chore(github-action): update action ubuntu to v26

.github/workflows/bats.yml

@@ -34,7 +34,7 @@ permissions:
 jobs:
   test:
     name: BATS
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     permissions:
       contents: read

.github/workflows/cleanup-packages.yaml

@@ -43,7 +43,7 @@ permissions:
 jobs:
   cleanup:
     name: Prune untagged devcontainer digests
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     permissions:
       contents: read

.github/workflows/devcontainer-prebuild.yaml

@@ -168,7 +168,7 @@ jobs:
 
   merge:
     name: Create Multi-Platform Manifest
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs: prebuild
     # Merge when images were actually pushed: main, schedule, dispatch, or v* tag.
     if: |
@@ -330,7 +330,7 @@ jobs:
       - prebuild
       - merge
     if: ${{ always() && github.event_name != 'pull_request' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:

.github/workflows/docs.yml

@@ -25,7 +25,7 @@ permissions:
 jobs:
   build:
     name: Build docs
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Harden runner
         # renovate: datasource=github-tags depName=DevSecNinja/.github
@@ -56,7 +56,7 @@ jobs:
 
   deploy:
     name: Deploy to GitHub Pages
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs: build
     if: github.event_name == 'push'
     permissions:
@@ -81,7 +81,7 @@ jobs:
       - build
       - deploy
     if: ${{ always() && github.ref == 'refs/heads/main' && github.event_name == 'push' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:

.github/workflows/release-please.yml

@@ -49,7 +49,7 @@ jobs:
     needs:
       - release-please
     if: ${{ always() && github.ref == 'refs/heads/main' && github.event_name == 'push' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:

.github/workflows/release.yml

@@ -40,7 +40,7 @@ concurrency:
 jobs:
   release:
     name: Build, attest, and publish
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
       # Required by actions/attest-build-provenance to mint the OIDC token
@@ -169,7 +169,7 @@ jobs:
     # condition meaningful; the action itself derives resolved-vs-firing
     # from `needs.release.result`.
     if: ${{ always() }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:

.github/workflows/sign-powershell.yml

@@ -103,7 +103,7 @@ jobs:
     needs:
       - sign-scripts
     if: ${{ always() && github.ref == 'refs/heads/main' && github.event_name == 'push' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:

.github/workflows/todo-to-issue.yml

@@ -17,7 +17,7 @@ permissions:
 jobs:
   run:
     name: "Run Todo to Issue"
-    runs-on: "ubuntu-24.04"
+    runs-on: "ubuntu-26.04"
     timeout-minutes: 10
     steps:
       - name: Harden runner