ci: pin release verification to Ubuntu 24.04

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ permissions:
 jobs:
   check:
     name: Lint, typecheck, and test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
         with:
@@ -39,7 +39,7 @@ jobs:
 
   image:
     name: Build container image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
         with:
@@ -59,7 +59,7 @@ jobs:
 
   ansible:
     name: Ansible sanity and integration
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
         with:

.github/workflows/release.yml

@@ -22,7 +22,7 @@ permissions:
 jobs:
   source:
     name: Resolve release source
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       sha: ${{ steps.release.outputs.sha }}
       tag: ${{ steps.release.outputs.tag }}
@@ -68,7 +68,7 @@ jobs:
       ref: ${{ needs.source.outputs.sha }}
       tag: ${{ needs.source.outputs.tag }}
       platform: linux/amd64
-      runner: ubuntu-latest
+      runner: ubuntu-24.04
 
   arm64:
     needs: [source, verify]
@@ -82,7 +82,7 @@ jobs:
   image:
     name: Publish verified multiarch image
     needs: [source, amd64, arm64]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: docker/setup-buildx-action@v4
       - uses: docker/login-action@v4

docs/DECISIONS.md

@@ -392,3 +392,17 @@ Ansible option `version_added` metadata accepts major/minor releases only. The
 patch-added proxy option is dated precisely in the 2.4.2 changelog and prose,
 without an inaccurate option-level version annotation. The collection's actual
 release remains 2.4.2 as requested.
+
+## 2026-11-06 — Pin the release test/build environment
+
+Pin GitHub-hosted x64 CI/build jobs to Ubuntu 24.04, matching the existing ARM64
+runner family, during the ubuntu-latest migration to 26.04. Logs showed unusually
+slow browser-dependency downloads on the moving label. Both systems are supported;
+this is a reproducibility choice, not a bypass of failing assertions. Test counts,
+permissions, native image smokes and offline compile checks stay unchanged.
+
+The workflow-dispatch release path can rebuild the existing immutable v2.4.2 tag
+using this updated infrastructure. Its source job still resolves/checks that tag,
+passes the exact SHA to every checkout and verifies app/collection versions.
+The application source/tag and collection archive remain unchanged. This
+infrastructure-only commit does not change product behaviour or its version.

docs/ansible.md

@@ -290,8 +290,9 @@ TLS verification and existing timeout/redirect limits still apply.
 
 Both accept `use_proxy: true` by default. Set it to `false` for direct image
 requests from a reachable controller/execution host; the V1 role exposes
-`v1_import_favicon_use_proxy: false`. This controls the favicon download, not the
-portal API connection. Python urllib `no_proxy` matches hostname suffixes; CIDRs
+`v1_import_favicon_use_proxy: false`. The V1-role flag controls only controller image downloads. In the direct
+`entry_favicon` module, Ansible also applies `use_proxy` to portal API calls;
+neither option alters the execution host's proxy environment. Python urllib `no_proxy` matches hostname suffixes; CIDRs
 such as `10.0.0.0/8` and IP-prefix shortcuts such as `10.` do not bypass proxies.
 Use explicit host/suffix exclusions or disable image proxy use for that task.
 See [Python ProxyHandler](https://docs.python.org/3/library/urllib.request.html#urllib.request.ProxyHandler).