Run CI on the ubuntu-22.04 hosted runners

.github/workflows/_resolve-wolfssl.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   resolve:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 5
     outputs:
       matrix: ${{ steps.refs.outputs.matrix }}

.github/workflows/auto-pin-dependencies.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   pin:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4

.github/workflows/compiler-matrix.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   host-unit-tests:
     name: Host tests (${{ matrix.name }})
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -47,9 +47,27 @@ jobs:
       - name: Install compiler
         run: |
           sudo apt-get update
-          sudo apt-get install -y --no-install-recommends software-properties-common
-          sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends ${{ matrix.package }}
+          sudo apt-get install -y --no-install-recommends software-properties-common curl gnupg
+          case "${{ matrix.package }}" in
+            clang-*)
+              # 22.04 carries no clang-17/18: add the signed LLVM apt repository,
+              # pinned to its signing key's fingerprint, and install only clang.
+              pkg='${{ matrix.package }}'
+              curl -fsSL https://apt.llvm.org/llvm-snapshot.gpg.key -o /tmp/llvm.asc
+              fpr=$(gpg --show-keys --with-colons /tmp/llvm.asc | awk -F: '/^fpr/{print $10; exit}')
+              test "$fpr" = "6084F3CF814B57C1CF12EFD515CF4D18AF4F7421"
+              sudo install -d -m 0755 /etc/apt/keyrings
+              sudo gpg --dearmor -o /etc/apt/keyrings/llvm.gpg /tmp/llvm.asc
+              echo "deb [signed-by=/etc/apt/keyrings/llvm.gpg] https://apt.llvm.org/jammy/ llvm-toolchain-jammy-${pkg#clang-} main" | \
+                sudo tee /etc/apt/sources.list.d/llvm.list
+              sudo apt-get update
+              sudo apt-get install -y --no-install-recommends "$pkg"
+              ;;
+            *)
+              sudo add-apt-repository -y ppa:ubuntu-toolchain-r/test
+              sudo apt-get update
+              sudo apt-get install -y --no-install-recommends ${{ matrix.package }}
+              ;;
+          esac
       - name: Run aggregate host test suite
         run: make test CC=${{ matrix.cc }}

.github/workflows/core-port-split.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   core-port-split:
     name: core/port split guard + vnet image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 20
     container:
       image: ghcr.io/wolfssl/wolfboot-ci-m33mu:v1.15

.github/workflows/cross-compile.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   cortex-m33:
     name: Cortex-M33 cross compilation
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4

.github/workflows/fuzz.yml

@@ -17,7 +17,7 @@ jobs:
   # type here: schedule / manual dispatch get the full 600s soak; PR pushes and
   # merges get the 60s smoke that keeps the required checks fast.
   select:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     outputs:
       matrix: ${{ steps.pick.outputs.matrix }}
     steps:
@@ -38,7 +38,7 @@ jobs:
 
   fuzz:
     needs: select
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 20
     strategy:
       fail-fast: false

.github/workflows/integration-tests.yml

@@ -17,7 +17,7 @@ jobs:
   wolfcose:
     name: wolfCOSE integration (${{ matrix.name }})
     needs: resolve
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -53,7 +53,7 @@ jobs:
   wolfpsa:
     name: wolfPSA integration (${{ matrix.name }})
     needs: resolve
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 30
     strategy:
       fail-fast: false

.github/workflows/m33mu.yml

@@ -20,7 +20,7 @@ concurrency:
 jobs:
   wolfboot-m33mu:
     name: wolfBoot signed boot and rollback
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
@@ -81,7 +81,7 @@ jobs:
 
   wolfboot-wolftrust-m33mu:
     name: wolfTrust ${{ matrix.guest }} lifecycle (${{ matrix.engine }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
@@ -276,7 +276,7 @@ jobs:
 
   wolfboot-wolftrust-m33mu-scenarios:
     name: ${{ matrix.scenario.name }} (${{ matrix.engine }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:

.github/workflows/sanitizers.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   host-sanitizers:
     name: Host tests (ASan and UBSan)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4

.github/workflows/unit-tests.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   discover:
     name: Discover host suites
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     outputs:
       matrix: ${{ steps.s.outputs.matrix }}
     steps:
@@ -29,7 +29,7 @@ jobs:
   host-unit-tests:
     name: ${{ matrix.suite }}
     needs: discover
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 20
     strategy:
       fail-fast: false
@@ -46,7 +46,7 @@ jobs:
 
   psa-ff-conformance:
     name: Arm PSA FF conformance
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
@@ -55,7 +55,7 @@ jobs:
 
   qcbor-interop:
     name: CBOR interop (wolfCOSE and QCBOR)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4

.github/workflows/valgrind.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   host-valgrind:
     name: Host tests (Valgrind)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
@@ -24,10 +24,7 @@ jobs:
           git submodule update --init --recursive
       - name: Install Valgrind
         run: |
-          sudo apt-get update \
-            -o Dir::Etc::sourcelist="sources.list.d/ubuntu.sources" \
-            -o Dir::Etc::sourceparts="-" \
-            -o APT::Get::List-Cleanup="0"
+          sudo apt-get update
           sudo apt-get install -y --no-install-recommends valgrind
       - name: Run aggregate host suite under Valgrind
         run: make test-valgrind

.github/workflows/wiki-sync.yml

@@ -17,7 +17,7 @@ concurrency:
 
 jobs:
   sync:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - name: Publish docs/ to wiki