fix(release): standardize on ubuntu-26.04 and share Go test job

.github/workflows/actions.lock

@@ -45,14 +45,16 @@ workflows:
         - 'anchore/sbom-action@v0.24.2'
     '.github/workflows/release-tag.yml':
         - 'actions/checkout@v7.0.1'
-        - 'actions/setup-go@v7.0.0'
     '.github/workflows/release.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/self-audit.yml':
         - 'actions/cache@v6.1.0'
         - 'actions/checkout@v7.0.1'
         - 'actions/setup-dotnet@v6.0.0'
         - 'actions/setup-go@v7.0.0'
+    '.github/workflows/test-go.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-go@v7.0.0'
     '.github/workflows/update-codeql.yml':
         - 'actions/cache@v6.1.0'
         - 'actions/checkout@v7.0.1'

.github/workflows/build-and-test-go.yml

@@ -16,6 +16,7 @@ on:
       - '**/testdata/**'
       - 'scripts/**'
       - '.github/workflows/build-and-test-go.yml'
+      - '.github/workflows/test-go.yml'
       - 'go.mod'
       - 'go.sum'
       - 'Makefile'
@@ -26,6 +27,7 @@ on:
       - '**/testdata/**'
       - 'scripts/**'
       - '.github/workflows/build-and-test-go.yml'
+      - '.github/workflows/test-go.yml'
       - 'go.mod'
       - 'go.sum'
       - 'Makefile'
@@ -34,82 +36,43 @@ permissions:
   contents: read
 
 jobs:
+  # Each of these is test-go.yml, the job a release tests its tree with, so a release runs nothing
+  # that a pull request has not already run.
   checks:
     name: Build and Test - Checks
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Build and Test - Checkout repository
-        uses: actions/checkout@v7.0.1
-
-      - name: Build and Test - Setup Go
-        uses: actions/setup-go@v7.0.0
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      # First, because a duplicated package clause reads as a syntax error everywhere else and
-      # sends the reader looking in the wrong place.
-      - name: Build and Test - Check for corrupted writes
-        run: make check-corrupt
-
-      - name: Build and Test - Check formatting
-        run: make fmt
-
-      - name: Build and Test - Vet
-        run: make vet
-
-      - name: Build and Test - Test the scripts
-        run: make script-test
-
-      - name: Build and Test - Build the binary
-        run: make build
+    permissions:
+      contents: read
+    uses: ./.github/workflows/test-go.yml
+    with:
+      # check-corrupt first, because a duplicated package clause reads as a syntax error
+      # everywhere else and sends the reader looking in the wrong place.
+      targets: check-corrupt fmt vet script-test build
+      cache: true
 
   sqlite:
     name: Build and Test - Go (SQLite)
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Build and Test - Checkout repository
-        uses: actions/checkout@v7.0.1
-
-      - name: Build and Test - Setup Go
-        uses: actions/setup-go@v7.0.0
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      # Graphviz is a requirement: serve refuses to start without it, and the layout and figure
-      # tests fail rather than skip.
-      - name: Build and Test - Install Graphviz
-        run: sudo apt-get update && sudo apt-get install --yes --no-install-recommends graphviz
-
-      - name: Build and Test - Run tests
-        run: make test-sqlite
+    permissions:
+      contents: read
+    uses: ./.github/workflows/test-go.yml
+    with:
+      targets: test-sqlite
+      cache: true
 
   postgres:
     name: Build and Test - Go (PostgreSQL)
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Build and Test - Checkout repository
-        uses: actions/checkout@v7.0.1
-
-      - name: Build and Test - Setup Go
-        uses: actions/setup-go@v7.0.0
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      # Docker is a requirement: the store suite runs on a PostgreSQL primary and physical standby in
-      # containers, and fails rather than skips without a daemon. Ubuntu runners have one.
-      - name: Build and Test - Run tests
-        run: make test-postgres
+    permissions:
+      contents: read
+    uses: ./.github/workflows/test-go.yml
+    with:
+      # Docker is a requirement: the store suite runs on a PostgreSQL primary and physical standby
+      # in containers, and fails rather than skips without a daemon. Ubuntu runners have one.
+      targets: test-postgres
+      cache: true
 
   # One name to require in branch protection, whichever jobs the run is split into.
   build-and-test-go:
     name: Build and Test - Go
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     needs: [checks, sqlite, postgres]
     if: always()
 

