From 3ef979c3deb66acf44771e9ea53e6b81e1335a7f Mon Sep 17 00:00:00 2001
From: Mark Lee <malept@users.noreply.github.com>
Date: Tue, 12 May 2026 08:26:52 -0700
Subject: [PATCH 01/16] feat(ci): report GitHub PAT rate-limit usage to Datadog
 (#1144)

Assisted-By: claude-opus 4.7 via OpenCode
---
 shell/ci/auth/github_packages.sh |   6 ++
 shell/ci/release/docker-authn.sh |  11 ++
 shell/lib/metrics.sh             |  98 +++++++++++++++++
 shell/lib/metrics_test.bats      | 179 +++++++++++++++++++++++++++++++
 shell/lib/mise.sh                |  80 ++------------
 5 files changed, 303 insertions(+), 71 deletions(-)
 create mode 100644 shell/lib/metrics.sh
 create mode 100644 shell/lib/metrics_test.bats

diff --git a/shell/ci/auth/github_packages.sh b/shell/ci/auth/github_packages.sh
index b10df69f..3a060a6d 100755
--- a/shell/ci/auth/github_packages.sh
+++ b/shell/ci/auth/github_packages.sh
@@ -15,6 +15,9 @@ source "${LIB_DIR}/github.sh"
 # shellcheck source=../../lib/logging.sh
 source "${LIB_DIR}/logging.sh"
 
+# shellcheck source=../../lib/metrics.sh
+source "${LIB_DIR}/metrics.sh"
+
 # shellcheck source=../../lib/docker/authn/ghcr.sh
 source "${LIB_DIR}/docker/authn/ghcr.sh"
 
@@ -71,3 +74,6 @@ fi
 info_sub "Docker"
 
 GITHUB_TOKEN="$GITHUB_PACKAGES_TOKEN" ghcr_auth "$ORG"
+
+# Best-effort report of PAT rate-limit usage to Datadog.
+GITHUB_TOKEN="$GITHUB_PACKAGES_TOKEN" report_gh_rate_limit_to_datadog pat consumer:github_packages
diff --git a/shell/ci/release/docker-authn.sh b/shell/ci/release/docker-authn.sh
index f09447fe..5b3d21a6 100755
--- a/shell/ci/release/docker-authn.sh
+++ b/shell/ci/release/docker-authn.sh
@@ -23,6 +23,9 @@ source "${LIB_DIR}/github.sh"
 # shellcheck source=../../lib/logging.sh
 source "${LIB_DIR}/logging.sh"
 
+# shellcheck source=../../lib/metrics.sh
+source "${LIB_DIR}/metrics.sh"
+
 # shellcheck source=../../lib/mise.sh
 source "${LIB_DIR}/mise.sh"
 
@@ -82,6 +85,7 @@ registries=$(echo "$pullRegistry $pushRegistries" | tr ' ' '\n' | sort --unique
 
 info "🔓 Authenticating to Docker registries"
 
+usedGitHubPAT=false
 for crURL in $registries; do
   case $crURL in
   gcr.io/*)
@@ -95,9 +99,16 @@ for crURL in $registries; do
     info_sub "🔓 GHCR ($crURL)"
     # Need the PAT because app-based tokens cannot publish containers.
     GITHUB_TOKEN="$(github_pat_from_ci)" ghcr_auth "$(get_box_field org)"
+    usedGitHubPAT=true
     ;;
   *)
     warn "No authentication script found for registry: $crURL"
     ;;
   esac
 done
+
+# Best-effort report of PAT rate-limit usage to Datadog, after all
+# GHCR registries have authenticated.
+if [[ $usedGitHubPAT == true ]]; then
+  GITHUB_TOKEN="$(github_pat_from_ci)" report_gh_rate_limit_to_datadog pat consumer:docker_authn
+fi
diff --git a/shell/lib/metrics.sh b/shell/lib/metrics.sh
new file mode 100644
index 00000000..c4f28fb8
--- /dev/null
+++ b/shell/lib/metrics.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+#
+# Helpers for emitting CI telemetry to Datadog. Assumes logging.sh
+# and shell.sh are sourced.
+
+# report_gh_rate_limit_to_datadog TOKEN_TYPE [EXTRA_TAG...]
+#
+# Best-effort submission of the current GitHub API rate-limit state
+# (for whatever token is in $GITHUB_TOKEN) as Datadog gauge metrics
+# under `devbase.github.<token_type>.rate_limit_{used,remaining}`. Always
+# tagged with `repo` and `ci_job`; any additional `key:value` tags
+# passed as arguments are appended.
+#
+# Silently no-ops (returns 0) when not in CI, when DATADOG_API_KEY is
+# unset, when `gh` or `gojq` are unavailable, or when the rate-limit
+# query fails for any reason (network, malformed JSON, missing fields,
+# Datadog rejection).
+#
+# Exits the calling shell via `fatal` if TOKEN_TYPE is empty -- this is
+# a programmer error (a caller passed an unset variable) and should
+# fail loudly rather than emit metrics under a meaningless key.
+report_gh_rate_limit_to_datadog() {
+  local ddPayload tokenType now rateLimit
+  tokenType="${1:-}"
+  if [[ -z $tokenType ]]; then
+    fatal "report_gh_rate_limit_to_datadog: tokenType is required"
+  fi
+  shift
+
+  if ! in_ci_environment || [[ -z ${DATADOG_API_KEY:-} ]] || ! command_exists gh || ! command_exists gojq; then
+    return 0
+  fi
+
+  rateLimit="$(gh api /rate_limit --jq .rate 2>/dev/null || true)"
+  if [[ -z $rateLimit ]]; then
+    warn "Could not get rate limit from GitHub API, skipping" >&2
+    return 0
+  fi
+  # Validate JSON before feeding to --argjson; a malformed response would
+  # otherwise make gojq exit non-zero and, under `set -e` in callers, kill
+  # the parent script.
+  if ! gojq --exit-status . <<<"$rateLimit" >/dev/null 2>&1; then
+    warn "Returned rate limit is not valid JSON, skipping" >&2
+    return 0
+  fi
+
+  now="$(date +%s)"
+  # Build the entire Datadog payload with gojq so every dynamic value
+  # (including `tokenType` and the extra tags) is properly JSON-encoded.
+  # type=3 is gauge.
+  # shellcheck disable=SC2016 # jq vars, not shell vars
+  ddPayload="$(gojq --null-input --compact-output \
+    --argjson rateLimit "$rateLimit" \
+    --argjson now "$now" \
+    --arg tokenType "$tokenType" \
+    --arg repo "${CIRCLE_PROJECT_REPONAME:-unknown}" \
+    --arg job "${CIRCLE_JOB:-unknown}" \
+    --args \
+    '
+      ($rateLimit.used) as $used |
+      ($rateLimit.remaining) as $remaining |
+      (["repo:" + $repo, "ci_job:" + $job] + $ARGS.positional) as $tags |
+      if ($used == null or $remaining == null) then
+        empty
+      else
+        {
+          series: [
+            {
+              metric: ("devbase.github." + $tokenType + ".rate_limit_used"),
+              type: 3,
+              points: [{ timestamp: $now, value: $used }],
+              tags: $tags
+            },
+            {
+              metric: ("devbase.github." + $tokenType + ".rate_limit_remaining"),
+              type: 3,
+              points: [{ timestamp: $now, value: $remaining }],
+              tags: $tags
+            }
+          ]
+        }
+      end
+    ' \
+    -- "$@")"
+
+  # gojq emitted `empty` -- used or remaining was null. Datadog rejects
+  # null numeric values; warn and skip rather than send a malformed
+  # request that would be silently swallowed by `curl || true` below.
+  if [[ -z $ddPayload ]]; then
+    warn "Rate limit response missing used/remaining, skipping" >&2
+    return 0
+  fi
+
+  curl --silent --show-error --request POST "https://api.datadoghq.com/api/v2/series" \
+    --header "Content-Type: application/json" \
+    --header "DD-API-KEY: $DATADOG_API_KEY" \
+    --data "$ddPayload" >/dev/null || true
+}
diff --git a/shell/lib/metrics_test.bats b/shell/lib/metrics_test.bats
new file mode 100644
index 00000000..0168c5c5
--- /dev/null
+++ b/shell/lib/metrics_test.bats
@@ -0,0 +1,179 @@
+#!/usr/bin/env bats
+
+bats_load_library "bats-support/load.bash"
+bats_load_library "bats-assert/load.bash"
+
+load logging.sh
+load shell.sh
+load metrics.sh
+
+setup() {
+  STUB_DIR="$(mktemp -d -t metrics-stubs-XXXXXX)"
+  STUB_CALLS_FILE="$STUB_DIR/calls"
+  STUB_OUTPUTS_DIR="$STUB_DIR/outputs"
+  STUB_ARGS_DIR="$STUB_DIR/args"
+  mkdir -p "$STUB_OUTPUTS_DIR" "$STUB_ARGS_DIR"
+  : >"$STUB_CALLS_FILE"
+  export STUB_CALLS_FILE STUB_OUTPUTS_DIR STUB_ARGS_DIR
+  export PATH="$STUB_DIR:$PATH"
+}
+
+teardown() {
+  rm -rf "$STUB_DIR"
+  unset STUB_CALLS_FILE STUB_OUTPUTS_DIR STUB_ARGS_DIR
+}
+
+# stub_command NAME OUTPUT [EXIT_CODE]
+#
+# Install an executable stub on PATH that records its invocation to
+# $STUB_CALLS_FILE (one line: "NAME ARGS..."), records its full argv to
+# $STUB_ARGS_DIR/NAME.argv (one arg per line, latest invocation only),
+# prints OUTPUT to stdout, and exits with EXIT_CODE (default 0).
+stub_command() {
+  local name="$1" output="$2" exitCode="${3:-0}"
+  printf '%s' "$output" >"$STUB_OUTPUTS_DIR/$name"
+  printf '%s' "$exitCode" >"$STUB_OUTPUTS_DIR/$name.exit"
+  cat >"$STUB_DIR/$name" <<'EOF'
+#!/usr/bin/env bash
+name="$(basename "$0")"
+echo "$name $*" >>"$STUB_CALLS_FILE"
+printf '%s\n' "$@" >"$STUB_ARGS_DIR/$name.argv"
+cat "$STUB_OUTPUTS_DIR/$name"
+exit "$(cat "$STUB_OUTPUTS_DIR/$name.exit")"
+EOF
+  chmod +x "$STUB_DIR/$name"
+}
+
+assert_stub_not_called() {
+  local name="$1"
+  # `run` swallows grep's non-zero exit when the count is 0, so we can
+  # assert the count directly without an explicit failure-path check.
+  run grep -c "^$name " "$STUB_CALLS_FILE"
+  assert_output "0"
+}
+
+# Extract the argument passed to curl's `--data` flag (the JSON payload).
+curl_payload() {
+  awk '/^--data$/ { getline; print; exit }' "$STUB_ARGS_DIR/curl.argv"
+}
+
+@test "report_gh_rate_limit_to_datadog fails when tokenType is empty" {
+  run report_gh_rate_limit_to_datadog ""
+  assert_failure
+  assert_output --partial "tokenType is required"
+}
+
+@test "report_gh_rate_limit_to_datadog no-ops when not in CI" {
+  CI="" run report_gh_rate_limit_to_datadog app
+  assert_success
+}
+
+@test "report_gh_rate_limit_to_datadog no-ops when DATADOG_API_KEY is unset" {
+  CI=true DATADOG_API_KEY="" run report_gh_rate_limit_to_datadog app
+  assert_success
+}
+
+@test "report_gh_rate_limit_to_datadog warns and returns 0 when gh returns invalid JSON" {
+  # gh emits a CLI error on stdout (not JSON).
+  stub_command gh 'gh: HTTP 401: Bad credentials'
+  # Stub gojq so the test doesn't depend on the real binary; mimic the
+  # real exit-code semantics for the validation check (`--exit-status`
+  # against non-JSON returns non-zero).
+  stub_command gojq '' 1
+  stub_command curl ''
+
+  CI=true DATADOG_API_KEY="fake-key" run report_gh_rate_limit_to_datadog app
+  assert_success
+  assert_output --partial "Returned rate limit is not valid JSON"
+  assert_stub_not_called curl
+}
+
+@test "report_gh_rate_limit_to_datadog warns and returns 0 when rate limit fields are null" {
+  # Real gh + real gojq path requires gojq to be installed; the
+  # function builds the payload via gojq and emits `empty` when used
+  # or remaining is null. Skip if gojq isn't on PATH (e.g., barebones
+  # container).
+  if ! command_exists gojq; then
+    skip "gojq not installed"
+  fi
+  # Valid JSON, but .used and .remaining are absent.
+  stub_command gh '{}'
+  stub_command curl ''
+
+  CI=true DATADOG_API_KEY="fake-key" run report_gh_rate_limit_to_datadog app
+  assert_success
+  assert_output --partial "Rate limit response missing used/remaining"
+  assert_stub_not_called curl
+}
+
+@test "report_gh_rate_limit_to_datadog posts a well-formed Datadog payload on success" {
+  if ! command_exists gojq; then
+    skip "gojq not installed"
+  fi
+  stub_command gh '{"used":42,"remaining":4958}'
+  stub_command curl ''
+
+  CI=true \
+    DATADOG_API_KEY="fake-key" \
+    CIRCLE_PROJECT_REPONAME="my-repo" \
+    CIRCLE_JOB="my-job" \
+    run report_gh_rate_limit_to_datadog pat consumer:test_consumer
+  assert_success
+
+  # curl should have been called exactly once.
+  run grep -c "^curl " "$STUB_CALLS_FILE"
+  assert_output "1"
+
+  # Verify endpoint and headers.
+  run cat "$STUB_ARGS_DIR/curl.argv"
+  assert_output --partial "https://api.datadoghq.com/api/v2/series"
+  assert_output --partial "DD-API-KEY: fake-key"
+  assert_output --partial "Content-Type: application/json"
+
+  # Extract the JSON payload passed to --data and verify its shape.
+  local payload
+  payload="$(curl_payload)"
+
+  run gojq -r '.series | length' <<<"$payload"
+  assert_output "2"
+
+  run gojq -r '.series[0].metric' <<<"$payload"
+  assert_output "devbase.github.pat.rate_limit_used"
+  run gojq -r '.series[1].metric' <<<"$payload"
+  assert_output "devbase.github.pat.rate_limit_remaining"
+
+  run gojq -r '.series[0].type' <<<"$payload"
+  assert_output "3"
+
+  run gojq -r '.series[0].points[0].value' <<<"$payload"
+  assert_output "42"
+  run gojq -r '.series[1].points[0].value' <<<"$payload"
+  assert_output "4958"
+
+  run gojq -r '.series[0].tags | sort | join(",")' <<<"$payload"
+  assert_output "ci_job:my-job,consumer:test_consumer,repo:my-repo"
+}
+
+@test "report_gh_rate_limit_to_datadog JSON-encodes tokenType with quotes safely" {
+  if ! command_exists gojq; then
+    skip "gojq not installed"
+  fi
+  stub_command gh '{"used":1,"remaining":2}'
+  stub_command curl ''
+
+  # A pathological tokenType containing a double-quote would break a
+  # heredoc-built payload; gojq's --arg encoding must handle it.
+  CI=true \
+    DATADOG_API_KEY="fake-key" \
+    run report_gh_rate_limit_to_datadog 'evil"name'
+  assert_success
+
+  local payload
+  payload="$(curl_payload)"
+
+  # Payload must still be valid JSON.
+  run gojq -e . <<<"$payload"
+  assert_success
+  run gojq -r '.series[0].metric' <<<"$payload"
+  assert_output 'devbase.github.evil"name.rate_limit_used'
+}
diff --git a/shell/lib/mise.sh b/shell/lib/mise.sh
index 13a50a8e..7a0900d4 100644
--- a/shell/lib/mise.sh
+++ b/shell/lib/mise.sh
@@ -2,6 +2,12 @@
 #
 # mise related functions. Assumes logging.sh and shell.sh are sourced.
 
+# DEVBASE_LIB_DIR is the directory that devbase shell script libraries live in.
+DEVBASE_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
+
+# shellcheck source=./metrics.sh
+source "${DEVBASE_LIB_DIR}/metrics.sh"
+
 # Installs `mise` if it isn't already found in PATH.
 # If running as root, install to /usr/local/bin. Otherwise, install
 # to $HOME/.local/bin.
@@ -240,7 +246,8 @@ mise_manages_tool_versions() {
 #
 # Runs `mise`. If in CI, `MISE_GITHUB_TOKEN` or `GITHUB_TOKEN` is set, and
 # `wait-for-gh-rate-limit` is installed, makes sure that the token
-# isn't rate limited before calling `mise`.
+# isn't rate limited before calling `mise`. Reports the GitHub API
+# rate-limit usage to Datadog after the `mise` invocation.
 run_mise() {
   local exitCode ghToken misePath
   misePath="$(find_mise)"
@@ -258,81 +265,12 @@ run_mise() {
   exitCode=${exitCode:-0}
 
   if [[ -n ${ghToken:-} ]]; then
-    GITHUB_TOKEN="$ghToken" report_gh_rate_limit_to_datadog "${1:-unknown}"
+    GITHUB_TOKEN="$ghToken" report_gh_rate_limit_to_datadog app consumer:mise "mise_command:${1:-unknown}"
   fi
 
   return "$exitCode"
 }
 
-# report_gh_rate_limit_to_datadog MISE_COMMAND
-#
-# Best-effort submission of the current GitHub API rate-limit state
-# as Datadog gauge metrics, tagged with the mise subcommand, repo, and
-# CI job. Silently no-ops when not in CI, when DATADOG_API_KEY is unset,
-# when `gh` or `gojq` are unavailable, or when the rate-limit query
-# fails. Never returns a non-zero exit code.
-report_gh_rate_limit_to_datadog() {
-  local ddPayload miseCommand now rateLimit remaining tags used
-  miseCommand="$1"
-
-  if ! in_ci_environment || [[ -z ${DATADOG_API_KEY:-} ]] || ! command_exists gh || ! command_exists gojq; then
-    return 0
-  fi
-
-  rateLimit="$(gh api /rate_limit --jq .rate 2>/dev/null || true)"
-  if [[ -z $rateLimit ]]; then
-    warn "Could not get rate limit from GitHub API, skipping" >&2
-    return 0
-  fi
-  # Validate JSON before feeding to --argjson; a malformed response would
-  # otherwise make gojq exit non-zero and, under `set -e` in callers, kill
-  # the parent script.
-  if ! gojq --exit-status . <<<"$rateLimit" >/dev/null 2>&1; then
-    warn "Returned rate limit is not valid JSON, skipping" >&2
-    return 0
-  fi
-
-  # Why: jq vars, not shell vars
-  # shellcheck disable=SC2016
-  used="$(gojq --null-input --argjson r "$rateLimit" '$r.used')"
-  # Why: jq vars, not shell vars
-  # shellcheck disable=SC2016
-  remaining="$(gojq --null-input --argjson r "$rateLimit" '$r.remaining')"
-  now="$(date +%s)"
-  # Why: jq vars, not shell vars
-  # shellcheck disable=SC2016
-  tags="$(gojq --null-input --compact-output \
-    --arg c "$miseCommand" \
-    --arg r "${CIRCLE_PROJECT_REPONAME:-unknown}" \
-    --arg j "${CIRCLE_JOB:-unknown}" \
-    '["mise_command:" + $c, "repo:" + $r, "ci_job:" + $j]')"
-  # type=3 is gauge
-  ddPayload=$(
-    cat <<EOF
-{
-  "series": [
-    {
-      "metric": "devbase.github.app.rate_limit_used",
-      "type": 3,
-      "points": [{"timestamp": $now, "value": $used}],
-      "tags": $tags
-    },
-    {
-      "metric": "devbase.github.app.rate_limit_remaining",
-      "type": 3,
-      "points": [{"timestamp": $now, "value": $remaining}],
-      "tags": $tags
-    }
-  ]
-}
-EOF
-  )
-  curl --silent --show-error --request POST "https://api.datadoghq.com/api/v2/series" \
-    --header "Content-Type: application/json" \
-    --header "DD-API-KEY: $DATADOG_API_KEY" \
-    --data "$ddPayload" >/dev/null || true
-}
-
 # If `wait-for-gh-rate-limit` is installed, runs it to wait for
 # GitHub rate limits to clear.
 wait_for_gh_rate_limit() {

From d4f10799fc119b4c98823d719cc759383b9a33da Mon Sep 17 00:00:00 2001
From: Outreach CI <outreach-ci@outreach.io>
Date: Tue, 12 May 2026 19:05:13 +0000
Subject: [PATCH 02/16] chore: Release


From d9f749ba62a4440a7a831413e4ecf624921b55e8 Mon Sep 17 00:00:00 2001
From: marnagy <47352326+marnagy@users.noreply.github.com>
Date: Mon, 18 May 2026 15:38:10 +0200
Subject: [PATCH 03/16] chore: restencil (#1148)

* chore: restencil

* revert mise.lock
---
 .circleci/config.yml |   1 +
 mise.lock            |   4 +-
 stencil.lock         |   2 +-
 yarn.lock            | 287 +++++++++++++++++++++----------------------
 4 files changed, 147 insertions(+), 147 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 00a93cc4..4369e075 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -28,6 +28,7 @@ contexts: &contexts
   - circleci-credentials
   - tray-webhooks
   - wizcli
+  - datadog
   ## <<Stencil::Block(extraContexts)>>
   - docker-registry
   - npm-credentials
diff --git a/mise.lock b/mise.lock
index 664d8f0d..af582d38 100644
--- a/mise.lock
+++ b/mise.lock
@@ -44,8 +44,8 @@ checksum = "sha256:522af40b3415c572188831c067504f1f5a6bea5606d0b06c9cf4b8ae5910a
 url = "https://github.com/CircleCI-Public/circleci-cli/releases/download/v0.1.34950/circleci-cli_0.1.34950_linux_amd64.tar.gz"
 
 [tools.circleci."platforms.macos-arm64"]
-checksum = "sha256:a715c72780c91b4226e16d32f5715dd568c1675a09942b4e4941266fb8e0564c"
-url = "https://github.com/CircleCI-Public/circleci-cli/releases/download/v0.1.34950/circleci-cli_0.1.34950_darwin_amd64.tar.gz"
+checksum = "sha256:5465379de428e91254604afd5f4dff4997c92e3c19b5251db53f3d7f43b54617"
+url = "https://github.com/CircleCI-Public/circleci-cli/releases/download/v0.1.34950/circleci-cli_0.1.34950_darwin_arm64.tar.gz"
 
 [tools.circleci."platforms.macos-x64"]
 checksum = "sha256:a715c72780c91b4226e16d32f5715dd568c1675a09942b4e4941266fb8e0564c"
diff --git a/stencil.lock b/stencil.lock
index 3447c369..dda54884 100644
--- a/stencil.lock
+++ b/stencil.lock
@@ -8,7 +8,7 @@ modules:
       version: v0.19.0
     - name: github.com/getoutreach/stencil-circleci
       url: https://github.com/getoutreach/stencil-circleci
-      version: v1.17.3-rc.1
+      version: v1.18.0
     - name: github.com/getoutreach/stencil-golang
       url: https://github.com/getoutreach/stencil-golang
       version: unstable
diff --git a/yarn.lock b/yarn.lock
index 7ff42514..0bc0cd7a 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3,9 +3,9 @@
 
