Improve AWS credential loading and configuration handling in BedrockProvider

.github/DISCUSSION_TEMPLATE/qa.yml

@@ -0,0 +1,26 @@
+title: "❓ Question: [Brief summary]"
+labels:
+  - help
+body:
+  - type: markdown
+    attributes:
+      value: |
+        💡 Before posting, please attach your **diagnostics zip** — it helps the Goose team debug faster and saves everyone time.  
+        [How to capture and share diagnostics](https://block.github.io/goose/docs/troubleshooting/diagnostics-and-reporting/)
+  - type: textarea
+    id: problem
+    attributes:
+      label: What happened?
+      description: Describe the issue in detail and attach your diagnostics zip if possible.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Tell us how to reproduce the issue — commands, steps, or context.
+  - type: textarea
+    id: version
+    attributes:
+      label: Goose version and environment
+      description: Include your Goose version and operating system if known.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -2,36 +2,49 @@
 name: Bug report
 about: Create a report to help us improve
 title: ''
-labels: ''
+labels: bug
 assignees: ''
-
 ---
 
 **Describe the bug**
 
-Note: Please check the common issues on https://block.github.io/goose/docs/troubleshooting before filing a report
+💡 Before filing, please check common issues:  
+https://block.github.io/goose/docs/troubleshooting  
+
+📦 To help us debug faster, attach your **diagnostics zip** if possible.  
+👉 How to capture it: https://block.github.io/goose/docs/troubleshooting/diagnostics-and-reporting/
 
 A clear and concise description of what the bug is.
 
+---
+
 **To Reproduce**
 Steps to reproduce the behavior:
 1. Go to '...'
 2. Click on '....'
 3. Scroll down to '....'
 4. See error
 
+---
+
 **Expected behavior**
 A clear and concise description of what you expected to happen.
 
+---
+
 **Screenshots**
 If applicable, add screenshots to help explain your problem.
 
-**Please provide following information:**
- - **OS & Arch:** [e.g. Ubuntu 22.04 x86]
- - **Interface:** [UI/CLI]
- - **Version:** [e.g. v1.0.2]
- - **Extensions enabled:** [e.g. Computer Controller, Figma]
- - **Provider & Model:** [e.g. Google - gemini-1.5-pro]
+---
+
+**Please provide the following information**
+- **OS & Arch:** [e.g. Ubuntu 22.04 x86]
+- **Interface:** [UI / CLI]
+- **Version:** [e.g. v1.0.2]
+- **Extensions enabled:** [e.g. Computer Controller, Figma]
+- **Provider & Model:** [e.g. Google – gemini-1.5-pro]
+
+---
 
 **Additional context**
 Add any other context about the problem here.

.github/actions/generate-release-pr-body/action.yaml

@@ -0,0 +1,44 @@
+name: 'Generate Release Notes'
+description: 'Generate release notes for a given version'
+
+inputs:
+  version:
+    description: 'The version being released'
+    required: true
+  head_ref:
+    description: 'The commit SHA or reference of the head of the release branch'
+    required: true
+  prior_ref:
+    description: 'The previous version to compare against'
+    required: true
+
+outputs:
+  pr_body_file:
+    description: 'Path to the generated PR body file'
+    value: ${{ steps.generate.outputs.pr_body_file }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Generate release notes
+      id: generate
+      shell: bash
+      env:
+        VERSION: ${{ inputs.version }}
+        HEAD_REF: ${{ inputs.head_ref }}
+        PRIOR_REF: ${{ inputs.prior_ref }}
+        TEMPLATE_FILE: "${{ github.action_path }}/pr_body_template.txt"
+      run: |
+        git fetch origin --tags
+
+        {
+          sed -e "s/{{VERSION}}/${VERSION}/g" \
+              -e "s/{{PRIOR_VERSION}}/${PRIOR_REF}/g" \
+              "$TEMPLATE_FILE"
+          git log --pretty=format:"- %s (%h)" --reverse ${PRIOR_REF}..${HEAD_REF}
+          echo ""
+          echo "---"
+          echo "*This release PR was generated automatically.*"
+        } > pr_body.txt
+
+        echo "pr_body_file=pr_body.txt" >> $GITHUB_OUTPUT