.github/workflows/build-and-test-ui.yml

@@ -6,6 +6,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/build-and-test-ui.yml'
+      - 'scripts/setup-graphviz.sh'
       - '.node-version'
       - 'Makefile'
       # The populated run is only as good as what it runs against, and both of these decide that:
@@ -28,6 +29,7 @@ on:
     branches: ['main']
     paths:
       - '.github/workflows/build-and-test-ui.yml'
+      - 'scripts/setup-graphviz.sh'
       - '.node-version'
       - 'Makefile'
       - 'cmd/abom-corpus/**'
@@ -55,7 +57,7 @@ jobs:
   # seconds rather than behind a toolchain neither of them uses.
   browser:
     name: Interface - Browser code
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Browser code - Checkout repository
@@ -78,7 +80,7 @@ jobs:
 
   components:
     name: Interface - Components
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Components - Checkout repository
@@ -110,7 +112,7 @@ jobs:
   # `dotnet publish` and a `go build` that together cost more than the tests it then runs.
   build:
     name: Interface - Build what the suite drives
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     outputs:
       specs: ${{ steps.specs.outputs.specs }}
@@ -189,7 +191,7 @@ jobs:
   suite:
     name: Interface - Browser suite (${{ matrix.spec }})
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     strategy:
       # Every shard reports. "Which spec files are broken" is the question a split suite exists to
@@ -240,8 +242,8 @@ jobs:
 
       # Graphviz is a requirement: serve refuses to start without it, and the layout and figure
       # tests fail rather than skip.
-      - name: Browser suite - Install Graphviz
-        run: sudo apt-get update && sudo apt-get install --yes --no-install-recommends graphviz
+      - name: Browser suite - Setup Graphviz
+        run: scripts/setup-graphviz.sh
 
       # `-run` rather than `make e2e`: the binary, the interface and the data set were built once
       # and unpacked above, and rebuilding them here would be the whole saving spent again.
@@ -261,7 +263,7 @@ jobs:
     name: Build and Test - Interface
     needs: [browser, build, components, suite]
     if: always()
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Interface - Summary

.github/workflows/copilot-setup-steps.yml

@@ -23,6 +23,7 @@ on:
       - 'go.mod'
       - 'go.sum'
       - 'Makefile'
+      - 'scripts/setup-graphviz.sh'
       # Pins the PostgreSQL image the setup pulls.
       - 'scripts/with-postgres.py'
       - '**/codeql-pack.yml'
@@ -42,6 +43,7 @@ on:
       - 'go.mod'
       - 'go.sum'
       - 'Makefile'
+      - 'scripts/setup-graphviz.sh'
       - 'scripts/with-postgres.py'
       - '**/codeql-pack.yml'
       - '**/codeql-pack.lock.yml'
@@ -56,7 +58,7 @@ jobs:
   copilot-setup-steps:
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Copilot Setup - Checkout code
@@ -139,8 +141,8 @@ jobs:
 
       # Graphviz is a requirement: serve refuses to start without it, and the layout and figure
       # tests fail rather than skip.
-      - name: Copilot Setup - Install Graphviz
-        run: sudo apt-get update && sudo apt-get install --yes --no-install-recommends graphviz
+      - name: Copilot Setup - Setup Graphviz
+        run: scripts/setup-graphviz.sh
 
       # `make test-postgres` runs the store suite in the PostgreSQL image the harness pins, and pulls it on
       # first use. The probe starts that image and removes its container; the image stays cached.

.github/workflows/dependency-review.yml

@@ -16,7 +16,7 @@ permissions:
 jobs:
   dependency-review:
     name: Dependency Review
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Dependency Review - Checkout repository

.github/workflows/lint-go.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   lint-go:
     name: Lint - Go
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Lint - Checkout repository

.github/workflows/query-unit-tests.yml

@@ -36,7 +36,7 @@ jobs:
   # here rather than at release time.
   versions:
     name: Query Unit Tests - Versions
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Versions - Checkout repository
@@ -49,7 +49,7 @@ jobs:
 
   query-unit-tests:
     name: Query Unit Tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Query Unit Tests - Checkout repository