 
 "@actions/core@^3.0.0":
-  version "3.0.0"
-  resolved "https://registry.yarnpkg.com/@actions/core/-/core-3.0.0.tgz#89cb07c119e9b46a649ad5f355e77de9b3108cf8"
-  integrity sha512-zYt6cz+ivnTmiT/ksRVriMBOiuoUpDCJJlZ5KPl2/FRdvwU3f7MPh9qftvbkXJThragzUZieit2nyHUyw53Seg==
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/@actions/core/-/core-3.0.1.tgz#0f4d8b14527ee51e0db061eedc24a206c9f98c23"
+  integrity sha512-a6d/Nwahm9fliVGRhdhofo40HjHQasUPusmc7vBfyky+7Z+P2A1J68zyFVaNcEclc/Se+eO595oAr5nwEIoIUA==
   dependencies:
     "@actions/exec" "^3.0.0"
     "@actions/http-client" "^4.0.0"
@@ -18,9 +18,9 @@
     "@actions/io" "^3.0.2"
 
 "@actions/http-client@^4.0.0":
-  version "4.0.0"
-  resolved "https://registry.yarnpkg.com/@actions/http-client/-/http-client-4.0.0.tgz#f9754133c22802466482bf96321d42f2dba1fc82"
-  integrity sha512-QuwPsgVMsD6qaPD57GLZi9sqzAZCtiJT8kVBCDpLtxhL5MydQ4gS+DrejtZZPdIYyB1e95uCK9Luyds7ybHI3g==
+  version "4.0.1"
+  resolved "https://registry.yarnpkg.com/@actions/http-client/-/http-client-4.0.1.tgz#22a23a7625ba1326d9ba154012ca8301a27f88a3"
+  integrity sha512-+Nvd1ImaOZBSoPbsUtEhv+1z99H12xzncCkz0a3RuehINE81FZSe2QTj3uvAPTcJX/SCzUQHQ0D1GrPMbrPitg==
   dependencies:
     tunnel "^0.0.6"
     undici "^6.23.0"
@@ -85,10 +85,10 @@
     lru-cache "^11.2.1"
     socks-proxy-agent "^8.0.3"
 
-"@npmcli/arborist@^9.4.2":
-  version "9.4.2"
-  resolved "https://registry.yarnpkg.com/@npmcli/arborist/-/arborist-9.4.2.tgz#3fe6b905c671e7082a13ff247c6cf5f2006a4202"
-  integrity sha512-omJgPyzt11cEGrxzgrECoOyxAunmPMgBFTcAB/FbaB+9iOYhGmRdsQqySV8o0LWQ/l2kTeASUIMR4xJufVwmtw==
+"@npmcli/arborist@^9.5.0":
+  version "9.5.0"
+  resolved "https://registry.yarnpkg.com/@npmcli/arborist/-/arborist-9.5.0.tgz#75d8817187923a30fa0e514d887abd923b0a5768"
+  integrity sha512-qS+TtKWC58sjBjD+szLrhEj2TCLnwzUA9vlMyCnU9ztw01ZjQSu25iQPxeBa0sk9sS9/Hzs/xJMWl7J/vRCjGQ==
   dependencies:
     "@gar/promise-retry" "^1.0.0"
     "@isaacs/string-locale-compare" "^1.1.0"
@@ -125,10 +125,10 @@
     treeverse "^3.0.0"
     walk-up-path "^4.0.0"
 
-"@npmcli/config@^10.8.1":
-  version "10.8.1"
-  resolved "https://registry.yarnpkg.com/@npmcli/config/-/config-10.8.1.tgz#36dd459a03cda0fa9211df9f669bd1b2ac46497b"
-  integrity sha512-MAYk9IlIGiyC0c9fnjdBSQfIFPZT0g1MfeSiD1UXTq2zJOLX55jS9/sETJHqw/7LN18JjITrhYfgCfapbmZHiQ==
+"@npmcli/config@^10.9.0":
+  version "10.9.0"
+  resolved "https://registry.yarnpkg.com/@npmcli/config/-/config-10.9.0.tgz#b12c35daefb607387a1c84a616ab5fc81a0c7f72"
+  integrity sha512-qOqb+RoMH+y0OsvjCNafav5U4NqjnqRwHsfQlMmMqBt/N8Yt2LjW5tF4VCp4oG9KZXSMpuveOFi9b+GfIVsE5g==
   dependencies:
     "@npmcli/map-workspaces" "^5.0.0"
     "@npmcli/package-json" "^7.0.0"
@@ -314,13 +314,14 @@
     "@octokit/types" "^16.0.0"
 
 "@octokit/request@^10.0.6":
-  version "10.0.8"
-  resolved "https://registry.yarnpkg.com/@octokit/request/-/request-10.0.8.tgz#6609a5a38ad6f8ee203d9eb8ac9361d906a4414e"
-  integrity sha512-SJZNwY9pur9Agf7l87ywFi14W+Hd9Jg6Ifivsd33+/bGUQIjNujdFiXII2/qSlN2ybqUHfp5xpekMEjIBTjlSw==
+  version "10.0.9"
+  resolved "https://registry.yarnpkg.com/@octokit/request/-/request-10.0.9.tgz#6e75648ace44e7416d06ff96c345f9f9de23df02"
+  integrity sha512-o8Bi3f608eyM+7BmBiUWxFsdjLb3/ym1cQek5LZOv9KkZcxRrHCPhhRzm6xjO6HVZ85ItD6+sTsjxo821SVa/A==
   dependencies:
     "@octokit/endpoint" "^11.0.3"
     "@octokit/request-error" "^7.0.2"
     "@octokit/types" "^16.0.0"
+    content-type "^2.0.0"
     fast-content-type-parse "^3.0.0"
     json-with-bigint "^3.5.3"
     universal-user-agent "^7.0.2"
@@ -409,9 +410,9 @@
     p-reduce "^2.0.0"
 
 "@semantic-release/github@^12.0.0", "@semantic-release/github@^12.0.2":
-  version "12.0.6"
-  resolved "https://registry.yarnpkg.com/@semantic-release/github/-/github-12.0.6.tgz#c60c556e7087938be988d0be3de6d70e8cbaced8"
-  integrity sha512-aYYFkwHW3c6YtHwQF0t0+lAjlU+87NFOZuH2CvWFD0Ylivc7MwhZMiHOJ0FMpIgPpCVib/VUAcOwvrW0KnxQtA==
+  version "12.0.8"
+  resolved "https://registry.yarnpkg.com/@semantic-release/github/-/github-12.0.8.tgz#536a5ce489692674f5cc51a1f9739489ae09a35c"
+  integrity sha512-tej5AAgK5X9wHRoDmYhecMXEHEkFeGOY1XsEblKxu8pIQwahzf1STYyr7iPU6Lpbg6C5I3N2w/ocXrBo+L7jhw==
   dependencies:
     "@octokit/core" "^7.0.0"
     "@octokit/plugin-paginate-rest" "^14.0.0"
@@ -421,8 +422,8 @@
     aggregate-error "^5.0.0"
     debug "^4.3.4"
     dir-glob "^3.0.1"
-    http-proxy-agent "^7.0.0"
-    https-proxy-agent "^7.0.0"
+    http-proxy-agent "^9.0.0"
+    https-proxy-agent "^9.0.0"
     issue-parser "^7.0.0"
     lodash-es "^4.17.21"
     mime "^4.0.0"
@@ -453,18 +454,16 @@
     tempy "^3.0.0"
 
 "@semantic-release/release-notes-generator@^14.1.0":
-  version "14.1.0"
-  resolved "https://registry.yarnpkg.com/@semantic-release/release-notes-generator/-/release-notes-generator-14.1.0.tgz#ac47bd214b48130e71578d9acefb1b1272854070"
-  integrity sha512-CcyDRk7xq+ON/20YNR+1I/jP7BYKICr1uKd1HHpROSnnTdGqOTburi4jcRiTYz0cpfhxSloQO3cGhnoot7IEkA==
+  version "14.1.1"
+  resolved "https://registry.yarnpkg.com/@semantic-release/release-notes-generator/-/release-notes-generator-14.1.1.tgz#8d8b8d99227429142e54204a6ba7f2bae11b497d"
+  integrity sha512-Pbd2e2XRMUD0OxehHpgd5/YghsE76cddkRHSoDvKLK+OCy4Ewxn49rWR631MEUU01lgwF/uyVXvbnVuu6+Z6VA==
   dependencies:
     conventional-changelog-angular "^8.0.0"
     conventional-changelog-writer "^8.0.0"
     conventional-commits-filter "^5.0.0"
     conventional-commits-parser "^6.0.0"
     debug "^4.0.0"
-    get-stream "^7.0.0"
     import-from-esm "^2.0.0"
-    into-stream "^7.0.0"
     lodash-es "^4.17.21"
     read-package-up "^11.0.0"
 
@@ -552,6 +551,11 @@ abbrev@^4.0.0:
   resolved "https://registry.yarnpkg.com/abbrev/-/abbrev-4.0.0.tgz#ec933f0e27b6cd60e89b5c6b2a304af42209bb05"
   integrity sha512-a1wflyaL0tHtJSmLSOVybYhy22vRih4eduhhrkcjgrWGnRfrZtovJ2FRjxuTtkkj47O/baf0R86QU5OuYpz8fA==
 
+agent-base@9.0.0:
+  version "9.0.0"
+  resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-9.0.0.tgz#ec9efb08314e1e75b0852d74aabf9a387f99834e"
+  integrity sha512-TQf59BsZnytt8GdJKLPfUZ54g/iaUL2OWDSFCCvMOhsHduDQxO8xC4PNeyIkVcA5KwL2phPSv0douC0fgWzmnA==
+
 agent-base@^7.1.0, agent-base@^7.1.2:
   version "7.1.4"
   resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-7.1.4.tgz#e3cd76d4c548ee895d3c3fd8dc1f6c5b9032e7a8"
@@ -671,9 +675,9 @@ bottleneck@^2.15.3:
   integrity sha512-VHiNCbI1lKdl44tGrhNfU3lup0Tj/ZBMJB5/2ZbNXRCPuRCO7ed2mgcK4r17y+KB2EfuYuRaVlwNbAeaWGSpbw==
 
 brace-expansion@^5.0.5:
-  version "5.0.5"
-  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-5.0.5.tgz#dcc3a37116b79f3e1b46db994ced5d570e930fdb"
-  integrity sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==
+  version "5.0.6"
+  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-5.0.6.tgz#ec68fe0a641a29d8711579caf641d05bae1f2285"
+  integrity sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==
   dependencies:
     balanced-match "^4.0.2"
 
@@ -742,10 +746,10 @@ ci-info@^4.0.0, ci-info@^4.4.0:
   resolved "https://registry.yarnpkg.com/ci-info/-/ci-info-4.4.0.tgz#7d54eff9f54b45b62401c26032696eb59c8bd18c"
   integrity sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg==
 
-cidr-regex@^5.0.1:
-  version "5.0.3"
-  resolved "https://registry.yarnpkg.com/cidr-regex/-/cidr-regex-5.0.3.tgz#6ae2f772d93c9cc941f85a4d597e4f97e95610af"
-  integrity sha512-zfPT2uurEroxXqefaL2L7/fT5ED2XTutC6UwFbSZfqSOk1vk5VFY6xa6/R6pBxB4Uc8MNPbRW5ykqutFG5P5ww==
+cidr-regex@^5.0.4:
+  version "5.0.5"
+  resolved "https://registry.yarnpkg.com/cidr-regex/-/cidr-regex-5.0.5.tgz#4f3ef4fd123f602481df6e6baf3e5a53b534a046"
+  integrity sha512-59tdLZcC+BJXa4C5rOmVSuJTy/UneqfJJtCraqwdx5BDHTkGrBtKCUl3u2uiCFvXu+wk0kVuX8axX7yHCZOI9w==
 
 clean-stack@^2.0.0:
   version "2.2.0"
@@ -848,6 +852,11 @@ config-chain@^1.1.11:
     ini "^1.3.4"
     proto-list "~1.2.1"
 
