diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 000000000000..7a7be904d071
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,30 @@
+self-hosted-runner:
+  # Custom self-hosted runner labels used in this repository
+  labels:
+    - 1-gpu-runner
+    - 2-gpu-runner
+    - 4-gpu-a10
+    - 4-gpu-b200
+    - 4-gpu-gb200
+    - 4-gpu-h100
+    - 8-gpu-b200
+    - 8-gpu-h20
+    - 8-gpu-h200
+    - 8-gpu-h200-oracle
+    - amd-docker-scale
+    - arm-docker-build-node
+    - arm-kernel-build-node
+    - intel-bmg
+    - linux-aarch64-a3-16
+    - linux-arm64-npu-1
+    - linux-arm64-npu-2
+    - linux-arm64-npu-4
+    - linux-mi300-gpu-1
+    - linux-mi300-gpu-2
+    - linux-mi300-gpu-8
+    - linux-mi325-gpu-2-nightly
+    - ubuntu-22.04-arm
+    - x64-cu13-kernel-tests
+    - x64-docker-build-node
+    - x64-kernel-build-node
+    - xeon-gnr
diff --git a/.github/workflows/auto-format.yml b/.github/workflows/auto-format.yml
index 7466572aa5e7..9058fdd4f867 100644
--- a/.github/workflows/auto-format.yml
+++ b/.github/workflows/auto-format.yml
@@ -22,7 +22,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: "3.10"
 
@@ -39,9 +39,9 @@ jobs:
         id: check_changes
         run: |
           if [[ -n $(git status -s) ]]; then
-            echo "has_changes=true" >> $GITHUB_OUTPUT
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_changes=false" >> $GITHUB_OUTPUT
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Commit and push changes
diff --git a/.github/workflows/bot-bump-kernel-version-to-sglang.yml b/.github/workflows/bot-bump-kernel-version-to-sglang.yml
index 1621c924179d..b1e991f82958 100644
--- a/.github/workflows/bot-bump-kernel-version-to-sglang.yml
+++ b/.github/workflows/bot-bump-kernel-version-to-sglang.yml
@@ -43,9 +43,9 @@ jobs:
           KERNEL_VERSION="${{ steps.check_sync.outputs.kernel_version }}"
           BRANCH_NAME="bot/bump-kernel-version-to-sglang-${KERNEL_VERSION}-${RANDOM_SUFFIX}"
           git checkout -b "$BRANCH_NAME"
-          echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
-          echo "KERNEL_VERSION=$KERNEL_VERSION" >> $GITHUB_ENV
-          echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
+          echo "BRANCH_NAME=$BRANCH_NAME" >> "$GITHUB_ENV"
+          echo "KERNEL_VERSION=$KERNEL_VERSION" >> "$GITHUB_ENV"
+          echo "branch_name=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
 
       - name: Run kernel version bump script
         if: steps.check_sync.outputs.needs_sync == 'true'
diff --git a/.github/workflows/bot-bump-kernel-version.yml b/.github/workflows/bot-bump-kernel-version.yml
index 91a808c6ab61..4504bc899fa9 100644
--- a/.github/workflows/bot-bump-kernel-version.yml
+++ b/.github/workflows/bot-bump-kernel-version.yml
@@ -37,7 +37,7 @@ jobs:
           RANDOM_SUFFIX=$(echo $RANDOM | md5sum | head -c 4)
           BRANCH_NAME="bot/bump-kernel-version-${{ github.event.inputs.new_version }}-${RANDOM_SUFFIX}"
           git checkout -b "$BRANCH_NAME"
-          echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
+          echo "BRANCH_NAME=$BRANCH_NAME" >> "$GITHUB_ENV"
 
       - name: Run kernel version bump script
         run: |
diff --git a/.github/workflows/bot-bump-sglang-version.yml b/.github/workflows/bot-bump-sglang-version.yml
index cbfd8e761a52..8352cdc362eb 100644
--- a/.github/workflows/bot-bump-sglang-version.yml
+++ b/.github/workflows/bot-bump-sglang-version.yml
@@ -40,8 +40,7 @@ jobs:
           RANDOM_SUFFIX=$(echo $RANDOM | md5sum | head -c 4)
           BRANCH_NAME="bot/bump-sglang-version-${{ github.event.inputs.new_version }}-${RANDOM_SUFFIX}"
           git checkout -b "$BRANCH_NAME"
-          echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
-          echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
+          echo "BRANCH_NAME=$BRANCH_NAME" >> "$GITHUB_ENV"
 
       - name: Run SGLang version bump script
         run: |
diff --git a/.github/workflows/cancel-all-pending-pr-test-runs.yml b/.github/workflows/cancel-all-pending-pr-test-runs.yml
index 6217542e7bae..29356ca9ee19 100644
--- a/.github/workflows/cancel-all-pending-pr-test-runs.yml
+++ b/.github/workflows/cancel-all-pending-pr-test-runs.yml
@@ -38,7 +38,7 @@ jobs:
               --json databaseId,status \
               --limit 1000 \
               | jq -r '.[] | select(.status=="queued" or .status=="in_progress") | .databaseId' \
-              | while read run_id; do
+              | while read -r run_id; do
                   echo "Cancelling run ID: $run_id for workflow: $workflow_file"
                   gh run cancel "$run_id" --repo "$REPO"
                 done
diff --git a/.github/workflows/ci-failure-monitor.yml b/.github/workflows/ci-failure-monitor.yml
index 665ef4757ad5..ccb4e53f04c7 100644
--- a/.github/workflows/ci-failure-monitor.yml
+++ b/.github/workflows/ci-failure-monitor.yml
@@ -50,10 +50,10 @@ jobs:
         run: |
           cd scripts/ci_monitor
           python ci_failures_analysis.py \
-            --token $GITHUB_TOKEN \
-            --limit ${{ inputs.limit || '800' }} \
-            --threshold ${{ inputs.threshold || '4' }} \
-            --output ci_failure_analysis_$(date +%Y%m%d_%H%M%S).json
+            --token "$GITHUB_TOKEN" \
+            --limit "${{ inputs.limit || '800' }}" \
+            --threshold "${{ inputs.threshold || '4' }}" \
+            --output "ci_failure_analysis_$(date +%Y%m%d_%H%M%S).json"
 
       - name: Upload Analysis Results
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ci-monitor.yml b/.github/workflows/ci-monitor.yml
index 28a198a32a58..04f75bcfa8f5 100644
--- a/.github/workflows/ci-monitor.yml
+++ b/.github/workflows/ci-monitor.yml
@@ -44,7 +44,7 @@ jobs:
           PYTHONIOENCODING: utf-8
         run: |
           cd scripts/ci_monitor
-          python ci_analyzer.py --token $GITHUB_TOKEN --limit ${{ inputs.limit || '1000' }} --output ci_analysis_$(date +%Y%m%d_%H%M%S).json
+          python ci_analyzer.py --token "$GITHUB_TOKEN" --limit "${{ inputs.limit || '1000' }}" --output "ci_analysis_$(date +%Y%m%d_%H%M%S).json"
 