.github/workflows/release-build.yml

@@ -3,8 +3,9 @@
 name: Release - Build
 
 # Called by release.yml only. Read-only: it tests the tagged commit, builds each platform's
-# archive on that platform, and smoke-tests the uploaded bytes on that platform again. Nothing
-# here signs or publishes, and nothing restores a cache another branch could have written.
+# archive on that platform, and smoke-tests the uploaded bytes on that platform again, darwin/amd64
+# under Rosetta. Nothing here signs or publishes, and nothing restores a cache another branch could
+# have written.
 
 on:
   workflow_call:
@@ -57,8 +58,8 @@ jobs:
 
       # Graphviz is a requirement: serve refuses to start without it, and the layout and figure
       # tests fail rather than skip.
-      - name: Verify - Install Graphviz
-        run: sudo apt-get update && sudo apt-get install --yes --no-install-recommends graphviz
+      - name: Verify - Setup Graphviz
+        run: scripts/setup-graphviz.sh
 
       # `make verify` less lint, pins and the browser suite, which pull requests already run and
       # which need tools this job would otherwise install for nothing the archive contains.
@@ -161,7 +162,10 @@ jobs:
         include:
           - { os: linux, arch: amd64, runner: ubuntu-22.04, codeql: linux64 }
           - { os: linux, arch: arm64, runner: ubuntu-22.04-arm, codeql: linux-arm64 }
-          - { os: darwin, arch: amd64, runner: macos-15-intel, codeql: osx64 }
+          # Under Rosetta on arm64: Homebrew has no Intel bottle for Graphviz or its dependencies,
+          # so an Intel runner would compile all of them before the smoke could start. The
+          # manifest check still requires the executable to report darwin/amd64.
+          - { os: darwin, arch: amd64, runner: macos-15, codeql: osx64 }
           - { os: darwin, arch: arm64, runner: macos-15, codeql: osx64 }
 
     steps:
@@ -200,13 +204,17 @@ jobs:
 
       # Graphviz is a requirement the release notes name: serve refuses to start without `dot`, so
       # the archive is proven on a machine that has it, installed the way a user would.
-      - name: Smoke - Install Graphviz
+      - name: Smoke - Setup Graphviz
+        run: scripts/setup-graphviz.sh dot
+
+      # An arm64 Mac runs the amd64 build only through Rosetta, which the image normally ships.
+      - name: Smoke - Install Rosetta
+        if: matrix.os == 'darwin' && matrix.arch == 'amd64'
         run: |
-          case "$RUNNER_OS" in
-            Linux) sudo apt-get update && sudo apt-get install --yes --no-install-recommends graphviz ;;
-            macOS) brew install graphviz ;;
-            *) echo "::error::no Graphviz install for $RUNNER_OS"; exit 1 ;;
-          esac
+          if ! arch -x86_64 /usr/bin/true 2>/dev/null; then
+            sudo softwareupdate --install-rosetta --agree-to-license
+          fi
+          arch -x86_64 /usr/bin/true
 
       - name: Smoke - Run
         run: |

.github/workflows/release-tag.yml

@@ -54,37 +54,19 @@ jobs:
             exit 1
           fi
 
+  # The job pull requests run, on the tree with every pack set to the release version. Read-only
+  # whatever this workflow is granted, and uncached: a release restores nothing another branch
+  # could have written.
   test:
     name: Tag - Test the tree to be tagged
     needs: inspect
     if: needs.inspect.outputs.exists == 'false'
-    runs-on: ubuntu-26.04
-
-    steps:
-      - name: Test - Checkout repository
-        uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Test - Setup Go
-        uses: actions/setup-go@v7.0.0
-        with:
-          go-version-file: go.mod
-          # A release restores nothing another branch could have written.
-          cache: false
-
-      - name: Test - Set the release version
-        env:
-          VERSION: ${{ inputs.version }}
-        run: scripts/release-version.sh "$VERSION"
-
-      # Graphviz is a requirement: serve refuses to start without it, and the layout and figure
-      # tests fail rather than skip.
-      - name: Test - Install Graphviz
-        run: sudo apt-get update && sudo apt-get install --yes --no-install-recommends graphviz
-
-      - name: Test - Run the Go checks
-        run: make check-corrupt check-release-version fmt vet test
+    permissions:
+      contents: read
+    uses: ./.github/workflows/test-go.yml
+    with:
+      version: ${{ inputs.version }}
+      targets: check-corrupt check-release-version fmt vet test
 
   create:
     name: Tag - Create