.github/actions/generate-release-pr-body/pr_body_template.txt

@@ -0,0 +1,19 @@
+# Release v{{VERSION}}
+
+## How to Release
+
+Push the release tag to trigger the release:
+   ```bash
+   git fetch && git tag v{{VERSION}} origin/release/{{VERSION}}
+   git push origin v{{VERSION}}
+   ```
+This PR will auto-merge once the tag is pushed.
+
+## Important Notes
+
+- All commits in this release should have corresponding cherry-picks in `main`
+- This PR can be closed if the release is not needed.
+
+## Changes in This Release
+
+**Comparing:** `{{PRIOR_VERSION}}...v{{VERSION}}`

.github/pull_request_template.md

@@ -14,6 +14,10 @@
 - [ ] Build / Release
 - [ ] Other (specify below)
 
+### AI Assistance
+<!-- great that you got assistance 🔥, just check out the HOWTOAI guidance: https://github.com/block/goose/blob/main/HOWTOAI.md-->
+- [ ] This PR was created or reviewed with AI assistance
+
 ### Testing
 <!-- How have this change been tested? Unit/integration tests? Manual testing? -->
 
@@ -27,5 +31,6 @@ Before:
 
 After:   
 
-<!-- For Recipe Cookbook Submissions ONLY: Include your email below to receive $10 OpenRouter credits once approved & merged -->
+### Submitting a Recipe?
+<!-- For Recipe Cookbook Submissions ONLY: Include your email below to receive $10 OpenRouter credits once approved and merged -->
 **Email**: 

.github/workflows/build-cli.yml

@@ -97,10 +97,10 @@ jobs:
         uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f
         with:
           path: target
-          key: ${{ runner.os }}-cargo-build-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('rust-toolchain.toml') }}
+          key: ${{ runner.os }}-cargo-build-release-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('rust-toolchain.toml') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-build-${{ hashFiles('Cargo.lock') }}-
-            ${{ runner.os }}-cargo-build-
+            ${{ runner.os }}-cargo-build-release-${{ hashFiles('Cargo.lock') }}-
+            ${{ runner.os }}-cargo-build-release-
 
       - name: Build CLI (Linux/macOS)
         if: matrix.use-cross

.github/workflows/bundle-desktop-intel.yml

@@ -83,9 +83,9 @@ jobs:
         uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
         with:
           path: target
-          key: ${{ runner.os }}-intel-cargo-build-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-intel-cargo-build-release-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-intel-cargo-build-
+            ${{ runner.os }}-intel-cargo-build-release-
 
 
       - name: Build goose-server for Intel macOS (x86_64)

.github/workflows/bundle-desktop-linux.yml

@@ -95,9 +95,9 @@ jobs:
             ${{ env.CARGO_HOME }}/registry/index/
             ${{ env.CARGO_HOME }}/registry/cache/
             ${{ env.CARGO_HOME }}/git/db/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-release-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-
+            ${{ runner.os }}-cargo-release-
 
       - name: Build goosed binary
         env:

.github/workflows/bundle-desktop-manual.yml

@@ -0,0 +1,19 @@
+name: Manual Desktop Bundle (Unsigned)
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: 'Branch name to bundle app from'
+        required: true
+        type: string
+
+jobs:
+  bundle-desktop-unsigned:
+    uses: ./.github/workflows/bundle-desktop.yml
+    permissions:
+      id-token: write
+      contents: read
+    with:
+      signing: false
+      ref: ${{ inputs.branch }}

.github/workflows/bundle-desktop-windows.yml

@@ -92,10 +92,10 @@ jobs:
         uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f
         with:
           path: target
-          key: ${{ runner.os }}-cargo-build-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('rust-toolchain.toml') }}
+          key: ${{ runner.os }}-cargo-build-release-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('rust-toolchain.toml') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-build-${{ hashFiles('Cargo.lock') }}-
-            ${{ runner.os }}-cargo-build-
+            ${{ runner.os }}-cargo-build-release-${{ hashFiles('Cargo.lock') }}-
+            ${{ runner.os }}-cargo-build-release-
 
