RHAIENG-6546: align rhoai-2.25 GHA disk layout with main (no LVM, /mnt, ubuntu-26.04)

.github/actions/free-up-disk-space/action.yml

@@ -4,11 +4,14 @@ description: 'Removes unnecessary packages and files to free up disk space on Gi
 runs:
   using: "composite"
   steps:
-    - name: Free up additional disk space
+    - name: Free up disk space
       shell: bash
       run: |
-        set -x
+        set -Eeuxo pipefail
         df -h
+        sudo docker system prune -af  || true
+        sudo apt-get clean
+        sudo rm -rf /tmp/*
         sudo apt-get update
         sudo apt-get purge -y '^dotnet-.*' '^llvm-.*' 'php.*' '^mongodb-.*'
         sudo apt-get autoremove -y --purge
@@ -20,6 +23,5 @@ runs:
         sudo rm -rf /usr/share/dotnet &
         sudo rm -rf /opt/ghc &
         sudo rm -rf /opt/hostedtoolcache/CodeQL &
-        sudo docker image prune --all --force &
         wait
         df -h

.github/workflows/auto-add-issue-to-project.yml

@@ -7,7 +7,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   add-to-project:
     name: Add issue to projects
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Generate github-app token
         id: app-token

.github/workflows/build-notebooks-TEMPLATE.yaml

@@ -173,22 +173,21 @@ jobs:
       - name: Prepare build environment
         run: |
           set -Eeuxo pipefail
-          # Match downstream/main: store rootful graphs under /mnt (larger than /).
+
+          # opendatahub-io/notebooks#3965; the only promise GitHub gives us
+          #  is >=15GiB disk space on /. In practice, we can either get a single
+          #  volume machine or a two volume machine (with extra volume mounted
+          #  under /mnt. Either case, /mnt should be large enough to fit our images.
           sudo mkdir -p /mnt/containers/storage
           sudo chown -R "${USER}:${USER}" /mnt/containers/storage
 
-      # codeserver npm ci can exhaust 16GB GHA runners during parallel postinstall.
-      - name: Add swap for codeserver GHA builds
-        if: ${{ contains(inputs.target, 'codeserver') }}
-        run: |
-          set -Eeuxo pipefail
-          sudo swapoff -a || true
-          sudo rm -f /swapfile /mnt/swapfile
-          sudo fallocate -l 16G /swapfile
-          sudo chmod 600 /swapfile
-          sudo mkswap /swapfile
-          sudo swapon /swapfile
-          free -h
+      # RHDS AIPCC ROCm pytorch builds ENOSPC near end of uv pip layer commit on
+      # single-volume ubuntu-26.04 runners (~145GiB). Other ROCm targets fit;
+      # only reclaim runner preinstalls for the two known failures (RHAIENG-6586).
+      - name: Free up disk space
+        uses: ./.github/actions/free-up-disk-space
+        if: ${{ inputs.target == 'rocm-jupyter-pytorch-ubi9-python-3.12' ||
+          inputs.target == 'rocm-runtime-pytorch-ubi9-python-3.12' }}
 
       # endregion
 
@@ -389,6 +388,8 @@ jobs:
       - name: "Build: make ${{ inputs.target }}"
         id: make-target
         run: |
+          # Print disk and memory stats every 30s so OOM/disk-full failures
+          # leave a breadcrumb trail in the logs.
           uv run scripts/monitor_resources.py &
           uv run make ${{ inputs.target }}
         env:
@@ -408,6 +409,7 @@ jobs:
       # long builds and check-payload image mounts — run Playwright first.
       # https://playwright.dev/docs/ci
       # https://playwright.dev/docs/docker
+      # opendatahub-io/notebooks#3965: podman storage is configured to have sufficient disk space
       - name: Run Playwright tests
         if: ${{ !cancelled() && contains(inputs.target, 'codeserver') && steps.make-target.outcome == 'success' }}
         uses: ./.github/actions/playwright-test

.github/workflows/build-notebooks-pr-aipcc.yaml

@@ -29,7 +29,7 @@ env:
 jobs:
   gen:
     name: Generate job matrix
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     # rhds/notebooks builds from AIPCC bases and requires pull_request_target trigger
     if: ${{ github.repository == 'red-hat-data-services/notebooks' }}
     outputs:

.github/workflows/build-notebooks-pr-rhel.yaml

@@ -29,7 +29,7 @@ env:
 jobs:
   gen:
     name: Generate job matrix
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       matrix: ${{ steps.gen.outputs.matrix }}
       has_jobs: ${{ steps.gen.outputs.has_jobs }}

.github/workflows/build-notebooks-push.yaml

@@ -19,7 +19,7 @@ permissions:
 jobs:
   gen:
     name: Generate job matrix
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     # for odh-io/notebooks and rhds/notebooks, allow only main, rhoai-*, release-*
     if: ${{ github.event_name == 'workflow_dispatch' ||
       (github.repository != 'opendatahub-io/notebooks' && github.repository != 'red-hat-data-services/notebooks')

.github/workflows/code-quality.yaml

@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   check-generated-code:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -45,7 +45,7 @@ jobs:
           fi
 
   pytest-tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -98,7 +98,7 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
 
   go-tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
@@ -143,7 +143,7 @@ jobs:
           files: scripts/buildinputs/junit-go.xml
 
   code-static-analysis:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -195,7 +195,7 @@ jobs:
 
   action-pin-check:
     name: GitHub Actions SHA pinning
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     env:

.github/workflows/codeql.yaml

@@ -19,7 +19,7 @@ concurrency:
 jobs:
   analyze:
     name: CodeQL (${{ matrix.language }})
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       security-events: write

