ci: pin GitHub Actions runners from ubuntu-latest to ubuntu-24.04 (#23)

* Update GitHub workflows from ubuntu-latest to ubuntu-24.04

Co-authored-by: deviantintegral <255023+deviantintegral@users.noreply.github.com>

* Add explicit permissions blocks to ci.yml and conventional-commits.yml

Co-authored-by: deviantintegral <255023+deviantintegral@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: deviantintegral <255023+deviantintegral@users.noreply.github.com>

Author: Copilot

.github/workflows/ci.yml

@@ -7,7 +7,9 @@ on:
 
 jobs:
   lint-and-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7

.github/workflows/conventional-commits.yml

@@ -5,7 +5,9 @@ on:
 
 jobs:
   validate:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:

.github/workflows/publish-to-pypi.yml

@@ -14,7 +14,7 @@ jobs:
 
   build:
     needs: ci
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:
@@ -41,7 +41,7 @@ jobs:
   publish-to-testpypi:
     needs: build
     if: github.event_name == 'push'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     environment: testpypi
     permissions:
       id-token: write
@@ -57,7 +57,7 @@ jobs:
   publish-to-pypi:
     needs: build
     if: github.event_name == 'release'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     environment: pypi
     permissions:
       id-token: write

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
     uses: ./.github/workflows/ci.yml
 
   release-please:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
     steps:
@@ -25,7 +25,7 @@ jobs:
   publish:
     needs: [ci, release-please]
     if: ${{ needs.release-please.outputs.release_created }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     environment: pypi
     permissions:
       id-token: write