ci: route upgraded Linux jobs to v2 runner pools

.github/actionlint.yaml

@@ -1,4 +1,5 @@
 # Custom labels also cover organization-configured GitHub-hosted larger runners.
 self-hosted-runner:
   labels:
-    - ubuntu-24.04-arm64-8core
+    - ubuntu-latest-8-cores-v2
+    - ubuntu-24.04-arm64-8core-v2

.github/workflows/agent-ci.yml

@@ -83,7 +83,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-26, windows-latest]
+        os: [ubuntu-latest-8-cores-v2, macos-26, windows-latest]
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:

.github/workflows/agent-desktop-build.yml

@@ -208,7 +208,7 @@ jobs:
     name: Linux AppImage (${{ matrix.variant }})
     needs: changes
     if: ${{ always() && !cancelled() && ((github.event_name == 'pull_request' && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false')) || (github.repository == 'MaplePrivacyLabs/Maple' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch'))) }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-8-cores-v2
     timeout-minutes: 120
     strategy:
       fail-fast: false

.github/workflows/android-build.yml

@@ -18,7 +18,7 @@ jobs:
     environment: android-signing
     needs: changes
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.android != 'false') }}
-    runs-on: ubuntu-latest-8-cores
+    runs-on: ubuntu-latest-8-cores-v2
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
         with:
@@ -102,7 +102,7 @@ jobs:
 
   verify-android-artifacts:
     needs: build-android
-    runs-on: ubuntu-latest-8-cores
+    runs-on: ubuntu-latest-8-cores-v2
     permissions:
       contents: read
     steps:

.github/workflows/android-pr-build.yml

@@ -14,7 +14,7 @@ jobs:
   build-android:
     needs: changes
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.android != 'false') }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-8-cores-v2
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
         with:

.github/workflows/auth-pages-build.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   build:
     if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-8-cores-v2
     timeout-minutes: 30
     steps:
       - name: Checkout auth source

.github/workflows/auth-pages-ci.yml

@@ -34,7 +34,7 @@ jobs:
       github.event_name == 'pull_request' ||
       ((github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
         github.ref == 'refs/heads/master')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-8-cores-v2
     timeout-minutes: 30
     env:
       SOURCE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}

.github/workflows/desktop-build.yml

@@ -90,7 +90,7 @@ jobs:
     environment: desktop-signing
     needs: changes
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.linux != 'false') }}
-    runs-on: ubuntu-latest-8-cores
+    runs-on: ubuntu-latest-8-cores-v2
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
         with:
@@ -167,7 +167,7 @@ jobs:
   verify-linux-desktop-artifacts:
     needs:
       - build-linux
-    runs-on: ubuntu-latest-8-cores
+    runs-on: ubuntu-latest-8-cores-v2
     permissions:
       contents: read
     steps:
@@ -341,7 +341,7 @@ jobs:
   verify-windows-desktop-artifacts:
     needs:
       - build-windows
-    runs-on: ubuntu-latest-8-cores
+    runs-on: ubuntu-latest-8-cores-v2
     permissions:
       contents: read
     steps:

.github/workflows/desktop-pr-build.yml

@@ -96,7 +96,7 @@ jobs:
   build-linux:
     needs: changes
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.linux != 'false') }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-8-cores-v2
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
         with:
@@ -222,7 +222,7 @@ jobs:
   verify-windows-artifacts:
     needs:
       - build-windows
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-8-cores-v2
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
         with:

.github/workflows/frontend-tests.yml

@@ -31,7 +31,7 @@ on:
 
 jobs:
   test-frontend:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-8-cores-v2
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
         with:

.github/workflows/opensecret-eif-release.yml

@@ -39,7 +39,7 @@ jobs:
     name: Build and attest EIF (${{ inputs.environment }})
     # Only the reviewed default branch can produce an approval candidate.
     if: github.ref == 'refs/heads/master'
-    runs-on: ubuntu-24.04-arm64-8core
+    runs-on: ubuntu-24.04-arm64-8core-v2
     timeout-minutes: 180
     permissions:
       contents: read

