chore(deps): update dependency ubuntu to v26

[mergeraptor]

This PR contains the following updates:

Package	Type	Update	Change
ubuntu	github-runner	major	24.04 → 26.04

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[hivecommons-hive]

🐝 Superseded regeneration series

mergeraptor[bot] has 2 open PRs regenerating the same file(s). This one is the newest, so the 1 older one(s) are superseded by construction:

• chore(deps): update projectbluefin/actions digest to 837850b #1135 — chore(deps): update projectbluefin/actions digest to 837850b

Posted once on the newest PR rather than on each of them, so a daily regeneration does not produce a daily comment on every PR in the series.

Evidence — identical changed-file set (1 file(s)):

• .github/workflows/build.yml

---

This is a suggestion, not a verdict. Hive will not close, label, approve or merge anything here — a human decides.

It was produced by comparing changed-file sets across open PRs, which is a candidate generator: PRs that share a file are not necessarily the same work. Here the patches DIFFER, so this is the weaker tier: dependency-bump PRs that edit one shared manifest, and unrelated fixes to one busy file, both land in it. Read the diffs before acting.

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.78

[Danathar]

Blocking for the same reason as projectbluefin/dakota#1592: build.yml calls projectbluefin/actions/bootc-build/setup-runner@v1 with update-podman: "true", and that action's "Add Ubuntu resolute apt source" step does test "${IDV}" = "ubuntu-24.04" under set -eux — on a ubuntu-26.04 runner the image build dies at setup before podman is touched. The validate failure here is only actionlint not knowing the new label yet; the runners themselves are deployed. The action needs to stop asserting 24.04 first (it has a TODO: remove when Ubuntu 26.04 runners ship a new-enough podman right above the check), then this bump can go through.

[Danathar]

The blocker for this bump now has a tracking issue: projectbluefin/actions#541 (setup-runner asserts ubuntu-24.04 under set -e, so every image build would fail at setup on a 26.04 runner). Once that action is fixed, this PR just needs a re-run — nothing to change here.

[Danathar]

Update on where this is blocked. projectbluefin/actions#541 is fixed (actions#549 merged 2026-09-20 09:47 UTC, and v1 now points at 837850b), so the setup-runner assertion no longer applies.

This PR is still red on validate for a different reason. The pinned actionlint (v1.7.12 in .pre-commit-config.yaml) does not know the ubuntu-26.04 runner label:

label "ubuntu-26.04" is unknown. available labels are "windows-latest", ... "ubuntu-24.04", ...

Upstream actionlint has not added the label yet. projectbluefin/review already handles this with a .github/actionlint.yaml that allowlists ubuntu-26.04 and ubuntu-26.04-arm under self-hosted-runner.labels. This repo needs the same entry before any ubuntu-26.04 bump can pass validate. That is a separate small PR on the repo, not a change to this one; Renovate will rebase this once it lands.

[Danathar]

The actionlint allowlist is now open as #1151. Once that lands, a Renovate rebase of this branch should turn validate green.

[hivecommons-hive]

validate is failing here at the actionlint pre-commit hook, not at anything this bump got wrong:

.github/workflows/build.yml:151:14: label "ubuntu-26.04" is unknown.
available labels are ... "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", ...
if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file [runner-label]

This bump moves runners to ubuntu-26.04, which the pinned actionlint does not yet know about. The fix is to teach actionlint the label (an actionlint.yaml config entry), not to change this bump.

That fix is already in flight as #1151 (ci(actionlint): allow the ubuntu-26.04 runner labels). This PR should go green once #1151 lands; it is not worth a second implementation here.

— hive: agent=scanner backend=copilot model=claude-opus-5 copilot=1.0.78

[castrojo]

@renovate rebase

[Danathar]

Approved at 6d7b8ba. Both things that blocked this on Saturday are gone: projectbluefin/actions#549 removed the ubuntu-24.04 assertion from setup-runner, and #1151 taught the pinned actionlint the ubuntu-26.04 labels. At this head validate passes and both image builds ran on the new runners and passed (x86_64 and aarch64), with Trivy green.