Merge pull request #847 from dev-sec/pin_runner_images

Author: schurzi

.config/ansible-lint.yml

@@ -5,6 +5,7 @@
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
   - .cache/ # implicit unless exclude_paths is defined in config
+  - .ansible/ # somehow someone decided that the cache directory should be renamed
   # add all waivers individually, since exclude_files does not support globs
   - molecule/os_hardening/waivers.yaml
   - molecule/ssh_hardening_bsd/waivers_freebsd13.yaml

.github/workflows/ansible-lint.yml

@@ -23,7 +23,7 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   ansible-lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

.github/workflows/enforce-labels.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   enforce-label:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
         with:

.github/workflows/galaxy-publish.yml

@@ -9,7 +9,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   deploy:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 

.github/workflows/mysql_hardening.yml

@@ -29,7 +29,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1

.github/workflows/nginx_hardening.yml

@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1

.github/workflows/os_hardening.yml

@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     env:
       PY_COLORS: 1
       ANSIBLE_FORCE_COLOR: 1

.github/workflows/prettier-md.yml

@@ -11,7 +11,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   prettier-md:
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 1
 
     steps:

.github/workflows/release.yml

@@ -11,7 +11,7 @@ jobs:
   generate_changelog:
     name: create release draft
     if: github.repository == 'dev-sec/ansible-collection-hardening'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:

.github/workflows/roles-readme.yml

@@ -17,7 +17,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   readme:
     name: create roles readme
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     strategy:
       matrix:
         roles: