diff --git a/.github/actions/copy-workflow-go/action.yml b/.github/actions/copy-workflow-go/action.yml
index 2c047eb3..78ab9f9b 100644
--- a/.github/actions/copy-workflow-go/action.yml
+++ b/.github/actions/copy-workflow-go/action.yml
@@ -4,23 +4,34 @@ description: Copy workflow steps specific to go
 runs:
   using: "composite"
   steps:
+    # GitHub Actions Expressions do not support last item access/array length retrieval
+    - id: go
+      run: echo "version=$(jq -r '.[-1]' <<< '${{ toJSON(matrix.cfg.go.versions) }}')" >> $GITHUB_OUTPUT
+      shell: bash
     - uses: actions/setup-go@v3
       with:
         # This should be the same Go version we use in the go-check workflow.
         # go mod tidy, go vet, staticcheck and gofmt might behave differently depending on the version.
-        go-version: "1.19.x"
+        go-version: ${{ steps.go.outputs.version }}
     - name: bump go.mod go version if needed
       uses: protocol/multiple-go-modules@v1.2
+      env:
+        VERSION: ${{ matrix.cfg.go.versions[0] }}
       with:
         working-directory: ${{ env.TARGET_REPO_DIR }}
         run: |
           # We want our modules to support two Go versions at a time.
-          # As of August 2022, Go 1.19 is the latest stable.
           # go.mod's Go version declares the language version being used.
           # As such, it has to be the minimum of all Go versions supported.
-          # Bump this every six months, as new Go versions come out.
-          TARGET_VERSION=1.18
-          PREVIOUS_TARGET_VERSION=1.17
+          TARGET_VERSION="$VERSION"
+          TARGET_VERSION="${TARGET_VERSION%.x}"
+          TARGET_MAJOR_VERSION="${TARGET_VERSION%.[0-9]*}"
+          TARGET_MINOR_VERSION="${TARGET_VERSION#[0-9]*.}"
+          # Assumptions:
+          # - all versions are targetted incrementally
+          # - no versions are skipped
+          # - patch version is never pinned explicitly
+          PREVIOUS_TARGET_VERSION="$TARGET_MAJOR_VERSION.$(($TARGET_MINOR_VERSION-1))"
 
           # Note that the "<" comparison doesn't understand semver,
           # but it should be good enough for the foreseeable future.
@@ -50,18 +61,18 @@ runs:
             # As of Go 1.19 io/ioutil is deprecated
             # We automate its upgrade here because it is quite a widely used package
             while read file; do
-              sed -i 's/ioutil.NopCloser/io.NopCloser/' "${file}";
-              sed -i 's/ioutil.ReadAll/io.ReadAll/' "${file}";
+              sed -i 's/ioutil.NopCloser/io.NopCloser/' "$file";
+              sed -i 's/ioutil.ReadAll/io.ReadAll/' "$file";
               # ReadDir replacement might require manual intervention (https://pkg.go.dev/io/ioutil#ReadDir)
-              sed -i 's/ioutil.ReadDir/os.ReadDir/' "${file}";
-              sed -i 's/ioutil.ReadFile/os.ReadFile/' "${file}";
-              sed -i 's/ioutil.TempDir/os.MkdirTemp/' "${file}";
-              sed -i 's/ioutil.TempFile/os.CreateTemp/' "${file}";
-              sed -i 's/ioutil.WriteFile/os.WriteFile/' "${file}";
-              sed -i 's/ioutil.Discard/io.Discard/' "${file}";
+              sed -i 's/ioutil.ReadDir/os.ReadDir/' "$file";
+              sed -i 's/ioutil.ReadFile/os.ReadFile/' "$file";
+              sed -i 's/ioutil.TempDir/os.MkdirTemp/' "$file";
+              sed -i 's/ioutil.TempFile/os.CreateTemp/' "$file";
+              sed -i 's/ioutil.WriteFile/os.WriteFile/' "$file";
+              sed -i 's/ioutil.Discard/io.Discard/' "$file";
             done <<< "$(find . -type f -name '*.go')"
 
-            go install golang.org/x/tools/cmd/goimports@v0.1.12
+            go install golang.org/x/tools/cmd/goimports@v0.5.0
             goimports -w .
 
             git add .
@@ -70,7 +81,7 @@ runs:
             fi
           fi
     - name: go mod tidy (on initial workflow deployment)
-      if: ${{ env.INITIAL_WORKFLOW_DEPLOYMENT == 1 }}
+      if: env.INITIAL_WORKFLOW_DEPLOYMENT == 1
       uses: protocol/multiple-go-modules@v1.2
       with:
         working-directory: ${{ env.TARGET_REPO_DIR }}
@@ -81,7 +92,7 @@ runs:
             git commit -m "run go mod tidy"
           fi
     - name: gofmt -s (on initial workflow deployment and on new Go version)
-      if: ${{ env.INITIAL_WORKFLOW_DEPLOYMENT == 1 || env.GO_VERSION_BUMP == 1}}
+      if: env.INITIAL_WORKFLOW_DEPLOYMENT == 1 || env.GO_VERSION_BUMP == 1
       working-directory: ${{ env.TARGET_REPO_DIR }}
       shell: bash
       run: |
diff --git a/.github/actions/read-config/action.yml b/.github/actions/read-config/action.yml
new file mode 100644
index 00000000..5d20028a
--- /dev/null
+++ b/.github/actions/read-config/action.yml
@@ -0,0 +1,22 @@
+name: read config
+description: Reads workflow config
+
+outputs:
+  json:
+    description: JSON config
+    value: ${{ steps.config.outputs.json }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: config
+      run: |
+        eof="EOF$RANDOM"
+        path="${GITHUB_WORKFLOW_REF%.yml@*}"
+        path="./${path#*/*/}-config.json"
+        printf "json<<$eof\n%s\n$eof" "$(cat "$path" || echo '{}')" >> $GITHUB_OUTPUT
+      shell: bash
+    - env:
+        CONFIG: ${{ steps.config.outputs.json }}
+      run: echo "$CONFIG"
+      shell: bash
diff --git a/.github/workflows/add-label-by-query.yml b/.github/workflows/add-label-by-query.yml
index 26fc7146..2b5b16e6 100644
--- a/.github/workflows/add-label-by-query.yml
+++ b/.github/workflows/add-label-by-query.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
       - name: Add label by query
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           QUERY: ${{ github.event.inputs.query }}
           LABEL: ${{ github.event.inputs.label }}
           DRY_RUN: ${{ github.event.inputs.dry-run }}
diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index c24662ca..ba91bdb5 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -21,17 +21,20 @@ jobs:
         fetch-depth: 0
     - name: Check if we should automerge
       id: should-automerge
+      env:
+        BASE_REF: ${{ github.event.pull_request.base.ref }}
+        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
       run: |
-        for commit in $(git rev-list --first-parent origin/${{ github.event.pull_request.base.ref }}..${{ github.event.pull_request.head.sha }}); do
+        for commit in $(git rev-list --first-parent origin/$BASE_REF..$HEAD_SHA); do
           committer=$(git show --format=$'%ce' -s $commit)
           echo "Committer: $committer"
           if [[ "$committer" != "web3-bot@users.noreply.github.com" ]]; then
             echo "Commit $commit wasn't committed by web3-bot, but by $committer."