+content-type@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/content-type/-/content-type-2.0.0.tgz#2fb3ede69dffa0af78ca7c4ce7589680638b56df"
+  integrity sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==
+
 conventional-changelog-angular@^8.0.0:
   version "8.3.1"
   resolved "https://registry.yarnpkg.com/conventional-changelog-angular/-/conventional-changelog-angular-8.3.1.tgz#0b015e25ca7f2766a8c5352ab6488dcb76a9d881"
@@ -1129,18 +1138,10 @@ find-versions@^6.0.0:
     semver-regex "^4.0.5"
     super-regex "^1.0.0"
 
-from2@^2.3.0:
-  version "2.3.0"
-  resolved "https://registry.yarnpkg.com/from2/-/from2-2.3.0.tgz#8bfb5502bde4a4d36cfdeea007fcca21d7e382af"
-  integrity sha512-OMcX/4IC/uqEPVgGeyfN22LJk6AZrMkRZHxcHBMBvHScDGgwTm2GT2Wkgtocyd3JfZffjj2kYUDXXII0Fk9W0g==
-  dependencies:
-    inherits "^2.0.1"
-    readable-stream "^2.0.0"
-
 fs-extra@^11.0.0:
-  version "11.3.4"
-  resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-11.3.4.tgz#ab6934eca8bcf6f7f6b82742e33591f86301d6fc"
-  integrity sha512-CTXd6rk/M3/ULNQj8FBqBWHYBVYybQ3VPBw0xGKFe3tuH7ytT6ACnvzpIQ3UZtB8yvUKC2cXn1a+x+5EVQLovA==
+  version "11.3.5"
+  resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-11.3.5.tgz#07a44eff40bea53e719909a532f91a23bf0769ff"
+  integrity sha512-eKpRKAovdpZtR1WopLHxlBWvAgPny3c4gX1G5Jhwmmw4XJj0ifSD5qB5TOo8hmA0wlRKDAOAhEE1yVPgs6Fgcg==
   dependencies:
     graceful-fs "^4.2.0"
     jsonfile "^6.0.1"
@@ -1164,20 +1165,15 @@ get-caller-file@^2.0.5:
   integrity sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==
 
 get-east-asian-width@^1.0.0:
-  version "1.5.0"
-  resolved "https://registry.yarnpkg.com/get-east-asian-width/-/get-east-asian-width-1.5.0.tgz#ce7008fe345edcf5497a6f557cfa54bc318a9ce7"
-  integrity sha512-CQ+bEO+Tva/qlmw24dCejulK5pMzVnUOFOijVogd3KQs07HnRIgp8TGipvCCRT06xeYEbpbgwaCxglFyiuIcmA==
+  version "1.6.0"
+  resolved "https://registry.yarnpkg.com/get-east-asian-width/-/get-east-asian-width-1.6.0.tgz#216900f91df11a8b2c198c3e1d93d6c035a776b9"
+  integrity sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA==
 
 get-stream@^6.0.0:
   version "6.0.1"
   resolved "https://registry.yarnpkg.com/get-stream/-/get-stream-6.0.1.tgz#a262d8eef67aced57c2852ad6167526a43cbf7b7"
   integrity sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==
 
-get-stream@^7.0.0:
-  version "7.0.1"
-  resolved "https://registry.yarnpkg.com/get-stream/-/get-stream-7.0.1.tgz#1664dfe7d1678540ea6a4da3ae7cd59bf4e4a91e"
-  integrity sha512-3M8C1EOFN6r8AMUhwUAACIoXZJEOufDU5+0gFFN5uNs6XYOralD2Pqkl7m046va6x77FwposWXbAhPPIOus7mQ==
-
 get-stream@^8.0.1:
   version "8.0.1"
   resolved "https://registry.yarnpkg.com/get-stream/-/get-stream-8.0.1.tgz#def9dfd71742cd7754a7761ed43749a27d02eca2"
@@ -1262,9 +1258,9 @@ hosted-git-info@^7.0.0:
     lru-cache "^10.0.1"
 
 hosted-git-info@^9.0.0, hosted-git-info@^9.0.2:
-  version "9.0.2"
-  resolved "https://registry.yarnpkg.com/hosted-git-info/-/hosted-git-info-9.0.2.tgz#b38c8a802b274e275eeeccf9f4a1b1a0a8557ada"
-  integrity sha512-M422h7o/BR3rmCQ8UHi7cyyMqKltdP9Uo+J2fXK+RSAY+wTcKOIRyhTuKv4qn+DJf3g+PL890AzId5KZpX+CBg==
+  version "9.0.3"
+  resolved "https://registry.yarnpkg.com/hosted-git-info/-/hosted-git-info-9.0.3.tgz#637b511ce62a28e4261a92b8da0a4d6be3522cd4"
+  integrity sha512-Hc+ghLoSt6QaYZUv0WBiIvmMDZuZZ7oaDvdH8MbfOO4lOsxdXLEvuC6ePoGs9H1X9oCLyq6+NVN0MKqD+ydxyg==
   dependencies:
     lru-cache "^11.1.0"
 
@@ -1281,7 +1277,15 @@ http-proxy-agent@^7.0.0:
     agent-base "^7.1.0"
     debug "^4.3.4"
 
-https-proxy-agent@^7.0.0, https-proxy-agent@^7.0.1:
+http-proxy-agent@^9.0.0:
+  version "9.0.0"
+  resolved "https://registry.yarnpkg.com/http-proxy-agent/-/http-proxy-agent-9.0.0.tgz#473fe9c2b8ffea87611f8c68dfb9872b835c91d1"
+  integrity sha512-FcF8VhXYLQcxWCnt/cCpT2apKsRDUGeVEeMqGu4HSTu29U8Yw0TLOjdYIlDsYk3IkUh+taX4IDWpPcCqKDhCjA==
+  dependencies:
+    agent-base "9.0.0"
+    debug "^4.3.4"
+
+https-proxy-agent@^7.0.1:
   version "7.0.6"
   resolved "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz#da8dfeac7da130b05c2ba4b59c9b6cd66611a6b9"
   integrity sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==
@@ -1289,6 +1293,14 @@ https-proxy-agent@^7.0.0, https-proxy-agent@^7.0.1:
     agent-base "^7.1.2"
     debug "4"
 
+https-proxy-agent@^9.0.0:
+  version "9.0.0"
+  resolved "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-9.0.0.tgz#89256adf9dc20926fe43ea1d3ca0feb9e23cc4bd"
+  integrity sha512-/MVmHp58WkOypgFhCLk4fzpPcFQvTJ/e6LBI7irpIO2HfxUbpmYoHF+KzipzJpxxzJu7aJNWQ0xojJ/dzV2G5g==
+  dependencies:
+    agent-base "9.0.0"
+    debug "^4.3.4"
+
 human-signals@^2.1.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/human-signals/-/human-signals-2.1.0.tgz#dc91fcba42e4d06e4abaed33b3e7a3c02f514ea0"
@@ -1354,7 +1366,7 @@ index-to-position@^1.1.0:
   resolved "https://registry.yarnpkg.com/index-to-position/-/index-to-position-1.2.0.tgz#c800eb34dacf4dbf96b9b06c7eb78d5f704138b4"
   integrity sha512-Yg7+ztRkqslMAS2iFaU+Oa4KTSidr63OsFGlOrJoW981kIYO3CGCS3wA95P1mUi/IVSJkn0D479KTJpVpvFNuw==
 
-inherits@^2.0.1, inherits@~2.0.3:
+inherits@~2.0.3:
   version "2.0.4"
   resolved "https://registry.yarnpkg.com/inherits/-/inherits-2.0.4.tgz#0fa2c64f932917c3433a0ded55363aae37416b7c"
   integrity sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==
@@ -1381,30 +1393,22 @@ init-package-json@^8.2.5:
     semver "^7.7.2"
     validate-npm-package-name "^7.0.0"
 
-into-stream@^7.0.0:
-  version "7.0.0"
-  resolved "https://registry.yarnpkg.com/into-stream/-/into-stream-7.0.0.tgz#d1a211e146be8acfdb84dabcbf00fe8205e72936"
-  integrity sha512-2dYz766i9HprMBasCMvHMuazJ7u4WzhJwo5kb3iPSiW/iRYV6uPari3zHoqZlnuaR7V1bEiNMxikhp37rdBXbw==
-  dependencies:
-    from2 "^2.3.0"
-    p-is-promise "^3.0.0"
-
-ip-address@^10.0.1:
-  version "10.1.0"
-  resolved "https://registry.yarnpkg.com/ip-address/-/ip-address-10.1.0.tgz#d8dcffb34d0e02eb241427444a6e23f5b0595aa4"
-  integrity sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==
+ip-address@^10.1.1:
+  version "10.2.0"
+  resolved "https://registry.yarnpkg.com/ip-address/-/ip-address-10.2.0.tgz#805fc178b20c518bd4c8548b24fe30892d7f3206"
+  integrity sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==
 
 is-arrayish@^0.2.1:
   version "0.2.1"
   resolved "https://registry.yarnpkg.com/is-arrayish/-/is-arrayish-0.2.1.tgz#77c99840527aa8ecb1a8ba697b80645a7a926a9d"
   integrity sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==
 
-is-cidr@^6.0.3:
-  version "6.0.3"
-  resolved "https://registry.yarnpkg.com/is-cidr/-/is-cidr-6.0.3.tgz#e9b332df01bef4d784a1aef93f920a59caf6b704"
-  integrity sha512-tPdsizbDiISrc4PoII6ZfpmAokx0oDKeYqAUp5bXOfznauOFXfEeosKBRrl0o0SriE4xoRR05Czn4YPCFMjSHA==
+is-cidr@^6.0.4:
+  version "6.0.4"
+  resolved "https://registry.yarnpkg.com/is-cidr/-/is-cidr-6.0.4.tgz#7dcbde8640cf00cddc38a3c159d937dc216deb5c"
+  integrity sha512-tOIBU3QiXy0W4LvHbcKWAWSuQfGwDiEILphFCAZtDqj7C57uv3ClO6K8aNEGV4VTA7bWJlpQ0suKQkUe6Rd6ag==
   dependencies:
-    cidr-regex "^5.0.1"
+    cidr-regex "^5.0.4"
 
 is-fullwidth-code-point@^3.0.0:
   version "3.0.0"
@@ -1462,9 +1466,9 @@ isexe@^4.0.0:
   integrity sha512-FFUtZMpoZ8RqHS3XeXEmHWLA4thH+ZxCv2lOiPIn1Xc7CxrqhWzNSDzD+/chS/zbYezmiwWLdQC09JdQKmthOw==
 
 issue-parser@^7.0.0:
-  version "7.0.1"
-  resolved "https://registry.yarnpkg.com/issue-parser/-/issue-parser-7.0.1.tgz#8a053e5a4952c75bb216204e454b4fc7d4cc9637"
-  integrity sha512-3YZcUUR2Wt1WsapF+S/WiA2WmlW0cWAoPccMqne7AxEBhCdFeTPjfv/Axb8V2gyCgY3nRw+ksZ3xSUX+R47iAg==
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/issue-parser/-/issue-parser-7.0.2.tgz#e592ed98d69d8306d08255bec4c6200a8aeabcbd"
+  integrity sha512-7atWPjhGEIX3JEtMrOYd8TKzboYlq+5sNbdl9POiLYOI14G5HZiQbZP0Xj5EZdrufQVXfJlpTV0hys0CuxwxZw==
   dependencies:
     lodash.capitalize "^4.2.1"
     lodash.escaperegexp "^4.1.2"
@@ -1515,9 +1519,9 @@ json-with-bigint@^3.5.3:
   integrity sha512-eq/4KP6K34kwa7TcFdtvnftvHCD9KvHOGGICWwMFc4dOOKF5t4iYqnfLK8otCRCRv06FXOzGGyqE8h8ElMvvdw==
 
 jsonfile@^6.0.1:
-  version "6.2.0"
-  resolved "https://registry.yarnpkg.com/jsonfile/-/jsonfile-6.2.0.tgz#7c265bd1b65de6977478300087c99f1c84383f62"
-  integrity sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==
+  version "6.2.1"
+  resolved "https://registry.yarnpkg.com/jsonfile/-/jsonfile-6.2.1.tgz#b6e31717f22cc37330b081ce0051ed5de53af2f6"
+  integrity sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==
   dependencies:
     universalify "^2.0.0"
   optionalDependencies:
@@ -1546,12 +1550,12 @@ libnpmaccess@^10.0.3:
     npm-package-arg "^13.0.0"
     npm-registry-fetch "^19.0.0"
 
