ci: stabilize release/3.18 CI environment

.github/workflows/build.yml

@@ -25,7 +25,7 @@ jobs:
       fail-fast: false
       matrix:
         platform:
-          - ubuntu-latest
+          - ubuntu-24.04
         os_name:
           - linux_openresty
         test_dir:

.github/workflows/check-changelog.yml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   check-changelog:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

.github/workflows/cli.yml

@@ -25,7 +25,7 @@ jobs:
       fail-fast: false
       matrix:
         platform:
-          - ubuntu-latest
+          - ubuntu-24.04
         job_name:
           - linux_apisix_current_luarocks
           - linux_apisix_current_luarocks_in_customed_nginx

.github/workflows/close-unresponded.yml

@@ -13,7 +13,7 @@ jobs:
     permissions:
       issues: write  # for actions/stale to close stale issues
     name: Prune Unresponded
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
     steps:

.github/workflows/code-lint.yml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -32,7 +32,7 @@ jobs:
         make lint
 
   sc-lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - name: Checkout code

.github/workflows/doc-lint.yml

@@ -19,7 +19,7 @@ permissions:
 jobs:
   markdownlint:
     name: 🍇 Markdown
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 1
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -46,7 +46,7 @@ jobs:
 
   Chinse-Copywriting-lint:
     name: Chinese Copywriting
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 1
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/docker-standalone.yml

@@ -27,7 +27,7 @@ permissions:
 
 jobs:
   docker-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
 
     steps:

.github/workflows/kubernetes-ci.yml

@@ -25,7 +25,7 @@ jobs:
       fail-fast: false
       matrix:
         platform:
-          - ubuntu-latest
+          - ubuntu-24.04
         os_name:
           - linux_openresty
 

.github/workflows/license-checker.yml

@@ -29,7 +29,7 @@ permissions:
 
 jobs:
   check-license:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 3
 
     steps:

.github/workflows/link-check.yml

@@ -29,7 +29,7 @@ concurrency:
 
 jobs:
   check-links:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/lint.yml

@@ -8,7 +8,7 @@ permissions:
 jobs:
   misc:
     name: misc checker
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Check out code.
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -25,7 +25,7 @@ jobs:
           bash ./utils/check-plugins-code.sh
 
   ci-eclint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
 
     steps:

.github/workflows/push-dev-image-on-commit.yml

@@ -96,7 +96,7 @@ jobs:
   merge-tags:
     needs: build-test-push
     if: github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Login to Docker Hub
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0

.github/workflows/redhat-ci.yaml

@@ -18,7 +18,7 @@ permissions:
 jobs:
   test_apisix:
     name: run ci on redhat ubi
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
     strategy:
       fail-fast: false

.github/workflows/semantic.yml

@@ -14,7 +14,7 @@ permissions:
 jobs:
   main:
     name: Validate PR title
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Check out repository code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/source-install.yml

@@ -25,7 +25,7 @@ jobs:
       fail-fast: false
       matrix:
         platform:
-          - ubuntu-latest
+          - ubuntu-24.04
         os_platform:
           - ubuntu
           - redhat

.github/workflows/stale.yml

@@ -14,7 +14,7 @@ jobs:
       issues: write  # for actions/stale to close stale issues
       pull-requests: write  # for actions/stale to close stale PRs
     name: Prune Stale
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
     steps:

.github/workflows/tars-ci.yml

@@ -25,7 +25,7 @@ jobs:
       fail-fast: false
       matrix:
         platform:
-          - ubuntu-latest
+          - ubuntu-24.04
         os_name:
           - linux_openresty
 

.github/workflows/update-labels.yml

@@ -12,7 +12,7 @@ on:
 jobs:
   issue_commented:
     if: github.event.issue && !github.event.issue.pull_request && github.event.comment.user.login == github.event.issue.user.login && contains(github.event.issue.labels.*.name, 'wait for update') && !contains(github.event.issue.labels.*.name, 'user responded')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: update labels when user responds
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@@ -33,7 +33,7 @@ jobs:
 
   pr_commented:
     if: github.event.issue && github.event.issue.pull_request && github.event.comment.user.login == github.event.issue.user.login && (contains(github.event.issue.labels.*.name, 'wait for update') || contains(github.event.issue.labels.*.name, 'discuss') || contains(github.event.issue.labels.*.name, 'need test cases')) && !contains(github.event.issue.labels.*.name, 'user responded')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: update label when user responds
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@@ -48,7 +48,7 @@ jobs:
 
   pr_review_commented:
     if: github.event.pull_request && github.event.comment.user.login == github.event.pull_request.user.login && (contains(github.event.pull_request.labels.*.name, 'wait for update') || contains(github.event.pull_request.labels.*.name, 'discuss') || contains(github.event.issue.labels.*.name, 'need test cases')) && !contains(github.event.pull_request.labels.*.name, 'user responded')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: update label when user responds
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0

ci/common.sh

@@ -108,7 +108,10 @@ install_nodejs () {
     export PNPM_HOME="/pnpm"
     export PATH="$PNPM_HOME:$PATH"
     corepack enable pnpm
-    pnpm setup
+    # Pin the pnpm used outside t/, which has its own packageManager pin.
+    # pnpm 12 rejects setup under sudo, while these maintenance branches run
+    # this installer through sudo in CI. Keep the last version known to work.
+    corepack prepare pnpm@11.25.0 --activate
 }
 
 install_brotli () {

docker/debian-dev/Dockerfile

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM debian:bullseye-slim AS build
+FROM debian/eol:bullseye AS build
 
 ARG ENABLE_PROXY=false
 ARG CODE_PATH
@@ -49,7 +49,7 @@ RUN set -x \
     && cp -r deps ${ENV_INST_LUADIR} \
     && make install
 
-FROM debian:bullseye-slim
+FROM debian/eol:bullseye
 
 ARG ENTRYPOINT_PATH=./docker-entrypoint.sh
 ARG INSTALL_BROTLI=./install-brotli.sh