-            echo "::set-output name=status::false"
+            echo "status=false" >> $GITHUB_OUTPUT
             exit
           fi
         done
-        echo "::set-output name=status::true"
+        echo "status=true" >> $GITHUB_OUTPUT
   automerge:
     needs: automerge-check
     runs-on: ubuntu-latest
@@ -40,16 +43,16 @@ jobs:
     if: github.event.pull_request.user.login == 'web3-bot' && needs.automerge-check.outputs.status == 'true'
     steps:
     - name: Wait on tests
-      uses: lewagon/wait-on-check-action@752bfae19aef55dab12a00bc36d48acc46b77e9d # v1.1.1
+      uses: lewagon/wait-on-check-action@3a563271c3f8d1611ed7352809303617ee7e54ac # v1.2.0
       with:
         ref: ${{ github.event.pull_request.head.sha }}
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        repo-token: ${{ github.token }}
         wait-interval: 10
         running-workflow-name: '${{ inputs.job }} / ${{ github.job }}' # the name of the check for this job
     - name: Merge PR
-      uses: pascalgn/automerge-action@741c311a47881be9625932b0a0de1b0937aab1ae # v0.13.1
+      uses: pascalgn/automerge-action@eb68b061739cb9d81564f8e812d0b3c45f0fb09a # v0.15.5
       env:
-        GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        GITHUB_TOKEN: "${{ github.token }}"
         MERGE_LABELS: ""
         MERGE_METHOD: "squash"
         MERGE_DELETE_BRANCH: true
diff --git a/.github/workflows/check-3rd-party.yml b/.github/workflows/check-3rd-party.yml
index 36203b6a..1df81c88 100644
--- a/.github/workflows/check-3rd-party.yml
+++ b/.github/workflows/check-3rd-party.yml
@@ -15,16 +15,18 @@ jobs:
       - id: set-matrix
         run: |
           TARGETS=$(find . -type f -name "*.yml" | sed "s|^\./||" | grep -v workflow-templates/header.yml | jq -R -s -c 'split("\n")[:-1]')
-          echo "::set-output name=targets::$TARGETS"
+          echo "targets=$TARGETS" >> $GITHUB_OUTPUT
   check:
     needs: [ matrix ]
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        file: ${{ fromJson(needs.matrix.outputs.targets) }}
+        file: ${{ fromJSON(needs.matrix.outputs.targets) }}
     name: ${{ matrix.file }}
     steps:
       - uses: actions/checkout@v3
       - name: Run check
-        run: .github/workflows/check-3rd-party.sh ${{ matrix.file }}
+        env:
+          FILE: ${{ matrix.file }}
+        run: .github/workflows/check-3rd-party.sh $FILE
diff --git a/.github/workflows/check-yaml.yml b/.github/workflows/check-yaml.yml
index 890a8e3d..4bdd2996 100644
--- a/.github/workflows/check-yaml.yml
+++ b/.github/workflows/check-yaml.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: nwisbeta/validate-yaml-schema@c3734e647d2a3beb98b9132330067e900fdbd1a2 # v2.0.0
+      - uses: pl-strflt/validate-yaml-schema@21116b89ed801672cb7354717c0d049974f265b0
         with:
           yamlSchemasJson: |
             {
diff --git a/.github/workflows/copy-workflow.yml b/.github/workflows/copy-workflow.yml
index 2eaa2163..6af22692 100644
--- a/.github/workflows/copy-workflow.yml
+++ b/.github/workflows/copy-workflow.yml
@@ -15,7 +15,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        cfg: ${{ fromJson(github.event.inputs.targets) }}
+        cfg: ${{ fromJSON(github.event.inputs.targets) }}
       max-parallel: 10
     env:
       TARGET_REPO_DIR: "target-repo"
@@ -53,16 +53,16 @@ jobs:
     - name: determine files to add
       # By setting the environment variable, it's possible to programmatically add / modify this list.
       # See https://github.com/protocol/.github/blob/38135c75e47839623bf9b2748275d8c6167a8fa8/.github/workflows/copy-workflow.yml#L163-L168 for an example, how we used to make use of this.
-      run: |
-        files=${{ toJson(toJson(matrix.cfg.files)) }}
-        extra_files=${{ toJson(toJson(matrix.cfg.extra_files)) }}
-        files=$(echo -e "$files" "$extra_files" | jq -nc '[inputs] | add')
-        echo "FILES=$files" >> $GITHUB_ENV
+      env:
+        FILES: |
+          ${{ toJSON(matrix.cfg.files) }}
+          ${{ toJSON(matrix.cfg.extra_files) }}
+      run: echo "FILES=$(jq -nc '[inputs] | add' <<< "$FILES")" >> $GITHUB_ENV
     - name: is initial workflow deployment
       # INITIAL_WORKFLOW_DEPLOYMENT=1 iff none of the files in the target repository exist yet
       run: |
         initial_workflow_deployment=1
-        for f in $(jq -r '.[]' <<< ${{ toJson(env.FILES) }}); do
+        for f in $(jq -r '.[]' <<< "$FILES"); do
           if [[ -f $TARGET_REPO_DIR/$f ]]; then
             initial_workflow_deployment=0
             break
@@ -70,7 +70,7 @@ jobs:
         done
         echo "INITIAL_WORKFLOW_DEPLOYMENT=$initial_workflow_deployment" >> $GITHUB_ENV
     - name: remove Travis (on initial workflow deployment)
-      if: ${{ env.INITIAL_WORKFLOW_DEPLOYMENT == 1 }}
+      if: env.INITIAL_WORKFLOW_DEPLOYMENT == 1
       working-directory: ${{ env.TARGET_REPO_DIR }}
       run: |
         if [[ -f .travis.yml ]]; then
@@ -78,7 +78,7 @@ jobs:
           git commit -m "disable Travis"
         fi
     - name: remove CircleCI (on initial workflow deployment)
-      if: ${{ env.INITIAL_WORKFLOW_DEPLOYMENT == 1 }}
+      if: env.INITIAL_WORKFLOW_DEPLOYMENT == 1
       working-directory: ${{ env.TARGET_REPO_DIR }}
       run: |
         if [[ -d .circleci ]]; then
@@ -86,7 +86,7 @@ jobs:
           git commit -m "disable CircleCI"
         fi
     - name: remove gx (on initial workflow deployment)
-      if: ${{ env.INITIAL_WORKFLOW_DEPLOYMENT == 1 }}
+      if: env.INITIAL_WORKFLOW_DEPLOYMENT == 1
       working-directory: ${{ env.TARGET_REPO_DIR }}
       run: |
         if [[ -d .gx ]]; then
@@ -111,7 +111,7 @@ jobs:
           }
         TEMPLATE_ENGINE: s#\$\{\{\{\s*(.*?)\s*\}\}\}#`jq -cjn 'env.CONTEXT | fromjson.$1'`#ge
       run: |
-        for f in $(jq -r '.[]' <<< ${{ toJson(env.FILES) }}); do
+        for f in $(jq -r '.[]' <<< "$FILES"); do
           echo -e "\nProcessing $f."
           # add DO NOT EDIT header
           tmp=$(mktemp)
@@ -144,7 +144,7 @@ jobs:
       working-directory: ${{ env.TARGET_REPO_DIR }}
       run: echo "NEEDS_UPDATE=$(git rev-list HEAD...origin/$(git rev-parse --abbrev-ref HEAD) --ignore-submodules --count 2> /dev/null || echo 1)" >> $GITHUB_ENV
     - name: Force push web3-bot/sync branch
-      if: ${{ env.NEEDS_UPDATE != 0 }}
+      if: env.NEEDS_UPDATE != 0
       working-directory: ${{ env.TARGET_REPO_DIR }}
       run: |
         git checkout -B web3-bot/sync
diff --git a/.github/workflows/create-prs.yml b/.github/workflows/create-prs.yml
index 01c96d15..d333b9a6 100644
--- a/.github/workflows/create-prs.yml
+++ b/.github/workflows/create-prs.yml
@@ -28,16 +28,16 @@ jobs:
           done
           failed=()
           for target in ${targets[@]}; do
-            echo "Processing ${target}"
-            base="$(gh api "/repos/${target}" --jq '.default_branch')"
+            echo "Processing $target"
+            base="$(gh api "/repos/$target" --jq '.default_branch')"
             # checks if a PR needs to be created
-            if [[ "$(gh api -X GET "/repos/${target}/compare/${base}...${{ env.PR_BRANCH }}" --jq '.status')" == 'ahead' ]]; then
-              if [[ "$(gh api -X GET "/repos/${target}/pulls" -f head="$(echo "${target}" | cut -d/ -f1):${{ env.PR_BRANCH }}" -f base="$base" --jq 'length')" != '0' ]] ; then
+            if [[ "$(gh api -X GET "/repos/$target/compare/$base...$PR_BRANCH" --jq '.status')" == 'ahead' ]]; then
+              if [[ "$(gh api -X GET "/repos/$target/pulls" -f head="$(echo "$target" | cut -d/ -f1):$PR_BRANCH" -f base="$base" --jq 'length')" != '0' ]] ; then
                 echo "The PR already exists. Skipping."
                 continue
               fi
             else
-              echo "The branch does not exist or has diverged from ${base}. Skipping."
+              echo "The branch does not exist or has diverged from $base. Skipping."
               continue
             fi
             # tries to create a PR in target
@@ -47,7 +47,7 @@ jobs:
             pr_create_cooldown_in_seconds=1
             # max cumulative sleep time - 68.25 minutes
             while true; do
-              if result="$(gh api "/repos/$target/pulls" -f title="${{ env.PR_TITLE }}" -f head="${{ env.PR_BRANCH }}" -f base="$base")"; then
+              if result="$(gh api "/repos/$target/pulls" -f title="$PR_TITLE" -f head="$PR_BRANCH" -f base="$base")"; then
                 echo "Successfully created a PR for '$target' ($pr_create_attempt/$pr_create_max_attempts)"
                 echo "Sleeping for $pr_create_cooldown_in_seconds seconds before creating a next one"
                 sleep $pr_create_cooldown_in_seconds
diff --git a/.github/workflows/dispatch.yml b/.github/workflows/dispatch.yml
index f546cb34..4fed8545 100644
--- a/.github/workflows/dispatch.yml
+++ b/.github/workflows/dispatch.yml
@@ -9,6 +9,10 @@ on:
     branches: [ master, testing ]
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   # Number of repositories in a batch.
   # Matrix jobs within a copy workflow run are run in parallel.
@@ -48,8 +52,8 @@ jobs:
             targets+=($(jq -c ".repositories[] | $defaults + ." $config))
             echo "::endgroup::"
           done
-          batches=$(jq -sc '[. | _nwise(${{ env.MAX_REPOS_PER_WORKFLOW }})] | to_entries' <<< "${targets[@]}")
-          echo "::set-output name=batches::$batches"
+          batches=$(jq -sc "[. | _nwise($MAX_REPOS_PER_WORKFLOW)] | to_entries" <<< "${targets[@]}")
+          echo "batches=$batches" >> $GITHUB_OUTPUT
   dispatch:
     needs: [ matrix ]
     name: Dispatch copy workflow(batch ${{ matrix.cfg.key }})
@@ -69,7 +73,7 @@ jobs:
         # The triggered copy workflow runs use that final array as their matrix.
         # Since max-parallel here is 1, we'll end up with at most max-parallel from copy workflow + 1 parallel jobs.
         # 20 is the upper limit on parallel jobs on a free plan.
-        cfg: ${{ fromJson(needs.matrix.outputs.batches) }}
+        cfg: ${{ fromJSON(needs.matrix.outputs.batches) }}
       max-parallel: 1
     env:
       GITHUB_TOKEN: ${{ secrets.WEB3BOT_GITHUB_TOKEN }}
@@ -78,31 +82,36 @@ jobs:
     steps:
       - id: dispatch
         name: Dispatch copy workflow
+        env:
+          TARGETS: ${{ toJSON(matrix.cfg.value) }}
         run: |
           start_date="$(date +%s)"
-          # 2 toJson calls are needed to turn the array of targets into a string
-          echo '{"targets":${{ toJson(toJson(matrix.cfg.value)) }}}' | jq -c '.' | gh workflow run "${{ env.WORKFLOW_YML }}" --ref "${{ github.ref }}" --repo "${{ env.WORKFLOW_REPO }}" --json
-          echo "::set-output name=start_date::$start_date"
+          gh workflow run "$WORKFLOW_YML" --ref "$GITHUB_REF" --repo "$WORKFLOW_REPO" --field "targets=$TARGETS"
+          echo "start_date=$start_date" >> $GITHUB_OUTPUT
       - id: run
         name: Wait for copy workflow run to start
+        env:
+          START_DATE: ${{ steps.dispatch.outputs.start_date }}
         run: |
           # checks every 3 seconds until the most recent copy workflow run's created_at is later than this job's start_date
           while sleep 3; do
-            run="$(gh api "/repos/${{ env.WORKFLOW_REPO }}/actions/workflows/${{ env.WORKFLOW_YML }}/runs?per_page=1" --jq '.workflow_runs[0]')"
+            run="$(gh api "/repos/$WORKFLOW_REPO/actions/workflows/$WORKFLOW_YML/runs?per_page=1" --jq '.workflow_runs[0]')"
             # nothing to check if no copy workflow run was returned
             if [[ ! -z "$run" ]]; then
               run_start_date="$(date --date="$(jq -r '.created_at' <<< "$run")" +%s)"
-              if [[ "$run_start_date" > "${{ steps.dispatch.outputs.start_date }}" ]]; then
-                echo "::set-output name=id::$(jq -r '.id' <<< "$run")"
+              if [[ "$run_start_date" > "$START_DATE" ]]; then
+                echo "id=$(jq -r '.id' <<< "$run")" >> $GITHUB_OUTPUT
                 break
               fi
             fi
           done
       - name: Wait for copy workflow run to complete
+        env:
+          RUN_ID: ${{ steps.run.outputs.id }}
         run: |
           # delays checking copy workflow's run status to save on GH API requests
-          sleep ${{ env.WORKFLOW_COMPLETION_CHECK_DELAY }}
+          sleep $WORKFLOW_COMPLETION_CHECK_DELAY
 
           # checks every 3 seconds until the copy workflow run's status is completed
           # redirects the stdout to /dev/null because it is very chatty
-          gh run watch "${{ steps.run.outputs.id }}" --repo "${{ env.WORKFLOW_REPO }}" > /dev/null
+          gh run watch "$RUN_ID" --repo "$WORKFLOW_REPO" > /dev/null
diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml
index ae7f6a4f..599a43ee 100644
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -1,9 +1,11 @@
-# This workflow cannot post sticky comments on PRs from forked repositories.
