use github runners

.github/workflows/ci.yaml

@@ -24,7 +24,7 @@ env:
   BUILDX_VERSION: v0.23.0
 jobs:
   setup:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     outputs:
       cache-key: ${{ steps.cache-key.outputs.key }}
     steps:
@@ -41,15 +41,15 @@ jobs:
     env:
       VERSION: v0.0.1-test
       SUBSTRATE_VERSION: 0.0.20
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     timeout-minutes: 30
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
       - name: Initialize Environment
         uses: ./.github/actions/initialize-environment
       - name: Allow unprivileged user namespaces
-        # Ubuntu 24.04 (ubuntu-latest) enables AppArmor-based restrictions on
+        # Ubuntu 24.04 (cncf-ubuntu-16-64-x86) enables AppArmor-based restrictions on
         # unprivileged user namespaces by default, which causes bubblewrap
         # to fail with EPERM on unshare(CLONE_NEWUSER)
         # See https://github.com/openai/codex/issues/14919
@@ -164,7 +164,7 @@ jobs:
 
   query-contraction-check:
     name: Query Contraction Check
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -185,7 +185,7 @@ jobs:
 
   proto-check:
     name: Protobuf Contract Check
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -207,7 +207,7 @@ jobs:
       - setup
     env:
       VERSION: v0.0.1-test
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     strategy:
       fail-fast: false
       matrix:
@@ -253,7 +253,7 @@ jobs:
       - setup
     env:
       VERSION: v0.0.1-test
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     strategy:
       fail-fast: false
       matrix:
@@ -295,7 +295,7 @@ jobs:
           kubectl logs -n kagent deployment/kagent-controller || true
 
   go-unit-tests:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -322,7 +322,7 @@ jobs:
   helm-unit-tests:
     env:
       VERSION: v0.0.1-test
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -346,7 +346,7 @@ jobs:
           helm unittest helm/tools/grafana-mcp
 
   ui-tests:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       pull-requests: write
@@ -402,7 +402,7 @@ jobs:
           - acp-sandbox-hermes
           - acp-sandbox-openclaw
           - acp-sandbox-claude
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     services:
       registry:
         image: registry:2
@@ -438,7 +438,7 @@ jobs:
         working-directory: ./
 
   go-lint:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -456,7 +456,7 @@ jobs:
   python-test:
     env:
       OPENAI_API_KEY: fake
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     strategy:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
@@ -483,7 +483,7 @@ jobs:
         run: make test
 
   python-lint:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -515,7 +515,7 @@ jobs:
           fi
 
   manifests-check:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6

.github/workflows/conventional-label.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   label-by-title:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       pull-requests: write

.github/workflows/image-scan.yaml

@@ -42,7 +42,7 @@ jobs:
           - build_target: golang-adk
             image_name: golang-adk
             tag_suffix: ""
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     services:
       registry:
         image: registry:2

.github/workflows/label-pull-requests.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   label-by-files:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       pull-requests: write

.github/workflows/migration-immutability.yaml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - uses: actions/checkout@v6
         with:

.github/workflows/run-agent-framework-test.yaml

@@ -63,7 +63,7 @@ jobs:
         - { name: scn1_ch22, scenario: scenario1, challenge: service-incorrect-port-number.yaml}
         - { name: scn1_ch23, scenario: scenario1, challenge: missing-service-selector.yaml}
         - { name: scn1_ch24, scenario: scenario1, challenge: pod-security-context-issue.yaml}
-    runs-on: ['ubuntu-latest']
+    runs-on: ['cncf-ubuntu-16-64-x86']
     steps:
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v4
@@ -150,7 +150,7 @@ jobs:
   summarize-results:
     needs: [solve-challenge]
     if: always()
-    runs-on: ['ubuntu-latest']
+    runs-on: ['cncf-ubuntu-16-64-x86']
     steps:
     - name: Summarize results
       run: |
@@ -159,4 +159,4 @@ jobs:
         EOF
         cat out.yaml
         echo "success: $(cat out.yaml|grep "status: success" |wc -l)"
-        echo "failures: $(cat out.yaml|grep "status: failure" |wc -l)"
+        echo "failures: $(cat out.yaml|grep "status: failure" |wc -l)"

.github/workflows/sqlc-generate-check.yaml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - uses: actions/checkout@v6
 

.github/workflows/tag.yaml

@@ -24,7 +24,7 @@ jobs:
           - acp-sandbox-hermes
           - acp-sandbox-openclaw
           - acp-sandbox-claude
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       packages: write
@@ -64,7 +64,7 @@ jobs:
   push-helm-chart:
     needs:
     - push-images
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       packages: write
@@ -89,7 +89,7 @@ jobs:
         fi
         make helm-publish
   release-python-packages:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       packages: write
@@ -143,7 +143,7 @@ jobs:
     needs:
     - push-helm-chart
     - release-python-packages
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: write
     steps:

.github/workflows/ui-chromatic.yaml

@@ -20,7 +20,7 @@ concurrency:
 
 jobs:
   chromatic:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       pull-requests: write

.github/workflows/ui-playwright.yaml

@@ -29,7 +29,7 @@ jobs:
   playwright:
     # Disabled until the Kind setup provisions Agent Substrate for SandboxAgent.
     if: false
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
     steps: