fix(ci): keep baseline CPU probes on compatible cloud runners

.changeset/compatible-baseline-runner.md

@@ -0,0 +1,2 @@
+---
+---

.github/workflows/ci.yml

@@ -232,7 +232,9 @@ jobs:
     name: Build compiled binary
     needs: changes
     if: needs.changes.outputs.code == 'true'
-    runs-on: ubuntu-latest
+    # Ubuntu 26.04 cloud libraries require x86-64-v3 and SIGILL under Nehalem even for /bin/true.
+    # Keep the emulated process's userland compatible with the CPU this job verifies.
+    runs-on: ubuntu-24.04
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/release-prebuilt-npm.yml

@@ -140,8 +140,10 @@ jobs:
         include:
           - package_name: hunkdiff-linux-arm64
             runner: ubuntu-24.04-arm
+          # Match main's baseline probe: Ubuntu 26.04 cloud libraries require x86-64-v3,
+          # so they cannot run under the Nehalem CPU used to verify this artifact.
           - package_name: hunkdiff-linux-x64
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
           - package_name: hunkdiff-windows-x64
             runner: windows-latest
           - package_name: hunkdiff-darwin-x64

scripts/quality/baseline-workflows.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+
+interface WorkflowJob {
+  "runs-on": string;
+  strategy?: {
+    matrix: { include: Array<{ package_name: string; runner: string }> };
+  };
+  steps: Array<{ name?: string; if?: string; run?: string }>;
+}
+
+/** Read the real workflow so runner changes cannot silently invalidate CPU emulation. */
+function readTestWorkflow(filename: string) {
+  const source = readFileSync(
+    path.resolve(import.meta.dir, "../../.github/workflows", filename),
+    "utf8",
+  );
+  return Bun.YAML.parse(source) as { jobs: Record<string, WorkflowJob> };
+}
+
+describe("baseline CPU workflow environments", () => {
+  test("main checks the binary on Nehalem with an older-CPU-compatible userland", () => {
+    const job = readTestWorkflow("ci.yml").jobs["build-bin"]!;
+    expect(job["runs-on"]).toBe("ubuntu-24.04");
+
+    const probe = job.steps.find((step) => step.name === "Verify the binary starts without AVX2");
+    expect(probe?.run).toContain("qemu-x86_64 -cpu Nehalem dist/hunk --version");
+    expect(probe?.if).toBeUndefined();
+  });
+
+  test("release checks the Linux x64 artifact with the same compatible userland", () => {
+    const job = readTestWorkflow("release-prebuilt-npm.yml").jobs["build-binaries"]!;
+    const target = job.strategy?.matrix.include.find(
+      (entry) => entry.package_name === "hunkdiff-linux-x64",
+    );
+    expect(target?.runner).toBe("ubuntu-24.04");
+
+    const probe = job.steps.find(
+      (step) => step.name === "Verify the x64 artifact starts without AVX2",
+    );
+    expect(probe?.run).toContain("qemu-x86_64 -cpu Nehalem dist/hunk --version");
+    expect(probe?.if).toBe("matrix.package_name == 'hunkdiff-linux-x64'");
+  });
+});