       - name: Run Nightly Test Analysis
         env:
@@ -53,7 +53,7 @@ jobs:
           PYTHONIOENCODING: utf-8
         run: |
           cd scripts/ci_monitor
-          python ci_analyzer.py --token $GITHUB_TOKEN --mode nightly --days 2 --output nightly_analysis_$(date +%Y%m%d_%H%M%S).json
+          python ci_analyzer.py --token "$GITHUB_TOKEN" --mode nightly --days 2 --output "nightly_analysis_$(date +%Y%m%d_%H%M%S).json"
 
       - name: Run Performance Analysis
         env:
@@ -62,7 +62,7 @@ jobs:
           PYTHONIOENCODING: utf-8
         run: |
           cd scripts/ci_monitor
-          python ci_analyzer_perf.py --token $GITHUB_TOKEN --limit ${{ inputs.limit || '1000' }} --output-dir performance_tables_$(date +%Y%m%d_%H%M%S) --upload-to-github
+          python ci_analyzer_perf.py --token "$GITHUB_TOKEN" --limit "${{ inputs.limit || '1000' }}" --output-dir "performance_tables_$(date +%Y%m%d_%H%M%S)" --upload-to-github
 
       - name: Upload Analysis Results
         uses: actions/upload-artifact@v4
@@ -99,7 +99,7 @@ jobs:
           PYTHONIOENCODING: utf-8
         run: |
           cd scripts/ci_monitor
-          python ci_analyzer_balance.py --token $GITHUB_TOKEN --limit ${{ inputs.limit || '1000' }} --output test_balance_report_$(date +%Y%m%d_%H%M%S).json
+          python ci_analyzer_balance.py --token "$GITHUB_TOKEN" --limit "${{ inputs.limit || '1000' }}" --output "test_balance_report_$(date +%Y%m%d_%H%M%S).json"
 
       - name: Upload Balance Analysis Results
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/close-inactive-issues.yml b/.github/workflows/close-inactive-issues.yml
index 048e6c443c81..56892f0669dc 100644
--- a/.github/workflows/close-inactive-issues.yml
+++ b/.github/workflows/close-inactive-issues.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check and close inactive issues
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 565984700c13..f1fb5b7da8fd 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: "3.10"
 
diff --git a/.github/workflows/nightly-release-gateway.yml b/.github/workflows/nightly-release-gateway.yml
index 7b5226bab32a..7893e255827a 100644
--- a/.github/workflows/nightly-release-gateway.yml
+++ b/.github/workflows/nightly-release-gateway.yml
@@ -75,7 +75,7 @@ jobs:
           sed -i.bak "s/version = \"${CURRENT_VERSION}\"/version = \"${NIGHTLY_VERSION}\"/" bindings/python/pyproject.toml
 
           # Verify the change
-          cat bindings/python/pyproject.toml | grep "^version"
+          grep "^version" < bindings/python/pyproject.toml
         shell: bash
 
       - name: Install twine and tomli
@@ -161,7 +161,7 @@ jobs:
           sed -i "s/version = \"${CURRENT_VERSION}\"/version = \"${NIGHTLY_VERSION}\"/" bindings/python/pyproject.toml
 
           # Verify the change
-          cat bindings/python/pyproject.toml | grep "^version"
+          grep "^version" < bindings/python/pyproject.toml
 
       - name: Build SDist
         uses: PyO3/maturin-action@v1
diff --git a/.github/workflows/nightly-test-amd.yml b/.github/workflows/nightly-test-amd.yml
index 932aafe8ceeb..70d43989830d 100644
--- a/.github/workflows/nightly-test-amd.yml
+++ b/.github/workflows/nightly-test-amd.yml
@@ -38,7 +38,7 @@ jobs:
       - name: Nightly Test
         run: |
           bash scripts/ci/amd_ci_exec.sh -e GITHUB_STEP_SUMMARY="/sglang-checkout/github_summary.md" python3 run_suite.py --suite nightly-amd --timeout-per-file 7200
-          echo "$(<github_summary.md )" >> $GITHUB_STEP_SUMMARY
+          echo "$(<github_summary.md )" >> "$GITHUB_STEP_SUMMARY"
 
   check-all-jobs:
     if: always() && (github.repository == 'sgl-project/sglang' || github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch')
diff --git a/.github/workflows/nightly-test-nvidia.yml b/.github/workflows/nightly-test-nvidia.yml
index 0e9e0c937d8e..10c68e9921ba 100644
--- a/.github/workflows/nightly-test-nvidia.yml
+++ b/.github/workflows/nightly-test-nvidia.yml
@@ -9,6 +9,12 @@ on:
     paths:
       - "python/sglang/version.py"
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout (branch, tag, or SHA)'
+        required: false
+        type: string
 
 concurrency:
   group: nightly-test-nvidia-${{ github.ref }}
@@ -22,6 +28,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install dependencies
         run: |
@@ -40,6 +48,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install dependencies
         run: |
@@ -60,6 +70,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install dependencies
         run: |
@@ -158,6 +170,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install dependencies
         run: |
@@ -178,6 +192,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install dependencies
         run: |
@@ -196,6 +212,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install dependencies
         run: |
@@ -227,6 +245,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install dependencies
         run: |
@@ -245,6 +265,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install dependencies
         run: |
@@ -281,6 +303,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install dependencies
         run: |
@@ -312,6 +336,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install dependencies
         run: |
@@ -338,6 +364,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install dependencies
         run: |
@@ -358,6 +386,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install dependencies
         run: |
diff --git a/.github/workflows/pr-gate.yml b/.github/workflows/pr-gate.yml
index cffc8f5da3c5..c8100c41e3fc 100644
--- a/.github/workflows/pr-gate.yml
+++ b/.github/workflows/pr-gate.yml
@@ -53,7 +53,7 @@ jobs:
       - name: Require run-ci label (optional)
         if:  github.event_name == 'pull_request' && inputs.require-run-ci == true
         run: |
-          labels='${{ steps.pr.outputs.labels }}'
+          _labels='${{ steps.pr.outputs.labels }}'
           if [[ "${{ contains(fromJson(steps.pr.outputs.labels), 'run-ci') }}" == "false" ]]; then
             echo "Missing required label 'run-ci'."
             exit 1
diff --git a/.github/workflows/pr-test-pd-router.yml b/.github/workflows/pr-test-pd-router.yml
index f622f3bc2d7d..e5308ff9f05d 100644
--- a/.github/workflows/pr-test-pd-router.yml
+++ b/.github/workflows/pr-test-pd-router.yml
@@ -37,7 +37,7 @@ jobs:
         fetch-depth: 10
 