-libnpmdiff@^8.1.5:
-  version "8.1.5"
-  resolved "https://registry.yarnpkg.com/libnpmdiff/-/libnpmdiff-8.1.5.tgz#369aea4a87053bd25eafa3c2b9da32be75274c54"
-  integrity sha512-3tknN/GosDOpIYjBplXpr7WVjpBDodAxXkZEtv410XlIsfMD+v/6mt9sYe/s/x+TRmmCRpzP/bxfhUorvV6Cqg==
+libnpmdiff@^8.1.7:
+  version "8.1.7"
+  resolved "https://registry.yarnpkg.com/libnpmdiff/-/libnpmdiff-8.1.7.tgz#fce20e575a84c952909daeac42ffc4b11fcd2a2b"
+  integrity sha512-6ISfPg+OEHnTPBqHhnFLC3pS9sGdVtflrDMdJ/EfgJshjdq3C28LV7X9rBgW3zBbs7gFrZkUjpzwcuHpbgGl+w==
   dependencies:
-    "@npmcli/arborist" "^9.4.2"
+    "@npmcli/arborist" "^9.5.0"
     "@npmcli/installed-package-contents" "^4.0.0"
     binary-extensions "^3.0.0"
     diff "^8.0.2"
@@ -1560,13 +1564,13 @@ libnpmdiff@^8.1.5:
     pacote "^21.0.2"
     tar "^7.5.1"
 
-libnpmexec@^10.2.5:
-  version "10.2.5"
-  resolved "https://registry.yarnpkg.com/libnpmexec/-/libnpmexec-10.2.5.tgz#21b2907c72bac11e696f5ea9fb5244254e5e7305"
-  integrity sha512-ayouyoml/4NmcgH+nWzK6QB5w0gKrftsYB8TAHu5TB5v6Nj3fgz8ZBK9FsG2A1SNuHZVTjvrNMDyF2VzDih/bA==
+libnpmexec@^10.2.7:
+  version "10.2.7"
+  resolved "https://registry.yarnpkg.com/libnpmexec/-/libnpmexec-10.2.7.tgz#f0c5b9effafa37f040acc7e87d56ae28a691cca2"
+  integrity sha512-kAmmRkN22ODFc9hkmgOxXL6qq6LkqlOyyfKUBI4E3Fu0igmdINfYWN2wnjQg5UD9D86YiP09Ze3WS40/X7vJpQ==
   dependencies:
     "@gar/promise-retry" "^1.0.0"
-    "@npmcli/arborist" "^9.4.2"
+    "@npmcli/arborist" "^9.5.0"
     "@npmcli/package-json" "^7.0.0"
     "@npmcli/run-script" "^10.0.0"
     ci-info "^4.0.0"
@@ -1578,12 +1582,12 @@ libnpmexec@^10.2.5:
     signal-exit "^4.1.0"
     walk-up-path "^4.0.0"
 
-libnpmfund@^7.0.19:
-  version "7.0.19"
-  resolved "https://registry.yarnpkg.com/libnpmfund/-/libnpmfund-7.0.19.tgz#03d766943b0052c1e3c19ff2c39ea1cb25f0a03d"
-  integrity sha512-RNyp5gnjVXaqlx0asRLmAOrFkTwANntzqkRyTT6Iu2nUt1F2eiMZNMOpO2HNfA7/NceBVBk/xsrzas3miCz9oQ==
+libnpmfund@^7.0.21:
+  version "7.0.21"
+  resolved "https://registry.yarnpkg.com/libnpmfund/-/libnpmfund-7.0.21.tgz#429d4aa5e3fc7dd1add1957c26536d514a8498ca"
+  integrity sha512-0GlVzx8LR1BGk1lT+zqvyhG4VbU471Hg4PNmAWT9wlzCgvevEVu4Q5kadauasa/uFC2w00gmERiy0V5yRa1VsQ==
   dependencies:
-    "@npmcli/arborist" "^9.4.2"
+    "@npmcli/arborist" "^9.5.0"
 
 libnpmorg@^8.0.1:
   version "8.0.1"
@@ -1593,12 +1597,12 @@ libnpmorg@^8.0.1:
     aproba "^2.0.0"
     npm-registry-fetch "^19.0.0"
 
-libnpmpack@^9.1.5:
-  version "9.1.5"
-  resolved "https://registry.yarnpkg.com/libnpmpack/-/libnpmpack-9.1.5.tgz#b0ba7affe4683f81e1c9e726212d0adb88bb9721"
-  integrity sha512-H1IX364ZwpeRfrL6UYSuxFNgP16/TvlwtCm8ZallbB7/1FZ3h1FBZHamQtv7PqcZUTWE27mygdQ4wCCW2BmVlg==
+libnpmpack@^9.1.7:
+  version "9.1.7"
+  resolved "https://registry.yarnpkg.com/libnpmpack/-/libnpmpack-9.1.7.tgz#515048ce68dbbccd544fbda31837723bb19fe71b"
+  integrity sha512-4K0T2HWf9GpjxBIGwitgSEySHJNOCbFugYtuOWixox/+yXdZlK54KTF8lvHK++nujGacPGmL8+CTIRamBlLXgQ==
   dependencies:
-    "@npmcli/arborist" "^9.4.2"
+    "@npmcli/arborist" "^9.5.0"
     "@npmcli/run-script" "^10.0.0"
     npm-package-arg "^13.0.0"
     pacote "^21.0.2"
@@ -1707,9 +1711,9 @@ lru-cache@^10.0.1:
   integrity sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==
 
 lru-cache@^11.0.0, lru-cache@^11.1.0, lru-cache@^11.2.1:
-  version "11.3.5"
-  resolved "https://registry.yarnpkg.com/lru-cache/-/lru-cache-11.3.5.tgz#29047d348c0b2793e3112a01c739bb7c6d855637"
-  integrity sha512-NxVFwLAnrd9i7KUBxC4DrUhmgjzOs+1Qm50D3oF1/oL+r1NpZ4gA7xvG0/zJ8evR7zIKn4vLf7qTNduWFtCrRw==
+  version "11.4.0"
+  resolved "https://registry.yarnpkg.com/lru-cache/-/lru-cache-11.4.0.tgz#87a577bfa71f7c94dfd71692874b859d1ca41a28"
+  integrity sha512-W+R+kFL4HgVxONq2bhXPi3bGpzGe/yEhVOp233qw9wCRtgncJ15P3bC+e4zZMu4Cq7d+WAJjXGW0uUkifhcatA==
 
 make-asynchronous@^1.0.1:
   version "1.1.0"
@@ -1789,7 +1793,7 @@ mimic-fn@^4.0.0:
   resolved "https://registry.yarnpkg.com/mimic-fn/-/mimic-fn-4.0.0.tgz#60a90550d5cb0b239cca65d893b1a53b29871ecc"
   integrity sha512-vqiC06CuhBTUdZH+RYl8sFrL096vA45Ok5ISO6sE/Mr1jRbGH4Csnhi8f3wKVl7x8mO4Au7Ir9D3Oyv1VYMFJw==
 
-minimatch@^10.0.3, minimatch@^10.1.1, minimatch@^10.2.2, minimatch@^10.2.4:
+minimatch@^10.0.3, minimatch@^10.1.1, minimatch@^10.2.2, minimatch@^10.2.5:
   version "10.2.5"
   resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-10.2.5.tgz#bd48687a0be38ed2961399105600f832095861d1"
   integrity sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==
@@ -1903,20 +1907,20 @@ node-emoji@^2.2.0:
     emojilib "^2.4.0"
     skin-tone "^2.0.0"
 
-node-gyp@^12.1.0, node-gyp@^12.2.0:
-  version "12.2.0"
-  resolved "https://registry.yarnpkg.com/node-gyp/-/node-gyp-12.2.0.tgz#ff73f6f509e33d8b7e768f889ffc9738ad117b07"
-  integrity sha512-q23WdzrQv48KozXlr0U1v9dwO/k59NHeSzn6loGcasyf0UnSrtzs8kRxM+mfwJSf0DkX0s43hcqgnSO4/VNthQ==
+node-gyp@^12.1.0, node-gyp@^12.3.0:
+  version "12.3.0"
+  resolved "https://registry.yarnpkg.com/node-gyp/-/node-gyp-12.3.0.tgz#a0e0d9364779451eaf4148b6f9a7366f98000b3f"
+  integrity sha512-QNcUWM+HgJplcPzBvFBZ9VXacyGZ4+VTOb80PwWR+TlVzoHbRKULNEzpRsnaoxG3Wzr7Qh7BYxGDU3CbKib2Yg==
   dependencies:
     env-paths "^2.2.0"
     exponential-backoff "^3.1.1"
     graceful-fs "^4.2.6"
-    make-fetch-happen "^15.0.0"
     nopt "^9.0.0"
     proc-log "^6.0.0"
     semver "^7.3.5"
     tar "^7.5.4"
     tinyglobby "^0.2.12"
+    undici "^6.25.0"
     which "^6.0.0"
 
 nopt@^9.0.0:
@@ -2051,13 +2055,13 @@ npm-user-validate@^4.0.0:
   integrity sha512-TP+Ziq/qPi/JRdhaEhnaiMkqfMGjhDLoh/oRfW+t5aCuIfJxIUxvwk6Sg/6ZJ069N/Be6gs00r+aZeJTfS9uHQ==
 
 npm@^11.6.2:
-  version "11.12.1"
-  resolved "https://registry.yarnpkg.com/npm/-/npm-11.12.1.tgz#432da55a9f0ca53c982740fabe2b081a38019fb1"
-  integrity sha512-zcoUuF1kezGSAo0CqtvoLXX3mkRqzuqYdL6Y5tdo8g69NVV3CkjQ6ZBhBgB4d7vGkPcV6TcvLi3GRKPDFX+xTA==
+  version "11.14.1"
+  resolved "https://registry.yarnpkg.com/npm/-/npm-11.14.1.tgz#4a6839650da0005f323fec6abd39d77ee24f842f"
+  integrity sha512-aopNZ0eEl6LbxoFcrXLmTEPzNBNxfiQnVgR9RmJBqzm+5h5pFoOmRljpRJbsXxocBeSl7GLcx3MoDf2UlEOjZw==
   dependencies:
     "@isaacs/string-locale-compare" "^1.1.0"
-    "@npmcli/arborist" "^9.4.2"
-    "@npmcli/config" "^10.8.1"
+    "@npmcli/arborist" "^9.5.0"
+    "@npmcli/config" "^10.9.0"
     "@npmcli/fs" "^5.0.0"
     "@npmcli/map-workspaces" "^5.0.3"
     "@npmcli/metavuln-calculator" "^9.0.3"
@@ -2078,24 +2082,24 @@ npm@^11.6.2:
     hosted-git-info "^9.0.2"
     ini "^6.0.0"
     init-package-json "^8.2.5"
-    is-cidr "^6.0.3"
+    is-cidr "^6.0.4"
     json-parse-even-better-errors "^5.0.0"
     libnpmaccess "^10.0.3"
-    libnpmdiff "^8.1.5"
-    libnpmexec "^10.2.5"
-    libnpmfund "^7.0.19"
+    libnpmdiff "^8.1.7"
+    libnpmexec "^10.2.7"
+    libnpmfund "^7.0.21"
     libnpmorg "^8.0.1"
-    libnpmpack "^9.1.5"
+    libnpmpack "^9.1.7"
     libnpmpublish "^11.1.3"
     libnpmsearch "^9.0.1"
     libnpmteam "^8.0.2"
     libnpmversion "^8.0.3"
     make-fetch-happen "^15.0.5"
-    minimatch "^10.2.4"
+    minimatch "^10.2.5"
     minipass "^7.1.3"
     minipass-pipeline "^1.2.4"
     ms "^2.1.2"
-    node-gyp "^12.2.0"
+    node-gyp "^12.3.0"
     nopt "^9.0.0"
     npm-audit-report "^7.0.0"
     npm-install-checks "^8.0.0"
@@ -2114,7 +2118,7 @@ npm@^11.6.2:
     spdx-expression-parse "^4.0.0"
     ssri "^13.0.1"
     supports-color "^10.2.2"
-    tar "^7.5.11"
+    tar "^7.5.13"
     text-table "~0.2.0"
     tiny-relative-date "^2.0.2"
     treeverse "^3.0.0"
@@ -2159,11 +2163,6 @@ p-filter@^4.0.0:
   dependencies:
     p-map "^7.0.1"
 
-p-is-promise@^3.0.0:
-  version "3.0.0"
-  resolved "https://registry.yarnpkg.com/p-is-promise/-/p-is-promise-3.0.0.tgz#58e78c7dfe2e163cf2a04ff869e7c1dba64a5971"
-  integrity sha512-Wo8VsW4IRQSKVXsJCn7TomUaVtyfjVDn3nUP7kE967BQk0CwFpdbZs0X0uk5sW9mkBa9eNM7hCMaG93WUAwxYQ==
-
 p-limit@^1.1.0:
   version "1.3.0"
   resolved "https://registry.yarnpkg.com/p-limit/-/p-limit-1.3.0.tgz#b86bd5f0c25690911c7590fcbfc2010d54b3ccb8"
@@ -2466,7 +2465,7 @@ read@^5.0.0, read@^5.0.1:
   dependencies:
     mute-stream "^3.0.0"
 
-readable-stream@^2.0.0, readable-stream@^2.0.2, readable-stream@~2.3.6:
+readable-stream@^2.0.2, readable-stream@~2.3.6:
   version "2.3.8"
   resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.3.8.tgz#91125e8042bba1b9887f49345f6277027ce8be9b"
   integrity sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==
@@ -2551,9 +2550,9 @@ semver-regex@^4.0.5:
   integrity sha512-hunMQrEy1T6Jr2uEVjrAIqjwWcQTgOAcIM52C8MY1EZSD3DDNft04XzvYKPqjED65bNVVko0YI38nYeEHCX3yw==
 
 semver@^7.1.1, semver@^7.1.2, semver@^7.3.2, semver@^7.3.5, semver@^7.3.7, semver@^7.5.2, semver@^7.5.3, semver@^7.6.0, semver@^7.7.2, semver@^7.7.4:
-  version "7.7.4"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-7.7.4.tgz#28464e36060e991fa7a11d0279d2d3f3b57a7e8a"
-  integrity sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==
+  version "7.8.0"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.8.0.tgz#ed0661039fcbcda2ce71f01fa6adbefaa77040df"
+  integrity sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==
 
 shebang-command@^2.0.0:
   version "2.0.0"
@@ -2620,11 +2619,11 @@ socks-proxy-agent@^8.0.3:
     socks "^2.8.3"
 
 socks@^2.8.3:
-  version "2.8.7"
-  resolved "https://registry.yarnpkg.com/socks/-/socks-2.8.7.tgz#e2fb1d9a603add75050a2067db8c381a0b5669ea"
-  integrity sha512-HLpt+uLy/pxB+bum/9DzAgiKS8CX1EvbWxI4zlmgGCExImLdiad2iCwXT5Z4c9c3Eq8rP2318mPW2c+QbtjK8A==
+  version "2.8.9"
+  resolved "https://registry.yarnpkg.com/socks/-/socks-2.8.9.tgz#aa5f130ca0f88a43fa44faf4869c50d22aa27752"
+  integrity sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw==
   dependencies:
-    ip-address "^10.0.1"
+    ip-address "^10.1.1"
     smart-buffer "^4.2.0"
 
 source-map@^0.6.1:
@@ -2798,10 +2797,10 @@ tagged-tag@^1.0.0:
   resolved "https://registry.yarnpkg.com/tagged-tag/-/tagged-tag-1.0.0.tgz#a0b5917c2864cba54841495abfa3f6b13edcf4d6"
   integrity sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng==
 
-tar@^7.4.3, tar@^7.5.1, tar@^7.5.11, tar@^7.5.4:
-  version "7.5.13"
-  resolved "https://registry.yarnpkg.com/tar/-/tar-7.5.13.tgz#0d214ed56781a26edc313581c0e2d929ceeb866d"
-  integrity sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==
+tar@^7.4.3, tar@^7.5.1, tar@^7.5.13, tar@^7.5.4:
+  version "7.5.15"
+  resolved "https://registry.yarnpkg.com/tar/-/tar-7.5.15.tgz#afe6d1316cddf614a566e3813e42fe01aed46fee"
+  integrity sha512-dzGK0boVlC4W5QFuQN1EFSl3bIDYsk7Tj40U6eIBnK2k/8ml7TZ5agbI5j5+qnoVcAA+rNtBml8SEiLxZpNqRQ==
   dependencies:
     "@isaacs/fs-minipass" "^4.0.0"
     chownr "^3.0.0"
@@ -2918,9 +2917,9 @@ type-fest@^4.39.1, type-fest@^4.6.0:
   integrity sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==
 
 type-fest@^5.2.0, type-fest@^5.4.4:
-  version "5.5.0"
-  resolved "https://registry.yarnpkg.com/type-fest/-/type-fest-5.5.0.tgz#78fca72f3a1f9ec964e6ae260db492b070c56f3b"
-  integrity sha512-PlBfpQwiUvGViBNX84Yxwjsdhd1TUlXr6zjX7eoirtCPIr08NAmxwa+fcYBTeRQxHo9YC9wwF3m9i700sHma8g==
+  version "5.6.0"
+  resolved "https://registry.yarnpkg.com/type-fest/-/type-fest-5.6.0.tgz#502f7a003b7309e96a7e17052cc2ab2c7e5c7a31"
+  integrity sha512-8ZiHFm91orbSAe2PSAiSVBVko18pbhbiB3U9GglSzF/zCGkR+rxpHx6sEMCUm4kxY4LjDIUGgCfUMtwfZfjfUA==
   dependencies:
     tagged-tag "^1.0.0"
 
@@ -2929,7 +2928,7 @@ uglify-js@^3.1.4:
   resolved "https://registry.yarnpkg.com/uglify-js/-/uglify-js-3.19.3.tgz#82315e9bbc6f2b25888858acd1fff8441035b77f"
   integrity sha512-v3Xu+yuwBXisp6QYTcH4UbH+xYJXqnq2m/LtQVWKWzYc1iehYnLixoQDN9FH6/j9/oybfd6W9Ghwkl8+UMKTKQ==
 
-undici@^6.23.0:
+undici@^6.23.0, undici@^6.25.0:
   version "6.25.0"
   resolved "https://registry.yarnpkg.com/undici/-/undici-6.25.0.tgz#8c4efb8c998dc187fc1cfb5dde1ef19a211849fb"
   integrity sha512-ZgpWDC5gmNiuY9CnLVXEH8rl50xhRCuLNA97fAUnKi8RRuV4E6KG31pDTsLVUKnohJE0I3XDrTeEydAXRw47xg==

From 35b3072f6ce7af96612a2a6f5282d7a38b55cfa5 Mon Sep 17 00:00:00 2001
From: AndrewWinterman <113374170+AndrewWinterman@users.noreply.github.com>
Date: Mon, 18 May 2026 10:41:58 -0700
Subject: [PATCH 04/16] fix(golangci-lint): add path-prefix flag (#1143)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With this change, linter errors have paths from workspace root rather
than scripts subdir.

On 4fda58f2291d0dd22caca57e518596c8e3f3df20

```
part-chunk-index  feature/part-chunk-index ❯ make lint
GOPROXY= GOPRIVATE=github.com/getoutreach/* OUTREACH_ACCOUNTS_BASE_URL=https://accounts.outreach-dev.com SKIP_VALIDATE= SKIP_LINTERS= OSS=false TEST_TAGS=or_test ./scripts/shell-wrapper.sh mise.sh exec -- ./scripts/shell-wrapper.sh linters
.sh
 :: Running linters
    -> shellcheck (.sh,.bash,.bats)
    -> shellcheck (.sh,.bash,.bats) (0.818s)t is mise-managed
    -> shellfmt (.sh,.bash,.bats)
    -> shellfmt (.sh,.bash,.bats) (0.548s)s mise-managed
    -> go mod tidy (.go) (0.576s)
    -> golangci-lint (.go)
internal/blobs/blobs.go:377:21: SA5009: Printf format %s has arg #3 of wrong type github.com/getoutreach/polaroid/internal/polaroids3.Key (staticcheck)
                        URL: fmt.Sprintf("s3-%s://%s/%s",
                                         ^
1 issues:
* staticcheck: 1
    -> golangci-lint (.go) (10.392s)
Error: linter failed to run. Please check the logs, 'make fmt' may help in some cases.
make: *** [lint] Error 1
```

On curent main:

part-chunk-index  feature/part-chunk-index ❯ make lint
GOPROXY= GOPRIVATE=github.com/getoutreach/* OUTREACH_ACCOUNTS_BASE_URL=https://accounts.outreach-dev.com SKIP_VALIDATE= SKIP_LINTERS= OSS=false TEST_TAGS=or_test ./scripts/shell-wrapper.sh mise.sh exec -- ./scripts/shell-wrapper.sh linters.sh
 :: Running linters
    -> shellcheck (.sh,.bash,.bats)
    -> shellcheck (.sh,.bash,.bats) (1.113s)t is mise-managed
    -> shellfmt (.sh,.bash,.bats)
    -> shellfmt (.sh,.bash,.bats) (0.893s)s mise-managed
    -> go mod tidy (.go) (0.595s)
    -> golangci-lint (.go)
../internal/blobs/blobs.go:377:21: SA5009: Printf format %s has arg #3 of wrong type github.com/getoutreach/polaroid/internal/polaroids3.Key (staticcheck)
                        URL: fmt.Sprintf("s3-%s://%s/%s",
                                         ^
1 issues:
* staticcheck: 1
    -> golangci-lint (.go) (4.277s)
Error: linter failed to run. Please check the logs, 'make fmt' may help in some cases.
make: *** [lint] Error 1
---
 shell/golangci-lint.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/shell/golangci-lint.sh b/shell/golangci-lint.sh
index c85794c0..8ab540e0 100755
--- a/shell/golangci-lint.sh
+++ b/shell/golangci-lint.sh
@@ -89,6 +89,7 @@ if [[ -n $needRunFlags || -n $needConfigFlag ]]; then
     fatal "$errMsg"
   fi
   args+=("--config=${configPath}")
+  args+=("--path-prefix=$(basename "$workspaceFolder")")
 fi
 