.github/workflows/opensecret-eif.yml

@@ -37,7 +37,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    runs-on: ubuntu-24.04-arm64-8core
+    runs-on: ubuntu-24.04-arm64-8core-v2
     timeout-minutes: 180
     strategy:
       fail-fast: false
@@ -152,7 +152,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    runs-on: ubuntu-24.04-arm64-8core
+    runs-on: ubuntu-24.04-arm64-8core-v2
     timeout-minutes: 180
     strategy:
       fail-fast: false

.github/workflows/pages-preview-build.yml

@@ -46,7 +46,7 @@ jobs:
       github.event_name == 'push' ||
       (github.event_name == 'pull_request' &&
         github.event.pull_request.head.repo.full_name == github.repository)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-8-cores-v2
     timeout-minutes: 30
     env:
       SOURCE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}

.github/workflows/release.yml

@@ -140,7 +140,7 @@ jobs:
           - platform: macos-26-xlarge
             nix_shell: ci
             artifact_prefix: macos
-          - platform: ubuntu-latest-8-cores
+          - platform: ubuntu-latest-8-cores-v2
             nix_shell: desktop-linux
             artifact_prefix: linux
 
@@ -172,7 +172,7 @@ jobs:
       # Ubuntu 24.04 restricts unprivileged user namespaces by default; linuxdeploy/AppImage
       # packaging uses bubblewrap and otherwise fails with "bwrap: setting up uid map: Permission denied".
       - name: Allow bubblewrap user namespaces
-        if: matrix.platform == 'ubuntu-latest-8-cores'
+        if: matrix.platform == 'ubuntu-latest-8-cores-v2'
         run: |
           set -euo pipefail
           if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then
@@ -185,8 +185,8 @@ jobs:
       - name: Build Tauri desktop app
         run: nix develop --no-update-lock-file .#${{ matrix.nix_shell }} -c ./scripts/ci/desktop-release.sh
         env:
-          APPIMAGE_EXTRACT_AND_RUN: ${{ matrix.platform == 'ubuntu-latest-8-cores' && '1' || '' }}
-          NO_STRIP: ${{ matrix.platform == 'ubuntu-latest-8-cores' && 'true' || '' }}
+          APPIMAGE_EXTRACT_AND_RUN: ${{ matrix.platform == 'ubuntu-latest-8-cores-v2' && '1' || '' }}
+          NO_STRIP: ${{ matrix.platform == 'ubuntu-latest-8-cores-v2' && 'true' || '' }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -382,7 +382,7 @@ jobs:
   build-android:
     environment: android-signing
     needs: classify-app-release
-    runs-on: ubuntu-latest-8-cores
+    runs-on: ubuntu-latest-8-cores-v2
     permissions:
       contents: write
       id-token: write
@@ -570,7 +570,7 @@ jobs:
 
   build-web:
     needs: classify-app-release
-    runs-on: ubuntu-latest-8-cores
+    runs-on: ubuntu-latest-8-cores-v2
     permissions:
       contents: write
       id-token: write
@@ -764,7 +764,7 @@ jobs:
     needs:
       - classify-app-release
       - build-android
-    runs-on: ubuntu-latest-8-cores
+    runs-on: ubuntu-latest-8-cores-v2
     permissions:
       contents: read
     steps:
@@ -795,7 +795,7 @@ jobs:
     needs:
       - classify-app-release
       - build-tauri
-    runs-on: ubuntu-latest-8-cores
+    runs-on: ubuntu-latest-8-cores-v2
     permissions:
       contents: read
     steps:
@@ -856,7 +856,7 @@ jobs:
     needs:
       - classify-app-release
       - build-windows
-    runs-on: ubuntu-latest-8-cores
+    runs-on: ubuntu-latest-8-cores-v2
     permissions:
       contents: read
     steps:

.github/workflows/rust-tests.yml

@@ -43,7 +43,7 @@ on:
 
 jobs:
   rust-tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-8-cores-v2
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
         with:

.github/workflows/web-build.yml

@@ -32,7 +32,7 @@ on:
 jobs:
   build-web:
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-8-cores-v2
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
         with:
@@ -66,7 +66,7 @@ jobs:
 
   build-web-master:
     if: github.event_name == 'push'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-8-cores-v2
     permissions:
       contents: read
       id-token: write
@@ -116,7 +116,7 @@ jobs:
   verify-web-master-artifact:
     if: github.event_name == 'push'
     needs: build-web-master
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-8-cores-v2
     permissions:
       contents: read
     steps:

scripts/ci/test_opensecret_workflows.py

@@ -89,9 +89,9 @@ def test_jobs_are_hosted_with_read_only_contents_and_scoped_oidc(self):
                     expected_runner = "ubuntu-latest"
                     if name == "opensecret-eif.yml":
                         expected_runner = {
-                            "eif-candidate": "ubuntu-24.04-arm64-8core",
+                            "eif-candidate": "ubuntu-24.04-arm64-8core-v2",
                             "eif": "ubuntu-24.04-arm",
-                            "eif-trusted": "ubuntu-24.04-arm64-8core",
+                            "eif-trusted": "ubuntu-24.04-arm64-8core-v2",
                         }[job_name]
                     elif (name, job_name) == ("opensecret-ci.yml", "helpers"):
                         expected_runner = "ubuntu-24.04-arm"
@@ -114,7 +114,7 @@ def test_custom_hosted_runner_is_registered_for_workflow_lint(self):
             check=True, capture_output=True, text=True,
         )
         self.assertEqual(json.loads(result.stdout), {
-            "self-hosted-runner": {"labels": ["ubuntu-24.04-arm64-8core"]},
+            "self-hosted-runner": {"labels": ["ubuntu-latest-8-cores-v2", "ubuntu-24.04-arm64-8core-v2"]},
         })
 
     def test_ordinary_backend_ci_does_not_publish_or_build_eifs(self):
@@ -416,7 +416,7 @@ def test_release_is_manual_and_never_creates_a_release_or_tag(self):
     def test_build_job_is_the_trusted_read_only_builder(self):
         job = workflow(self.NAME)["jobs"]["build"]
         self.assertEqual(job["if"], "github.ref == 'refs/heads/master'")
-        self.assertEqual(job["runs-on"], "ubuntu-24.04-arm64-8core")
+        self.assertEqual(job["runs-on"], "ubuntu-24.04-arm64-8core-v2")
         self.assertEqual(job["timeout-minutes"], 180)
         self.assertEqual(job["permissions"], {"contents": "read", "id-token": "write", "attestations": "write"})
         self.assertNotIn("environment", job)

services/opensecret/docs/nitro-deploy.md

@@ -109,10 +109,10 @@ reports an EIF input or approval JSON edit, as routed to the respective job.
 This intentionally trusts same-repository PR code to write the
 FlakeHub cache; it does not grant signing or deployment authority.
 Trusted jobs use the organization-configured GitHub-hosted runner
-`ubuntu-24.04-arm64-8core` (Ubuntu 24.04 ARM64, 8 CPU, 32 GB RAM) and allow
+`ubuntu-24.04-arm64-8core-v2` (Ubuntu 24.04 ARM64, 8 CPU, 32 GB RAM) and allow
 180 minutes for cold kernel builds. Its runner group must allow the public
 Maple repository, with capacity for both dev/prod jobs. The existing
-`ubuntu-latest-8-cores` runner is x86-64, not a substitute. Unprivileged jobs
+`ubuntu-latest-8-cores-v2` runner is x86-64, not a substitute. Unprivileged jobs
 retain the standard `ubuntu-24.04-arm` runner and their 90-minute limit.
 
 The trusted job also explicitly enables the GitHub cache and `diff-store: true`,