     - name: Setup Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: '3.12'
 
@@ -71,7 +71,7 @@ jobs:
         echo "=== System Validation ==="
         nvidia-smi
         echo "GPU count: $(nvidia-smi -L | wc -l)"
-        if [ $(nvidia-smi -L | wc -l) -lt 8 ]; then
+        if [ "$(nvidia-smi -L | wc -l)" -lt 8 ]; then
           echo "Error: This test requires at least 8 GPUs"
           exit 1
         fi
@@ -108,8 +108,8 @@ jobs:
         # Check for active IB devices
         found_active_device=false
         for device in mlx5_{0..11}; do
-            if ibv_devinfo $device >/dev/null 2>&1; then
-                state=$(ibv_devinfo $device | grep "state:" | head -1 | awk '{print $2}')
+            if ibv_devinfo "$device" >/dev/null 2>&1; then
+                state=$(ibv_devinfo "$device" | grep "state:" | head -1 | awk '{print $2}')
                 if [[ "$state" == "PORT_ACTIVE" ]]; then
                     echo "✓ Found active device: $device"
                     found_active_device=true
@@ -159,7 +159,7 @@ jobs:
         rm -f "$READY_FILE"
         DISAGG_READY_FILE="$READY_FILE" bash scripts/ci/ci_start_disaggregation_servers.sh &
         SERVER_PID=$!
-        echo "server_pid=$SERVER_PID" >> $GITHUB_OUTPUT
+        echo "server_pid=$SERVER_PID" >> "$GITHUB_OUTPUT"
 
         # Wait until script signals readiness (8/8 healthy) or timeout
         TIMEOUT=300
@@ -312,7 +312,7 @@ jobs:
 
           if [ -n "$actual_folder" ]; then
             # Extract metrics from the Excel summary or JSON files
-            summary_file="$actual_folder"/*_summary.xlsx
+            _summary_file=("$actual_folder"/*_summary.xlsx)
             json_files=$(find "$actual_folder" -name "*.json" | grep -v experiment_metadata)
 
             echo "Genai-bench results saved in: $actual_folder"
@@ -398,8 +398,8 @@ jobs:
           kill $ROUTER_PID 2>/dev/null || true
 
           # Wait up to 5 seconds for graceful shutdown
-          for i in {1..5}; do
-            if ! ps -p $ROUTER_PID > /dev/null 2>&1; then
+          for _i in {1..5}; do
+            if ! ps -p "$ROUTER_PID" > /dev/null 2>&1; then
               echo "Router stopped gracefully"
               break
             fi
@@ -407,9 +407,9 @@ jobs:
           done
 
           # Force kill if still running
-          if ps -p $ROUTER_PID > /dev/null 2>&1; then
+          if ps -p "$ROUTER_PID" > /dev/null 2>&1; then
             echo "Force killing router..."
-            kill -9 $ROUTER_PID 2>/dev/null || true
+            kill -9 "$ROUTER_PID" 2>/dev/null || true
           fi
 
           # Short delay to ensure port is released
@@ -438,7 +438,7 @@ jobs:
         fi
         pkill -f "sglang.launch_server" || true
         sleep 5
-        remaining=$(ps aux | grep -c "sglang.launch_server" || echo "0")
+        remaining=$(pgrep -c -f "sglang.launch_server" || echo "0")
         echo "Cleanup completed. Remaining processes: $remaining"
 
   summarize-benchmarks:
@@ -470,12 +470,14 @@ jobs:
         find . -name "benchmark_*" -type d
         echo "=========================================="
 
-        echo "## PD Router Genai-Bench Results Summary" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "🚀 **Benchmarked with genai-bench for comprehensive LLM serving performance evaluation**" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "| Policy | Status | TTFT (s) | E2E Latency (s) | Input Throughput (tok/s) | Output Throughput (tok/s) |" >> $GITHUB_STEP_SUMMARY
-        echo "|--------|--------|----------|-----------------|--------------------------|---------------------------|" >> $GITHUB_STEP_SUMMARY
+        {
+          echo "## PD Router Genai-Bench Results Summary"
+          echo ""
+          echo "🚀 **Benchmarked with genai-bench for comprehensive LLM serving performance evaluation**"
+          echo ""
+          echo "| Policy | Status | TTFT (s) | E2E Latency (s) | Input Throughput (tok/s) | Output Throughput (tok/s) |"
+          echo "|--------|--------|----------|-----------------|--------------------------|---------------------------|"
+        } >> "$GITHUB_STEP_SUMMARY"
 
         # First, complete the table with all policies
         for policy in random round_robin cache_aware power_of_two; do
@@ -524,21 +526,23 @@ jobs:
                 output_display="N/A"
               fi
 
-              echo "| ${policy} | ✅ Success | $ttft_display | $e2e_display | $input_display | $output_display |" >> $GITHUB_STEP_SUMMARY
+              echo "| ${policy} | ✅ Success | $ttft_display | $e2e_display | $input_display | $output_display |" >> "$GITHUB_STEP_SUMMARY"
             else
-              echo "| ${policy} | ❌ No Data | N/A | N/A | N/A | N/A |" >> $GITHUB_STEP_SUMMARY
+              echo "| ${policy} | ❌ No Data | N/A | N/A | N/A | N/A |" >> "$GITHUB_STEP_SUMMARY"
             fi
           else
-            echo "| ${policy} | ❌ Failed | N/A | N/A | N/A | N/A |" >> $GITHUB_STEP_SUMMARY
+            echo "| ${policy} | ❌ Failed | N/A | N/A | N/A | N/A |" >> "$GITHUB_STEP_SUMMARY"
           fi
         done
 
         # Add performance validation summary
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "## 📊 Performance Validation" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "**Thresholds:** TTFT ≤ 2.0s | E2E Latency ≤ 8.0s | Input Throughput ≥ 10,000 tok/s | Output Throughput ≥ 100 tok/s" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
+        {
+          echo ""
+          echo "## 📊 Performance Validation"
+          echo ""
+          echo "**Thresholds:** TTFT ≤ 2.0s | E2E Latency ≤ 8.0s | Input Throughput ≥ 10,000 tok/s | Output Throughput ≥ 100 tok/s"
+          echo ""
+        } >> "$GITHUB_STEP_SUMMARY"
 
         validation_summary=""
         for policy in random round_robin cache_aware power_of_two; do
@@ -589,14 +593,16 @@ jobs:
           fi
         done
 
-        echo -e "$validation_summary" >> $GITHUB_STEP_SUMMARY
-
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "## 📊 Genai-Bench Features Used" >> $GITHUB_STEP_SUMMARY
-        echo "- **Token-level Performance**: TTFT, TPOT, End-to-End latency" >> $GITHUB_STEP_SUMMARY
-        echo "- **Throughput Analysis**: Input/Output/Total token throughput" >> $GITHUB_STEP_SUMMARY
-        echo "- **Statistical Analysis**: Percentiles, mean, std dev for all metrics" >> $GITHUB_STEP_SUMMARY
-        echo "- **Visual Reports**: Automated plots and Excel summaries" >> $GITHUB_STEP_SUMMARY
-        echo "- **SGLang Backend**: Native integration with SGLang serving" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "✅ All policies tested successfully with genai-bench!" >> $GITHUB_STEP_SUMMARY
+        echo -e "$validation_summary" >> "$GITHUB_STEP_SUMMARY"
+
+        {
+          echo ""
+          echo "## 📊 Genai-Bench Features Used"
+          echo "- **Token-level Performance**: TTFT, TPOT, End-to-End latency"
+          echo "- **Throughput Analysis**: Input/Output/Total token throughput"
+          echo "- **Statistical Analysis**: Percentiles, mean, std dev for all metrics"
+          echo "- **Visual Reports**: Automated plots and Excel summaries"
+          echo "- **SGLang Backend**: Native integration with SGLang serving"
+          echo ""
+          echo "✅ All policies tested successfully with genai-bench!"
+        } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/pr-test-rust.yml b/.github/workflows/pr-test-rust.yml
index 375f9b2f21f8..42ffb0f1c2a3 100644
--- a/.github/workflows/pr-test-rust.yml
+++ b/.github/workflows/pr-test-rust.yml
@@ -241,13 +241,13 @@ jobs:
             mkdir -p "$INSTANT_CLIENT_DIR"
             cd "$INSTANT_CLIENT_DIR"
             wget https://download.oracle.com/otn_software/linux/instantclient/2390000/$INSTANT_CLIENT_ZIP
-            unzip $INSTANT_CLIENT_ZIP
-            rm $INSTANT_CLIENT_ZIP
+            unzip "$INSTANT_CLIENT_ZIP"
+            rm "$INSTANT_CLIENT_ZIP"
           else
             echo "Oracle Instant Client already exists, skipping download"
           fi
 
-          echo "LD_LIBRARY_PATH=/home/ubuntu/instant-client/instantclient_23_9:\$LD_LIBRARY_PATH" >> $GITHUB_ENV
+          echo "LD_LIBRARY_PATH=/home/ubuntu/instant-client/instantclient_23_9:\$LD_LIBRARY_PATH" >> "$GITHUB_ENV"
 
       - name: Start Oracle Database
         run: |
@@ -255,9 +255,11 @@ jobs:
           echo "Starting Oracle DB..."
 
           # Export Oracle connection environment variables
-          echo "ATP_USER=system" >> $GITHUB_ENV
-          echo "ATP_PASSWORD=oracle" >> $GITHUB_ENV
-          echo "ATP_DSN=localhost:1521/XEPDB1" >> $GITHUB_ENV
+          {
+            echo "ATP_USER=system"
+            echo "ATP_PASSWORD=oracle"
+            echo "ATP_DSN=localhost:1521/XEPDB1"
+          } >> "$GITHUB_ENV"
 
       - name: Start Brave MCP Server
         run: |
@@ -343,12 +345,14 @@ jobs:
         find . -name "benchmark_*" -type d || true
         echo "=========================================="
 
-        echo "## Router E2E Genai-Bench Results Summary" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "Results captured from E2E tests for two scenarios: regular router (2 workers, dp=2) and PD router (2 prefill + 2 decode)." >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "| Scenario | Status | TTFT (s) | E2E Latency (s) | Input Throughput (tok/s) | Output Throughput (tok/s) |" >> $GITHUB_STEP_SUMMARY
-        echo "|----------|--------|----------|-----------------|--------------------------|---------------------------|" >> $GITHUB_STEP_SUMMARY
+        {
+          echo "## Router E2E Genai-Bench Results Summary"
+          echo ""
+          echo "Results captured from E2E tests for two scenarios: regular router (2 workers, dp=2) and PD router (2 prefill + 2 decode)."
+          echo ""
+          echo "| Scenario | Status | TTFT (s) | E2E Latency (s) | Input Throughput (tok/s) | Output Throughput (tok/s) |"
+          echo "|----------|--------|----------|-----------------|--------------------------|---------------------------|"
+        } >> "$GITHUB_STEP_SUMMARY"
 
         scenarios=$'Regular (dp=2, round_robin)|benchmark_round_robin_regular\nPD (2 prefill + 2 decode, round_robin)|benchmark_round_robin_pd'
 
@@ -371,16 +375,18 @@ jobs:
               input_display=$(printf "%.0f" "$input_throughput_mean" 2>/dev/null || echo "$input_throughput_mean")
               output_display=$(printf "%.0f" "$output_throughput_mean" 2>/dev/null || echo "$output_throughput_mean")
 
-              echo "| ${label} | ✅ Success | $ttft_display | $e2e_display | $input_display | $output_display |" >> $GITHUB_STEP_SUMMARY
+              echo "| ${label} | ✅ Success | $ttft_display | $e2e_display | $input_display | $output_display |" >> "$GITHUB_STEP_SUMMARY"
 
               # Optional GPU utilization table if monitor output exists
               gpu_json="$result_folder/gpu_utilization.json"
               if [ -f "$gpu_json" ]; then
                 overall_mean=$(jq -r '.overall.mean // 0' "$gpu_json")
-                printf "\n#### GPU Utilization — %s\n\n" "$label" >> $GITHUB_STEP_SUMMARY
-                printf "Overall mean: %.2f%%\n\n" "$overall_mean" >> $GITHUB_STEP_SUMMARY
-                echo "| GPU | Mean (%) | p5 | p10 | p25 | p50 | p75 | p90 | p95 |" >> $GITHUB_STEP_SUMMARY
-                echo "|-----|----------|----|-----|-----|-----|-----|-----|-----|" >> $GITHUB_STEP_SUMMARY
+                {
+                  printf "\n#### GPU Utilization — %s\n\n" "$label"
+                  printf "Overall mean: %.2f%%\n\n" "$overall_mean"
+                  echo "| GPU | Mean (%) | p5 | p10 | p25 | p50 | p75 | p90 | p95 |"
+                  echo "|-----|----------|----|-----|-----|-----|-----|-----|-----|"
+                } >> "$GITHUB_STEP_SUMMARY"
                 jq -r '
                   .per_gpu
                   | to_entries[]
@@ -396,9 +402,9 @@ jobs:
                     ]
                   | @tsv' "$gpu_json" \
                   | while IFS=$'\t' read -r gpu m p5 p10 p25 p50 p75 p90 p95; do
-                      printf "| %s | %.2f | %.2f | %.2f | %.2f | %.2f | %.2f | %.2f | %.2f |\n" "$gpu" "$m" "$p5" "$p10" "$p25" "$p50" "$p75" "$p90" "$p95" >> $GITHUB_STEP_SUMMARY
+                      printf "| %s | %.2f | %.2f | %.2f | %.2f | %.2f | %.2f | %.2f | %.2f |\n" "$gpu" "$m" "$p5" "$p10" "$p25" "$p50" "$p75" "$p90" "$p95" >> "$GITHUB_STEP_SUMMARY"
                     done
-                echo "" >> $GITHUB_STEP_SUMMARY
+                echo "" >> "$GITHUB_STEP_SUMMARY"
               fi
             fi
           fi
diff --git a/.github/workflows/pr-test-xeon.yml b/.github/workflows/pr-test-xeon.yml
index aed9fb32fe51..16283ee785b9 100644
--- a/.github/workflows/pr-test-xeon.yml
+++ b/.github/workflows/pr-test-xeon.yml
@@ -54,22 +54,23 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Build and Push
+        env:
+          PR_REPO: ${{ github.event.pull_request.head.repo.clone_url }}
+          PR_HEAD_REF: ${{ github.head_ref }}
         run: |
-          version=$(cat python/sglang/version.py | cut -d'"' -f2)
-          tag=v${version}-xeon
-          PR_REPO=${{ github.event.pull_request.head.repo.clone_url }}
-          PR_HEAD_REF=${{ github.head_ref }}
+          _version=$(cut -d'"' -f2 < python/sglang/version.py)
+          _tag=v${_version}-xeon
 