-# Instead, it outputs the message it would have posted as a workflow notice.
-# See https://github.com/protocol/.github/issues/254 for details.
-
 name: Release Checker
-on: [ workflow_call ]
+on:
+  workflow_call:
+    inputs:
+      go-version:
+        required: true
+        type: string
+        default: 1.19.x # TODO: remove once release-check is upgraded in all the targets
 
 jobs:
   releaser:
@@ -14,11 +16,19 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v3
         with:
-          go-version: "1.19.x"
+          go-version: ${{ inputs.go-version }}
       - id: version
         name: Determine version
-        if: hashFiles('version.json')
-        run: echo "version=$(jq -r .version version.json)" >> $GITHUB_OUTPUT
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          HEAD_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          # If `version.json` file doesn't exists, `version` is `""` and `404` is printed on stderr.
+          # The step won't be marked as a failure though because the error happens in a subshell.
+          version="$(gh api -X GET "repos/$HEAD_FULL_NAME/contents/version.json" -f ref="$HEAD_SHA" --jq '.content' | base64 -d | jq -r '.version')"
+          echo "version=$version"
+          echo "version=$version" >> $GITHUB_OUTPUT
       - id: tag
         name: Check if the tag already exists
         # Check if a git tag for the version (as read from version.json) exists
@@ -35,7 +45,7 @@ jobs:
           fi
       - name: Install semver (node command line tool)
         if: steps.tag.outputs.exists == 'false'
-        run: npm install -g "https://github.com/npm/node-semver#e79ac3a450e8bb504e78b8159e3efc7089569" # v7.3.5
+        run: npm install -g "https://github.com/npm/node-semver#dc0fe202faaf19a545ce5eeab3480be84180a082" # v7.3.8
       - name: Check version
         if: steps.tag.outputs.exists == 'false'
         env:
@@ -55,23 +65,16 @@ jobs:
         run: |
           git fetch origin --tags
           go install github.com/marten-seemann/semver-highest@fcdc98f8820ff0e6613c1bee071c096febd98dbf
-          v=$(semver-highest -target "$VERSION" -versions $(git tag | paste -sd , -))
-          status=$?
-          if [[ $status != 0 ]]; then
-            echo $v
-            exit $status
+          vs=$(git tag | paste -sd , -)
+          if [[ ! -z "$vs" ]]; then
+            v=$(semver-highest -target "$VERSION" -versions "$vs")
+            status=$?
+            if [[ $status != 0 ]]; then
+              echo $v
+              exit $status
+            fi
+            echo "version=$v" >> $GITHUB_OUTPUT
           fi
-          echo "version=$v" >> $GITHUB_OUTPUT
-      - name: Post output
-        if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version == ''
-        uses: marocchino/sticky-pull-request-comment@82e7a0d3c51217201b3fedc4ddde6632e969a477 # v2.1.1
-        with:
-          header: release-check
-          recreate: true
-          message: |
-            Suggested version: `${{ steps.version.outputs.version }}`
-
-            This is the first release of this module.
       - id: git-diff
         name: run git diff on go.mod file(s)
         if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version != ''
@@ -95,7 +98,7 @@ jobs:
         # see https://github.com/golang/exp/commits/master/cmd/gorelease
         run: |
           go mod download
-          go install golang.org/x/exp/cmd/gorelease@b4e88ed8e8aab63a9aa9a52276782ebbc547adef
+          go install golang.org/x/exp/cmd/gorelease@f062dba9d201f5ec084d25785efec05637818c00 # https://cs.opensource.google/go/x/exp/+/f062dba9d201f5ec084d25785efec05637818c00
           output=$((gorelease -base "$PREV_VERSION") 2>&1 || true)
           printf "output<<$EOF\n%s\n$EOF" "$output" >> $GITHUB_OUTPUT
       - id: gocompat
@@ -110,64 +113,103 @@ jobs:
             output="(empty)"
           fi
           printf "output<<$EOF\n%s\n$EOF" "$output" >> $GITHUB_OUTPUT
-      - id: footnote
-        if: github.base_ref != github.event.repository.default_branch
+      - id: release
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        uses: galargh/action-gh-release@25b3878b4c346655a4d3d9bea8b76638f64743cf # https://github.com/softprops/action-gh-release/pull/316
+        with:
+          draft: true
+          tag_name: ${{ steps.version.outputs.version }}
+          generate_release_notes: true
+      - id: message
         env:
+          HEADER: |
+            Suggested version: `${{ steps.version.outputs.version }}`
+          BODY: |
+            Comparing to: [${{ steps.prev.outputs.version }}](${{ github.event.pull_request.base.repo.html_url }}/releases/tag/${{ steps.prev.outputs.version }}) ([diff](${{ github.event.pull_request.base.repo.html_url }}/compare/${{ steps.prev.outputs.version }}..${{ github.event.pull_request.head.label }}))
+
+            Changes in `go.mod` file(s):
+            ```diff
+            ${{ steps.git-diff.outputs.output }}
+            ```
+
+            `gorelease` says:
+            ```
+            ${{ steps.gorelease.outputs.output }}
+            ```
+
+            `gocompat` says:
+            ```
+            ${{ steps.gocompat.outputs.output }}
+            ```
+
+          BODY_ALT: |
+            This is the first release of this module.
+
+          RELEASE_BRANCH_NOTICE: |
+            ## Cutting a Release (when not on `${{ github.event.repository.default_branch }}`)
+
+            This PR is targeting `${{ github.base_ref }}`, which is not the default branch.
+            If you wish to cut a release once this PR is merged, please add the `release` label to this PR.
+
+          DIFF_NOTICE: |
+            ## Cutting a Release (and modifying non-markdown files)
+
+            This PR is modifying both `version.json` and non-markdown files.
+            The Release Checker is not able to analyse files that are not checked in to `${{ github.base_ref }}`. This might cause the above analysis to be inaccurate.
+            Please consider performing all the code changes in a separate PR before cutting the release.
+
+          RELEASE_NOTICE: |
+            ## Automatically created GitHub Release
+
+            A [draft GitHub Release](${{ steps.release.outputs.url }}) has been created.
+            It is going to be published when this PR is merged.
+            You can modify its' body to include any release notes you wish to include with the release.
+
+          RELEASE_NOTICE_ALT: |
+            ## Automatically created GitHub Release
+
+            Pre-creating GitHub Releases on release PRs initiated from forks is not supported.
+            If you wish to prepare release notes yourself, you should create a draft GitHub Release for tag `${{ steps.version.outputs.version }}` manually.
+            The draft GitHub Release is going to be published when this PR is merged.
+            If you choose not to create a draft GitHub Release, a published GitHub Released is going to be created when this PR is merged.
+
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
           BASE_REF: ${{ github.base_ref }}
-        run: |
-          echo 'output<<'"$EOF"'
-          ---
-          ## Cutting a Release (when not on `'"$DEFAULT_BRANCH"'`)
-
-          This PR is targeting `'"$BASE_REF"'`, which is not the default branch.
-          If you wish to cut a release once this PR is merged, please add the `release` label to this PR.
-          '"$EOF" >> $GITHUB_ENV
-      - id: message
-        if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version != ''
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-          PREV_VERSION: ${{ steps.prev.outputs.version }}
-          BASE_HTML_URL: ${{ github.event.pull_request.base.repo.html_url }}
           HEAD_LABEL: ${{ github.event.pull_request.head.label }}
-          GIT_DIFF: ${{ steps.git-diff.outputs.output }}
-          GORELEASE: ${{ steps.gorelease.outputs.output }}
-          GOCOMPAT: ${{ steps.gocompat.outputs.output }}
-          FOOTNOTE: ${{ steps.footnote.outputs.output }}
+          HEAD_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
+          GITHUB_TOKEN: ${{ github.token }}
+          PREV_VERSION: ${{ steps.prev.outputs.version }}
         run: |
-          echo 'output<<'"$EOF"'
-          Suggested version: `'"$VERSION"'`
-          Comparing to: [`'"$PREV_VERSION"'`]('"$BASE_HTML_URL"'/releases/tag/'"$PREV_VERSION"') ([diff]('"$BASE_HTML_URL"'/compare/'"$PREV_VERSION"'..'"$HEAD_LABEL"'))
-
-          Changes in `go.mod` file(s):
-          ```diff
-          '"$GIT_DIFF"'
-          ```
-
-          `gorelease` says:
-          ```
-          '"$GORELEASE"'
-          ```
-
-          `gocompat` says:
-          ```
-          '"$GOCOMPAT"'
-          ```
-          '"$FOOTNOTE"'
-          '"$EOF" >> $GITHUB_OUTPUT
+          echo "output<<$EOF" >> $GITHUB_OUTPUT
+
+          echo "$HEADER" >> $GITHUB_OUTPUT
+
+          if [[ "$PREV_VERSION" != "" ]]; then
+            echo "$BODY" >> $GITHUB_OUTPUT
+          else
+            echo "$BODY_ALT" >> $GITHUB_OUTPUT
+          fi
+
+          if [[ "$DEFAULT_BRANCH" != "$BASE_REF" ]]; then
+            echo "$RELEASE_BRANCH_NOTICE" >> $GITHUB_OUTPUT
+          fi
+
+          diff="$(gh api -X GET "repos/$GITHUB_REPOSITORY/compare/$BASE_REF...$HEAD_LABEL" --jq '.files | map(.filename) | map(select(test("^(version\\.json|.*\\.md)$") | not)) | .[]')"
+          if [[ "$diff" != "" ]]; then
+            echo "$DIFF_NOTICE" >> $GITHUB_OUTPUT
+          fi
+
+          if [[ "$GITHUB_REPOSITORY" == "$HEAD_FULL_NAME" ]]; then
+            echo "$RELEASE_NOTICE" >> $GITHUB_OUTPUT
+          else
+            echo "$RELEASE_NOTICE_ALT" >> $GITHUB_OUTPUT
+          fi
+
+          echo "$EOF" >> $GITHUB_OUTPUT
       - name: Post message on PR
-        uses: marocchino/sticky-pull-request-comment@82e7a0d3c51217201b3fedc4ddde6632e969a477 # v2.1.1
-        if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version != '' && github.event.pull_request.head.repo.full_name == github.repository
+        uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
+        if: steps.tag.outputs.exists == 'false'
         with:
           header: release-check
           recreate: true
           message: ${{ steps.message.outputs.output }}
-      - name: Set a notice message on run
-        if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version != '' && github.event.pull_request.head.repo.full_name != github.repository
-        env:
-          MESSAGE: ${{ steps.message.outputs.output }}
-        run: |
-          message="${MESSAGE//'%'/'%25'}"
-          message="${message//$'\n'/'%0A'}"
-          message="${message//$'\r'/'%0D'}"
-          echo "::notice ::$message"
diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml
index 7c27f737..e9242442 100644
--- a/.github/workflows/releaser.yml
+++ b/.github/workflows/releaser.yml
@@ -4,39 +4,34 @@ on: [ workflow_call ]
 jobs:
   releaser:
     runs-on: ubuntu-latest
-    env:
-      VERSION: ""
-      CREATETAG: "false"
-      DEFAULT_BRANCH: ""
     steps:
       - uses: actions/checkout@v3
-      - name: Determine version
-        run: echo "VERSION=$(jq -r .version version.json)" >> $GITHUB_ENV
-      - name: Determine branch
-        run: echo "DEFAULT_BRANCH=refs/heads/${{ github.event.repository.default_branch }}" >> $GITHUB_ENV
-      - name: Create a release, if we're on the default branch
-        run: echo "CREATETAG=true" >> $GITHUB_ENV
-        if: env.DEFAULT_BRANCH == github.ref
-      - name: Determine if this commit is a merged PR (if we're not on a default branch)
-        if: env.DEFAULT_BRANCH != github.ref
-        id: getmergedpr
-        uses: actions-ecosystem/action-get-merged-pull-request@59afe90821bb0b555082ce8ff1e36b03f91553d9
+      - id: version
+        name: Determine version
+        run: echo "version=$(jq -r .version version.json)" >> $GITHUB_OUTPUT
+      - id: pr
+        name: Determine if this commit is a merged PR (if we're not on a default branch)
+        if: github.ref != format('refs/heads/{0}', github.event.repository.default_branch)
+        uses: actions-ecosystem/action-get-merged-pull-request@59afe90821bb0b555082ce8ff1e36b03f91553d9 # v1.0.1
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Check if the "release" label was set on the PR
-        if: steps.getmergedpr.outputs.number != '' && env.DEFAULT_BRANCH != github.ref
-        run: |
-          while IFS= read -r label; do
-            if [[ "$label" == "release" ]]; then
-              echo "CREATETAG=true" >> $GITHUB_ENV
-              break
-            fi
-          done <<< "${{ steps.getmergedpr.outputs.labels }}"
+          github_token: ${{ github.token }}
+      - id: labels
+        env:
+          LABELS: ${{ steps.pr.outputs.labels }}
+        run: echo "labels=$(jq -nc 'env.LABELS | split("\n")')" >> $GITHUB_OUTPUT
+      - id: tag
+        name: Check if tag already exists
+        if: steps.version.outputs.version != ''
+        uses: mukunku/tag-exists-action@9298fbcc409758ba624a0ae16b83df86637cb8ce # v1.2.0
+        with:
+          tag: ${{ steps.version.outputs.version }}
       - name: Create release
-        if: env.CREATETAG == 'true'
-        run: |
-          git fetch origin --tags
-          if ! $(git rev-list ${{ env.VERSION}}.. &> /dev/null); then
-            git tag ${{ env.VERSION }}
-            git push --tags
-          fi
+        if: steps.version.outputs.version != '' && steps.tag.outputs.exists == 'false' && (
+            github.ref == format('refs/heads/{0}', github.event.repository.default_branch) ||
+            contains(fromJSON(steps.labels.outputs.labels), 'release')
+          )
+        uses: galargh/action-gh-release@25b3878b4c346655a4d3d9bea8b76638f64743cf # https://github.com/softprops/action-gh-release/pull/316
+        with:
+          draft: false
+          tag_name: ${{ steps.version.outputs.version }}
+          generate_release_notes: true
diff --git a/.github/workflows/stale-repos.yml b/.github/workflows/stale-repos.yml
index b0258bb8..b5df67fa 100644
--- a/.github/workflows/stale-repos.yml
+++ b/.github/workflows/stale-repos.yml
@@ -15,15 +15,17 @@ jobs:
       - uses: actions/checkout@v3
       - id: repos
         name: find repositories to check
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: |
           # returns a JSON array of repository objects with the following schema:
           #  [ {"config": "$JSON_CONFIG_FILE_PATH", "repo": "$GITHUB_REPOSITORY_FULL_NAME"} ]
           repos="$(jq -nc '[inputs | .repositories[] | {"config":input_filename,"repo":.target}]' configs/*.json)"
 
-          if [[ '${{ github.event_name }}' == 'pull_request' ]]; then
+          if [[ "$GITHUB_EVENT_NAME" == 'pull_request' ]]; then
             # resets the checkout to PR target commit
-            git fetch origin ${{ github.event.pull_request.base.sha }}
-            git checkout ${{ github.event.pull_request.base.sha }}
+            git fetch origin $BASE_SHA
+            git checkout $BASE_SHA
 
             # returns a JSON array of repository objects as they exist on pull request target
             base="$(jq -nc '[inputs | .repositories[] | {"config":input_filename,"repo":.target}]' configs/*.json)"
@@ -33,16 +35,19 @@ jobs:
             repos="$(jq -nc '$head - $base' --argjson head "$repos" --argjson base "$base")"
           fi
 
-          echo "::set-output name=repos::$repos"
+          echo "repos=$repos" >> $GITHUB_OUTPUT
       - name: find deleted / archived repositories
-        if: ${{ steps.repos.outputs.repos != '[]' }}
+        if: steps.repos.outputs.repos != '[]'
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          REPOS: ${{ steps.repos.outputs.repos }}
         run: |
           status=0
           while read config; do
             echo "::group::$config"
             while read repo; do
               exists=true
-              output=$(curl -s -f -H "Accept: application/vnd.github.v3+json" -H "authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" "https://api.github.com/repos/$repo") || exists=false
+              output=$(curl -s -f -H "Accept: application/vnd.github.v3+json" -H "authorization: Bearer $GITHUB_TOKEN" "https://api.github.com/repos/$repo") || exists=false
               if ! $exists; then
                 echo "Repository $repo does not exist."
                 status=1
@@ -52,7 +57,7 @@ jobs:
                 echo "Repository $repo is archived."
                 status=1
               fi
-            done <<< "$(jq -r '.[] | select(.config == $key) | .repo' --arg key "$config" <<< '${{ steps.repos.outputs.repos }}')"
+            done <<< "$(jq -r '.[] | select(.config == $key) | .repo' --arg key "$config" <<< "$REPOS")"
             echo "::endgroup::"
-          done <<< "$(jq -r 'map(.config) | unique | .[]' <<< '${{ steps.repos.outputs.repos }}')"
+          done <<< "$(jq -r 'map(.config) | unique | .[]' <<< "$REPOS")"
           exit $status
diff --git a/.github/workflows/tagpush.yml b/.github/workflows/tagpush.yml
index f295aacf..9d119e9e 100644
--- a/.github/workflows/tagpush.yml
+++ b/.github/workflows/tagpush.yml
@@ -20,28 +20,30 @@ jobs:
       - run: cat "$GITHUB_EVENT_PATH" | jq -M .
       - name: extract tag name
         run: |
-          tagname=$(echo "${{ github.ref }}" | sed "s/refs\/tags\///")
-          echo $tagnmae
+          tagname=$(echo "$GITHUB_REF" | sed "s/refs\/tags\///")
+          echo $tagname
           echo "TAGNAME=$tagname" >> $GITHUB_ENV
       - name: create issue template file
-        if: ${{ github.event.pusher.name != 'web3-bot' }}
+        if: github.event.pusher.name != 'web3-bot'
+        env:
+          PUSHER: ${{ github.event.pusher.name }}
         run: |
           echo "---" >> .github/workflows/tagpush.md
-          echo "title: ${{ env.ISSUE_TITLE }}" | sed "s/%tagname%/${{ env.TAGNAME }}/" >> .github/workflows/tagpush.md
-          echo "assignees: ${{ env.ISSUE_ASSIGNEE }}" | sed "s/%pusher%/${{ github.event.pusher.name }}/" >> .github/workflows/tagpush.md
+          echo "title: $ISSUE_TITLE" | sed "s/%tagname%/$TAGNAME/" >> .github/workflows/tagpush.md
+          echo "assignees: $ISSUE_ASSIGNEE" | sed "s/%pusher%/$PUSHER/" >> .github/workflows/tagpush.md
           echo "---" >> .github/workflows/tagpush.md
           cat <<EOF >> .github/workflows/tagpush.md
-          ${{ env.ISSUE_BODY }}
+          $ISSUE_BODY
           EOF
       - run: cat .github/workflows/tagpush.md
       - name: create an issue
-        if: ${{ github.event.pusher.name != 'web3-bot' }}
-        uses: JasonEtco/create-an-issue@9e6213aec58987fa7d2f4deb8b256b99e63107a2 # v2.6.0
+        if: github.event.pusher.name != 'web3-bot'
+        uses: JasonEtco/create-an-issue@e27dddc79c92bc6e4562f268fffa5ed752639abd # v2.9.1
         env:
           GITHUB_TOKEN: ${{ github.token }}
           PUSHER: ${{ github.event.pusher.name }}
         with:
           filename: .github/workflows/tagpush.md
       - name: fail build if push wasn't done by web3-bot
-        if: ${{ github.event.pusher.name != 'web3-bot' }}
+        if: github.event.pusher.name != 'web3-bot'
         run: exit 1
diff --git a/README.md b/README.md
index ad7cfed4..7d3e59f2 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,15 @@ By storing them in a central place (here), and distributing them in an automated
 ### Additional Setup Steps
 
 Most repositories won't need any customization, and the workflows defined here will just work fine.
+
+#### Configuration Variables
+
+Some aspects of Unified CI workflows are configurable through [configuration variables](https://docs.github.com/en/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository).
+
+You can customise the runner type for `go-test` through `UCI_GO_TEST_RUNNER_UBUNTU`, `UCI_GO_TEST_RUNNER_WINDOWS` and `UCI_GO_TEST_RUNNER_MACOS` configuration variables. This option will be useful for repositories wanting to use more powerful, [PL self-hosted GitHub Actions runners](https://github.com/pl-strflt/tf-aws-gh-runner).
+
+#### Setup Actions
+
 Some repositories may require some pre-setup steps to be run before tests (or code checks) can be run. Setup steps for `go-test` are defined in `.github/actions/go-test-setup/action.yml`, and setup steps for `go-check` are defined in `.github/actions/go-check-setup/action.yml`, in the following format:
 
 ```yml
@@ -43,6 +52,26 @@ This check will be run in repositories that set `gogenerate` to `true` in `.gith
 Note that depending on the code generators used, it might be necessary to [install those first](#additional-setup-steps).
 The generators must also be deterministic, to prevent CI from getting different results each time.
 
+`go-test` offers an option to completely disable running 32-bit tests.
+This option is useful when a project or its upstream dependencies are not 32-bit compatible.
+Typically, such tests can be disabled using [build constraints](https://pkg.go.dev/cmd/go#hdr-Build_constraints).
+However, the constraints must be set per go file, which can be cumbersome for a project with many files.
+Using this option, 32-bit tests can be skipped entirely without having to specify build constraints per file.
+
+To completely disable running 32-bit tests set `skip32bit` to `true` in `.github/workflows/go-test-config.json`:
+```json
+{
+  "skip32bit": true
+}
+```
+
+If your project cannot be built on one of the supported operating systems, you can disable it by setting `skipOSes` to a list of operating systems in `.github/workflows/go-test-config.json`:
+```json
+{
+  "skipOSes": ["windows", "macos"]
+}
+```
+
 ## Technical Preview
 
 You can opt-in to receive early updates from the `next` branch in-between official Unified CI releases.
diff --git a/VERSIONING.md b/VERSIONING.md
index c4ccb3cf..cff629c3 100644
--- a/VERSIONING.md
+++ b/VERSIONING.md
@@ -30,9 +30,13 @@ Every Go repository contains a `version.json` file in the root directory:
 This version file defines the currently released version.
 
 When cutting a new release, open a Pull Request that bumps the version number and have it review by your team mates.
-The [release check workflow](.github/workflows/release-check.yml) will comment on the PR and post useful information (the output of `gorelease`, `gocompat` and a diff of the `go.mod` files(s)).
+The [release check workflow](.github/workflows/release-check.yml) will create a draft GitHub Release (_if the workflow was not initiated by a PR from a fork_) and post a link to it along with other useful information (the output of `gorelease`, `gocompat` and a diff of the `go.mod` files(s)).
 
-As soon as the PR is merged into the default branch, the [releaser workflow](.github/workflows/releaser.yml) is run. This workflow cuts a new release on CI and pushes the tag.
+As soon as the PR is merged into the default branch, the [releaser workflow](.github/workflows/releaser.yml) is run. This workflow either publishes the draft GitHub Release created by the release check workflow or creates a published GitHub Release if it doesn't exist yet. This, in turn, will create a new Git tag and push it to the repository.
+
+### Modifying GitHub Release
+
+All modification you make to the draft GitHub Release created by the release check workflow will be preserved. You can change its' name and body to describe the release in more detail.
 
 ### Using a Release Branch
 
diff --git a/configs/README.md b/configs/README.md
index 1c6a2775..ba569665 100644
--- a/configs/README.md
+++ b/configs/README.md
@@ -38,3 +38,12 @@ To customise the copy workflow further, you can add more fields to the `defaults
 ## Testing
 
 You can use [testing](https://github.com/protocol/.github/tree/testing) branch for worklow/configuration testing. Once you push your changes to the branch, a [dispatch](../.github/workflows/dispatch.yml) workflow will be triggered. The workflow will use [testing.json](testing.json) configuration file only. You can manipalate that configuration file as needed(you can copy all the `defaults` from [go.json](go.json) for [example](https://github.com/protocol/.github/commit/43476995428996a90ca95bf838f084ba1a710c68)).
+
+## Upgrading Go
+
+To upgrade Go, modify the `defaults.go.versions` array in the [Go config](go.json).
+
+Remember to:
+- Keep the array sorted in increasing order,
+- Upgrade versions incrementally. Do not skip a version,
+- never pin the patch version (`"1.19.x"` is correct, `"1.19.8"` is incorrect).
diff --git a/configs/go.json b/configs/go.json
index 5d0879fc..8e3c764f 100644
--- a/configs/go.json
+++ b/configs/go.json
@@ -136,8 +136,7 @@
       "target": "ipfs/go-ds-measure"
     },
     {
-      "target": "ipfs/go-ds-pebble",
-      "source_ref": "next"
+      "target": "ipfs/go-ds-pebble"
     },
     {
       "target": "ipfs/go-ds-redis"
@@ -347,12 +346,10 @@
       "target": "ipni/depute"
     },
     {
-      "target": "ipni/dhstore",
-      "source_ref": "next"
+      "target": "ipni/dhstore"
     },
     {
-      "target": "ipni/go-indexer-core",
-      "source_ref": "next"
+      "target": "ipni/go-indexer-core"
     },
     {
       "target": "ipni/go-naam"
@@ -370,8 +367,7 @@
       "target": "ipni/indexstar"
     },
     {
-      "target": "ipni/storetheindex",
-      "source_ref": "next"
+      "target": "ipni/storetheindex"
     },
     {
       "target": "libp2p/dht-tracer1"
diff --git a/templates/.github/workflows/go-check.yml b/templates/.github/workflows/go-check.yml
index 22d23a45..011be1d6 100644
--- a/templates/.github/workflows/go-check.yml
+++ b/templates/.github/workflows/go-check.yml
@@ -5,26 +5,20 @@ jobs:
   unit:
     runs-on: ubuntu-latest
     name: All
-    env:
-      RUNGOGENERATE: false
     steps:
       - uses: actions/checkout@v3
         with:
           submodules: recursive
+      - id: config
+        uses: protocol/.github/.github/actions/read-config@master
       - uses: actions/setup-go@v3
         with:
-          go-version: "1.19.x"
+          go-version: ${{{ config.go.versions[-1] }}}
       - name: Run repo-specific setup
         uses: ./.github/actions/go-check-setup
         if: hashFiles('./.github/actions/go-check-setup') != ''
-      - name: Read config
-        if: hashFiles('./.github/workflows/go-check-config.json') != ''
-        run: |
-          if jq -re .gogenerate ./.github/workflows/go-check-config.json; then
-            echo "RUNGOGENERATE=true" >> $GITHUB_ENV
-          fi
       - name: Install staticcheck
-        run: go install honnef.co/go/tools/cmd/staticcheck@376210a89477dedbe6fdc4484b233998650d7b3c # 2022.1.3 (v0.3.3)
+        run: go install honnef.co/go/tools/cmd/staticcheck@4970552d932f48b71485287748246cf3237cebdf # 2023.1 (v0.4.0)
       - name: Check that go.mod is tidy
         uses: protocol/multiple-go-modules@v1.2
         with:
@@ -36,7 +30,7 @@ jobs:
             fi
             git diff --exit-code -- go.sum go.mod
       - name: gofmt
-        if: ${{ success() || failure() }} # run this step even if the previous one failed
+        if: success() || failure() # run this step even if the previous one failed
         run: |
           out=$(gofmt -s -l .)
           if [[ -n "$out" ]]; then
@@ -44,12 +38,12 @@ jobs:
             exit 1
           fi
       - name: go vet
-        if: ${{ success() || failure() }} # run this step even if the previous one failed
+        if: success() || failure() # run this step even if the previous one failed
         uses: protocol/multiple-go-modules@v1.2
         with:
           run: go vet ./...
