Pin GHA runner versions (#1938)

.github/workflows/build_and_test.yaml

@@ -50,7 +50,7 @@ jobs:
             matrix:
                 include:
                     - name: macOS Universal
-                      os: macos-latest
+                      os: macos-14
                       artifact: macos
                       executable: "/Users/runner/Applications/Element.app/Contents/MacOS/Element"
                       # We need to mount the DMG and copy the app to the Applications folder as a mounted DMG is
@@ -80,11 +80,11 @@ jobs:
                       executable: "/opt/Element/element-desktop"
                       prepare_cmd: "sudo apt-get -qq update && sudo apt install -y ./dist/*.deb"
                     - name: Windows (x86)
-                      os: windows-latest
+                      os: windows-2022
                       artifact: win-ia32
                       executable: "./dist/win-ia32-unpacked/Element.exe"
                     - name: Windows (x64)
-                      os: windows-latest
+                      os: windows-2022
                       artifact: win-x64
                       executable: "./dist/win-unpacked/Element.exe"
         name: Test ${{ matrix.name }}
@@ -132,7 +132,7 @@ jobs:
                   RUN_AS: ${{ runner.os == 'Linux' && 'sudo' || '' }}
 
             - name: Workaround macOS GHA permission issues
-              if: matrix.os == 'macos-latest'
+              if: runner.os == 'macOS'
               run: |
                   sqlite3 $HOME/Library/Application\ Support/com.apple.TCC/TCC.db "INSERT OR IGNORE INTO access VALUES ('kTCCServiceMicrophone','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159,NULL,NULL,'UNUSED',1687786159);"
                   sqlite3 $HOME/Library/Application\ Support/com.apple.TCC/TCC.db "INSERT OR IGNORE INTO access VALUES ('kTCCServiceMicrophone','/opt/off/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159,NULL,NULL,'UNUSED',1687786159);"

.github/workflows/build_windows.yaml

@@ -2,7 +2,7 @@
 # Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
 # the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
 
-# window-latest by default uses the pwsh shell which breaks codeSigningCert in the workflow
+# Windows GHA runner by default uses the pwsh shell which breaks codeSigningCert in the workflow
 defaults:
     run:
         shell: powershell
@@ -30,7 +30,7 @@ on:
                 description: "Whether to sign & notarise the build, requires 'packages.element.io' environment"
 jobs:
     build:
-        runs-on: windows-latest
+        runs-on: windows-2022
         environment: ${{ inputs.sign && 'packages.element.io' || '' }}
         env:
             SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.22000.0/x86/signtool.exe"

docs/windows-requirements.md

@@ -2,7 +2,7 @@
 
 ## Requirements to build native modules
 
-We rely on Github Actions `windows-latest` plus a few extra utilities as per [the workflow](https://github.com/vector-im/element-desktop/blob/develop/.github/workflows/build_windows.yaml).
+We rely on Github Actions `windows-2022` plus a few extra utilities as per [the workflow](https://github.com/vector-im/element-desktop/blob/develop/.github/workflows/build_windows.yaml).
 
 If you want to build native modules, make sure that the following tools are installed on your system.