Pin runner images to specific versions

.github/renovate.json5

@@ -1,7 +1,19 @@
 {
     extends: [
-        'config:best-practices',
-        'config:semverAllMonthly',
+        "config:best-practices",
+        "config:semverAllMonthly",
+    ],
+    additionalBranchPrefix: "{{datasource}}-",
+    customManagers: [
+        {
+            customType: "regex",
+            datasourceTemplate: "github-runners",
+            depTypeTemplate: "github-runner",
+            versioningTemplate: "docker",
+            fileMatch: ["^\\.github/workflows/.+\\.ya?ml$"],
+            matchStrings: [
+                "[\"']?(?<depName>[^\\s]+?)-(?<currentValue>[^\\s]+?)[\"']?\\s+# renovate: github-runner",
+            ],
+        },
     ],
-    additionalBranchPrefix: '{{categories}}-',
 }

.github/workflows/ci-cd.yml

@@ -4,7 +4,7 @@ on: [push, pull_request]
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
       - name: Install uv
@@ -19,10 +19,13 @@ jobs:
         run: make lint
 
   test:
-    runs-on: ${{ matrix.os }}-latest
+    runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu, macos, windows]
+        os:
+          - ubuntu-24.04  # renovate: github-runner
+          - macos-14  # renovate: github-runner
+          - windows-2022  # renovate: github-runner
         python-version:
           - "3.9"
           - "3.10"
@@ -55,7 +58,7 @@ jobs:
           include-hidden-files: true
 
   coverage:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: test
     outputs:
       percentage: ${{ steps.percentage.outputs.percentage }}
@@ -81,7 +84,7 @@ jobs:
         run: coverage report --fail-under=100
 
   coverage-badge:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: coverage
     if: github.event_name == 'push' && github.ref_name == 'main'
     permissions:
@@ -122,7 +125,7 @@ jobs:
           git commit -am "Update coverage" && git push || true
 
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
       - name: Install uv
@@ -139,7 +142,7 @@ jobs:
           if-no-files-found: error
 
   pypi-publish:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
       - lint
       - test
@@ -159,7 +162,7 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
 
   lint-spec-parser:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     defaults:
       run:
         working-directory: spec_parser
@@ -177,7 +180,7 @@ jobs:
         run: make lint
 
   dummy-required-job:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
       - lint
       - test

.github/workflows/update-elements.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   update:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
       - name: Install uv