84c02a068184ee4c1f59bc4 # v1.2.2 with: working-directory: src/github.com/containerd/nri @@ -46,7 +46,7 @@ jobs: timeout-minutes: 5 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -84,7 +84,7 @@ jobs: os: [ubuntu-22.04] steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -97,7 +97,7 @@ jobs: run: | echo "${{ github.workspace }}/bin" >> $GITHUB_PATH - - uses: golangci/golangci-lint-action@v9.3.0 + - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: v2.12 @@ -111,7 +111,7 @@ jobs: go-version: ["1.24.x"] steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 876e9c28..b9e84a4c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -27,14 +27,14 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: $/.github/actions/install-go - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.7 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 - name: Install protoc and plugins run: | @@ -44,4 +44,4 @@ jobs: - run: make - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.7 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index 48f98b39..ba70bc11 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -20,8 +20,8 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Codespell - uses: codespell-project/actions-codespell@v2.2 + uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # v2.2 diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index fbc42684..dabe3247 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -37,22 +37,22 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install cosign if: github.event_name != 'pull_request' - uses: sigstore/cosign-installer@v4.1.2 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 with: cosign-release: 'v2.5.3' - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4.2.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Log in to registry if: github.event_name == 'push' - uses: docker/login-action@v4.6.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -82,7 +82,7 @@ jobs: - name: Build and push image id: build-and-push - uses: docker/build-push-action@v7.3.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . file: ./plugins/Dockerfile From d952523c228ec8120116837245720d14a84814d0 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 15 Aug 2026 12:59:26 +0200 Subject: [PATCH 11/11] ci: update to ubuntu-26.04 Signed-off-by: Sebastiaan van Stijn --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/codeql.yml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d3658e87..f58d1c6d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ jobs: checks: name: Project Checks - runs-on: ubuntu-22.04 + runs-on: ubuntu-26.04 timeout-minutes: 5 steps: @@ -42,7 +42,7 @@ jobs: test-build: name: Check buildability - runs-on: ubuntu-22.04 + runs-on: ubuntu-26.04 timeout-minutes: 5 steps: @@ -81,7 +81,7 @@ jobs: strategy: matrix: go-version: ["1.24.x"] - os: [ubuntu-22.04] + os: [ubuntu-26.04] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -103,7 +103,7 @@ jobs: tests: name: Tests - runs-on: ubuntu-22.04 + runs-on: ubuntu-26.04 timeout-minutes: 5 strategy: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b9e84a4c..25945c69 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -21,7 +21,7 @@ jobs: contents: read # for actions/checkout to fetch code security-events: write # for github/codeql-action/analyze to upload SARIF results - runs-on: ubuntu-22.04 + runs-on: ubuntu-26.04 timeout-minutes: 30