Question

Your enterprise standardizes on GitHub-hosted ubuntu-latest runners. A workflow that ran successfully last month now fails during a step that assumes a specific version of the Terraform CLI is preinstalled. No workflow file changes were made. As the platform engineer, what is the MOST reliable way to determine whether the preinstalled Terraform version changed and to prevent this class of failure going forward?

Accepted Answer

Check the runner image release notes in the actions/runner-images repository to identify version changes, then pin the required version at runtime using the setup-terraform action rather than relying on the preinstalled binary.

Answer

Open a support ticket to have GitHub roll back the ubuntu-latest image to last month's version for your enterprise.

Answer

Add the Terraform binary to a runner group's IP allow list so the correct version is always resolved from the toolcache.

Answer

Switch the runs-on value to ubuntu-24.04 so that the image version never receives updates and the preinstalled tool versions stay frozen.