Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/apparmor-validate.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
matrix:
profile:
- filename: openedx_codejail_service.profile
os: ubuntu-24.04 # apparmor 4
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs to remain at 24.04 and not be updated to latest. See comments.

os: ubuntu-latest # apparmor 4
Copy link

Copilot AI Jan 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change is problematic because the apparmor profile specifically requires AppArmor 4 or higher, which is only available in Ubuntu 24.04+. The profile uses AppArmor 4-specific features including the abi <abi/4.0> declaration and attach_disconnected.path flag. The workflow comment at line 12 explicitly states "AppArmor version must be coordinated with ABI specified in profile."

GitHub's ubuntu-latest may not currently point to Ubuntu 24.04, which would cause this workflow to fail or behave incorrectly. The runner should remain pinned to ubuntu-24.04 to ensure the correct AppArmor version is used.

Suggested change
os: ubuntu-latest # apparmor 4
os: ubuntu-24.04 # apparmor 4

Copilot uses AI. Check for mistakes.
runs-on: "${{ matrix.profile.os }}"
steps:

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/push-docker-images.yml
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ on:

jobs:
set-matrix:
runs-on: ubuntu-22.04
runs-on: ubuntu-latest
outputs:
docker_images: ${{ steps.set-images-input.outputs.images_to_build }}
steps:
Expand All @@ -54,7 +54,7 @@ jobs:
echo "images_to_build=$images" >> $GITHUB_OUTPUT
fi
push:
runs-on: ubuntu-22.04
runs-on: ubuntu-latest
# Keep building other images even if one of them fails. As a confusing side
# effect, the overall workflow will show up as having passed (even though a
# job has failed), but the important part is that notification emails should
Expand Down