 # If GOGC or GOMEMLIMIT aren't set, we attempt to set them to better

From cae9e6f149f3907ceacaeb93b8b2e9f635a5cbe1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 19 May 2026 11:19:56 -0700
Subject: [PATCH 05/16] chore(deps): bump google.golang.org/grpc from 1.80.0 to
 1.81.0 (#1145)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.80.0 to 1.81.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.80.0...v1.81.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.81.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 10 +++++-----
 go.sum | 24 ++++++++++++------------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/go.mod b/go.mod
index 043b5660..e8019d84 100644
--- a/go.mod
+++ b/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/magefile/mage v1.17.2
 	github.com/pkg/errors v0.9.1
 	github.com/rs/zerolog v1.35.1
-	google.golang.org/grpc v1.80.0
+	google.golang.org/grpc v1.81.0
 	gopkg.in/yaml.v2 v2.4.0
 	gotest.tools/v3 v3.5.2
 )
@@ -68,12 +68,12 @@ require (
 	github.com/zalando/go-keyring v0.2.6 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
-	go.opentelemetry.io/otel v1.42.0 // indirect
+	go.opentelemetry.io/otel v1.43.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
-	go.opentelemetry.io/otel/metric v1.42.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.42.0 // indirect
-	go.opentelemetry.io/otel/trace v1.42.0 // indirect
+	go.opentelemetry.io/otel/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
+	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	golang.org/x/crypto v0.49.0 // indirect
diff --git a/go.sum b/go.sum
index 84dc86b0..58624618 100644
--- a/go.sum
+++ b/go.sum
@@ -168,20 +168,20 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
-go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
-go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU=
-go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
-go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
-go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
-go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
-go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
-go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
-go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
-go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
+go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
+go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
 go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
 go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -242,8 +242,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c h1:
 google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c/go.mod h1:X2gu9Qwng7Nn009s/r3RUxqkzQNqOrAy79bluY7ojIg=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c h1:xgCzyF2LFIO/0X2UAoVRiXKU5Xg6VjToG4i2/ecSswk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
-google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/grpc v1.81.0 h1:W3G9N3KQf3BU+YuCtGKJk0CmxQNbAISICD/9AORxLIw=
+google.golang.org/grpc v1.81.0/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

From 88f725231820e84d8e0fa9bf525c3d6b63e100af Mon Sep 17 00:00:00 2001
From: Outreach CI <outreach-ci@outreach.io>
Date: Tue, 19 May 2026 19:05:26 +0000
Subject: [PATCH 06/16] chore: Release


From dc0bf46632ede6f6e8b79bf45125da7a1a4111d3 Mon Sep 17 00:00:00 2001
From: Egor Kalinichev <egor.kalinichev@outreach.io>
Date: Thu, 21 May 2026 16:21:34 +0200
Subject: [PATCH 07/16] feat: switch to Gen2 CircleCI executors (#1150)

* feat: switch to Gen2 CircleCI executors

* fix: accidentally commited file
---
 orbs/shared/jobs/docker_amd64.yaml       | 2 +-
 orbs/shared/jobs/docker_stitch.yaml      | 2 +-
 orbs/shared/jobs/e2e.yaml                | 2 +-
 orbs/shared/jobs/pre-release.yaml        | 2 +-
 orbs/shared/jobs/release.yaml            | 2 +-
 orbs/shared/jobs/save_cache.yaml         | 2 +-
 orbs/shared/jobs/save_e2e_cache.yaml     | 2 +-
 orbs/shared/jobs/test.yaml               | 2 +-
 orbs/shared/jobs/trigger_rc_release.yaml | 2 +-
 9 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/orbs/shared/jobs/docker_amd64.yaml b/orbs/shared/jobs/docker_amd64.yaml
index 951ae66f..c8b16790 100644
--- a/orbs/shared/jobs/docker_amd64.yaml
+++ b/orbs/shared/jobs/docker_amd64.yaml
@@ -3,7 +3,7 @@ executor:
   name: testbed-docker-aws
   docker_image: $DOCKER_PULL_REGISTRY_URL/bootstrap/ci-docker
   docker_tag: latest
-resource_class: xlarge
+resource_class: xlarge.gen2
 parameters:
   push_registries:
     type: string
diff --git a/orbs/shared/jobs/docker_stitch.yaml b/orbs/shared/jobs/docker_stitch.yaml
index 0d210a1a..8f20f48f 100644
--- a/orbs/shared/jobs/docker_stitch.yaml
+++ b/orbs/shared/jobs/docker_stitch.yaml
@@ -3,7 +3,7 @@ executor:
   name: testbed-docker-aws
   docker_image: $DOCKER_PULL_REGISTRY_URL/bootstrap/ci-docker
   docker_tag: latest
-resource_class: medium
+resource_class: medium.gen2
 parameters:
   push_registries:
     type: string
diff --git a/orbs/shared/jobs/e2e.yaml b/orbs/shared/jobs/e2e.yaml
index 3afaa9ce..4322914e 100644
--- a/orbs/shared/jobs/e2e.yaml
+++ b/orbs/shared/jobs/e2e.yaml
@@ -15,7 +15,7 @@ parameters:
   resource_class:
     description: The resource class to use for the e2e tests
     type: string
-    default: "xlarge"
+    default: "xlarge.gen2"
   no_output_timeout:
     description: The timeout that gets applied when CircleCI receives no output during the running of e2e tests.
     type: string
diff --git a/orbs/shared/jobs/pre-release.yaml b/orbs/shared/jobs/pre-release.yaml
index 7b0f9ade..8823bd69 100644
--- a/orbs/shared/jobs/pre-release.yaml
+++ b/orbs/shared/jobs/pre-release.yaml
@@ -15,7 +15,7 @@ parameters:
   resource_class:
     description: The resource class to use for the release
     type: string
-    default: "large"
+    default: "large.gen2"
   release_failure_slack_channel:
     description: The slack channel to notify if the release fails
     type: string
diff --git a/orbs/shared/jobs/release.yaml b/orbs/shared/jobs/release.yaml
index 36dea9dc..27d6cb35 100644
--- a/orbs/shared/jobs/release.yaml
+++ b/orbs/shared/jobs/release.yaml
@@ -15,7 +15,7 @@ parameters:
   resource_class:
     description: The resource class to use for the release
     type: string
-    default: "large"
+    default: "large.gen2"
   release_failure_slack_channel:
     description: The slack channel to notify if the release fails
     type: string
diff --git a/orbs/shared/jobs/save_cache.yaml b/orbs/shared/jobs/save_cache.yaml
index c86ad468..2eea726e 100644
--- a/orbs/shared/jobs/save_cache.yaml
+++ b/orbs/shared/jobs/save_cache.yaml
@@ -18,7 +18,7 @@ parameters:
   resource_class:
     description: The resource class to use for the release
     type: string
-    default: "large"
+    default: "large.gen2"
   docker_image:
     description: The docker image to use for running the test
     type: string
diff --git a/orbs/shared/jobs/save_e2e_cache.yaml b/orbs/shared/jobs/save_e2e_cache.yaml
index 45f2446a..91bd67bf 100644
--- a/orbs/shared/jobs/save_e2e_cache.yaml
+++ b/orbs/shared/jobs/save_e2e_cache.yaml
@@ -21,7 +21,7 @@ parameters:
   resource_class:
     description: Unused, needed so that it can be run with *rebuild-cache workflows
     type: string
-    default: "large"
+    default: "large.gen2"
   docker_image:
     description: Unused, needed so that it can be run with *rebuild-cache workflows
     type: string
diff --git a/orbs/shared/jobs/test.yaml b/orbs/shared/jobs/test.yaml
index ff11dbd1..a311cc2c 100644
--- a/orbs/shared/jobs/test.yaml
+++ b/orbs/shared/jobs/test.yaml
@@ -18,7 +18,7 @@ parameters:
   resource_class:
     description: The resource class to use for the release
     type: string
-    default: "large"
+    default: "large.gen2"
   no_output_timeout:
     description: The timeout that gets applied when CircleCI receives no output during the running of tests.
     type: string
diff --git a/orbs/shared/jobs/trigger_rc_release.yaml b/orbs/shared/jobs/trigger_rc_release.yaml
index dd7c45e4..a72a48e9 100644
--- a/orbs/shared/jobs/trigger_rc_release.yaml
+++ b/orbs/shared/jobs/trigger_rc_release.yaml
@@ -8,7 +8,7 @@ parameters:
     description: The resource class to use for the release
     type: string
     # This is to trigger the release job, small should be enough
-    default: "small"
+    default: "small.gen2"
   release_failure_slack_channel:
     description: The slack channel to notify if the release fails
     type: string

From 550dbda5abdf85b4e252c0b7408152f2f80afdd0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 21 May 2026 21:35:50 -0700
Subject: [PATCH 08/16] chore(deps): bump google.golang.org/grpc from 1.81.0 to
 1.81.1 (#1149)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.0 to 1.81.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.81.0...v1.81.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.81.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index e8019d84..ba901c53 100644
--- a/go.mod
+++ b/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/magefile/mage v1.17.2
 	github.com/pkg/errors v0.9.1
 	github.com/rs/zerolog v1.35.1
-	google.golang.org/grpc v1.81.0
+	google.golang.org/grpc v1.81.1
 	gopkg.in/yaml.v2 v2.4.0
 	gotest.tools/v3 v3.5.2
 )
diff --git a/go.sum b/go.sum
index 58624618..419c8039 100644
--- a/go.sum
+++ b/go.sum
@@ -242,8 +242,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c h1:
 google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c/go.mod h1:X2gu9Qwng7Nn009s/r3RUxqkzQNqOrAy79bluY7ojIg=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c h1:xgCzyF2LFIO/0X2UAoVRiXKU5Xg6VjToG4i2/ecSswk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.0 h1:W3G9N3KQf3BU+YuCtGKJk0CmxQNbAISICD/9AORxLIw=
-google.golang.org/grpc v1.81.0/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
+google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

From 2218fbad063b0121f925efea003b63d978805c73 Mon Sep 17 00:00:00 2001
From: Mark Lee <malept@users.noreply.github.com>
Date: Fri, 22 May 2026 01:23:56 -0700
Subject: [PATCH 09/16] fix(orb): upgrade machine image to Ubuntu 24.04
 (2026.05.01) (#1151)

---
 orbs/shared/executors/testbed-machine.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/orbs/shared/executors/testbed-machine.yml b/orbs/shared/executors/testbed-machine.yml
index de34aa33..12137f41 100644
--- a/orbs/shared/executors/testbed-machine.yml
+++ b/orbs/shared/executors/testbed-machine.yml
@@ -1,6 +1,6 @@
 description: Standard executor for machine runtimes
 machine:
-  image: ubuntu-2404:2024.11.1
+  image: ubuntu-2404:2026.05.1
   docker_layer_caching: true
 environment:
   TEST_RESULTS: /tmp/test-results

From b8fff2f2a54c818006dd9cb1664069ecc5e0c207 Mon Sep 17 00:00:00 2001
From: Outreach CI <outreach-ci@outreach.io>
Date: Fri, 22 May 2026 15:34:25 +0000
Subject: [PATCH 10/16] chore: Release


From d62e64edbc44be1cd1a19f01104f778b9b19589f Mon Sep 17 00:00:00 2001
From: marnagy <47352326+marnagy@users.noreply.github.com>
Date: Tue, 26 May 2026 17:28:35 +0200
Subject: [PATCH 11/16] fix: use first tool version from .tool-versions when
 multiple are declared (#1147)