           docker build \
-            ${PR_REPO:+--build-arg SGLANG_REPO=$PR_REPO} \
-            ${PR_HEAD_REF:+--build-arg VER_SGLANG=$PR_HEAD_REF} \
+            ${PR_REPO:+--build-arg SGLANG_REPO="$PR_REPO"} \
+            ${PR_HEAD_REF:+--build-arg VER_SGLANG="$PR_HEAD_REF"} \
             . -f docker/xeon.Dockerfile  -t sglang_xeon --no-cache
 
       - name: Run container
         run: |
           docker run -dt \
-            -v ${{ github.workspace }}:/sglang-checkout/ --ipc=host \
-            -v ${HF_HOME}:/root/.cache/huggingface \
+            -v "${{ github.workspace }}":/sglang-checkout/ --ipc=host \
+            -v "${HF_HOME}":/root/.cache/huggingface \
             --name ci_sglang_xeon \
             sglang_xeon
 
diff --git a/.github/workflows/pr-test-xpu.yml b/.github/workflows/pr-test-xpu.yml
index ece9ebe96b8e..8add97a3722e 100644
--- a/.github/workflows/pr-test-xpu.yml
+++ b/.github/workflows/pr-test-xpu.yml
@@ -57,9 +57,10 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Build Docker image
+        env:
+          PR_REPO: ${{ github.event.pull_request.head.repo.clone_url }}
+          PR_HEAD_REF: ${{ github.head_ref }}
         run: |
-          PR_REPO=${{ github.event.pull_request.head.repo.clone_url }}
-          PR_HEAD_REF=${{ github.head_ref }}
           docker build \
             ${PR_REPO:+--build-arg SG_LANG_REPO=$PR_REPO} \
             ${PR_HEAD_REF:+--build-arg SG_LANG_BRANCH=$PR_HEAD_REF} \
@@ -70,8 +71,8 @@ jobs:
         run: |
           container_id=$(docker run -dt \
             --group-add 992 \
-            --group-add $(getent group video | cut -d: -f3) \
-            -v ${HF_HOME}:/root/.cache/huggingface \
+            --group-add "$(getent group video | cut -d: -f3)" \
+            -v "${HF_HOME}":/root/.cache/huggingface \
             --device /dev/dri \
             -e HF_TOKEN="$(cat ~/huggingface_token.txt)" \
             xpu_sglang_main:bmg)
diff --git a/.github/workflows/pr-test.yml b/.github/workflows/pr-test.yml
index d5bb879db619..eca5c865a0f4 100644
--- a/.github/workflows/pr-test.yml
+++ b/.github/workflows/pr-test.yml
@@ -65,7 +65,7 @@ jobs:
             echo "| main_package   | ${{ steps.filter.outputs.main_package }} |"
             echo "| sgl_kernel     | ${{ steps.filter.outputs.sgl_kernel }} |"
             echo "| multimodal_gen | ${{ steps.filter.outputs.multimodal_gen }} |"
-          } >> $GITHUB_STEP_SUMMARY
+          } >> "$GITHUB_STEP_SUMMARY"
 
   # =============================================== sgl-kernel ====================================================
 
@@ -85,7 +85,7 @@ jobs:
     steps:
       - name: Cleanup
         run: |
-          sudo rm -rf $GITHUB_WORKSPACE/* || true
+          sudo rm -rf "$GITHUB_WORKSPACE"/* || true
 
       - uses: actions/checkout@v4
         with:
diff --git a/.github/workflows/release-docker-amd-nightly.yml b/.github/workflows/release-docker-amd-nightly.yml
index 47508ac2e8d5..c7bcff888f73 100644
--- a/.github/workflows/release-docker-amd-nightly.yml
+++ b/.github/workflows/release-docker-amd-nightly.yml
@@ -28,17 +28,17 @@ jobs:
 
       - name: "Set Date"
         run: |
-          echo "DATE=$(date +%Y%m%d)" >> $GITHUB_ENV
+          echo "DATE=$(date +%Y%m%d)" >> "$GITHUB_ENV"
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_AMD_USERNAME }}
           password: ${{ secrets.DOCKERHUB_AMD_TOKEN }}
 
       - name: Build and Push
         run: |
-          version=$(cat python/sglang/version.py | cut -d'"' -f2)
+          version=$(cut -d'"' -f2 < python/sglang/version.py)
           echo "Version: ${version}"
 
           if [ "${{ matrix.gpu_arch }}" = "gfx942" ]; then
@@ -54,8 +54,8 @@ jobs:
 
           tag=v${version}-${rocm_tag}
 
-          docker build . -f docker/rocm.Dockerfile --build-arg BUILD_TYPE=${{ matrix.build_type }} --build-arg GPU_ARCH=${{ matrix.gpu_arch }} -t rocm/sgl-dev:${tag}-${{ env.DATE }} --no-cache
-          docker push rocm/sgl-dev:${tag}-${{ env.DATE }}
+          docker build . -f docker/rocm.Dockerfile --build-arg BUILD_TYPE="${{ matrix.build_type }}" --build-arg GPU_ARCH="${{ matrix.gpu_arch }}" -t rocm/sgl-dev:"${tag}-${{ env.DATE }}" --no-cache
+          docker push rocm/sgl-dev:"${tag}-${{ env.DATE }}"
 
   cache:
     if: always() && github.repository == 'sgl-project/sglang'
@@ -73,10 +73,10 @@ jobs:
 
       - name: "Set Date"
         run: |
-          echo "DATE=$(date +%Y%m%d)" >> $GITHUB_ENV
+          echo "DATE=$(date +%Y%m%d)" >> "$GITHUB_ENV"
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_AMD_USERNAME }}
           password: ${{ secrets.DOCKERHUB_AMD_TOKEN }}
@@ -85,7 +85,7 @@ jobs:
         run: |
           set -euxo pipefail
 
-          version=$(cat python/sglang/version.py | cut -d'"' -f2)
+          version=$(cut -d'"' -f2 < python/sglang/version.py)
           echo "Version: ${version}"
 
           if [ "${{ matrix.gpu_arch }}" = "gfx942" ]; then
diff --git a/.github/workflows/release-docker-amd.yml b/.github/workflows/release-docker-amd.yml
index 8b4fae51f7ee..bd26172534ac 100644
--- a/.github/workflows/release-docker-amd.yml
+++ b/.github/workflows/release-docker-amd.yml
@@ -21,14 +21,14 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and Push
         run: |
-          version=$(cat python/sglang/version.py | cut -d'"' -f2)
+          version=$(cut -d'"' -f2 < python/sglang/version.py)
           echo "Version: ${version}"
 
           if [ "${{ matrix.gpu_arch }}" = "gfx942" ]; then
@@ -44,5 +44,5 @@ jobs:
 
           tag=v${version}-${rocm_tag}
 
-          docker build . -f docker/rocm.Dockerfile --build-arg BUILD_TYPE=${{ matrix.build_type }} --build-arg GPU_ARCH=${{ matrix.gpu_arch }} -t lmsysorg/sglang:${tag} --no-cache
-          docker push lmsysorg/sglang:${tag}
+          docker build . -f docker/rocm.Dockerfile --build-arg BUILD_TYPE="${{ matrix.build_type }}" --build-arg GPU_ARCH="${{ matrix.gpu_arch }}" -t lmsysorg/sglang:"${tag}" --no-cache
+          docker push lmsysorg/sglang:"${tag}"
diff --git a/.github/workflows/release-docker-cu13.yml b/.github/workflows/release-docker-cu13.yml
index 32763cb7a781..185a63fe9c37 100644
--- a/.github/workflows/release-docker-cu13.yml
+++ b/.github/workflows/release-docker-cu13.yml
@@ -45,7 +45,7 @@ jobs:
               uses: docker/setup-buildx-action@v3
 
             - name: Login to Docker Hub
-              uses: docker/login-action@v2
+              uses: docker/login-action@v3
               with:
                   username: ${{ secrets.DOCKERHUB_USERNAME }}
                   password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -53,15 +53,15 @@ jobs:
             - name: Build and Push Dev Image
               run: |
                   docker buildx build \
-                    --platform ${{ matrix.platform }} \
+                    --platform "${{ matrix.platform }}" \
                     --push \
                     -f docker/Dockerfile \
-                    --build-arg CUDA_VERSION=${{ matrix.version }} \
-                    --build-arg BUILD_TYPE=${{ matrix.build_type }} \
-                    --build-arg CMAKE_BUILD_PARALLEL_LEVEL=$(nproc) \
-                    --build-arg GRACE_BLACKWELL=${{ matrix.grace_blackwell }} \
+                    --build-arg CUDA_VERSION="${{ matrix.version }}" \
+                    --build-arg BUILD_TYPE="${{ matrix.build_type }}" \
+                    --build-arg CMAKE_BUILD_PARALLEL_LEVEL="$(nproc)" \
+                    --build-arg GRACE_BLACKWELL="${{ matrix.grace_blackwell }}" \
                     --build-arg USE_LATEST_SGLANG=1 \
-                    -t lmsysorg/sglang:${{ matrix.tag }} \
+                    -t lmsysorg/sglang:"${{ matrix.tag }}" \
                     --no-cache \
                     .
 
@@ -78,16 +78,16 @@ jobs:
         steps:
             - uses: docker/setup-buildx-action@v3
 
-            - uses: docker/login-action@v2
+            - uses: docker/login-action@v3
               with:
                   username: ${{ secrets.DOCKERHUB_USERNAME }}
                   password: ${{ secrets.DOCKERHUB_TOKEN }}
             - run: |
                   docker buildx imagetools create \
-                    -t lmsysorg/sglang:${{ matrix.variant.tag }} \
-                    -t lmsysorg/sglang:nightly-${{ matrix.variant.tag }}-$(date +%Y%m%d)-${GITHUB_SHA:0:8} \
-                    lmsysorg/sglang:${{ matrix.variant.x86_tag }} \
-                    lmsysorg/sglang:${{ matrix.variant.arm64_tag }}
+                    -t lmsysorg/sglang:"${{ matrix.variant.tag }}" \
+                    -t lmsysorg/sglang:"nightly-${{ matrix.variant.tag }}-$(date +%Y%m%d)-${GITHUB_SHA:0:8}" \
+                    lmsysorg/sglang:"${{ matrix.variant.x86_tag }}" \
+                    lmsysorg/sglang:"${{ matrix.variant.arm64_tag }}"
 
             - name: Cleanup Old Nightly Builds
               run: |
diff --git a/.github/workflows/release-docker-dev.yml b/.github/workflows/release-docker-dev.yml
index dfe346b23f87..73fefc3b92ab 100644
--- a/.github/workflows/release-docker-dev.yml
+++ b/.github/workflows/release-docker-dev.yml
@@ -46,7 +46,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -54,16 +54,16 @@ jobs:
       - name: Build and Push Dev Image
         run: |
           docker buildx build \
-            --platform ${{ matrix.platform }} \
+            --platform "${{ matrix.platform }}" \
             --push \
             -f docker/Dockerfile \
-            --build-arg CUDA_VERSION=${{ matrix.version }} \
-            --build-arg BUILD_TYPE=${{ matrix.build_type }} \
-            --build-arg CMAKE_BUILD_PARALLEL_LEVEL=$(nproc) \
-            --build-arg GRACE_BLACKWELL=${{ matrix.grace_blackwell }} \
+            --build-arg CUDA_VERSION="${{ matrix.version }}" \
+            --build-arg BUILD_TYPE="${{ matrix.build_type }}" \
+            --build-arg CMAKE_BUILD_PARALLEL_LEVEL="$(nproc)" \
+            --build-arg GRACE_BLACKWELL="${{ matrix.grace_blackwell }}" \
             --build-arg USE_LATEST_SGLANG=1 \
             --build-arg INSTALL_FLASHINFER_JIT_CACHE=1 \
-            -t lmsysorg/sglang:${{ matrix.tag }} \
+            -t lmsysorg/sglang:"${{ matrix.tag }}" \
             --no-cache \
             .
 
@@ -80,17 +80,17 @@ jobs:
     steps:
       - uses: docker/setup-buildx-action@v3
 
-      - uses: docker/login-action@v2
+      - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - run: |
           SHORT_SHA="${{ github.sha }}"
           docker buildx imagetools create \
-            -t lmsysorg/sglang:${{ matrix.variant.tag }} \
-            -t lmsysorg/sglang:nightly-${{ matrix.variant.tag }}-$(date +%Y%m%d)-${SHORT_SHA:0:8} \
-            lmsysorg/sglang:${{ matrix.variant.x86_tag }} \
-            lmsysorg/sglang:${{ matrix.variant.arm64_tag }}
+            -t lmsysorg/sglang:"${{ matrix.variant.tag }}" \
+            -t lmsysorg/sglang:"nightly-${{ matrix.variant.tag }}-$(date +%Y%m%d)-${SHORT_SHA:0:8}" \
+            lmsysorg/sglang:"${{ matrix.variant.x86_tag }}" \
+            lmsysorg/sglang:"${{ matrix.variant.arm64_tag }}"
 
       - name: Cleanup Old Nightly Builds
         run: |
diff --git a/.github/workflows/release-docker-gateway.yml b/.github/workflows/release-docker-gateway.yml
index d1061333ab10..42a1ec63c2c5 100644
--- a/.github/workflows/release-docker-gateway.yml
+++ b/.github/workflows/release-docker-gateway.yml
@@ -16,15 +16,15 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and Push
         run: |
-          version=$(cat sgl-router/bindings/python/sglang_router/version.py | cut -d'"' -f2)
+          version=$(cut -d'"' -f2 < sgl-router/bindings/python/sglang_router/version.py)
           tag=v${version}
 
-          docker build . -f docker/gateway.Dockerfile -t lmsysorg/sglang-router:${tag} --no-cache
-          docker push lmsysorg/sglang-router:${tag}
+          docker build . -f docker/gateway.Dockerfile -t lmsysorg/sglang-router:"${tag}" --no-cache
+          docker push lmsysorg/sglang-router:"${tag}"
diff --git a/.github/workflows/release-docker-npu.yml b/.github/workflows/release-docker-npu.yml
index 2b2506a28c63..40aa90749910 100644
--- a/.github/workflows/release-docker-npu.yml
+++ b/.github/workflows/release-docker-npu.yml
@@ -1,16 +1,16 @@
 name: Release Docker Images (NPU)
 on:
   push:
-    tags-ignore:
-      - "gateway-*" # Exclude gateway/router tags
-      - "router-*" # Exclude router tags
+    tags:
+      - "*" # Trigger on all tags and filterred by pep440 later
+      - "!gateway-*" # Exclude gateway/router tags
+      - "!router-*" # Exclude router tags
   pull_request:
     branches:
       - main
     paths:
       - ".github/workflows/release-docker-npu.yml"
       - "docker/npu.Dockerfile"
-  workflow_dispatch:
 
 jobs:
   build:
@@ -45,7 +45,7 @@ jobs:
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         if: ${{ github.repository == 'sgl-project/sglang' && github.event_name != 'pull_request' }}
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -54,8 +54,8 @@ jobs:
       - name: Get version
         id: get_version
         run: |
-          version=$(cat python/sglang/version.py | cut -d'"' -f2)
-          echo "TAG=lmsysorg/sglang:v$version-cann${{ matrix.cann_version }}-${{ matrix.device_type }}" >> $GITHUB_OUTPUT
+          version=$(cut -d'"' -f2 < python/sglang/version.py)
+          echo "TAG=lmsysorg/sglang:v$version-cann${{ matrix.cann_version }}-${{ matrix.device_type }}" >> "$GITHUB_OUTPUT"
 
       - name: Build and push Docker image
         id: build-and-push
diff --git a/.github/workflows/release-docker-xeon.yml b/.github/workflows/release-docker-xeon.yml
index 60e249335f5c..fe3be97c65a7 100644
--- a/.github/workflows/release-docker-xeon.yml
+++ b/.github/workflows/release-docker-xeon.yml
@@ -21,15 +21,15 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and Push
         run: |
-          version=$(cat python/sglang/version.py | cut -d'"' -f2)
+          version=$(cut -d'"' -f2 < python/sglang/version.py)
           tag=v${version}-xeon
 
-          docker build . -f docker/xeon.Dockerfile  -t lmsysorg/sglang:${tag} --no-cache
-          docker push lmsysorg/sglang:${tag}
+          docker build . -f docker/xeon.Dockerfile  -t lmsysorg/sglang:"${tag}" --no-cache
+          docker push lmsysorg/sglang:"${tag}"
diff --git a/.github/workflows/release-docker.yml b/.github/workflows/release-docker.yml
index 596033854e7c..d10f2fbed3d9 100644
--- a/.github/workflows/release-docker.yml
+++ b/.github/workflows/release-docker.yml
@@ -40,24 +40,24 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and Push AMD64
         run: |
-          version=$(cat python/sglang/version.py | cut -d'"' -f2)
+          version=$(cut -d'"' -f2 < python/sglang/version.py)
           tag=v${version}-cu129-amd64
 
           docker buildx build \
             --platform linux/amd64 \
             --push \
             -f docker/Dockerfile \
-            --build-arg CUDA_VERSION=${{ matrix.variant.cuda_version }} \
-            --build-arg BUILD_TYPE=${{ matrix.variant.build_type }} \
-            --build-arg GRACE_BLACKWELL=${{ matrix.variant.grace_blackwell }} \
-            -t lmsysorg/sglang:${tag} \
+            --build-arg CUDA_VERSION="${{ matrix.variant.cuda_version }}" \
+            --build-arg BUILD_TYPE="${{ matrix.variant.build_type }}" \
+            --build-arg GRACE_BLACKWELL="${{ matrix.variant.grace_blackwell }}" \
+            -t lmsysorg/sglang:"${tag}" \
             --no-cache \
             .
 
@@ -82,24 +82,24 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and Push ARM64
         run: |
-          version=$(cat python/sglang/version.py | cut -d'"' -f2)
+          version=$(cut -d'"' -f2 < python/sglang/version.py)
           tag=v${version}-cu129-arm64
 
           docker buildx build \
             --platform linux/arm64 \
             --push \
             -f docker/Dockerfile \
-            --build-arg CUDA_VERSION=${{ matrix.variant.cuda_version }} \
-            --build-arg BUILD_TYPE=${{ matrix.variant.build_type }} \
-            --build-arg GRACE_BLACKWELL=${{ matrix.variant.grace_blackwell }} \
-            -t lmsysorg/sglang:${tag} \
+            --build-arg CUDA_VERSION="${{ matrix.variant.cuda_version }}" \
+            --build-arg BUILD_TYPE="${{ matrix.variant.build_type }}" \
+            --build-arg GRACE_BLACKWELL="${{ matrix.variant.grace_blackwell }}" \
+            -t lmsysorg/sglang:"${tag}" \
             --no-cache \
             .
 
