Pin runner images to avoid CI rot

ref https://github.com/MagicStack/asyncpg/actions/runs/22286259051/job/64465189709?pr=1308

failed with:

======================================================================
ERROR: test_tls_version (test_connect.TestSSLConnection)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/Users/runner/work/asyncpg/asyncpg/asyncpg/_testbase/__init__.py", line 92, in wrapper
    self.loop.run_until_complete(coro)
  File "/Applications/Xcode_16.4.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/asyncio/base_events.py", line 642, in run_until_complete
    return future.result()
  File "/Users/runner/work/asyncpg/asyncpg/tests/test_connect.py", line 2024, in test_tls_version
    await self.connect(
  File "/Users/runner/work/asyncpg/asyncpg/asyncpg/connection.py", line 2443, in connect
    return await connect_utils._connect(
  File "/Users/runner/work/asyncpg/asyncpg/asyncpg/connect_utils.py", line 1209, in _connect
    addrs, params, config = _parse_connect_arguments(**kwargs)
  File "/Users/runner/work/asyncpg/asyncpg/asyncpg/connect_utils.py", line 893, in _parse_connect_arguments
    addrs, params = _parse_connect_dsn_and_args(
  File "/Users/runner/work/asyncpg/asyncpg/asyncpg/connect_utils.py", line 798, in _parse_connect_dsn_and_args
    ssl.minimum_version = _parse_tls_version(
  File "/Applications/Xcode_16.4.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/ssl.py", line 586, in minimum_version
    super(SSLContext, SSLContext).minimum_version.__set__(self, value)
ValueError: Unsupported protocol version 0x304

Author: ddelange

.github/workflows/release.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   validate-release-request:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Validate release PR
       uses: edgedb/action-release/validate-pr@master
@@ -44,7 +44,7 @@ jobs:
 
   build-sdist:
     needs: validate-release-request
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     env:
       PIP_DISABLE_PIP_VERSION_CHECK: 1
@@ -73,7 +73,7 @@ jobs:
 
   build-wheels-matrix:
     needs: validate-release-request
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       include: ${{ steps.set-matrix.outputs.include }}
     steps:
@@ -141,7 +141,7 @@ jobs:
         path: wheelhouse/*.whl
 
   merge-artifacts:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [build-sdist, build-wheels]
     steps:
       - name: Merge Artifacts
@@ -152,7 +152,7 @@ jobs:
 
   publish-docs:
     needs: [build-sdist, build-wheels]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     env:
       PIP_DISABLE_PIP_VERSION_CHECK: 1
@@ -201,7 +201,7 @@ jobs:
 
   publish:
     needs: [build-sdist, build-wheels, publish-docs]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     environment:
       name: pypi

.github/workflows/tests.yml

@@ -22,12 +22,15 @@ jobs:
     strategy:
       matrix:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14", "3.14t"]
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-24.04, macos-15, windows-2025]
         loop: [asyncio, uvloop]
         exclude:
           # uvloop does not support windows
           - loop: uvloop
-            os: windows-latest
+            os: windows-2025
+          # github does not provide 3.9 cpython for arm64 runners
+          - python-version: "3.9"
+            os: macos-15
 
     runs-on: ${{ matrix.os }}
 
@@ -54,13 +57,17 @@ jobs:
         version_line_pattern: |
           __version__(?:\s*:\s*typing\.Final)?\s*=\s*(?:['"])([[:PEP440:]])(?:['"])
 
-    - name: Setup PostgreSQL
-      if: "!steps.release.outputs.is_release && matrix.os == 'macos-latest'"
+    - name: Set up PostgreSQL
+      if: "!steps.release.outputs.is_release && startsWith(matrix.os, 'macos')"
       run: |
         POSTGRES_FORMULA="postgresql@18"
         brew install "$POSTGRES_FORMULA"
         echo "$(brew --prefix "$POSTGRES_FORMULA")/bin" >> $GITHUB_PATH
 
+    - name: Set up Kerberos
+      if: "!steps.release.outputs.is_release && startsWith(matrix.os, 'ubuntu')"
+      run: .github/workflows/install-krb5.sh
+
     - name: Set up Python ${{ matrix.python-version }}
       uses: astral-sh/setup-uv@v7
       if: "!steps.release.outputs.is_release"
@@ -71,26 +78,20 @@ jobs:
     - name: Install Python Deps
       if: "!steps.release.outputs.is_release"
       run: |
-        [ "$RUNNER_OS" = "Linux" ] && .github/workflows/install-krb5.sh
         uv pip install -e . --group test
 
     - name: Test
       if: "!steps.release.outputs.is_release"
       env:
-        LOOP_IMPL: ${{ matrix.loop }}
-      run: |
-        if [ "${LOOP_IMPL}" = "uvloop" ]; then
-          env USE_UVLOOP=1 python -m unittest -v tests.suite
-        else
-          python -m unittest -v tests.suite
-        fi
+        USE_UVLOOP: ${{ matrix.loop == 'uvloop' && '1' || '' }}
+      run: python -m unittest -v tests.suite
 
   test-postgres:
     strategy:
       matrix:
         postgres-version: ["9.5", "9.6", "10", "11", "12", "13", "14", "15", "16", "17", "18"]
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     permissions: {}
 
@@ -122,6 +123,10 @@ jobs:
         echo PGINSTALLATION="/usr/lib/postgresql/${PGVERSION}/bin" \
           >> "${GITHUB_ENV}"
 
+    - name: Set up Kerberos
+      if: "!steps.release.outputs.is_release"
+      run: .github/workflows/install-krb5.sh
+
     - name: Set up Python
       uses: astral-sh/setup-uv@v7
       if: "!steps.release.outputs.is_release"
@@ -131,7 +136,6 @@ jobs:
     - name: Install Python Deps
       if: "!steps.release.outputs.is_release"
       run: |
-        [ "$RUNNER_OS" = "Linux" ] && .github/workflows/install-krb5.sh
         uv pip install -e . --group test
 
     - name: Test
@@ -146,7 +150,7 @@ jobs:
   regression-tests:
     name: "Regression Tests"
     needs: [test-platforms, test-postgres]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions: {}
 
     steps: