From 4ef54da0f692d61c958cb740975fcf457a22d862 Mon Sep 17 00:00:00 2001
From: "Masih H. Derkani" <m@derkani.org>
Date: Mon, 14 Nov 2022 08:21:30 +0000
Subject: [PATCH 01/15] Add option to skip `32-bit` go test (#412)

Introduce an option to configure `go-test` to allow completely skipping
`32-bit` tests.

Fixes #388
---
 README.md                               | 13 +++++++++++++
 templates/.github/workflows/go-test.yml | 10 +++++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 22198a06..022220dc 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,19 @@ This check will be run in repositories that set `gogenerate` to `true` in `.gith
 Note that depending on the code generators used, it might be necessary to [install those first](#additional-setup-steps).
 The generators must also be deterministic, to prevent CI from getting different results each time.
 
+`go-test` offers an option to completely disable running 32-bit tests.
+This option is useful when a project or its upstream dependencies are not 32-bit compatible.
+Typically, such tests can be disabled using [build constraints](https://pkg.go.dev/cmd/go#hdr-Build_constraints).
+However, the constraints must be set per go file, which can be cumbersome for a project with many files.
+Using this option, 32-bit tests can be skipped entirely without having to specify build constraints per file.
+
+To completely disable running 32-bit tests set `skip32bit` to `true` in `.github/workflows/go-test-config.json`:
+```json
+{
+  "skip32bit": true
+}
+```
+
 ## Technical Preview
 
 You can opt-in to receive early updates from the `next` branch in-between official Unified CI releases.
diff --git a/templates/.github/workflows/go-test.yml b/templates/.github/workflows/go-test.yml
index 10307176..07f9cf52 100644
--- a/templates/.github/workflows/go-test.yml
+++ b/templates/.github/workflows/go-test.yml
@@ -10,6 +10,7 @@ jobs:
         go: [ "1.18.x", "1.19.x" ]
     env:
       COVERAGES: ""
+      SKIP32BIT: false
     runs-on: ${{ format('{0}-latest', matrix.os) }}
     name: ${{ matrix.os }} (go ${{ matrix.go }})
     steps:
@@ -34,6 +35,13 @@ jobs:
       - name: Run repo-specific setup
         uses: ./.github/actions/go-test-setup
         if: hashFiles('./.github/actions/go-test-setup') != ''
+      - name: Read config
+        if: hashFiles('./.github/workflows/go-test-config.json') != ''
+        shell: bash
+        run: |
+          if jq -re .skip32bit ./.github/workflows/go-test-config.json; then
+            echo "SKIP32BIT=true" >> $GITHUB_ENV
+          fi
       - name: Run tests
         uses: protocol/multiple-go-modules@v1.2
         with:
@@ -42,7 +50,7 @@ jobs:
           # this means ./B's coverage will be significantly higher than 0%.
           run: go test -v -shuffle=on -coverprofile=module-coverage.txt -coverpkg=./... ./...
       - name: Run tests (32 bit)
-        if: ${{ matrix.os != 'macos' }} # can't run 32 bit tests on OSX.
+        if: matrix.os != 'macos' && env.SKIP32BIT == 'false' # can't run 32 bit tests on OSX.
         uses: protocol/multiple-go-modules@v1.2
         env:
           GOARCH: 386

From 8ea31c2f6acc7387f0902a898bf8b43f3b186c9d Mon Sep 17 00:00:00 2001
From: Piotr Galar <piotr.galar@gmail.com>
Date: Tue, 3 Jan 2023 09:18:55 +0100
Subject: [PATCH 02/15] Run at most 1 dispatch job per ref (#414)

---
 .github/workflows/dispatch.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/dispatch.yml b/.github/workflows/dispatch.yml
index f546cb34..c90712da 100644
--- a/.github/workflows/dispatch.yml
+++ b/.github/workflows/dispatch.yml
@@ -8,6 +8,10 @@ on:
   push:
     branches: [ master, testing ]
   workflow_dispatch:
+  
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 env:
   # Number of repositories in a batch.

From b2b129d22eead3739da081ef72406c4e2081eccd Mon Sep 17 00:00:00 2001
From: Piotr Galar <piotr.galar@gmail.com>
Date: Tue, 3 Jan 2023 09:21:08 +0100
Subject: [PATCH 03/15] fix: check if git tag returns any results (#415)

---
 .github/workflows/release-check.yml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml
index 5b2e63bc..b7eee92e 100644
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -52,13 +52,16 @@ jobs:
         run: |
           git fetch origin --tags
           go install github.com/marten-seemann/semver-highest@fcdc98f8820ff0e6613c1bee071c096febd98dbf
-          v=$(semver-highest -target ${{ env.VERSION }} -versions $(git tag | paste -sd , -))
-          status=$?
-          if [[ $status != 0 ]]; then
-            echo $v
-            exit $status
+          vs=$(git tag | paste -sd , -)
+          if [[ ! -z "$vs" ]]; then
+            v=$(semver-highest -target ${{ env.VERSION }} -versions "$vs")
+            status=$?
+            if [[ $status != 0 ]]; then
+              echo $v
+              exit $status
+            fi
+            echo "COMPARETO=$v" >> $GITHUB_ENV
           fi
-          echo "COMPARETO=$v" >> $GITHUB_ENV
       - name: Post output
         if: env.TAG_EXISTS == 'false' && env.COMPARETO == ''
         uses: marocchino/sticky-pull-request-comment@82e7a0d3c51217201b3fedc4ddde6632e969a477 # v2.1.1

From 1691531089b935a4ef93fcece9051f5823463c09 Mon Sep 17 00:00:00 2001
From: Marten Seemann <martenseemann@gmail.com>
Date: Thu, 12 Jan 2023 01:02:11 -0800
Subject: [PATCH 04/15] make go generate print the commands it executs (#440)

---
 templates/.github/workflows/go-check.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/.github/workflows/go-check.yml b/templates/.github/workflows/go-check.yml
index 22d23a45..b834b1c4 100644
--- a/templates/.github/workflows/go-check.yml
+++ b/templates/.github/workflows/go-check.yml
@@ -61,7 +61,7 @@ jobs:
         with:
           run: |
             git clean -fd # make sure there aren't untracked files / directories
-            go generate ./...
+            go generate -x ./...
             # check if go generate modified or added any files
             if ! $(git add . && git diff-index HEAD --exit-code --quiet); then
               echo "go generated caused changes to the repository:"

From 5a5bca13070f12b1b70190c0291027a2464af38c Mon Sep 17 00:00:00 2001
From: Piotr Galar <piotr.galar@gmail.com>
Date: Wed, 1 Feb 2023 20:21:55 +0100
Subject: [PATCH 05/15] use pull_request_target event for release-check
 workflow (#295)

* Revert "include cross-package coverage in codecov"

* Revert "Revert "include cross-package coverage in codecov""

* Make automerge a reusable workflow (#260)

* move automerge from template to workflows

* make automerge reusable and use it from new automerge template

* pass parent job name to reusable automerge

* check github actions yamls (#272)

* check github actions yamls

* make yaml linter happy about go-test

* mention VS Code YAML extension in the readme

* add info about other YAML checking extensions

* make yaml checker more generic

* use validate-yaml-schema action from mainline (#277)

* upgrade lewagon/wait-on-check-action to v1.1.1 (#278)

* always add a version.json file if it doesn't exist (#281)

* fix go-test runner string

* check if tag already exists in release-check (#287)

* allow specifying custom PATH for 386 arch (#289)

* use pull_request_target event for release-check workflow

* add comment on missing version.json

* chore: revert release checker path trigger change

* chore: add footnote when non-docs files are modified with the release

* fix: prev version calculation
---
 .github/workflows/release-check.yml           | 101 +++++++++---------
 templates/.github/workflows/release-check.yml |   2 +-
 2 files changed, 49 insertions(+), 54 deletions(-)

diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml
index 73569d1c..66a99ae8 100644
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -1,7 +1,3 @@
-# This workflow cannot post sticky comments on PRs from forked repositories.
-# Instead, it outputs the message it would have posted as a workflow notice.
-# See https://github.com/protocol/.github/issues/254 for details.
-
 name: Release Checker
 on: [ workflow_call ]
 
@@ -17,8 +13,16 @@ jobs:
           go-version: "1.19.x"
       - id: version
         name: Determine version
-        if: hashFiles('version.json')
-        run: echo "version=$(jq -r .version version.json)" >> $GITHUB_OUTPUT
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          HEAD_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          # If `version.json` file doesn't exists, `version` is `""` and `404` is printed on stderr.
+          # The step won't be marked as a failure though because the error happens in a subshell.
+          version="$(gh api -X GET "repos/$HEAD_FULL_NAME/contents/version.json" -f ref="$HEAD_SHA" --jq '.content' | base64 -d | jq -r '.version')"
+          echo "version=$version"
+          echo "version=$version" >> $GITHUB_OUTPUT
       - id: tag
         name: Check if the tag already exists
         # Check if a git tag for the version (as read from version.json) exists
@@ -63,7 +67,7 @@ jobs:
               echo $v
               exit $status
             fi
-            echo "version=$v" >> $GITHUB_ENV
+            echo "version=$v" >> $GITHUB_OUTPUT
           fi
       - name: Post output
         if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version == ''
@@ -114,63 +118,54 @@ jobs:
           fi
           printf "output<<$EOF\n%s\n$EOF" "$output" >> $GITHUB_OUTPUT
       - id: footnote
-        if: github.base_ref != github.event.repository.default_branch
         env:
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
           BASE_REF: ${{ github.base_ref }}
+          GITHUB_TOKEN: ${{ github.token }}
+          HEAD_LABEL: ${{ github.event.pull_request.head.label }}
         run: |
-          echo 'output<<'"$EOF"'
-          ---
+          output=''
+          if [[ "$DEFAULT_BRANCH" != "$BASE_REF" ]]; then
+            output+='
           ## Cutting a Release (when not on `'"$DEFAULT_BRANCH"'`)
 
           This PR is targeting `'"$BASE_REF"'`, which is not the default branch.
           If you wish to cut a release once this PR is merged, please add the `release` label to this PR.
-          '"$EOF" >> $GITHUB_ENV
-      - id: message
-        if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version != ''
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-          PREV_VERSION: ${{ steps.prev.outputs.version }}
-          BASE_HTML_URL: ${{ github.event.pull_request.base.repo.html_url }}
-          HEAD_LABEL: ${{ github.event.pull_request.head.label }}
-          GIT_DIFF: ${{ steps.git-diff.outputs.output }}
-          GORELEASE: ${{ steps.gorelease.outputs.output }}
-          GOCOMPAT: ${{ steps.gocompat.outputs.output }}
-          FOOTNOTE: ${{ steps.footnote.outputs.output }}
-        run: |
-          echo 'output<<'"$EOF"'
-          Suggested version: `'"$VERSION"'`
-          Comparing to: [`'"$PREV_VERSION"'`]('"$BASE_HTML_URL"'/releases/tag/'"$PREV_VERSION"') ([diff]('"$BASE_HTML_URL"'/compare/'"$PREV_VERSION"'..'"$HEAD_LABEL"'))
-
-          Changes in `go.mod` file(s):
-          ```diff
-          '"$GIT_DIFF"'
-          ```
-
-          `gorelease` says:
-          ```
-          '"$GORELEASE"'
-          ```
+          '
+          fi
+          diff="$(gh api -X GET "repos/$GITHUB_REPOSITORY/compare/$BASE_REF...$HEAD_LABEL" --jq '.files | map(.filename) | map(select(test("^(version\\.json|.*\\.md)$") | not)) | .[]')"
+          if [[ "$diff" != "" ]]; then
+            output+='
+          ## Cutting a Release (and modifying non-markdown files)
 
-          `gocompat` says:
-          ```
-          '"$GOCOMPAT"'
-          ```
-          '"$FOOTNOTE"'
-          '"$EOF" >> $GITHUB_OUTPUT
+          This PR is modifying both `version.json` and non-markdown files.
+          The Release Checker is not able to analyse files that are not checked in to `'"$BASE_REF"'`. This might cause the above analysis to be inaccurate.
+          Please consider performing all the code changes in a separate PR before cutting the release.
+          '
+          fi
+          printf "output<<$EOF\n%s\n$EOF" "$output" >> $GITHUB_OUTPUT
       - name: Post message on PR
         uses: marocchino/sticky-pull-request-comment@82e7a0d3c51217201b3fedc4ddde6632e969a477 # v2.1.1
-        if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version != '' && github.event.pull_request.head.repo.full_name == github.repository
+        if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version != ''
         with:
           header: release-check
           recreate: true
-          message: ${{ steps.message.outputs.output }}
-      - name: Set a notice message on run
-        if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version != '' && github.event.pull_request.head.repo.full_name != github.repository
-        env:
-          MESSAGE: ${{ steps.message.outputs.output }}
-        run: |
-          message="${MESSAGE//'%'/'%25'}"
-          message="${message//$'\n'/'%0A'}"
-          message="${message//$'\r'/'%0D'}"
-          echo "::notice ::$message"
+          message: |
+            Suggested version: `${{ steps.version.outputs.version }}`
+            Comparing to: [${{ steps.prev.outputs.version }}](${{ github.event.pull_request.base.repo.html_url }}/releases/tag/${{ steps.prev.outputs.version }}) ([diff](${{ github.event.pull_request.base.repo.html_url }}/compare/${{ steps.prev.outputs.version }}..${{ github.event.pull_request.head.label }}))
+
+            Changes in `go.mod` file(s):
+            ```diff
+            ${{ steps.git-diff.outputs.output }}
+            ```
+
+            `gorelease` says:
+            ```
+            ${{ steps.gorelease.outputs.output }}
+            ```
+
+            `gocompat` says:
+            ```
+            ${{ steps.gocompat.outputs.output }}
+            ```
+            ${{ steps.footnote.outputs.output }}
diff --git a/templates/.github/workflows/release-check.yml b/templates/.github/workflows/release-check.yml
index f1b5f7bb..fd823694 100644
--- a/templates/.github/workflows/release-check.yml
+++ b/templates/.github/workflows/release-check.yml
@@ -1,6 +1,6 @@
 name: Release Checker
 on:
-  pull_request:
+  pull_request_target:
     paths: [ 'version.json' ]
 
 jobs:

From b66f621efde82e912f2c25ab0452237b44520b75 Mon Sep 17 00:00:00 2001
From: Piotr Galar <piotr.galar@gmail.com>
Date: Fri, 3 Feb 2023 10:37:26 +0100
Subject: [PATCH 06/15] feat: allow configuring custom go-test runners (#443)

* feat: allow configuring custom go-test runners

* docs: update readme to include info on configuration variables
---
 README.md                               | 9 +++++++++
 templates/.github/workflows/go-test.yml | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index fdd4cc75..c3af2b84 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,15 @@ By storing them in a central place (here), and distributing them in an automated
 ### Additional Setup Steps
 
 Most repositories won't need any customization, and the workflows defined here will just work fine.
+
+#### Configuration Variables
+
+Some aspects of Unified CI workflows are configurable through [configuration variables](https://docs.github.com/en/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository).
+
+You can customise the runner type for `go-test` through `UCI_GO_TEST_RUNNER_UBUNTU`, `UCI_GO_TEST_RUNNER_WINDOWS` and `UCI_GO_TEST_RUNNER_MACOS` configuration variables. This option will be useful for repositories wanting to use more powerful, [PL self-hosted GitHub Actions runners](https://github.com/pl-strflt/tf-aws-gh-runner).
+
+#### Setup Actions
+
 Some repositories may require some pre-setup steps to be run before tests (or code checks) can be run. Setup steps for `go-test` are defined in `.github/actions/go-test-setup/action.yml`, and setup steps for `go-check` are defined in `.github/actions/go-check-setup/action.yml`, in the following format:
 
 ```yml
diff --git a/templates/.github/workflows/go-test.yml b/templates/.github/workflows/go-test.yml
index 07f9cf52..c229ce10 100644
--- a/templates/.github/workflows/go-test.yml
+++ b/templates/.github/workflows/go-test.yml
@@ -11,7 +11,7 @@ jobs:
     env:
       COVERAGES: ""
       SKIP32BIT: false
-    runs-on: ${{ format('{0}-latest', matrix.os) }}
+    runs-on: ${{ fromJSON(vars[format('UCI_GO_TEST_RUNNER_{0}', matrix.os)] || format('"{0}-latest"', matrix.os)) }}
     name: ${{ matrix.os }} (go ${{ matrix.go }})
     steps:
       - uses: actions/checkout@v3

From 8c30e23ce68cd222ae5d9371917041add322d22b Mon Sep 17 00:00:00 2001
From: Piotr Galar <piotr.galar@gmail.com>
Date: Mon, 6 Feb 2023 16:22:10 +0100
Subject: [PATCH 07/15] feat: allow skipping go-test on certain OSes (#455)

* feat: standarise JSON config reading

* feat: allow skipping go-test on certain OSes

* fix: go-test conditional

* chore: show config after extracting it
---
 .github/actions/read-config/action.yml   | 22 ++++++++++++++++++++++
 README.md                                |  7 +++++++
 templates/.github/workflows/go-check.yml | 12 +++---------
 templates/.github/workflows/go-test.yml  | 20 ++++++++++----------
 4 files changed, 42 insertions(+), 19 deletions(-)
 create mode 100644 .github/actions/read-config/action.yml

diff --git a/.github/actions/read-config/action.yml b/.github/actions/read-config/action.yml
new file mode 100644
index 00000000..5d20028a
--- /dev/null
+++ b/.github/actions/read-config/action.yml
@@ -0,0 +1,22 @@
+name: read config
+description: Reads workflow config
+
+outputs:
+  json:
+    description: JSON config
+    value: ${{ steps.config.outputs.json }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: config
+      run: |
+        eof="EOF$RANDOM"
+        path="${GITHUB_WORKFLOW_REF%.yml@*}"
+        path="./${path#*/*/}-config.json"
+        printf "json<<$eof\n%s\n$eof" "$(cat "$path" || echo '{}')" >> $GITHUB_OUTPUT
+      shell: bash
+    - env:
+        CONFIG: ${{ steps.config.outputs.json }}
+      run: echo "$CONFIG"
+      shell: bash
diff --git a/README.md b/README.md
index c3af2b84..7d3e59f2 100644
--- a/README.md
+++ b/README.md
@@ -65,6 +65,13 @@ To completely disable running 32-bit tests set `skip32bit` to `true` in `.github
 }
 ```
 
+If your project cannot be built on one of the supported operating systems, you can disable it by setting `skipOSes` to a list of operating systems in `.github/workflows/go-test-config.json`:
+```json
+{
+  "skipOSes": ["windows", "macos"]
+}
+```
+
 ## Technical Preview
 
 You can opt-in to receive early updates from the `next` branch in-between official Unified CI releases.
diff --git a/templates/.github/workflows/go-check.yml b/templates/.github/workflows/go-check.yml
index b834b1c4..f87cd7c3 100644
--- a/templates/.github/workflows/go-check.yml
+++ b/templates/.github/workflows/go-check.yml
@@ -5,24 +5,18 @@ jobs:
   unit:
     runs-on: ubuntu-latest
     name: All
-    env:
-      RUNGOGENERATE: false
     steps:
       - uses: actions/checkout@v3
         with:
           submodules: recursive
+      - id: config
+        uses: protocol/.github/.github/actions/read-config@master
       - uses: actions/setup-go@v3
         with:
           go-version: "1.19.x"
       - name: Run repo-specific setup
         uses: ./.github/actions/go-check-setup
         if: hashFiles('./.github/actions/go-check-setup') != ''
-      - name: Read config
-        if: hashFiles('./.github/workflows/go-check-config.json') != ''
-        run: |
-          if jq -re .gogenerate ./.github/workflows/go-check-config.json; then
-            echo "RUNGOGENERATE=true" >> $GITHUB_ENV
-          fi
       - name: Install staticcheck
         run: go install honnef.co/go/tools/cmd/staticcheck@376210a89477dedbe6fdc4484b233998650d7b3c # 2022.1.3 (v0.3.3)
       - name: Check that go.mod is tidy
@@ -57,7 +51,7 @@ jobs:
             staticcheck ./... | sed -e 's@\(.*\)\.go@./\1.go@g'
       - name: go generate
         uses: protocol/multiple-go-modules@v1.2
-        if: (success() || failure()) && env.RUNGOGENERATE == 'true'
+        if: (success() || failure()) && fromJSON(steps.config.outputs.json).gogenerate == true
         with:
           run: |
             git clean -fd # make sure there aren't untracked files / directories
diff --git a/templates/.github/workflows/go-test.yml b/templates/.github/workflows/go-test.yml
index c229ce10..0fd34a7e 100644
--- a/templates/.github/workflows/go-test.yml
+++ b/templates/.github/workflows/go-test.yml
@@ -10,13 +10,14 @@ jobs:
         go: [ "1.18.x", "1.19.x" ]
     env:
       COVERAGES: ""
-      SKIP32BIT: false
     runs-on: ${{ fromJSON(vars[format('UCI_GO_TEST_RUNNER_{0}', matrix.os)] || format('"{0}-latest"', matrix.os)) }}
     name: ${{ matrix.os }} (go ${{ matrix.go }})
     steps:
       - uses: actions/checkout@v3
         with:
           submodules: recursive
+      - id: config
+        uses: protocol/.github/.github/actions/read-config@master
       - uses: actions/setup-go@v3
         with:
           go-version: ${{ matrix.go }}
@@ -35,14 +36,8 @@ jobs:
       - name: Run repo-specific setup
         uses: ./.github/actions/go-test-setup
         if: hashFiles('./.github/actions/go-test-setup') != ''
-      - name: Read config
-        if: hashFiles('./.github/workflows/go-test-config.json') != ''
-        shell: bash
-        run: |
-          if jq -re .skip32bit ./.github/workflows/go-test-config.json; then
-            echo "SKIP32BIT=true" >> $GITHUB_ENV
-          fi
       - name: Run tests
+        if: contains(fromJSON(steps.config.outputs.json).skipOSes, matrix.os) == false
         uses: protocol/multiple-go-modules@v1.2
         with:
           # Use -coverpkg=./..., so that we include cross-package coverage.
@@ -50,7 +45,10 @@ jobs:
           # this means ./B's coverage will be significantly higher than 0%.
           run: go test -v -shuffle=on -coverprofile=module-coverage.txt -coverpkg=./... ./...
       - name: Run tests (32 bit)
-        if: matrix.os != 'macos' && env.SKIP32BIT == 'false' # can't run 32 bit tests on OSX.
+        # can't run 32 bit tests on OSX.
+        if: matrix.os != 'macos' &&
+          fromJSON(steps.config.outputs.json).skip32bit != true &&
+          contains(fromJSON(steps.config.outputs.json).skipOSes, matrix.os) == false
         uses: protocol/multiple-go-modules@v1.2
         env:
           GOARCH: 386
@@ -59,7 +57,9 @@ jobs:
             export "PATH=${{ env.PATH_386 }}:$PATH"
             go test -v -shuffle=on ./...
       - name: Run tests with race detector
-        if: ${{ matrix.os == 'ubuntu' }} # speed things up. Windows and OSX VMs are slow
+        # speed things up. Windows and OSX VMs are slow
+        if: matrix.os == 'ubuntu' &&
+          contains(fromJSON(steps.config.outputs.json).skipOSes, matrix.os) == false
         uses: protocol/multiple-go-modules@v1.2
         with:
           run: go test -v -race ./...

From 41d2feb323cf165706a25fd1d09a29290ece604e Mon Sep 17 00:00:00 2001
From: Piotr Galar <piotr.galar@gmail.com>
Date: Mon, 6 Feb 2023 16:27:17 +0100
Subject: [PATCH 08/15] chore: udpate actions and go modules (#458)

---
 .github/actions/copy-workflow-go/action.yml        |  2 +-
 .github/workflows/automerge.yml                    |  4 ++--
 .github/workflows/check-yaml.yml                   |  2 +-
 .github/workflows/release-check.yml                |  8 ++++----
 .github/workflows/releaser.yml                     |  2 +-
 .github/workflows/tagpush.yml                      |  2 +-
 templates/.github/workflows/go-check.yml           |  2 +-
 templates/.github/workflows/go-test.yml            |  2 +-
 .../.github/workflows/js-test-and-release.yml      | 14 +++++++-------
 9 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/.github/actions/copy-workflow-go/action.yml b/.github/actions/copy-workflow-go/action.yml
index 2c047eb3..50b2f282 100644
--- a/.github/actions/copy-workflow-go/action.yml
+++ b/.github/actions/copy-workflow-go/action.yml
@@ -61,7 +61,7 @@ runs:
               sed -i 's/ioutil.Discard/io.Discard/' "${file}";
             done <<< "$(find . -type f -name '*.go')"
 
-            go install golang.org/x/tools/cmd/goimports@v0.1.12
+            go install golang.org/x/tools/cmd/goimports@v0.5.0
             goimports -w .
 
             git add .
diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index c24662ca..5fd9e162 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -40,14 +40,14 @@ jobs:
     if: github.event.pull_request.user.login == 'web3-bot' && needs.automerge-check.outputs.status == 'true'
     steps:
     - name: Wait on tests
-      uses: lewagon/wait-on-check-action@752bfae19aef55dab12a00bc36d48acc46b77e9d # v1.1.1
+      uses: lewagon/wait-on-check-action@3a563271c3f8d1611ed7352809303617ee7e54ac # v1.2.0
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         wait-interval: 10
         running-workflow-name: '${{ inputs.job }} / ${{ github.job }}' # the name of the check for this job
     - name: Merge PR
-      uses: pascalgn/automerge-action@741c311a47881be9625932b0a0de1b0937aab1ae # v0.13.1
+      uses: pascalgn/automerge-action@eb68b061739cb9d81564f8e812d0b3c45f0fb09a # v0.15.5
       env:
         GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         MERGE_LABELS: ""
diff --git a/.github/workflows/check-yaml.yml b/.github/workflows/check-yaml.yml
index 890a8e3d..4bdd2996 100644
--- a/.github/workflows/check-yaml.yml
+++ b/.github/workflows/check-yaml.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: nwisbeta/validate-yaml-schema@c3734e647d2a3beb98b9132330067e900fdbd1a2 # v2.0.0
+      - uses: pl-strflt/validate-yaml-schema@21116b89ed801672cb7354717c0d049974f265b0
         with:
           yamlSchemasJson: |
             {
diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml
index 66a99ae8..d1420659 100644
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -39,7 +39,7 @@ jobs:
           fi
       - name: Install semver (node command line tool)
         if: steps.tag.outputs.exists == 'false'
-        run: npm install -g "https://github.com/npm/node-semver#e79ac3a450e8bb504e78b8159e3efc7089569" # v7.3.5
+        run: npm install -g "https://github.com/npm/node-semver#dc0fe202faaf19a545ce5eeab3480be84180a082" # v7.3.8
       - name: Check version
         if: steps.tag.outputs.exists == 'false'
         env:
@@ -71,7 +71,7 @@ jobs:
           fi
       - name: Post output
         if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version == ''
-        uses: marocchino/sticky-pull-request-comment@82e7a0d3c51217201b3fedc4ddde6632e969a477 # v2.1.1
+        uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
         with:
           header: release-check
           recreate: true
@@ -102,7 +102,7 @@ jobs:
         # see https://github.com/golang/exp/commits/master/cmd/gorelease
         run: |
           go mod download
-          go install golang.org/x/exp/cmd/gorelease@b4e88ed8e8aab63a9aa9a52276782ebbc547adef
+          go install golang.org/x/exp/cmd/gorelease@f062dba9d201f5ec084d25785efec05637818c00 # https://cs.opensource.google/go/x/exp/+/f062dba9d201f5ec084d25785efec05637818c00
           output=$((gorelease -base "$PREV_VERSION") 2>&1 || true)
           printf "output<<$EOF\n%s\n$EOF" "$output" >> $GITHUB_OUTPUT
       - id: gocompat
@@ -145,7 +145,7 @@ jobs:
           fi
           printf "output<<$EOF\n%s\n$EOF" "$output" >> $GITHUB_OUTPUT
       - name: Post message on PR
-        uses: marocchino/sticky-pull-request-comment@82e7a0d3c51217201b3fedc4ddde6632e969a477 # v2.1.1
+        uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
         if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version != ''
         with:
           header: release-check
diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml
index 7c27f737..64174686 100644
--- a/.github/workflows/releaser.yml
+++ b/.github/workflows/releaser.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Determine if this commit is a merged PR (if we're not on a default branch)
         if: env.DEFAULT_BRANCH != github.ref
         id: getmergedpr
-        uses: actions-ecosystem/action-get-merged-pull-request@59afe90821bb0b555082ce8ff1e36b03f91553d9
+        uses: actions-ecosystem/action-get-merged-pull-request@59afe90821bb0b555082ce8ff1e36b03f91553d9 # v1.0.1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
       - name: Check if the "release" label was set on the PR
diff --git a/.github/workflows/tagpush.yml b/.github/workflows/tagpush.yml
index f295aacf..b2c19e90 100644
--- a/.github/workflows/tagpush.yml
+++ b/.github/workflows/tagpush.yml
@@ -36,7 +36,7 @@ jobs:
       - run: cat .github/workflows/tagpush.md
       - name: create an issue
         if: ${{ github.event.pusher.name != 'web3-bot' }}
-        uses: JasonEtco/create-an-issue@9e6213aec58987fa7d2f4deb8b256b99e63107a2 # v2.6.0
+        uses: JasonEtco/create-an-issue@e27dddc79c92bc6e4562f268fffa5ed752639abd # v2.9.1
         env:
           GITHUB_TOKEN: ${{ github.token }}
           PUSHER: ${{ github.event.pusher.name }}
diff --git a/templates/.github/workflows/go-check.yml b/templates/.github/workflows/go-check.yml
index f87cd7c3..9a8d5c03 100644
--- a/templates/.github/workflows/go-check.yml
+++ b/templates/.github/workflows/go-check.yml
@@ -18,7 +18,7 @@ jobs:
         uses: ./.github/actions/go-check-setup
         if: hashFiles('./.github/actions/go-check-setup') != ''
       - name: Install staticcheck
-        run: go install honnef.co/go/tools/cmd/staticcheck@376210a89477dedbe6fdc4484b233998650d7b3c # 2022.1.3 (v0.3.3)
+        run: go install honnef.co/go/tools/cmd/staticcheck@4970552d932f48b71485287748246cf3237cebdf # 2023.1 (v0.4.0)
       - name: Check that go.mod is tidy
         uses: protocol/multiple-go-modules@v1.2
         with:
diff --git a/templates/.github/workflows/go-test.yml b/templates/.github/workflows/go-test.yml
index 0fd34a7e..ba823ed6 100644
--- a/templates/.github/workflows/go-test.yml
+++ b/templates/.github/workflows/go-test.yml
@@ -67,7 +67,7 @@ jobs:
         shell: bash
         run: echo "COVERAGES=$(find . -type f -name 'module-coverage.txt' | tr -s '\n' ',' | sed 's/,$//')" >> $GITHUB_ENV
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           files: '${{ env.COVERAGES }}'
           env_vars: OS=${{ matrix.os }}, GO=${{ matrix.go }}
diff --git a/templates/.github/workflows/js-test-and-release.yml b/templates/.github/workflows/js-test-and-release.yml
index 27fd45a3..0bd8f243 100644
--- a/templates/.github/workflows/js-test-and-release.yml
+++ b/templates/.github/workflows/js-test-and-release.yml
@@ -33,7 +33,7 @@ jobs:
           node-version: ${{ matrix.node }}
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:node
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: node
 
@@ -47,7 +47,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:chrome
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: chrome
 
@@ -61,7 +61,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:chrome-webworker
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: chrome-webworker
 
@@ -75,7 +75,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:firefox
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: firefox
 
@@ -89,7 +89,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npm run --if-present test:firefox-webworker
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: firefox-webworker
 
@@ -103,7 +103,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npx xvfb-maybe npm run --if-present test:electron-main
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: electron-main
 
@@ -117,7 +117,7 @@ jobs:
           node-version: lts/*
       - uses: ipfs/aegir/actions/cache-node-modules@master
       - run: npx xvfb-maybe npm run --if-present test:electron-renderer
-      - uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+      - uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           flags: electron-renderer
 

From 4b2bfa6dee77a9f63b298a7a47e444535030219a Mon Sep 17 00:00:00 2001
From: galargh <piotr.galar@gmail.com>
Date: Mon, 6 Feb 2023 17:47:00 +0100
Subject: [PATCH 09/15] fix: source read-config from next for now

---
 templates/.github/workflows/go-check.yml | 2 +-
 templates/.github/workflows/go-test.yml  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/.github/workflows/go-check.yml b/templates/.github/workflows/go-check.yml
index 9a8d5c03..f9c8352c 100644
--- a/templates/.github/workflows/go-check.yml
+++ b/templates/.github/workflows/go-check.yml
@@ -10,7 +10,7 @@ jobs:
         with:
           submodules: recursive
       - id: config
-        uses: protocol/.github/.github/actions/read-config@master
+        uses: protocol/.github/.github/actions/read-config@next
       - uses: actions/setup-go@v3
         with:
           go-version: "1.19.x"
diff --git a/templates/.github/workflows/go-test.yml b/templates/.github/workflows/go-test.yml
index ba823ed6..0f26e3ec 100644
--- a/templates/.github/workflows/go-test.yml
+++ b/templates/.github/workflows/go-test.yml
@@ -17,7 +17,7 @@ jobs:
         with:
           submodules: recursive
       - id: config
-        uses: protocol/.github/.github/actions/read-config@master
+        uses: protocol/.github/.github/actions/read-config@next
       - uses: actions/setup-go@v3
         with:
           go-version: ${{ matrix.go }}

From 2117cefe779dd9ddd49c625618bff82888aeba6f Mon Sep 17 00:00:00 2001
From: Piotr Galar <piotr.galar@gmail.com>
Date: Tue, 7 Feb 2023 10:57:48 +0100
Subject: [PATCH 10/15] simplify Go version upgrade procedure (#280)

* chore: simplify Go version upgrade procedure

* chore: add default for the go-version input of release-check

* Update .github/actions/copy-workflow-go/action.yml

* Update configs/README.md

Co-authored-by: Laurent Senta <laurent@singulargarden.com>

---------

Co-authored-by: Laurent Senta <laurent@singulargarden.com>
---
 .github/actions/copy-workflow-go/action.yml   | 19 ++++++++++++++-----
 .github/workflows/release-check.yml           | 10 ++++++++--
 configs/README.md                             |  9 +++++++++
 configs/go.json                               |  5 ++++-
 templates/.github/workflows/go-check.yml      |  2 +-
 templates/.github/workflows/go-test.yml       |  2 +-
 templates/.github/workflows/release-check.yml |  2 ++
 7 files changed, 39 insertions(+), 10 deletions(-)

diff --git a/.github/actions/copy-workflow-go/action.yml b/.github/actions/copy-workflow-go/action.yml
index 50b2f282..3b5b4075 100644
--- a/.github/actions/copy-workflow-go/action.yml
+++ b/.github/actions/copy-workflow-go/action.yml
@@ -4,23 +4,32 @@ description: Copy workflow steps specific to go
 runs:
   using: "composite"
   steps:
+    # GitHub Actions Expressions do not support last item access/array length retrieval
+    - id: go
+      run: echo "::set-output name=version::$(jq -r '.[-1]' <<< '${{ toJSON(matrix.cfg.go.versions) }}')"
+      shell: bash
     - uses: actions/setup-go@v3
       with:
         # This should be the same Go version we use in the go-check workflow.
         # go mod tidy, go vet, staticcheck and gofmt might behave differently depending on the version.
-        go-version: "1.19.x"
+        go-version: ${{ steps.go.outputs.version }}
     - name: bump go.mod go version if needed
       uses: protocol/multiple-go-modules@v1.2
       with:
         working-directory: ${{ env.TARGET_REPO_DIR }}
         run: |
           # We want our modules to support two Go versions at a time.
-          # As of August 2022, Go 1.19 is the latest stable.
           # go.mod's Go version declares the language version being used.
           # As such, it has to be the minimum of all Go versions supported.
-          # Bump this every six months, as new Go versions come out.
-          TARGET_VERSION=1.18
-          PREVIOUS_TARGET_VERSION=1.17
+          TARGET_VERSION='${{ matrix.cfg.go.versions[0] }}'
+          TARGET_VERSION="${TARGET_VERSION%.x}"
+          TARGET_MAJOR_VERSION="${TARGET_VERSION%.[0-9]*}"
+          TARGET_MINOR_VERSION="${TARGET_VERSION#[0-9]*.}"
+          # Assumptions:
+          # - all versions are targetted incrementally
+          # - no versions are skipped
+          # - patch version is never pinned explicitly 
+          PREVIOUS_TARGET_VERSION="$TARGET_MAJOR_VERSION.$(($TARGET_MINOR_VERSION-1))"
 
           # Note that the "<" comparison doesn't understand semver,
           # but it should be good enough for the foreseeable future.
diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml
index d1420659..2a8e7941 100644
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -1,5 +1,11 @@
 name: Release Checker
-on: [ workflow_call ]
+on:
+  workflow_call:
+    inputs:
+      go-version:
+        required: true
+        type: string
+        default: 1.19.x # TODO: remove once release-check is upgraded in all the targets
 
 jobs:
   releaser:
@@ -10,7 +16,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v3
         with:
-          go-version: "1.19.x"
+          go-version: ${{ inputs.go-version }}
       - id: version
         name: Determine version
         env:
diff --git a/configs/README.md b/configs/README.md
index 1c6a2775..ba569665 100644
--- a/configs/README.md
+++ b/configs/README.md
@@ -38,3 +38,12 @@ To customise the copy workflow further, you can add more fields to the `defaults
 ## Testing
 
 You can use [testing](https://github.com/protocol/.github/tree/testing) branch for worklow/configuration testing. Once you push your changes to the branch, a [dispatch](../.github/workflows/dispatch.yml) workflow will be triggered. The workflow will use [testing.json](testing.json) configuration file only. You can manipalate that configuration file as needed(you can copy all the `defaults` from [go.json](go.json) for [example](https://github.com/protocol/.github/commit/43476995428996a90ca95bf838f084ba1a710c68)).
+
+## Upgrading Go
+
+To upgrade Go, modify the `defaults.go.versions` array in the [Go config](go.json).
+
+Remember to:
+- Keep the array sorted in increasing order,
+- Upgrade versions incrementally. Do not skip a version,
+- never pin the patch version (`"1.19.x"` is correct, `"1.19.8"` is incorrect).
diff --git a/configs/go.json b/configs/go.json
index 39994638..6fdd6968 100644
--- a/configs/go.json
+++ b/configs/go.json
@@ -9,7 +9,10 @@
       ".github/workflows/tagpush.yml"
     ],
     "deploy_versioning": true,
-    "deploy_go": true
+    "deploy_go": true,
+    "go": {
+      "versions": [ "1.18.x", "1.19.x" ]
+    }
   },
   "repositories": [
     {
diff --git a/templates/.github/workflows/go-check.yml b/templates/.github/workflows/go-check.yml
index f9c8352c..3f52a160 100644
--- a/templates/.github/workflows/go-check.yml
+++ b/templates/.github/workflows/go-check.yml
@@ -13,7 +13,7 @@ jobs:
         uses: protocol/.github/.github/actions/read-config@next
       - uses: actions/setup-go@v3
         with:
-          go-version: "1.19.x"
+          go-version: ${{{ config.go.versions[-1] }}}
       - name: Run repo-specific setup
         uses: ./.github/actions/go-check-setup
         if: hashFiles('./.github/actions/go-check-setup') != ''
diff --git a/templates/.github/workflows/go-test.yml b/templates/.github/workflows/go-test.yml
index 0f26e3ec..637a76aa 100644
--- a/templates/.github/workflows/go-test.yml
+++ b/templates/.github/workflows/go-test.yml
@@ -7,7 +7,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ "ubuntu", "windows", "macos" ]
-        go: [ "1.18.x", "1.19.x" ]
+        go: ${{{ config.go.versions }}}
     env:
       COVERAGES: ""
     runs-on: ${{ fromJSON(vars[format('UCI_GO_TEST_RUNNER_{0}', matrix.os)] || format('"{0}-latest"', matrix.os)) }}
diff --git a/templates/.github/workflows/release-check.yml b/templates/.github/workflows/release-check.yml
index fd823694..036e96ad 100644
--- a/templates/.github/workflows/release-check.yml
+++ b/templates/.github/workflows/release-check.yml
@@ -6,3 +6,5 @@ on:
 jobs:
   release-check:
     uses: protocol/.github/.github/workflows/release-check.yml@master
+    with:
+      go-version: ${{{ config.go.versions[-1] }}}

From 3865639dc2272c5cf644561a1291d3778f995a04 Mon Sep 17 00:00:00 2001
From: Piotr Galar <piotr.galar@gmail.com>
Date: Tue, 7 Feb 2023 11:09:31 +0100
Subject: [PATCH 11/15] Go through all the workflows and clean them up ahead of
 the next major release (#462)

* chore: clean up deprecated set-output

* chore: do not use substitution inside run

* chore: do not use substitution in if

* chore: skip env var brakets where possible

* fix: env var substitution

* fix: double toJSON

* Update templates/.github/workflows/js-test-and-release.yml
---
 .github/actions/copy-workflow-go/action.yml   | 20 ++++++------
 .github/workflows/add-label-by-query.yml      |  2 +-
 .github/workflows/automerge.yml               | 13 +++++---
 .github/workflows/check-3rd-party.yml         |  8 +++--
 .github/workflows/copy-workflow.yml           | 24 +++++++-------
 .github/workflows/create-prs.yml              | 12 +++----
 .github/workflows/dispatch.yml                | 31 +++++++++++--------
 .github/workflows/releaser.yml                | 14 ++++++---
 .github/workflows/stale-repos.yml             | 21 ++++++++-----
 .github/workflows/tagpush.yml                 | 18 ++++++-----
 templates/.github/workflows/go-check.yml      |  6 ++--
 templates/.github/workflows/go-test.yml       |  4 +--
 .../.github/workflows/js-test-and-release.yml |  2 +-
 13 files changed, 98 insertions(+), 77 deletions(-)

diff --git a/.github/actions/copy-workflow-go/action.yml b/.github/actions/copy-workflow-go/action.yml
index 3b5b4075..2030a6ac 100644
--- a/.github/actions/copy-workflow-go/action.yml
+++ b/.github/actions/copy-workflow-go/action.yml
@@ -59,15 +59,15 @@ runs:
             # As of Go 1.19 io/ioutil is deprecated
             # We automate its upgrade here because it is quite a widely used package
             while read file; do
-              sed -i 's/ioutil.NopCloser/io.NopCloser/' "${file}";
-              sed -i 's/ioutil.ReadAll/io.ReadAll/' "${file}";
+              sed -i 's/ioutil.NopCloser/io.NopCloser/' "$file";
+              sed -i 's/ioutil.ReadAll/io.ReadAll/' "$file";
               # ReadDir replacement might require manual intervention (https://pkg.go.dev/io/ioutil#ReadDir)
-              sed -i 's/ioutil.ReadDir/os.ReadDir/' "${file}";
-              sed -i 's/ioutil.ReadFile/os.ReadFile/' "${file}";
-              sed -i 's/ioutil.TempDir/os.MkdirTemp/' "${file}";
-              sed -i 's/ioutil.TempFile/os.CreateTemp/' "${file}";
-              sed -i 's/ioutil.WriteFile/os.WriteFile/' "${file}";
-              sed -i 's/ioutil.Discard/io.Discard/' "${file}";
+              sed -i 's/ioutil.ReadDir/os.ReadDir/' "$file";
+              sed -i 's/ioutil.ReadFile/os.ReadFile/' "$file";
+              sed -i 's/ioutil.TempDir/os.MkdirTemp/' "$file";
+              sed -i 's/ioutil.TempFile/os.CreateTemp/' "$file";
+              sed -i 's/ioutil.WriteFile/os.WriteFile/' "$file";
+              sed -i 's/ioutil.Discard/io.Discard/' "$file";
             done <<< "$(find . -type f -name '*.go')"
 
             go install golang.org/x/tools/cmd/goimports@v0.5.0
@@ -79,7 +79,7 @@ runs:
             fi
           fi
     - name: go mod tidy (on initial workflow deployment)
-      if: ${{ env.INITIAL_WORKFLOW_DEPLOYMENT == 1 }}
+      if: env.INITIAL_WORKFLOW_DEPLOYMENT == 1
       uses: protocol/multiple-go-modules@v1.2
       with:
         working-directory: ${{ env.TARGET_REPO_DIR }}
@@ -90,7 +90,7 @@ runs:
             git commit -m "run go mod tidy"
           fi
     - name: gofmt -s (on initial workflow deployment and on new Go version)
-      if: ${{ env.INITIAL_WORKFLOW_DEPLOYMENT == 1 || env.GO_VERSION_BUMP == 1}}
+      if: env.INITIAL_WORKFLOW_DEPLOYMENT == 1 || env.GO_VERSION_BUMP == 1
       working-directory: ${{ env.TARGET_REPO_DIR }}
       shell: bash
       run: |
diff --git a/.github/workflows/add-label-by-query.yml b/.github/workflows/add-label-by-query.yml
index 26fc7146..2b5b16e6 100644
--- a/.github/workflows/add-label-by-query.yml
+++ b/.github/workflows/add-label-by-query.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
       - name: Add label by query
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           QUERY: ${{ github.event.inputs.query }}
           LABEL: ${{ github.event.inputs.label }}
           DRY_RUN: ${{ github.event.inputs.dry-run }}
diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index 5fd9e162..ba91bdb5 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -21,17 +21,20 @@ jobs:
         fetch-depth: 0
     - name: Check if we should automerge
       id: should-automerge
+      env:
+        BASE_REF: ${{ github.event.pull_request.base.ref }}
+        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
       run: |
-        for commit in $(git rev-list --first-parent origin/${{ github.event.pull_request.base.ref }}..${{ github.event.pull_request.head.sha }}); do
+        for commit in $(git rev-list --first-parent origin/$BASE_REF..$HEAD_SHA); do
           committer=$(git show --format=$'%ce' -s $commit)
           echo "Committer: $committer"
           if [[ "$committer" != "web3-bot@users.noreply.github.com" ]]; then
             echo "Commit $commit wasn't committed by web3-bot, but by $committer."
-            echo "::set-output name=status::false"
+            echo "status=false" >> $GITHUB_OUTPUT
             exit
           fi
         done
-        echo "::set-output name=status::true"
+        echo "status=true" >> $GITHUB_OUTPUT
   automerge:
     needs: automerge-check
     runs-on: ubuntu-latest
@@ -43,13 +46,13 @@ jobs:
       uses: lewagon/wait-on-check-action@3a563271c3f8d1611ed7352809303617ee7e54ac # v1.2.0
       with:
         ref: ${{ github.event.pull_request.head.sha }}
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        repo-token: ${{ github.token }}
         wait-interval: 10
         running-workflow-name: '${{ inputs.job }} / ${{ github.job }}' # the name of the check for this job
     - name: Merge PR
       uses: pascalgn/automerge-action@eb68b061739cb9d81564f8e812d0b3c45f0fb09a # v0.15.5
       env:
-        GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        GITHUB_TOKEN: "${{ github.token }}"
         MERGE_LABELS: ""
         MERGE_METHOD: "squash"
         MERGE_DELETE_BRANCH: true
diff --git a/.github/workflows/check-3rd-party.yml b/.github/workflows/check-3rd-party.yml
index 36203b6a..1df81c88 100644
--- a/.github/workflows/check-3rd-party.yml
+++ b/.github/workflows/check-3rd-party.yml
@@ -15,16 +15,18 @@ jobs:
       - id: set-matrix
         run: |
           TARGETS=$(find . -type f -name "*.yml" | sed "s|^\./||" | grep -v workflow-templates/header.yml | jq -R -s -c 'split("\n")[:-1]')
-          echo "::set-output name=targets::$TARGETS"
+          echo "targets=$TARGETS" >> $GITHUB_OUTPUT
   check:
     needs: [ matrix ]
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        file: ${{ fromJson(needs.matrix.outputs.targets) }}
+        file: ${{ fromJSON(needs.matrix.outputs.targets) }}
     name: ${{ matrix.file }}
     steps:
       - uses: actions/checkout@v3
       - name: Run check
-        run: .github/workflows/check-3rd-party.sh ${{ matrix.file }}
+        env:
+          FILE: ${{ matrix.file }}
+        run: .github/workflows/check-3rd-party.sh $FILE
diff --git a/.github/workflows/copy-workflow.yml b/.github/workflows/copy-workflow.yml
index 2eaa2163..6af22692 100644
--- a/.github/workflows/copy-workflow.yml
+++ b/.github/workflows/copy-workflow.yml
@@ -15,7 +15,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        cfg: ${{ fromJson(github.event.inputs.targets) }}
+        cfg: ${{ fromJSON(github.event.inputs.targets) }}
       max-parallel: 10
     env:
       TARGET_REPO_DIR: "target-repo"
@@ -53,16 +53,16 @@ jobs:
     - name: determine files to add
       # By setting the environment variable, it's possible to programmatically add / modify this list.
       # See https://github.com/protocol/.github/blob/38135c75e47839623bf9b2748275d8c6167a8fa8/.github/workflows/copy-workflow.yml#L163-L168 for an example, how we used to make use of this.
-      run: |
-        files=${{ toJson(toJson(matrix.cfg.files)) }}
-        extra_files=${{ toJson(toJson(matrix.cfg.extra_files)) }}
-        files=$(echo -e "$files" "$extra_files" | jq -nc '[inputs] | add')
-        echo "FILES=$files" >> $GITHUB_ENV
+      env:
+        FILES: |
+          ${{ toJSON(matrix.cfg.files) }}
+          ${{ toJSON(matrix.cfg.extra_files) }}
+      run: echo "FILES=$(jq -nc '[inputs] | add' <<< "$FILES")" >> $GITHUB_ENV
     - name: is initial workflow deployment
       # INITIAL_WORKFLOW_DEPLOYMENT=1 iff none of the files in the target repository exist yet
       run: |
         initial_workflow_deployment=1
-        for f in $(jq -r '.[]' <<< ${{ toJson(env.FILES) }}); do
+        for f in $(jq -r '.[]' <<< "$FILES"); do
           if [[ -f $TARGET_REPO_DIR/$f ]]; then
             initial_workflow_deployment=0
             break
@@ -70,7 +70,7 @@ jobs:
         done
         echo "INITIAL_WORKFLOW_DEPLOYMENT=$initial_workflow_deployment" >> $GITHUB_ENV
     - name: remove Travis (on initial workflow deployment)
-      if: ${{ env.INITIAL_WORKFLOW_DEPLOYMENT == 1 }}
+      if: env.INITIAL_WORKFLOW_DEPLOYMENT == 1
       working-directory: ${{ env.TARGET_REPO_DIR }}
       run: |
         if [[ -f .travis.yml ]]; then
@@ -78,7 +78,7 @@ jobs:
           git commit -m "disable Travis"
         fi
     - name: remove CircleCI (on initial workflow deployment)
-      if: ${{ env.INITIAL_WORKFLOW_DEPLOYMENT == 1 }}
+      if: env.INITIAL_WORKFLOW_DEPLOYMENT == 1
       working-directory: ${{ env.TARGET_REPO_DIR }}
       run: |
         if [[ -d .circleci ]]; then
@@ -86,7 +86,7 @@ jobs:
           git commit -m "disable CircleCI"
         fi
     - name: remove gx (on initial workflow deployment)
-      if: ${{ env.INITIAL_WORKFLOW_DEPLOYMENT == 1 }}
+      if: env.INITIAL_WORKFLOW_DEPLOYMENT == 1
       working-directory: ${{ env.TARGET_REPO_DIR }}
       run: |
         if [[ -d .gx ]]; then
@@ -111,7 +111,7 @@ jobs:
           }
         TEMPLATE_ENGINE: s#\$\{\{\{\s*(.*?)\s*\}\}\}#`jq -cjn 'env.CONTEXT | fromjson.$1'`#ge
       run: |
-        for f in $(jq -r '.[]' <<< ${{ toJson(env.FILES) }}); do
+        for f in $(jq -r '.[]' <<< "$FILES"); do
           echo -e "\nProcessing $f."
           # add DO NOT EDIT header
           tmp=$(mktemp)
@@ -144,7 +144,7 @@ jobs:
       working-directory: ${{ env.TARGET_REPO_DIR }}
       run: echo "NEEDS_UPDATE=$(git rev-list HEAD...origin/$(git rev-parse --abbrev-ref HEAD) --ignore-submodules --count 2> /dev/null || echo 1)" >> $GITHUB_ENV
     - name: Force push web3-bot/sync branch
-      if: ${{ env.NEEDS_UPDATE != 0 }}
+      if: env.NEEDS_UPDATE != 0
       working-directory: ${{ env.TARGET_REPO_DIR }}
       run: |
         git checkout -B web3-bot/sync
diff --git a/.github/workflows/create-prs.yml b/.github/workflows/create-prs.yml
index 01c96d15..d333b9a6 100644
--- a/.github/workflows/create-prs.yml
+++ b/.github/workflows/create-prs.yml
@@ -28,16 +28,16 @@ jobs:
           done
           failed=()
           for target in ${targets[@]}; do
-            echo "Processing ${target}"
-            base="$(gh api "/repos/${target}" --jq '.default_branch')"
+            echo "Processing $target"
+            base="$(gh api "/repos/$target" --jq '.default_branch')"
             # checks if a PR needs to be created
-            if [[ "$(gh api -X GET "/repos/${target}/compare/${base}...${{ env.PR_BRANCH }}" --jq '.status')" == 'ahead' ]]; then
-              if [[ "$(gh api -X GET "/repos/${target}/pulls" -f head="$(echo "${target}" | cut -d/ -f1):${{ env.PR_BRANCH }}" -f base="$base" --jq 'length')" != '0' ]] ; then
+            if [[ "$(gh api -X GET "/repos/$target/compare/$base...$PR_BRANCH" --jq '.status')" == 'ahead' ]]; then
+              if [[ "$(gh api -X GET "/repos/$target/pulls" -f head="$(echo "$target" | cut -d/ -f1):$PR_BRANCH" -f base="$base" --jq 'length')" != '0' ]] ; then
                 echo "The PR already exists. Skipping."
                 continue
               fi
             else
-              echo "The branch does not exist or has diverged from ${base}. Skipping."
+              echo "The branch does not exist or has diverged from $base. Skipping."
               continue
             fi
             # tries to create a PR in target
@@ -47,7 +47,7 @@ jobs:
             pr_create_cooldown_in_seconds=1
             # max cumulative sleep time - 68.25 minutes
             while true; do
-              if result="$(gh api "/repos/$target/pulls" -f title="${{ env.PR_TITLE }}" -f head="${{ env.PR_BRANCH }}" -f base="$base")"; then
+              if result="$(gh api "/repos/$target/pulls" -f title="$PR_TITLE" -f head="$PR_BRANCH" -f base="$base")"; then
                 echo "Successfully created a PR for '$target' ($pr_create_attempt/$pr_create_max_attempts)"
                 echo "Sleeping for $pr_create_cooldown_in_seconds seconds before creating a next one"
                 sleep $pr_create_cooldown_in_seconds
diff --git a/.github/workflows/dispatch.yml b/.github/workflows/dispatch.yml
index c90712da..4fed8545 100644
--- a/.github/workflows/dispatch.yml
+++ b/.github/workflows/dispatch.yml
@@ -8,8 +8,8 @@ on:
   push:
     branches: [ master, testing ]
   workflow_dispatch:
-  
-concurrency: 
+
+concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
@@ -52,8 +52,8 @@ jobs:
             targets+=($(jq -c ".repositories[] | $defaults + ." $config))
             echo "::endgroup::"
           done
-          batches=$(jq -sc '[. | _nwise(${{ env.MAX_REPOS_PER_WORKFLOW }})] | to_entries' <<< "${targets[@]}")
-          echo "::set-output name=batches::$batches"
+          batches=$(jq -sc "[. | _nwise($MAX_REPOS_PER_WORKFLOW)] | to_entries" <<< "${targets[@]}")
+          echo "batches=$batches" >> $GITHUB_OUTPUT
   dispatch:
     needs: [ matrix ]
     name: Dispatch copy workflow(batch ${{ matrix.cfg.key }})
@@ -73,7 +73,7 @@ jobs:
         # The triggered copy workflow runs use that final array as their matrix.
         # Since max-parallel here is 1, we'll end up with at most max-parallel from copy workflow + 1 parallel jobs.
         # 20 is the upper limit on parallel jobs on a free plan.
-        cfg: ${{ fromJson(needs.matrix.outputs.batches) }}
+        cfg: ${{ fromJSON(needs.matrix.outputs.batches) }}
       max-parallel: 1
     env:
       GITHUB_TOKEN: ${{ secrets.WEB3BOT_GITHUB_TOKEN }}
@@ -82,31 +82,36 @@ jobs:
     steps:
       - id: dispatch
         name: Dispatch copy workflow
+        env:
+          TARGETS: ${{ toJSON(matrix.cfg.value) }}
         run: |
           start_date="$(date +%s)"
-          # 2 toJson calls are needed to turn the array of targets into a string
-          echo '{"targets":${{ toJson(toJson(matrix.cfg.value)) }}}' | jq -c '.' | gh workflow run "${{ env.WORKFLOW_YML }}" --ref "${{ github.ref }}" --repo "${{ env.WORKFLOW_REPO }}" --json
-          echo "::set-output name=start_date::$start_date"
+          gh workflow run "$WORKFLOW_YML" --ref "$GITHUB_REF" --repo "$WORKFLOW_REPO" --field "targets=$TARGETS"
+          echo "start_date=$start_date" >> $GITHUB_OUTPUT
       - id: run
         name: Wait for copy workflow run to start
+        env:
+          START_DATE: ${{ steps.dispatch.outputs.start_date }}
         run: |
           # checks every 3 seconds until the most recent copy workflow run's created_at is later than this job's start_date
           while sleep 3; do
-            run="$(gh api "/repos/${{ env.WORKFLOW_REPO }}/actions/workflows/${{ env.WORKFLOW_YML }}/runs?per_page=1" --jq '.workflow_runs[0]')"
+            run="$(gh api "/repos/$WORKFLOW_REPO/actions/workflows/$WORKFLOW_YML/runs?per_page=1" --jq '.workflow_runs[0]')"
             # nothing to check if no copy workflow run was returned
             if [[ ! -z "$run" ]]; then
               run_start_date="$(date --date="$(jq -r '.created_at' <<< "$run")" +%s)"
-              if [[ "$run_start_date" > "${{ steps.dispatch.outputs.start_date }}" ]]; then
-                echo "::set-output name=id::$(jq -r '.id' <<< "$run")"
+              if [[ "$run_start_date" > "$START_DATE" ]]; then
+                echo "id=$(jq -r '.id' <<< "$run")" >> $GITHUB_OUTPUT
                 break
               fi
             fi
           done
       - name: Wait for copy workflow run to complete
+        env:
+          RUN_ID: ${{ steps.run.outputs.id }}
         run: |
           # delays checking copy workflow's run status to save on GH API requests
-          sleep ${{ env.WORKFLOW_COMPLETION_CHECK_DELAY }}
+          sleep $WORKFLOW_COMPLETION_CHECK_DELAY
 
           # checks every 3 seconds until the copy workflow run's status is completed
           # redirects the stdout to /dev/null because it is very chatty
-          gh run watch "${{ steps.run.outputs.id }}" --repo "${{ env.WORKFLOW_REPO }}" > /dev/null
+          gh run watch "$RUN_ID" --repo "$WORKFLOW_REPO" > /dev/null
diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml
index 64174686..ce0d4f0d 100644
--- a/.github/workflows/releaser.yml
+++ b/.github/workflows/releaser.yml
@@ -13,7 +13,9 @@ jobs:
       - name: Determine version
         run: echo "VERSION=$(jq -r .version version.json)" >> $GITHUB_ENV
       - name: Determine branch
-        run: echo "DEFAULT_BRANCH=refs/heads/${{ github.event.repository.default_branch }}" >> $GITHUB_ENV
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: echo "DEFAULT_BRANCH=refs/heads/$DEFAULT_BRANCH" >> $GITHUB_ENV
       - name: Create a release, if we're on the default branch
         run: echo "CREATETAG=true" >> $GITHUB_ENV
         if: env.DEFAULT_BRANCH == github.ref
@@ -22,21 +24,23 @@ jobs:
         id: getmergedpr
         uses: actions-ecosystem/action-get-merged-pull-request@59afe90821bb0b555082ce8ff1e36b03f91553d9 # v1.0.1
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ github.token }}
       - name: Check if the "release" label was set on the PR
         if: steps.getmergedpr.outputs.number != '' && env.DEFAULT_BRANCH != github.ref
+        env:
+          LABELS: ${{ steps.getmergedpr.outputs.labels }}
         run: |
           while IFS= read -r label; do
             if [[ "$label" == "release" ]]; then
               echo "CREATETAG=true" >> $GITHUB_ENV
               break
             fi
-          done <<< "${{ steps.getmergedpr.outputs.labels }}"
+          done <<< "$LABELS"
       - name: Create release
         if: env.CREATETAG == 'true'
         run: |
           git fetch origin --tags
-          if ! $(git rev-list ${{ env.VERSION}}.. &> /dev/null); then
-            git tag ${{ env.VERSION }}
+          if ! $(git rev-list $VERSION.. &> /dev/null); then
+            git tag $VERSION
             git push --tags
           fi
diff --git a/.github/workflows/stale-repos.yml b/.github/workflows/stale-repos.yml
index b0258bb8..b5df67fa 100644
--- a/.github/workflows/stale-repos.yml
+++ b/.github/workflows/stale-repos.yml
@@ -15,15 +15,17 @@ jobs:
       - uses: actions/checkout@v3
       - id: repos
         name: find repositories to check
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: |
           # returns a JSON array of repository objects with the following schema:
           #  [ {"config": "$JSON_CONFIG_FILE_PATH", "repo": "$GITHUB_REPOSITORY_FULL_NAME"} ]
           repos="$(jq -nc '[inputs | .repositories[] | {"config":input_filename,"repo":.target}]' configs/*.json)"
 
-          if [[ '${{ github.event_name }}' == 'pull_request' ]]; then
+          if [[ "$GITHUB_EVENT_NAME" == 'pull_request' ]]; then
             # resets the checkout to PR target commit
-            git fetch origin ${{ github.event.pull_request.base.sha }}
-            git checkout ${{ github.event.pull_request.base.sha }}
+            git fetch origin $BASE_SHA
+            git checkout $BASE_SHA
 
             # returns a JSON array of repository objects as they exist on pull request target
             base="$(jq -nc '[inputs | .repositories[] | {"config":input_filename,"repo":.target}]' configs/*.json)"
@@ -33,16 +35,19 @@ jobs:
             repos="$(jq -nc '$head - $base' --argjson head "$repos" --argjson base "$base")"
           fi
 
-          echo "::set-output name=repos::$repos"
+          echo "repos=$repos" >> $GITHUB_OUTPUT
       - name: find deleted / archived repositories
-        if: ${{ steps.repos.outputs.repos != '[]' }}
+        if: steps.repos.outputs.repos != '[]'
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          REPOS: ${{ steps.repos.outputs.repos }}
         run: |
           status=0
           while read config; do
             echo "::group::$config"
             while read repo; do
               exists=true
-              output=$(curl -s -f -H "Accept: application/vnd.github.v3+json" -H "authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" "https://api.github.com/repos/$repo") || exists=false
+              output=$(curl -s -f -H "Accept: application/vnd.github.v3+json" -H "authorization: Bearer $GITHUB_TOKEN" "https://api.github.com/repos/$repo") || exists=false
               if ! $exists; then
                 echo "Repository $repo does not exist."
                 status=1
@@ -52,7 +57,7 @@ jobs:
                 echo "Repository $repo is archived."
                 status=1
               fi
-            done <<< "$(jq -r '.[] | select(.config == $key) | .repo' --arg key "$config" <<< '${{ steps.repos.outputs.repos }}')"
+            done <<< "$(jq -r '.[] | select(.config == $key) | .repo' --arg key "$config" <<< "$REPOS")"
             echo "::endgroup::"
-          done <<< "$(jq -r 'map(.config) | unique | .[]' <<< '${{ steps.repos.outputs.repos }}')"
+          done <<< "$(jq -r 'map(.config) | unique | .[]' <<< "$REPOS")"
           exit $status
diff --git a/.github/workflows/tagpush.yml b/.github/workflows/tagpush.yml
index b2c19e90..9d119e9e 100644
--- a/.github/workflows/tagpush.yml
+++ b/.github/workflows/tagpush.yml
@@ -20,22 +20,24 @@ jobs:
       - run: cat "$GITHUB_EVENT_PATH" | jq -M .
       - name: extract tag name
         run: |
-          tagname=$(echo "${{ github.ref }}" | sed "s/refs\/tags\///")
-          echo $tagnmae
+          tagname=$(echo "$GITHUB_REF" | sed "s/refs\/tags\///")
+          echo $tagname
           echo "TAGNAME=$tagname" >> $GITHUB_ENV
       - name: create issue template file
-        if: ${{ github.event.pusher.name != 'web3-bot' }}
+        if: github.event.pusher.name != 'web3-bot'
+        env:
+          PUSHER: ${{ github.event.pusher.name }}
         run: |
           echo "---" >> .github/workflows/tagpush.md
-          echo "title: ${{ env.ISSUE_TITLE }}" | sed "s/%tagname%/${{ env.TAGNAME }}/" >> .github/workflows/tagpush.md
-          echo "assignees: ${{ env.ISSUE_ASSIGNEE }}" | sed "s/%pusher%/${{ github.event.pusher.name }}/" >> .github/workflows/tagpush.md
+          echo "title: $ISSUE_TITLE" | sed "s/%tagname%/$TAGNAME/" >> .github/workflows/tagpush.md
+          echo "assignees: $ISSUE_ASSIGNEE" | sed "s/%pusher%/$PUSHER/" >> .github/workflows/tagpush.md
           echo "---" >> .github/workflows/tagpush.md
           cat <<EOF >> .github/workflows/tagpush.md
-          ${{ env.ISSUE_BODY }}
+          $ISSUE_BODY
           EOF
       - run: cat .github/workflows/tagpush.md
       - name: create an issue
-        if: ${{ github.event.pusher.name != 'web3-bot' }}
+        if: github.event.pusher.name != 'web3-bot'
         uses: JasonEtco/create-an-issue@e27dddc79c92bc6e4562f268fffa5ed752639abd # v2.9.1
         env:
           GITHUB_TOKEN: ${{ github.token }}
@@ -43,5 +45,5 @@ jobs:
         with:
           filename: .github/workflows/tagpush.md
       - name: fail build if push wasn't done by web3-bot
-        if: ${{ github.event.pusher.name != 'web3-bot' }}
+        if: github.event.pusher.name != 'web3-bot'
         run: exit 1
diff --git a/templates/.github/workflows/go-check.yml b/templates/.github/workflows/go-check.yml
index 3f52a160..2265815d 100644
--- a/templates/.github/workflows/go-check.yml
+++ b/templates/.github/workflows/go-check.yml
@@ -30,7 +30,7 @@ jobs:
             fi
             git diff --exit-code -- go.sum go.mod
       - name: gofmt
-        if: ${{ success() || failure() }} # run this step even if the previous one failed
+        if: success() || failure() # run this step even if the previous one failed
         run: |
           out=$(gofmt -s -l .)
           if [[ -n "$out" ]]; then
@@ -38,12 +38,12 @@ jobs:
             exit 1
           fi
       - name: go vet
-        if: ${{ success() || failure() }} # run this step even if the previous one failed
+        if: success() || failure() # run this step even if the previous one failed
         uses: protocol/multiple-go-modules@v1.2
         with:
           run: go vet ./...
       - name: staticcheck
-        if: ${{ success() || failure() }} # run this step even if the previous one failed
+        if: success() || failure() # run this step even if the previous one failed
         uses: protocol/multiple-go-modules@v1.2
         with:
           run: |
diff --git a/templates/.github/workflows/go-test.yml b/templates/.github/workflows/go-test.yml
index 637a76aa..64ec0182 100644
--- a/templates/.github/workflows/go-test.yml
+++ b/templates/.github/workflows/go-test.yml
@@ -26,7 +26,7 @@ jobs:
           go version
           go env
       - name: Use msys2 on windows
-        if: ${{ matrix.os == 'windows' }}
+        if: matrix.os == 'windows'
         shell: bash
         # The executable for msys2 is also called bash.cmd
         #   https://github.com/actions/virtual-environments/blob/main/images/win/Windows2019-Readme.md#shells
@@ -54,7 +54,7 @@ jobs:
           GOARCH: 386
         with:
           run: |
-            export "PATH=${{ env.PATH_386 }}:$PATH"
+            export "PATH=$PATH_386:$PATH"
             go test -v -shuffle=on ./...
       - name: Run tests with race detector
         # speed things up. Windows and OSX VMs are slow
diff --git a/templates/.github/workflows/js-test-and-release.yml b/templates/.github/workflows/js-test-and-release.yml
index 0bd8f243..14d6f155 100644
--- a/templates/.github/workflows/js-test-and-release.yml
+++ b/templates/.github/workflows/js-test-and-release.yml
@@ -139,5 +139,5 @@ jobs:
           docker-username: ${{ secrets.DOCKER_USERNAME }}
       - run: npm run --if-present release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

From 17f5f954f9dcef9663a9aeb2a7c669d89881fab9 Mon Sep 17 00:00:00 2001
From: Piotr Galar <piotr.galar@gmail.com>
Date: Tue, 7 Feb 2023 11:23:47 +0100
Subject: [PATCH 12/15] feat: create gh releases in release-check/releaser
 workflows (#456)

* feat: create gh releases in release-check/releaser workflows

* fix: fill expr in release check workflow

* fix: add missing gh token in release check

* fix: add missing prev version env var in release check workflow

* fix: release check in release check

* chore: clean up obsolete step from releaser

* fix: step outputs in release workflows

* fix: labels in releaser

* fix: action gh release
---
 .github/workflows/release-check.yml | 126 ++++++++++++++++++----------
 .github/workflows/releaser.yml      |  49 ++++-------
 VERSIONING.md                       |   8 +-
 3 files changed, 104 insertions(+), 79 deletions(-)

diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml
index 2a8e7941..599a43ee 100644
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -75,16 +75,6 @@ jobs:
             fi
             echo "version=$v" >> $GITHUB_OUTPUT
           fi
-      - name: Post output
-        if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version == ''
-        uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
-        with:
-          header: release-check
-          recreate: true
-          message: |
-            Suggested version: `${{ steps.version.outputs.version }}`
-
-            This is the first release of this module.
       - id: git-diff
         name: run git diff on go.mod file(s)
         if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version != ''
@@ -123,41 +113,18 @@ jobs:
             output="(empty)"
           fi
           printf "output<<$EOF\n%s\n$EOF" "$output" >> $GITHUB_OUTPUT
-      - id: footnote
-        env:
-          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-          BASE_REF: ${{ github.base_ref }}
-          GITHUB_TOKEN: ${{ github.token }}
-          HEAD_LABEL: ${{ github.event.pull_request.head.label }}
-        run: |
-          output=''
-          if [[ "$DEFAULT_BRANCH" != "$BASE_REF" ]]; then
-            output+='
-          ## Cutting a Release (when not on `'"$DEFAULT_BRANCH"'`)
-
-          This PR is targeting `'"$BASE_REF"'`, which is not the default branch.
-          If you wish to cut a release once this PR is merged, please add the `release` label to this PR.
-          '
-          fi
-          diff="$(gh api -X GET "repos/$GITHUB_REPOSITORY/compare/$BASE_REF...$HEAD_LABEL" --jq '.files | map(.filename) | map(select(test("^(version\\.json|.*\\.md)$") | not)) | .[]')"
-          if [[ "$diff" != "" ]]; then
-            output+='
-          ## Cutting a Release (and modifying non-markdown files)
-
-          This PR is modifying both `version.json` and non-markdown files.
-          The Release Checker is not able to analyse files that are not checked in to `'"$BASE_REF"'`. This might cause the above analysis to be inaccurate.
-          Please consider performing all the code changes in a separate PR before cutting the release.
-          '
-          fi
-          printf "output<<$EOF\n%s\n$EOF" "$output" >> $GITHUB_OUTPUT
-      - name: Post message on PR
-        uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
-        if: steps.tag.outputs.exists == 'false' && steps.prev.outputs.version != ''
+      - id: release
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        uses: galargh/action-gh-release@25b3878b4c346655a4d3d9bea8b76638f64743cf # https://github.com/softprops/action-gh-release/pull/316
         with:
-          header: release-check
-          recreate: true
-          message: |
+          draft: true
+          tag_name: ${{ steps.version.outputs.version }}
+          generate_release_notes: true
+      - id: message
+        env:
+          HEADER: |
             Suggested version: `${{ steps.version.outputs.version }}`
+          BODY: |
             Comparing to: [${{ steps.prev.outputs.version }}](${{ github.event.pull_request.base.repo.html_url }}/releases/tag/${{ steps.prev.outputs.version }}) ([diff](${{ github.event.pull_request.base.repo.html_url }}/compare/${{ steps.prev.outputs.version }}..${{ github.event.pull_request.head.label }}))
 
             Changes in `go.mod` file(s):
@@ -174,4 +141,75 @@ jobs:
             ```
             ${{ steps.gocompat.outputs.output }}
             ```
-            ${{ steps.footnote.outputs.output }}
+
+          BODY_ALT: |
+            This is the first release of this module.
+
+          RELEASE_BRANCH_NOTICE: |
+            ## Cutting a Release (when not on `${{ github.event.repository.default_branch }}`)
+
+            This PR is targeting `${{ github.base_ref }}`, which is not the default branch.
+            If you wish to cut a release once this PR is merged, please add the `release` label to this PR.
+
+          DIFF_NOTICE: |
+            ## Cutting a Release (and modifying non-markdown files)
+
+            This PR is modifying both `version.json` and non-markdown files.
+            The Release Checker is not able to analyse files that are not checked in to `${{ github.base_ref }}`. This might cause the above analysis to be inaccurate.
+            Please consider performing all the code changes in a separate PR before cutting the release.
+
+          RELEASE_NOTICE: |
+            ## Automatically created GitHub Release
+
+            A [draft GitHub Release](${{ steps.release.outputs.url }}) has been created.
+            It is going to be published when this PR is merged.
+            You can modify its' body to include any release notes you wish to include with the release.
+
+          RELEASE_NOTICE_ALT: |
+            ## Automatically created GitHub Release
+
+            Pre-creating GitHub Releases on release PRs initiated from forks is not supported.
+            If you wish to prepare release notes yourself, you should create a draft GitHub Release for tag `${{ steps.version.outputs.version }}` manually.
+            The draft GitHub Release is going to be published when this PR is merged.
+            If you choose not to create a draft GitHub Release, a published GitHub Released is going to be created when this PR is merged.
+
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          BASE_REF: ${{ github.base_ref }}
+          HEAD_LABEL: ${{ github.event.pull_request.head.label }}
+          HEAD_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
+          GITHUB_TOKEN: ${{ github.token }}
+          PREV_VERSION: ${{ steps.prev.outputs.version }}
+        run: |
+          echo "output<<$EOF" >> $GITHUB_OUTPUT
+
+          echo "$HEADER" >> $GITHUB_OUTPUT
+
+          if [[ "$PREV_VERSION" != "" ]]; then
+            echo "$BODY" >> $GITHUB_OUTPUT
+          else
+            echo "$BODY_ALT" >> $GITHUB_OUTPUT
+          fi
+
+          if [[ "$DEFAULT_BRANCH" != "$BASE_REF" ]]; then
+            echo "$RELEASE_BRANCH_NOTICE" >> $GITHUB_OUTPUT
+          fi
+
+          diff="$(gh api -X GET "repos/$GITHUB_REPOSITORY/compare/$BASE_REF...$HEAD_LABEL" --jq '.files | map(.filename) | map(select(test("^(version\\.json|.*\\.md)$") | not)) | .[]')"
+          if [[ "$diff" != "" ]]; then
+            echo "$DIFF_NOTICE" >> $GITHUB_OUTPUT
+          fi
+
+          if [[ "$GITHUB_REPOSITORY" == "$HEAD_FULL_NAME" ]]; then
+            echo "$RELEASE_NOTICE" >> $GITHUB_OUTPUT
+          else
+            echo "$RELEASE_NOTICE_ALT" >> $GITHUB_OUTPUT
+          fi
+
+          echo "$EOF" >> $GITHUB_OUTPUT
+      - name: Post message on PR
+        uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
+        if: steps.tag.outputs.exists == 'false'
+        with:
+          header: release-check
+          recreate: true
+          message: ${{ steps.message.outputs.output }}
diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml
index ce0d4f0d..099d8e37 100644
--- a/.github/workflows/releaser.yml
+++ b/.github/workflows/releaser.yml
@@ -4,43 +4,26 @@ on: [ workflow_call ]
 jobs:
   releaser:
     runs-on: ubuntu-latest
-    env:
-      VERSION: ""
-      CREATETAG: "false"
-      DEFAULT_BRANCH: ""
     steps:
       - uses: actions/checkout@v3
-      - name: Determine version
-        run: echo "VERSION=$(jq -r .version version.json)" >> $GITHUB_ENV
-      - name: Determine branch
-        env:
-          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-        run: echo "DEFAULT_BRANCH=refs/heads/$DEFAULT_BRANCH" >> $GITHUB_ENV
-      - name: Create a release, if we're on the default branch
-        run: echo "CREATETAG=true" >> $GITHUB_ENV
-        if: env.DEFAULT_BRANCH == github.ref
-      - name: Determine if this commit is a merged PR (if we're not on a default branch)
-        if: env.DEFAULT_BRANCH != github.ref
-        id: getmergedpr
+      - id: version
+        name: Determine version
+        run: echo "version=$(jq -r .version version.json)" >> $GITHUB_OUTPUT
+      - id: pr
+        name: Determine if this commit is a merged PR (if we're not on a default branch)
+        if: github.ref != format('refs/heads/{0}', github.event.repository.default_branch)
         uses: actions-ecosystem/action-get-merged-pull-request@59afe90821bb0b555082ce8ff1e36b03f91553d9 # v1.0.1
         with:
           github_token: ${{ github.token }}
-      - name: Check if the "release" label was set on the PR
-        if: steps.getmergedpr.outputs.number != '' && env.DEFAULT_BRANCH != github.ref
+      - id: labels
         env:
-          LABELS: ${{ steps.getmergedpr.outputs.labels }}
-        run: |
-          while IFS= read -r label; do
-            if [[ "$label" == "release" ]]; then
-              echo "CREATETAG=true" >> $GITHUB_ENV
-              break
-            fi
-          done <<< "$LABELS"
+          LABELS: ${{ steps.pr.outputs.labels }}
+        run: echo "labels=$(jq -nc 'env.LABELS | split("\n")')" >> $GITHUB_OUTPUT
       - name: Create release
-        if: env.CREATETAG == 'true'
-        run: |
-          git fetch origin --tags
-          if ! $(git rev-list $VERSION.. &> /dev/null); then
-            git tag $VERSION
-            git push --tags
-          fi
+        if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) ||
+          contains(fromJSON(steps.labels.outputs.labels), 'release')
+        uses: galargh/action-gh-release@25b3878b4c346655a4d3d9bea8b76638f64743cf # https://github.com/softprops/action-gh-release/pull/316
+        with:
+          draft: false
+          tag_name: ${{ steps.version.outputs.version }}
+          generate_release_notes: true
diff --git a/VERSIONING.md b/VERSIONING.md
index c4ccb3cf..cff629c3 100644
--- a/VERSIONING.md
+++ b/VERSIONING.md
@@ -30,9 +30,13 @@ Every Go repository contains a `version.json` file in the root directory:
 This version file defines the currently released version.
 
 When cutting a new release, open a Pull Request that bumps the version number and have it review by your team mates.
-The [release check workflow](.github/workflows/release-check.yml) will comment on the PR and post useful information (the output of `gorelease`, `gocompat` and a diff of the `go.mod` files(s)).
+The [release check workflow](.github/workflows/release-check.yml) will create a draft GitHub Release (_if the workflow was not initiated by a PR from a fork_) and post a link to it along with other useful information (the output of `gorelease`, `gocompat` and a diff of the `go.mod` files(s)).
 
-As soon as the PR is merged into the default branch, the [releaser workflow](.github/workflows/releaser.yml) is run. This workflow cuts a new release on CI and pushes the tag.
+As soon as the PR is merged into the default branch, the [releaser workflow](.github/workflows/releaser.yml) is run. This workflow either publishes the draft GitHub Release created by the release check workflow or creates a published GitHub Release if it doesn't exist yet. This, in turn, will create a new Git tag and push it to the repository.
+
+### Modifying GitHub Release
+
+All modification you make to the draft GitHub Release created by the release check workflow will be preserved. You can change its' name and body to describe the release in more detail.
 
 ### Using a Release Branch
 

From 453222d93d9a96b1be9f32f6641ac6c10397f598 Mon Sep 17 00:00:00 2001
From: Piotr Galar <piotr.galar@gmail.com>
Date: Wed, 8 Feb 2023 09:49:36 +0100
Subject: [PATCH 13/15] update go version to 1.20.x (#463)

* update go version to 1.20.x

* fix: go 1.20 upgrade

* Revert "fix: go 1.20 upgrade"

This reverts commit ceb72ef2a16c5e00aded6d1f409010ca2cdb0446.
---
 configs/go.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configs/go.json b/configs/go.json
index 6fdd6968..0710be29 100644
--- a/configs/go.json
+++ b/configs/go.json
@@ -11,7 +11,7 @@
     "deploy_versioning": true,
     "deploy_go": true,
     "go": {
-      "versions": [ "1.18.x", "1.19.x" ]
+      "versions": [ "1.19.x", "1.20.x" ]
     }
   },
   "repositories": [

From 9d08a25d852a84c367584ffb8fa14b49db7cbda5 Mon Sep 17 00:00:00 2001
From: Piotr Galar <piotr.galar@gmail.com>
Date: Wed, 8 Feb 2023 12:54:54 +0100
Subject: [PATCH 14/15] clean up where source ref was set to next (#464)

---
 configs/go.json                          | 12 ++++--------
 templates/.github/workflows/go-check.yml |  2 +-
 templates/.github/workflows/go-test.yml  |  2 +-
 3 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/configs/go.json b/configs/go.json
index 5d0879fc..8e3c764f 100644
--- a/configs/go.json
+++ b/configs/go.json
@@ -136,8 +136,7 @@
       "target": "ipfs/go-ds-measure"
     },
     {
-      "target": "ipfs/go-ds-pebble",
-      "source_ref": "next"
+      "target": "ipfs/go-ds-pebble"
     },
     {
       "target": "ipfs/go-ds-redis"
@@ -347,12 +346,10 @@
       "target": "ipni/depute"
     },
     {
-      "target": "ipni/dhstore",
-      "source_ref": "next"
+      "target": "ipni/dhstore"
     },
     {
-      "target": "ipni/go-indexer-core",
-      "source_ref": "next"
+      "target": "ipni/go-indexer-core"
     },
     {
       "target": "ipni/go-naam"
@@ -370,8 +367,7 @@
       "target": "ipni/indexstar"
     },
     {
-      "target": "ipni/storetheindex",
-      "source_ref": "next"
+      "target": "ipni/storetheindex"
     },
     {
       "target": "libp2p/dht-tracer1"
diff --git a/templates/.github/workflows/go-check.yml b/templates/.github/workflows/go-check.yml
index 2265815d..011be1d6 100644
--- a/templates/.github/workflows/go-check.yml
+++ b/templates/.github/workflows/go-check.yml
@@ -10,7 +10,7 @@ jobs:
         with:
           submodules: recursive
       - id: config
-        uses: protocol/.github/.github/actions/read-config@next
+        uses: protocol/.github/.github/actions/read-config@master
       - uses: actions/setup-go@v3
         with:
           go-version: ${{{ config.go.versions[-1] }}}
diff --git a/templates/.github/workflows/go-test.yml b/templates/.github/workflows/go-test.yml
index 64ec0182..5d5b2e80 100644
--- a/templates/.github/workflows/go-test.yml
+++ b/templates/.github/workflows/go-test.yml
@@ -17,7 +17,7 @@ jobs:
         with:
           submodules: recursive
       - id: config
-        uses: protocol/.github/.github/actions/read-config@next
+        uses: protocol/.github/.github/actions/read-config@master
       - uses: actions/setup-go@v3
         with:
           go-version: ${{ matrix.go }}

From cbbd6f0b42557972799e6abffcb093768266a2ad Mon Sep 17 00:00:00 2001
From: galargh <piotr.galar@gmail.com>
Date: Wed, 8 Feb 2023 13:33:06 +0100
Subject: [PATCH 15/15] perform self-review before final release

---
 .github/actions/copy-workflow-go/action.yml |  8 +++++---
 .github/workflows/releaser.yml              | 12 ++++++++++--
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/.github/actions/copy-workflow-go/action.yml b/.github/actions/copy-workflow-go/action.yml
index 2030a6ac..78ab9f9b 100644
--- a/.github/actions/copy-workflow-go/action.yml
+++ b/.github/actions/copy-workflow-go/action.yml
@@ -6,7 +6,7 @@ runs:
   steps:
     # GitHub Actions Expressions do not support last item access/array length retrieval
     - id: go
-      run: echo "::set-output name=version::$(jq -r '.[-1]' <<< '${{ toJSON(matrix.cfg.go.versions) }}')"
+      run: echo "version=$(jq -r '.[-1]' <<< '${{ toJSON(matrix.cfg.go.versions) }}')" >> $GITHUB_OUTPUT
       shell: bash
     - uses: actions/setup-go@v3
       with:
@@ -15,20 +15,22 @@ runs:
         go-version: ${{ steps.go.outputs.version }}
     - name: bump go.mod go version if needed
       uses: protocol/multiple-go-modules@v1.2
+      env:
+        VERSION: ${{ matrix.cfg.go.versions[0] }}
       with:
         working-directory: ${{ env.TARGET_REPO_DIR }}
         run: |
           # We want our modules to support two Go versions at a time.
           # go.mod's Go version declares the language version being used.
           # As such, it has to be the minimum of all Go versions supported.
-          TARGET_VERSION='${{ matrix.cfg.go.versions[0] }}'
+          TARGET_VERSION="$VERSION"
           TARGET_VERSION="${TARGET_VERSION%.x}"
           TARGET_MAJOR_VERSION="${TARGET_VERSION%.[0-9]*}"
           TARGET_MINOR_VERSION="${TARGET_VERSION#[0-9]*.}"
           # Assumptions:
           # - all versions are targetted incrementally
           # - no versions are skipped
-          # - patch version is never pinned explicitly 
+          # - patch version is never pinned explicitly
           PREVIOUS_TARGET_VERSION="$TARGET_MAJOR_VERSION.$(($TARGET_MINOR_VERSION-1))"
 
           # Note that the "<" comparison doesn't understand semver,
diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml
index 099d8e37..e9242442 100644
--- a/.github/workflows/releaser.yml
+++ b/.github/workflows/releaser.yml
@@ -19,9 +19,17 @@ jobs:
         env:
           LABELS: ${{ steps.pr.outputs.labels }}
         run: echo "labels=$(jq -nc 'env.LABELS | split("\n")')" >> $GITHUB_OUTPUT
+      - id: tag
+        name: Check if tag already exists
+        if: steps.version.outputs.version != ''
+        uses: mukunku/tag-exists-action@9298fbcc409758ba624a0ae16b83df86637cb8ce # v1.2.0
+        with:
+          tag: ${{ steps.version.outputs.version }}
       - name: Create release
-        if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) ||
-          contains(fromJSON(steps.labels.outputs.labels), 'release')
+        if: steps.version.outputs.version != '' && steps.tag.outputs.exists == 'false' && (
+            github.ref == format('refs/heads/{0}', github.event.repository.default_branch) ||
+            contains(fromJSON(steps.labels.outputs.labels), 'release')
+          )
         uses: galargh/action-gh-release@25b3878b4c346655a4d3d9bea8b76638f64743cf # https://github.com/softprops/action-gh-release/pull/316
         with:
           draft: false