@@ -116,23 +116,23 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Create multi-arch manifests
         run: |
-          version=$(cat python/sglang/version.py | cut -d'"' -f2)
+          version=$(cut -d'"' -f2 < python/sglang/version.py)
 
           # Create versioned manifest
           docker buildx imagetools create \
-            -t lmsysorg/sglang:v${version} \
-            lmsysorg/sglang:v${version}-cu129-amd64 \
-            lmsysorg/sglang:v${version}-cu129-arm64
+            -t lmsysorg/sglang:"v${version}" \
+            lmsysorg/sglang:"v${version}-cu129-amd64" \
+            lmsysorg/sglang:"v${version}-cu129-arm64"
 
           # Create latest manifest
           docker buildx imagetools create \
             -t lmsysorg/sglang:latest \
-            lmsysorg/sglang:v${version}-cu129-amd64 \
-            lmsysorg/sglang:v${version}-cu129-arm64
+            lmsysorg/sglang:"v${version}-cu129-amd64" \
+            lmsysorg/sglang:"v${version}-cu129-arm64"
diff --git a/.github/workflows/release-docs.yml b/.github/workflows/release-docs.yml
index 78fafc60bcad..21e012fbad41 100644
--- a/.github/workflows/release-docs.yml
+++ b/.github/workflows/release-docs.yml
@@ -51,15 +51,15 @@ jobs:
 
           cd _build/html
 
-          git clone https://$GITHUB_TOKEN@github.com/sgl-project/sgl-project.github.io.git ../sgl-project.github.io --depth 1
+          git clone https://"$GITHUB_TOKEN"@github.com/sgl-project/sgl-project.github.io.git ../sgl-project.github.io --depth 1
           find ../sgl-project.github.io/ -mindepth 1 -not -path "../sgl-project.github.io/.git*" -not -name CNAME -not -name ".jekyll" -not -name ".nojekyll" -delete
-          cp -r * ../sgl-project.github.io
+          cp -r ./* ../sgl-project.github.io
           cp ../../README.md ../sgl-project.github.io/README.md
           cd ../sgl-project.github.io
           git config user.name "sglang-bot"
           git config user.email "sglangbot@gmail.com"
           git add .
           git commit -m "Update $(date +'%Y-%m-%d %H:%M:%S')"
-          git push https://$GITHUB_TOKEN@github.com/sgl-project/sgl-project.github.io.git main
+          git push https://"$GITHUB_TOKEN"@github.com/sgl-project/sgl-project.github.io.git main
           cd ..
           rm -rf sgl-project.github.io
diff --git a/.github/workflows/release-fake-tag.yml b/.github/workflows/release-fake-tag.yml
index d1acc6bf44b0..1cc8af3178b0 100644
--- a/.github/workflows/release-fake-tag.yml
+++ b/.github/workflows/release-fake-tag.yml
@@ -24,8 +24,8 @@ jobs:
       - name: Get version
         id: get_version
         run: |
-          version=$(cat python/sglang/version.py | cut -d'"' -f2)
-          echo "TAG=v$version" >> $GITHUB_OUTPUT
+          version=$(cut -d'"' -f2 < python/sglang/version.py)
+          echo "TAG=v$version" >> "$GITHUB_OUTPUT"
 
       - name: Create and push tag
         run: |
diff --git a/.github/workflows/release-pypi.yml b/.github/workflows/release-pypi.yml
index 354ee21d1cde..65e240b42b09 100644
--- a/.github/workflows/release-pypi.yml
+++ b/.github/workflows/release-pypi.yml
@@ -14,7 +14,7 @@ jobs:
     environment: "prod"
     steps:
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: "3.10"
 
diff --git a/.github/workflows/release-whl-kernel.yml b/.github/workflows/release-whl-kernel.yml
index 4f0a33efb8b1..e1f12b05f274 100644
--- a/.github/workflows/release-whl-kernel.yml
+++ b/.github/workflows/release-whl-kernel.yml
@@ -77,10 +77,10 @@ jobs:
         id: set_tag_name
         run: |
           if [ -z "${{ inputs.tag_name }}" ]; then
-            TAG_NAME="v$(cat sgl-kernel/python/sgl_kernel/version.py | cut -d'"' -f2)"
-            echo "tag_name=$TAG_NAME" >> $GITHUB_OUTPUT
+            TAG_NAME="v$(cut -d'"' -f2 < sgl-kernel/python/sgl_kernel/version.py)"
+            echo "tag_name=$TAG_NAME" >> "$GITHUB_OUTPUT"
           else
-            echo "tag_name=${{ inputs.tag_name }}" >> $GITHUB_OUTPUT
+            echo "tag_name=${{ inputs.tag_name }}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Release
@@ -93,7 +93,7 @@ jobs:
             sgl-kernel/dist/*
 
       - name: Clone wheel index
-        run: git clone https://oauth2:${WHL_TOKEN}@github.com/sgl-project/whl.git sgl-whl
+        run: git clone https://oauth2:"${WHL_TOKEN}"@github.com/sgl-project/whl.git sgl-whl
         env:
           WHL_TOKEN: ${{ secrets.WHL_TOKEN }}
 
@@ -164,10 +164,10 @@ jobs:
         id: set_tag_name
         run: |
           if [ -z "${{ inputs.tag_name }}" ]; then
-            TAG_NAME="v$(cat sgl-kernel/python/sgl_kernel/version.py | cut -d'"' -f2)"
-            echo "tag_name=$TAG_NAME" >> $GITHUB_OUTPUT
+            TAG_NAME="v$(cut -d'"' -f2 < sgl-kernel/python/sgl_kernel/version.py)"
+            echo "tag_name=$TAG_NAME" >> "$GITHUB_OUTPUT"
           else
-            echo "tag_name=${{ inputs.tag_name }}" >> $GITHUB_OUTPUT
+            echo "tag_name=${{ inputs.tag_name }}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Release
@@ -180,7 +180,7 @@ jobs:
             sgl-kernel/dist/*
 
       - name: Clone wheel index
-        run: git clone https://oauth2:${WHL_TOKEN}@github.com/sgl-project/whl.git sgl-whl
+        run: git clone https://oauth2:"${WHL_TOKEN}"@github.com/sgl-project/whl.git sgl-whl
         env:
           WHL_TOKEN: ${{ secrets.GH_PAT_FOR_WHL_RELEASE }}
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index d54c2be5bbde..be39e287f9b4 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -74,3 +74,7 @@ repos:
         args:
           - '--keep-output'
           - '--extra-keys=metadata.kernelspec metadata.language_info.version'
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.4
+    hooks:
+      - id: actionlint