diff --git a/.github/workflows/add_new_issue_to_triage_project.yml b/.github/workflows/add_new_issue_to_triage_project.yml
index 775d16e6..f3c5b845 100644
--- a/.github/workflows/add_new_issue_to_triage_project.yml
+++ b/.github/workflows/add_new_issue_to_triage_project.yml
@@ -1,7 +1,26 @@
+# Add new issues to triage project board (https://github.com/orgs/simp/projects/11)
+# ------------------------------------------------------------------------------
+#
+#             NOTICE: **This file is maintained with puppetsync**
+#
+# This file is updated automatically as part of a puppet module baseline.
+#
+# The next baseline sync will overwrite any local changes to this file!
+#
+# ==============================================================================
+# This pipeline uses the following GitHub Action Secrets:
+#
+#   GitHub Secret variable               Notes
+#   -------------------------------      ---------------------------------------
+#   AUTO_TRIAGE_TOKEN                    Token with appropriate permissions
+#
+# ------------------------------------------------------------------------------
+#
+#
 ---
 name: Add new issues to triage project
 
-on:
+'on':
   issues:
     types:
       - opened
diff --git a/.github/workflows/release_rpms.yml b/.github/workflows/release_rpms.yml
index 450ff7c4..04f1ef57 100644
--- a/.github/workflows/release_rpms.yml
+++ b/.github/workflows/release_rpms.yml
@@ -31,7 +31,7 @@
 ---
 name: 'RELENG: Build + attach RPMs to GitHub Release'
 
-on:
+'on':
   workflow_dispatch:
     inputs:
       release_tag:
@@ -71,10 +71,10 @@ on:
         description: "Dry run (Test-build RPMs)"
         required: false
         default: 'no'
-      #verbose:
-      #  description: 'Verbose RPM builds when "yes"'
-      #  required: false
-      #  default: 'no'
+      # verbose:
+      #   description: 'Verbose RPM builds when "yes"'
+      #   required: false
+      #   default: 'no'
       rebuild_number:
         description: 'If this is an RPM rebuild, put the number of the rebuild here'
         required: false
@@ -255,13 +255,13 @@ jobs:
           simp_core_ref_for_building_rpms: ${{ secrets.SIMP_CORE_REF_FOR_BUILDING_RPMS }}
           simp_builder_docker_image: 'docker.io/simpproject/simp_build_${{ github.event.inputs.build_container_os }}:latest'
           path_to_build: "${{ (github.event.inputs.path_to_build != null && format('{0}/{1}', github.workspace, github.event.inputs.path_to_build)) || github.workspace }}"
-          verbose: 'no'  #${{ github.event.inputs.verbose }}
+          verbose: 'no'  # ${{ github.event.inputs.verbose }}
 
       - name: "Wipe all previous assets from GitHub Release (when clean == 'yes')"
         if: ${{ github.event.inputs.clean == 'yes' && github.event.inputs.dry_run != 'yes' }}
         uses: actions/github-script@v6
         env:
-          release_id:  ${{ steps.release-api.outputs.id }}
+          release_id: ${{ steps.release-api.outputs.id }}
         with:
           github-token: ${{ github.event.inputs.target_repo_token || secrets.GITHUB_TOKEN }}
           script: |
@@ -282,7 +282,7 @@ jobs:
         env:
           rpm_file_paths: ${{ steps.build-and-sign-rpm.outputs.rpm_file_paths }}
           rpm_gpg_file: ${{ steps.build-and-sign-rpm.outputs.rpm_gpg_file }}
-          release_id:  ${{ steps.release-api.outputs.id }}
+          release_id: ${{ steps.release-api.outputs.id }}
           clobber: ${{ github.event.inputs.clobber }}
           clean: ${{ github.event.inputs.clean }}
           dry_run: ${{ github.event.inputs.dry_run }}
diff --git a/.github/workflows/tag_deploy_github-rpms.yml b/.github/workflows/tag_deploy_github-rpms.yml
index 6848d7c9..8c1f7cea 100644
--- a/.github/workflows/tag_deploy_github-rpms.yml
+++ b/.github/workflows/tag_deploy_github-rpms.yml
@@ -29,7 +29,7 @@
 ---
 name: 'Tag: Release to GitHub w/RPMs'
 
-on:
+'on':
   push:
     tags:
       # NOTE: These filter patterns aren't actually regexes:
@@ -38,7 +38,7 @@ on:
       - '[0-9]+\.[0-9]+\.[0-9]+\-[a-z]+[0-9]+'
 
 env:
-  PUPPET_VERSION: '~> 7'
+  PUPPET_VERSION: '~> 8'
 
 jobs:
   create-github-release:
@@ -95,13 +95,14 @@ jobs:
         run: |
           echo "${RELEASE_MESSAGE}" > /tmp/.commit-msg.txt
           args=(-F /tmp/.commit-msg.txt)
-          [[ ${{ steps.tag-check.outputs.prerelease }} == yes ]] && args+=(--prerelease)
+          [[ "${{ steps.tag-check.outputs.prerelease }}" == yes ]] && args+=(--prerelease)
 
           gh release create ${args[@]} "$TARGET_TAG"
 
   build-and-attach-rpms:
     name: Trigger RPM release
-    needs: [ create-github-release ]
+    needs:
+      - create-github-release
     if: github.repository_owner == 'simp'
     runs-on: ubuntu-latest
     env:
diff --git a/.github/workflows/validate_tokens_asset.yml b/.github/workflows/validate_tokens_asset.yml
index 14cb05a0..92719949 100644
--- a/.github/workflows/validate_tokens_asset.yml
+++ b/.github/workflows/validate_tokens_asset.yml
@@ -20,7 +20,7 @@
 ---
 name: 'Manual: Validate API tokens'
 
-on:
+'on':
   - workflow_dispatch
 
 jobs:
@@ -52,4 +52,3 @@ jobs:
             echo "::debug ::${scopes}"
             exit 1
           fi
-