       # 4) Build Rust for Windows using Docker (cross-compilation with enhanced caching)
       - name: Build Windows executable using Docker cross-compilation with enhanced caching

.github/workflows/bundle-desktop.yml

@@ -3,6 +3,7 @@
 #  - release.yml
 #  - canary.yml
 #  - pr-comment-bundle-desktop.yml
+#  - bundle-desktop-manual.yml
 on:
   workflow_call:
     inputs:
@@ -127,9 +128,9 @@ jobs:
         uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
         with:
           path: target
-          key: ${{ runner.os }}-cargo-build-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-build-release-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-build-
+            ${{ runner.os }}-cargo-build-release-
 
       # Build the project
       - name: Build goosed
@@ -295,4 +296,4 @@ jobs:
             exit 1
           fi
           # Kill the app to clean up
-          pkill -f "Goose.app/Contents/MacOS/Goose"
+          pkill -f "Goose.app/Contents/MacOS/Goose"

.github/workflows/check-release-pr.yaml

@@ -0,0 +1,57 @@
+name: Check Release PR
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+    branches:
+      - main
+
+jobs:
+  check-commits:
+    runs-on: ubuntu-latest
+    if: startsWith(github.head_ref, 'release/')
+    steps:
+    - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      with:
+        ref: ${{ github.head_ref }}
+        fetch-depth: 0
+
+    - name: Check all PR commits exist in main
+      run: |
+        git fetch origin main
+
+        CHERRY_OUTPUT=$(git cherry origin/main HEAD)
+
+        if [ -z "$CHERRY_OUTPUT" ]; then
+          echo "✅ All commits already exist in main"
+          exit 0
+        fi
+
+        echo "Cherry check results:"
+        echo "$CHERRY_OUTPUT"
+
+        MISSING_COMMITS=$(echo "$CHERRY_OUTPUT" | grep '^+' | cut -d' ' -f2)
+
+        if [ -z "$MISSING_COMMITS" ]; then
+          echo "✅ All commits exist in main"
+          exit 0
+        fi
+
+        COMMIT_COUNT=$(echo "$MISSING_COMMITS" | wc -l)
+        FIRST_COMMIT=$(git rev-list --reverse HEAD ^origin/main | head -1)
+
+        if [ "$COMMIT_COUNT" -eq 1 ] && echo "$MISSING_COMMITS" | grep -q "$FIRST_COMMIT"; then
+          echo "✅ Only version bump commit is unique"
+          git log --oneline -1 "$FIRST_COMMIT"
+        else
+          echo "❌ Found commits that should exist in main:"
+          for commit in $MISSING_COMMITS; do
+            if [ "$commit" != "$FIRST_COMMIT" ]; then
+              git log --oneline -1 "$commit"
+            fi
+          done
+          echo "Make sure commits have equivalents in main. If you've since updated main, re-run this job"
+          exit 1
+        fi

.github/workflows/ci.yml

@@ -73,9 +73,9 @@ jobs:
             ${{ env.CARGO_HOME }}/registry/cache/
             ${{ env.CARGO_HOME }}/git/db/
             target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-debug-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-
+            ${{ runner.os }}-cargo-debug-
 
       - name: Build and Test
         run: |
@@ -131,13 +131,4 @@ jobs:
         run: source ../../bin/activate-hermit && npm run test:run
         working-directory: ui/desktop
 
-  # Faster Desktop App build for PRs only
-  bundle-desktop-unsigned:
-    uses: ./.github/workflows/bundle-desktop.yml
-    permissions:
-      id-token: write
-      contents: read
-    needs: changes
-    if: (github.event_name == 'pull_request' || github.event_name == 'merge_group') && (needs.changes.outputs.code == 'true' || github.event_name != 'pull_request')
-    with:
-      signing: false
+