ci: make RUNNER_OS fork-safe with Ubuntu 26.04 fallback

[rodri-oliveira-dev]

Summary

• replace all 7 Linux runner declarations using ${{ vars.RUNNER_OS }} with the fork-safe ${{ vars.RUNNER_OS || 'ubuntu-26.04' }} pattern
• preserve all workflow and job names
• keep the repository-level RUNNER_OS variable optional as an override
• leave Windows/macOS behavior unchanged

Changed workflows

• .github/workflows/codeql.yml
• .github/workflows/dependency-review.yml
• .github/workflows/dotnet.yml
• .github/workflows/release-check.yml
• .github/workflows/release.yml

Validation

• diff is limited to 7 runs-on replacements across 5 workflow files
• branch is based on current main and is not behind it
• no workflow or job names changed
• without RUNNER_OS, the expression resolves to the versioned ubuntu-26.04 fallback
• with RUNNER_OS configured, the repository variable remains the explicit override

Closes #73

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: rodri-oliveira-dev/CSF.Analyzers/https://raw.githubusercontent.com/rodri-oliveira-dev/.github/main/coderabbit-templates/dotnet-tooling.yaml (via .coderabbit.yaml)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5f8029d3-6917-4736-a2a3-7818b1592f44

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-06T18:06:32.634690Z	9c15d61	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.