remove runs-on input to avoid running builds on unattended runners

.github/workflows/bake.yml

@@ -3,10 +3,6 @@ name: bake
 on:
   workflow_call:
     inputs:
-      runs-on:
-        type: string
-        description: "Type of machine to run the jobs on similar to jobs.<job_id>.runs-on (defaults to best matching runner depending on target platform)"
-        required: false
       context:
         type: string
         description: "Context to build from (defaults to repository root)"
@@ -145,7 +141,7 @@ env:
 
 jobs:
   prepare:
-    runs-on: ${{ inputs.runs-on || 'ubuntu-latest' }}
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     outputs:
@@ -177,7 +173,6 @@ jobs:
         uses: actions/github-script@v8
         env:
           INPUT_MATRIX-SIZE-LIMIT: ${{ env.MATRIX_SIZE_LIMIT }}
-          INPUT_RUNS-ON: ${{ inputs.runs-on }}
           INPUT_CONTEXT: ${{ inputs.context }}
           INPUT_TARGET: ${{ inputs.target }}
           INPUT_BAKE-ALLOW: ${{ inputs.bake-allow }}
@@ -194,7 +189,6 @@ jobs:
 
             const inpMatrixSizeLimit = parseInt(core.getInput('matrix-size-limit'), 10);
 
-            const inpRunsOn = core.getInput('runs-on');
             const inpContext = core.getInput('context');
             const inpTarget = core.getInput('target');
             const inpBakeAllow = core.getInput('bake-allow');
@@ -240,18 +234,14 @@ jobs:
               } else if (platforms.length === 0) {
                 includes.push({
                   index: 0,
-                  'runs-on': inpRunsOn || 'ubuntu-latest'
+                  runner: 'ubuntu-24.04'
                 });
               } else {
                 platforms.forEach((platform, index) => {
-                  let runsOn = inpRunsOn;
-                  if (!runsOn) {
-                    runsOn = platform.startsWith('linux/arm') ? 'ubuntu-24.04-arm' : 'ubuntu-latest';
-                  }
                   includes.push({
                     index: index,
                     platform: platform,
-                    'runs-on': runsOn
+                    runner: platform.startsWith('linux/arm') ? 'ubuntu-24.04-arm' : 'ubuntu-24.04'
                   });
                 });
               }
@@ -260,7 +250,7 @@ jobs:
             });
 
   build:
-    runs-on: ${{ matrix.runs-on }}
+    runs-on: ${{ matrix.runner }}
     needs:
       - prepare
     permissions:
@@ -633,7 +623,7 @@ jobs:
             core.setOutput(`result_${inpIndex}`, JSON.stringify(result));
 
   finalize:
-    runs-on: ${{ inputs.runs-on || 'ubuntu-latest' }}
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       id-token: write # for registry authentication with OIDC if needed

.github/workflows/build.yml

@@ -3,10 +3,6 @@ name: build
 on:
   workflow_call:
     inputs:
-      runs-on:
-        type: string
-        description: "Type of machine to run the jobs on similar to jobs.<job_id>.runs-on (defaults to best matching runner depending on target platform)"
-        required: false
       context:
         type: string
         description: "Context to build from (defaults to repository root)"
@@ -156,7 +152,7 @@ env:
 
 jobs:
   prepare:
-    runs-on: ${{ inputs.runs-on || 'ubuntu-latest' }}
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     outputs:
@@ -176,15 +172,13 @@ jobs:
         uses: actions/github-script@v8
         env:
           INPUT_MATRIX-SIZE-LIMIT: ${{ env.MATRIX_SIZE_LIMIT }}
-          INPUT_RUNS-ON: ${{ inputs.runs-on }}
           INPUT_BUILD-PLATFORMS: ${{ inputs.build-platforms }}
         with:
           script: |
             const { Util } = require('@docker/actions-toolkit/lib/util');
 
             const inpMatrixSizeLimit = parseInt(core.getInput('matrix-size-limit'), 10);
 
-            const inpRunsOn = core.getInput('runs-on');
             const inpBuildPlatforms = Util.getInputList('build-platforms');
 
             await core.group(`Set includes`, async () => {
@@ -194,18 +188,14 @@ jobs:
               } else if (inpBuildPlatforms.length === 0) {
                 includes.push({
                   index: 0,
-                  'runs-on': inpRunsOn || 'ubuntu-latest'
+                  runner: 'ubuntu-24.04'
                 });
               } else {
                 inpBuildPlatforms.forEach((platform, index) => {
-                  let runsOn = inpRunsOn;
-                  if (!runsOn) {
-                    runsOn = platform.startsWith('linux/arm') ? 'ubuntu-24.04-arm' : 'ubuntu-latest';
-                  }
                   includes.push({
                     index: index,
                     platform: platform,
-                    'runs-on': runsOn
+                    runner: platform.startsWith('linux/arm') ? 'ubuntu-24.04-arm' : 'ubuntu-24.04'
                   });
                 });
               }
@@ -214,7 +204,7 @@ jobs:
             });
 
   build:
-    runs-on: ${{ matrix.runs-on }}
+    runs-on: ${{ matrix.runner }}
     needs:
       - prepare
     permissions:
@@ -524,7 +514,7 @@ jobs:
             core.setOutput(`result_${inpIndex}`, JSON.stringify(result));
 
   finalize:
-    runs-on: ${{ inputs.runs-on || 'ubuntu-latest' }}
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       id-token: write # for registry authentication with OIDC if needed

.github/workflows/verify.yml

@@ -14,7 +14,7 @@ on:
 
 jobs:
   verify:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       -
         name: Extract builder outputs