       - name: staticcheck
-        if: ${{ success() || failure() }} # run this step even if the previous one failed
+        if: success() || failure() # run this step even if the previous one failed
         uses: protocol/multiple-go-modules@v1.2
         with:
           run: |
@@ -57,11 +51,11 @@ jobs:
             staticcheck ./... | sed -e 's@\(.*\)\.go@./\1.go@g'
       - name: go generate
         uses: protocol/multiple-go-modules@v1.2
-        if: (success() || failure()) && env.RUNGOGENERATE == 'true'
+        if: (success() || failure()) && fromJSON(steps.config.outputs.json).gogenerate == true
         with:
           run: |
             git clean -fd # make sure there aren't untracked files / directories
-            go generate ./...
+            go generate -x ./...
             # check if go generate modified or added any files
             if ! $(git add . && git diff-index HEAD --exit-code --quiet); then
               echo "go generated caused changes to the repository:"
diff --git a/templates/.github/workflows/go-test.yml b/templates/.github/workflows/go-test.yml
index 10307176..5d5b2e80 100644
--- a/templates/.github/workflows/go-test.yml
+++ b/templates/.github/workflows/go-test.yml
@@ -7,15 +7,17 @@ jobs:
       fail-fast: false
       matrix:
         os: [ "ubuntu", "windows", "macos" ]
-        go: [ "1.18.x", "1.19.x" ]
+        go: ${{{ config.go.versions }}}
     env:
       COVERAGES: ""
-    runs-on: ${{ format('{0}-latest', matrix.os) }}
+    runs-on: ${{ fromJSON(vars[format('UCI_GO_TEST_RUNNER_{0}', matrix.os)] || format('"{0}-latest"', matrix.os)) }}
     name: ${{ matrix.os }} (go ${{ matrix.go }})
     steps:
       - uses: actions/checkout@v3
         with:
           submodules: recursive
+      - id: config
+        uses: protocol/.github/.github/actions/read-config@master
       - uses: actions/setup-go@v3
         with:
           go-version: ${{ matrix.go }}
@@ -24,7 +26,7 @@ jobs:
           go version
           go env
       - name: Use msys2 on windows
-        if: ${{ matrix.os == 'windows' }}
+        if: matrix.os == 'windows'
         shell: bash
         # The executable for msys2 is also called bash.cmd
         #   https://github.com/actions/virtual-environments/blob/main/images/win/Windows2019-Readme.md#shells
@@ -35,6 +37,7 @@ jobs:
         uses: ./.github/actions/go-test-setup
         if: hashFiles('./.github/actions/go-test-setup') != ''
       - name: Run tests
+        if: contains(fromJSON(steps.config.outputs.json).skipOSes, matrix.os) == false
         uses: protocol/multiple-go-modules@v1.2
         with:
           # Use -coverpkg=./..., so that we include cross-package coverage.
@@ -42,16 +45,21 @@ jobs:
           # this means ./B's coverage will be significantly higher than 0%.
           run: go test -v -shuffle=on -coverprofile=module-coverage.txt -coverpkg=./... ./...
       - name: Run tests (32 bit)
-        if: ${{ matrix.os != 'macos' }} # can't run 32 bit tests on OSX.
+        # can't run 32 bit tests on OSX.
+        if: matrix.os != 'macos' &&
+          fromJSON(steps.config.outputs.json).skip32bit != true &&
+          contains(fromJSON(steps.config.outputs.json).skipOSes, matrix.os) == false
         uses: protocol/multiple-go-modules@v1.2
         env:
           GOARCH: 386
         with:
           run: |
-            export "PATH=${{ env.PATH_386 }}:$PATH"
+            export "PATH=$PATH_386:$PATH"
             go test -v -shuffle=on ./...
       - name: Run tests with race detector
-        if: ${{ matrix.os == 'ubuntu' }} # speed things up. Windows and OSX VMs are slow
+        # speed things up. Windows and OSX VMs are slow
+        if: matrix.os == 'ubuntu' &&
+          contains(fromJSON(steps.config.outputs.json).skipOSes, matrix.os) == false
         uses: protocol/multiple-go-modules@v1.2
         with:
           run: go test -v -race ./...
@@ -59,7 +67,7 @@ jobs:
         shell: bash
         run: echo "COVERAGES=$(find . -type f -name 'module-coverage.txt' | tr -s '\n' ',' | sed 's/,$//')" >> $GITHUB_ENV
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           files: '${{ env.COVERAGES }}'
           env_vars: OS=${{ matrix.os }}, GO=${{ matrix.go }}
diff --git a/templates/.github/workflows/js-test-and-release.yml b/templates/.github/workflows/js-test-and-release.yml
index 27fd45a3..14d6f155 100644
--- a/templates/.github/workflows/js-test-and-release.yml
+++ b/templates/.github/workflows/js-test-and-release.yml
@@ -33,7 +33,7 @@ jobs:
           node-version: ${{ matrix.node }}
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:node
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: node
 
@@ -47,7 +47,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:chrome
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: chrome
 
@@ -61,7 +61,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:chrome-webworker
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: chrome-webworker
 
@@ -75,7 +75,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:firefox
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: firefox
 
@@ -89,7 +89,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:firefox-webworker
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: firefox-webworker
 
@@ -103,7 +103,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npx xvfb-maybe npm run --if-present test:electron-main
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: electron-main
 
@@ -117,7 +117,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npx xvfb-maybe npm run --if-present test:electron-renderer
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: electron-renderer
 
@@ -139,5 +139,5 @@ jobs:
           docker-username: ${{ secrets.DOCKER_USERNAME }}
       - run: npm run --if-present release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/templates/.github/workflows/release-check.yml b/templates/.github/workflows/release-check.yml
index f1b5f7bb..036e96ad 100644
--- a/templates/.github/workflows/release-check.yml
+++ b/templates/.github/workflows/release-check.yml
@@ -1,8 +1,10 @@
 name: Release Checker
 on:
-  pull_request:
+  pull_request_target:
     paths: [ 'version.json' ]
 
 jobs:
   release-check:
     uses: protocol/.github/.github/workflows/release-check.yml@master
+    with:
+      go-version: ${{{ config.go.versions[-1] }}}