---------

Co-authored-by: Mark Lee <malept@users.noreply.github.com>
---
 shell/lib/mise.sh        |  3 +-
 shell/lib/mise_test.bats | 64 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 shell/lib/mise_test.bats

diff --git a/shell/lib/mise.sh b/shell/lib/mise.sh
index 7a0900d4..e128b020 100644
--- a/shell/lib/mise.sh
+++ b/shell/lib/mise.sh
@@ -486,6 +486,7 @@ devbase_tool_version_from_mise() {
 }
 
 # Parse the given tool's version from the given repo's .tool-versions file.
+# When multiple versions of the same tool are declared, only the first is returned.
 # Echoes the version on success; returns 1 (with no output) if the tool is not
 # found, so callers can detect the failure with `||` even when invoked via
 # command substitution (where a `fatal` inside the subshell would not abort
@@ -494,7 +495,7 @@ version_from_toolversions() {
   local repoDir="$1"
   local tool="$2"
   local version
-  version="$(awk -v tool="$tool" '$1 == tool {print $2}' "$repoDir/.tool-versions")"
+  version="$(awk -v tool="$tool" '$1 == tool {print $2; exit}' "$repoDir/.tool-versions")"
   if [[ -z $version ]]; then
     return 1
   fi
diff --git a/shell/lib/mise_test.bats b/shell/lib/mise_test.bats
new file mode 100644
index 00000000..f1ed605c
--- /dev/null
+++ b/shell/lib/mise_test.bats
@@ -0,0 +1,64 @@
+#!/usr/bin/env bats
+
+bats_load_library "bats-support/load.bash"
+bats_load_library "bats-assert/load.bash"
+
+load mise.sh
+load test_helper.sh
+
+setup() {
+  REPO_DIR="$(mktempdir devbase-mise-test-XXXXXX)"
+}
+
+teardown() {
+  rm -rf "$REPO_DIR"
+}
+
+# write_tool_versions [entry...]
+#
+# Write a .tool-versions file in $REPO_DIR with one or more entries.
+write_tool_versions() {
+  printf '%s\n' "$@" >"$REPO_DIR/.tool-versions"
+}
+
+@test "version_from_toolversions returns the version for a single-entry tool" {
+  write_tool_versions "nodejs 20.11.0"
+  run version_from_toolversions "$REPO_DIR" nodejs
+  assert_success
+  assert_output "20.11.0"
+}
+
+@test "version_from_toolversions returns the first version when multiple entries exist for the same tool" {
+  write_tool_versions "nodejs 20.11.0" "nodejs 18.19.0"
+  run version_from_toolversions "$REPO_DIR" nodejs
+  assert_success
+  assert_output "20.11.0"
+}
+
+@test "version_from_toolversions returns failure when tool is not found" {
+  write_tool_versions "golang 1.22.0"
+  run version_from_toolversions "$REPO_DIR" nodejs
+  assert_failure
+  assert_output ""
+}
+
+@test "version_from_toolversions returns failure when .tool-versions is empty" {
+  write_tool_versions
+  run version_from_toolversions "$REPO_DIR" nodejs
+  assert_failure
+  assert_output ""
+}
+
+@test "version_from_toolversions returns the correct tool when multiple different tools are present" {
+  write_tool_versions "golang 1.22.0" "nodejs 20.11.0" "python 3.12.0"
+  run version_from_toolversions "$REPO_DIR" nodejs
+  assert_success
+  assert_output "20.11.0"
+}
+
+@test "version_from_toolversions does not match a tool that is a prefix of another" {
+  write_tool_versions "nodejsextra 16.0.0" "nodejs 20.11.0"
+  run version_from_toolversions "$REPO_DIR" nodejs
+  assert_success
+  assert_output "20.11.0"
+}

From b890b5446c669fd7f536b08a82f4baac07aa2ae2 Mon Sep 17 00:00:00 2001
From: Outreach CI <outreach-ci@outreach.io>
Date: Tue, 26 May 2026 19:04:19 +0000
Subject: [PATCH 12/16] chore: Release


From b260ed7154016bfb50c8fe98242ca2bc8c653346 Mon Sep 17 00:00:00 2001
From: Mark Lee <malept@users.noreply.github.com>
Date: Thu, 28 May 2026 13:42:44 -0700
Subject: [PATCH 13/16] fix(release): set up gh-based git credentials (#1152)

---
 shell/ci/release/dryrun.sh      | 4 +++-
 shell/ci/release/pre-release.sh | 4 +++-
 shell/ci/release/release.sh     | 4 +++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/shell/ci/release/dryrun.sh b/shell/ci/release/dryrun.sh
index bf9b95f7..44ed113b 100755
--- a/shell/ci/release/dryrun.sh
+++ b/shell/ci/release/dryrun.sh
@@ -60,9 +60,11 @@ if ! git diff --quiet "$OLD_CIRCLE_BRANCH"; then
 
   GITHUB_TOKEN="$(github_token)"
   if [[ -z $GITHUB_TOKEN ]]; then
-    warn "Failed to read Github personal access token" >&2
+    warn "Failed to read GitHub token" >&2
   fi
 
+  run_gh auth setup-git
+
   MISE_GITHUB_TOKEN="$GITHUB_TOKEN" GH_TOKEN="$GITHUB_TOKEN" \
     yarn --frozen-lockfile semantic-release --dry-run
 
diff --git a/shell/ci/release/pre-release.sh b/shell/ci/release/pre-release.sh
index 70356c9a..564d79af 100755
--- a/shell/ci/release/pre-release.sh
+++ b/shell/ci/release/pre-release.sh
@@ -70,6 +70,8 @@ if [[ $CIRCLE_BRANCH != "$prereleasesBranch" ]] && [[ $DRYRUN == "false" ]]; the
   exit 0
 fi
 
+run_gh auth setup-git
+
 # If we're in dry-run mode, skip creating the release.
 if [[ $DRYRUN == "true" ]]; then
   exit 0
@@ -85,7 +87,7 @@ if [[ $COMMIT_MESSAGE =~ "chore: Release" ]]; then
   # Retrieve the GH_TOKEN
   GH_TOKEN=$(github_token)
   if [[ -z $GH_TOKEN ]]; then
-    echo "Failed to read Github personal access token" >&2
+    echo "Failed to read GitHub token" >&2
   fi
   # Unset NPM_TOKEN to force it to use the configured ~/.npmrc
   NPM_TOKEN='' GH_TOKEN=$GH_TOKEN \
diff --git a/shell/ci/release/release.sh b/shell/ci/release/release.sh
index 3a4e6e84..91e55cfa 100755
--- a/shell/ci/release/release.sh
+++ b/shell/ci/release/release.sh
@@ -14,9 +14,11 @@ source "${LIB_DIR}/logging.sh"
 # Retrieve the GH_TOKEN
 GITHUB_TOKEN="$(github_token)"
 if [[ -z $GITHUB_TOKEN ]]; then
-  error "Failed to read GitHub personal access token"
+  error "Failed to read GitHub token"
 fi
 
+run_gh auth setup-git
+
 send_failure_notification() {
   if [[ -z $RELEASE_FAILURE_SLACK_CHANNEL ]]; then
     fatal "Failed to release"

From 91ba3e60e0c2a63d20b6cb7ac6d906071946be59 Mon Sep 17 00:00:00 2001
From: Outreach CI <outreach-ci@outreach.io>
Date: Thu, 28 May 2026 20:55:49 +0000
Subject: [PATCH 14/16] chore: Release


From 3526f7fc9a261c63a5849f4a0bb9c00eee752f33 Mon Sep 17 00:00:00 2001
From: Mark Lee <malept@users.noreply.github.com>
Date: Mon, 1 Jun 2026 07:49:39 -0700
Subject: [PATCH 15/16] fix(e2e): add mage to mise tool list (#1153)

---
 mise.e2e.lock | 32 ++++++++++++++++++++++++++++++++
 mise.e2e.toml |  2 ++
 2 files changed, 34 insertions(+)

diff --git a/mise.e2e.lock b/mise.e2e.lock
index 7362c004..696d409c 100644
--- a/mise.e2e.lock
+++ b/mise.e2e.lock
@@ -257,6 +257,38 @@ url = "https://dl.k8s.io/v1.34.7/bin/darwin/amd64/kubectl"
 checksum = "sha256:cd158f0f6e4e7624a7d82706d13b9fa8c70aa3026658217a2cf260d0933c4aa9"
 url = "https://dl.k8s.io/v1.34.7/bin/windows/amd64/kubectl.exe"
 
+[[tools.mage]]
+version = "1.14.0"
+backend = "aqua:magefile/mage"
+
+[tools.mage."platforms.linux-arm64"]
+checksum = "sha256:f9ad70938fbaf15233a574b89f7fa41566102f18114eab9b2aa37d64ad7f21de"
+url = "https://github.com/magefile/mage/releases/download/v1.14.0/mage_1.14.0_Linux-ARM64.tar.gz"
+
+[tools.mage."platforms.linux-arm64-musl"]
+checksum = "sha256:f9ad70938fbaf15233a574b89f7fa41566102f18114eab9b2aa37d64ad7f21de"
+url = "https://github.com/magefile/mage/releases/download/v1.14.0/mage_1.14.0_Linux-ARM64.tar.gz"
+
+[tools.mage."platforms.linux-x64"]
+checksum = "sha256:a9eb55344ccf6728ab40fe55f809fb7cc0f1085858afd9e594753ed82e59b73f"
+url = "https://github.com/magefile/mage/releases/download/v1.14.0/mage_1.14.0_Linux-64bit.tar.gz"
+
+[tools.mage."platforms.linux-x64-musl"]
+checksum = "sha256:a9eb55344ccf6728ab40fe55f809fb7cc0f1085858afd9e594753ed82e59b73f"
+url = "https://github.com/magefile/mage/releases/download/v1.14.0/mage_1.14.0_Linux-64bit.tar.gz"
+
+[tools.mage."platforms.macos-arm64"]
+checksum = "sha256:4ff2119161d70c94bca2d5f870f566b5cd7f4ed73c94c92c96f83ed650a7c849"
+url = "https://github.com/magefile/mage/releases/download/v1.14.0/mage_1.14.0_macOS-ARM64.tar.gz"
+
+[tools.mage."platforms.macos-x64"]
+checksum = "sha256:f7f4feb2971742caf77fe77553817c2eb9c448422b15a97cc6ab821ce683d610"
+url = "https://github.com/magefile/mage/releases/download/v1.14.0/mage_1.14.0_macOS-64bit.tar.gz"
+
+[tools.mage."platforms.windows-x64"]
+checksum = "sha256:28571e0a50955ea4e5a1596908bf98f5e0c345c6696c836cbd2c42e37b16da29"
+url = "https://github.com/magefile/mage/releases/download/v1.14.0/mage_1.14.0_Windows-64bit.zip"
+
 [[tools.vault]]
 version = "2.0.0"
 backend = "aqua:hashicorp/vault"
diff --git a/mise.e2e.toml b/mise.e2e.toml
index be16f47e..26e7f5bd 100644
--- a/mise.e2e.toml
+++ b/mise.e2e.toml
@@ -15,3 +15,5 @@ vault = "2.0.0"
 gotestsum = "1.13.0"
 # Work around GitHub token rate limits
 wait-for-gh-rate-limit = "1.1.1"
+# Build Go apps/services
+mage = "1.14.0"

From 67b9208002f7bee91cc66641820446bede26f74b Mon Sep 17 00:00:00 2001
From: Outreach CI <outreach-ci@outreach.io>
Date: Mon, 1 Jun 2026 16:32:01 +0000
Subject: [PATCH 16/16] chore: Release