Update workflow runners to Ubuntu 26.04

[sarasvoss]

Summary

• update all GitHub-hosted workflow jobs from Ubuntu 24.04 to Ubuntu 26.04
• publish new minor versions for the eight affected reusable workflows and update their documentation
• update the root Node.js runtime pin from 24.15.0 to 24.21.0

Validation

• npm run ci
• version-label validation for all eight workflow releases
• no deployment or Terraform apply workflows were executed locally

Summary by CodeRabbit

• Updates
  • Workflow jobs now run on Ubuntu 26.04 instead of Ubuntu 24.04, including deployment, Terraform, validation, and security scanning workflows.
  • The configured Node.js version is now 24.21.0.
• Documentation
  • Workflow examples and version references have been updated to reflect the current runner and workflow versions.

[github-actions]

Tags

The following tags will be created on main after merge

🏷️ workflows/tf_validate_plan_single_root/0.2.0
🏷️ workflows/deploy_thru_prod/0.2.0
🏷️ workflows/tf_validate_plan_env_roots/0.2.0
🏷️ workflows/trigger_workflow_and_wait/0.2.0
🏷️ workflows/deploy_environment/0.2.0
🏷️ workflows/run_semgrep_scan/1.2.0
🏷️ workflows/run_sonar_scan/1.2.0
🏷️ workflows/tf_apply/0.2.0

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 9075cfd1-f16a-4892-a306-03f4d3a0ee8d

📥 Commits

Reviewing files that changed from the base of the PR and between 2be5bde and c5d59a7.

📒 Files selected for processing (27)

• .github/workflows/CHANGELOGS/deploy_environment.md
• .github/workflows/CHANGELOGS/deploy_thru_prod.md
• .github/workflows/CHANGELOGS/run_semgrep_scan.md
• .github/workflows/CHANGELOGS/run_sonar_scan.md
• .github/workflows/CHANGELOGS/tf_apply.md
• .github/workflows/CHANGELOGS/tf_validate_plan_env_roots.md
• .github/workflows/CHANGELOGS/tf_validate_plan_single_root.md
• .github/workflows/CHANGELOGS/trigger_workflow_and_wait.md
• .github/workflows/READMES/deploy_environment.md
• .github/workflows/READMES/deploy_thru_prod.md
• .github/workflows/READMES/run_semgrep_scan.md
• .github/workflows/READMES/run_sonar_scan.md
• .github/workflows/READMES/tf_apply.md
• .github/workflows/READMES/tf_validate_plan_env_roots.md
• .github/workflows/READMES/tf_validate_plan_single_root.md
• .github/workflows/READMES/trigger_workflow_and_wait.md
• .github/workflows/deploy_thru_prod.yml
• .github/workflows/internal_on_merge_tag_versions.yml
• .github/workflows/internal_on_pr_validate_component_version.yml
• .github/workflows/internal_on_push_ci.yml
• .github/workflows/run_semgrep_scan.yml
• .github/workflows/run_sonar_scan.yml
• .github/workflows/tf_apply.yml
• .github/workflows/tf_validate_plan_single_root.yml
• .github/workflows/trigger_workflow_and_wait.yml
• .nvmrc
• semgrep/README.md

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

Workflow jobs change from Ubuntu 24.04 to Ubuntu 26.04. Related workflow documentation, changelogs, and reusable workflow references are updated. The configured Node.js version changes from 24.15.0 to 24.21.0.

Changes

Workflow runner updates

Layer / File(s)	Summary
Deployment and Terraform workflow runners .github/workflows/deploy_thru_prod.yml, .github/workflows/tf_apply.yml, .github/workflows/tf_validate_plan_single_root.yml, .github/workflows/trigger_workflow_and_wait.yml, .github/workflows/READMES/*, .github/workflows/CHANGELOGS/*	Deployment, Terraform, and workflow-trigger jobs now use Ubuntu 26.04. Related documentation and changelogs record the runner updates and reusable workflow version changes.
Security scan runners .github/workflows/run_semgrep_scan.yml, .github/workflows/run_sonar_scan.yml, .github/workflows/READMES/run_semgrep_scan.md, .github/workflows/READMES/run_sonar_scan.md, .github/workflows/CHANGELOGS/run_semgrep_scan.md, .github/workflows/CHANGELOGS/run_sonar_scan.md, semgrep/README.md	Semgrep and SonarQube jobs now use Ubuntu 26.04. The documentation and changelogs record the runner updates and applicable workflow version change.
Internal automation runners .github/workflows/internal_on_merge_tag_versions.yml, .github/workflows/internal_on_pr_validate_component_version.yml, .github/workflows/internal_on_push_ci.yml	Release-tag, version-validation, and internal CI jobs now use Ubuntu 26.04.

Node.js version pin

Layer / File(s)	Summary
Update configured Node.js version .nvmrc	The configured Node.js version changes from 24.15.0 to 24.21.0.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: theowldude

Merge Risk: ⚪ Minimal · up to c5d59

This change moves workflows to Ubuntu 26.04 and updates the Node.js pin. No concrete merge-blocking risk was found.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: updating workflow runners from Ubuntu 24.04 to Ubuntu 26.04.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}