.github/workflows/create-release.yaml

@@ -41,7 +41,7 @@ env:
 jobs:
   release:
     name: Create opendatahub-io/notebooks release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

.github/workflows/docs.yaml

@@ -14,7 +14,7 @@ env:
 jobs:
   generate-releasenotes:
     name: Generate list of images for release notes
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 

.github/workflows/gitleaks.yaml

@@ -19,7 +19,7 @@ concurrency:
 jobs:
   scan:
     name: Gitleaks secret scan
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       security-events: write

.github/workflows/insta-merge.yaml

@@ -19,7 +19,7 @@ permissions:
 
 jobs:
   instant-merge:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: insta-merge
         if: ${{ github.event.sender.login == 'red-hat-konflux[bot]' && ( contains(github.event.pull_request.title, 'Update odh-workbench-jupyter-') || contains(github.event.pull_request.title, 'Update odh-workbench-codeserver-') || contains(github.event.pull_request.title, 'Update odh-pipeline-runtime-') ) }}

.github/workflows/instant-merge.yaml

@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   instant-merge:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: instant-merge
         if: ${{ github.event.sender.login == 'red-hat-konflux[bot]' && ( contains(github.event.pull_request.title, 'Update odh-workbench-jupyter-') || contains(github.event.pull_request.title, 'Update odh-workbench-codeserver-') || contains(github.event.pull_request.title, 'Update odh-pipeline-runtime-') ) }}

.github/workflows/notebook-digest-updater.yaml

@@ -17,7 +17,7 @@ env:
   RELEASE_VERSION_N_1: 2024a
 jobs:
   initialize:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
     steps:
@@ -42,7 +42,7 @@ jobs:
 
   update-n-version:
     needs: [initialize]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
     steps:
@@ -137,7 +137,7 @@ jobs:
 
   update-n-1-version:
     needs: [initialize, update-n-version]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
     steps:
@@ -228,7 +228,7 @@ jobs:
 
   open-pull-request:
     needs: [update-n-version, update-n-1-version]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       pull-requests: write
     steps:

.github/workflows/notebooks-digest-updater.yaml

@@ -33,7 +33,7 @@ env:
 
 jobs:
   update-images:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
       pull-requests: write

.github/workflows/notebooks-release.yaml

@@ -67,7 +67,7 @@ jobs:
   # 2. Check if the Manifest PR is merged
   Manifests_merged:
     needs: Update_manifests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       pr_merged_m: ${{ steps.check_pr.outputs.pr_merged }}
     steps:
@@ -100,7 +100,7 @@ jobs:
   BuildConfigs_merged:
     needs: Update_buildConfigs
     if: ${{ inputs.update_buildconfigs && github.event.inputs.release_type == 'Release' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       pr_merged_b: ${{ steps.check_pr.outputs.pr_merged }}
     steps:

.github/workflows/notify-team-to-review-pr.yml

@@ -14,7 +14,7 @@ permissions:
 jobs:
   add-label:
     if: contains(github.event.pull_request.labels.*.name, 'konflux-nudge') == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
 
       # SECURITY: never clone untrusted code in pull_request_target workflows

.github/workflows/params-env.yaml

@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   validation-of-params-env:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:

.github/workflows/piplock-renewal.yaml

@@ -42,7 +42,7 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   refresh-pipfile-locks:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     concurrency:
       group: refresh-pipfile-locks-${{ matrix.python-version }}-${{ github.ref }}
       cancel-in-progress: false

.github/workflows/pr-merge-image-delete.yml

@@ -11,7 +11,7 @@ env:
   QUAY_IMAGE_REPO: ${{ secrets.QUAY_IMAGE_REPO }}
 jobs:
   delete-pr-quay-image:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Git checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

.github/workflows/purge-ghcr.yaml

@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   clean:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     name: Delete old test images
     steps:
       # https://github.com/snok/container-retention-policy?tab=readme-ov-file#parameters

.github/workflows/rpms-lock-renewal.yaml

@@ -36,8 +36,8 @@ jobs:
   refresh-rpm-lock-files:
     if: github.event_name == 'workflow_dispatch'
     # Match build-notebooks-TEMPLATE / install-podman-action (Podman 5.7+).
-    # ubuntu-latest is still 24.04 and fails the AppArmor pasta peer reload
-    # (apparmor_parser exits 2 when /etc/apparmor.d/usr.bin.pasta is absent).
+    # ubuntu-24.04 fails the AppArmor pasta peer reload (apparmor_parser exits 2
+    # when /etc/apparmor.d/usr.bin.pasta is absent).
     runs-on: ubuntu-26.04
     concurrency:
       group: refresh-rpm-lock-files-${{ github.ref }}

.github/workflows/sec-scan.yml

@@ -16,7 +16,7 @@ env:
   RELEASE_VERSION_N_1: 2023a
 jobs:
   initialize:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
     steps:
@@ -42,7 +42,7 @@ jobs:
 
   check-vulnerabilities:
     needs: [initialize]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
     steps:
@@ -123,7 +123,7 @@ jobs:
   # Creates the Pull Request
   open-pull-request:
     needs: [check-vulnerabilities]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       pull-requests: write
     steps:

.github/workflows/security.yaml

@@ -10,7 +10,7 @@ name: Security
 jobs:
   build:
     name: Trivy scan (fs)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       security-events: write

.github/workflows/semgrep.yaml

@@ -19,7 +19,7 @@ concurrency:
 jobs:
   scan:
     name: Semgrep scan
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       security-events: write