From d0836c642e0e79577099f1f39ea812ffdc099a67 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:43:28 -0700
Subject: [PATCH 1/9] chore: bump actions/checkout from 6 to 7 (#748)

Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/chart.yml                 | 4 ++--
 .github/workflows/ci.yml                    | 4 ++--
 .github/workflows/code-lint.yml             | 6 +++---
 .github/workflows/codeql-analysis.yml       | 2 +-
 .github/workflows/codespell.yml             | 2 +-
 .github/workflows/markdown-lint.yml         | 2 +-
 .github/workflows/release.yml               | 2 +-
 .github/workflows/squad-ci.yml              | 2 +-
 .github/workflows/squad-docs.yml            | 2 +-
 .github/workflows/squad-heartbeat.yml       | 2 +-
 .github/workflows/squad-insider-release.yml | 2 +-
 .github/workflows/squad-issue-assign.yml    | 2 +-
 .github/workflows/squad-label-enforce.yml   | 2 +-
 .github/workflows/squad-preview.yml         | 2 +-
 .github/workflows/squad-promote.yml         | 4 ++--
 .github/workflows/squad-release.yml         | 2 +-
 .github/workflows/squad-triage.yml          | 2 +-
 .github/workflows/sync-squad-labels.yml     | 2 +-
 .github/workflows/trivy.yml                 | 2 +-
 .github/workflows/upgrade.yml               | 6 +++---
 20 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/chart.yml b/.github/workflows/chart.yml
index 4f285b52b..472711a68 100644
--- a/.github/workflows/chart.yml
+++ b/.github/workflows/chart.yml
@@ -39,7 +39,7 @@ jobs:
       group: helm-chart-publish-gh-pages
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: true
           fetch-depth: 0
@@ -56,7 +56,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 790d0c3ec..0a37ee82e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
               
       - name: Set up Ginkgo CLI
         run: |
@@ -118,7 +118,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       
       - name: Install Ginkgo CLI
         run: |
diff --git a/.github/workflows/code-lint.yml b/.github/workflows/code-lint.yml
index e67741c41..296a29060 100644
--- a/.github/workflows/code-lint.yml
+++ b/.github/workflows/code-lint.yml
@@ -42,7 +42,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: true
 
@@ -63,7 +63,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: golangci-lint
         run: make lint
@@ -76,7 +76,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Helm
         uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index b03cef53b..dc1667315 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -38,7 +38,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index f5d349197..f91ea3e47 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -16,7 +16,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.1.7
       - uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # master
         with:
           check_filenames: true
diff --git a/.github/workflows/markdown-lint.yml b/.github/workflows/markdown-lint.yml
index 0fba45539..9cfb00bb2 100644
--- a/.github/workflows/markdown-lint.yml
+++ b/.github/workflows/markdown-lint.yml
@@ -10,7 +10,7 @@ jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
     - uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 # v1
       with:
         # this will only show errors in the output
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 38792e220..21401ea03 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,7 +49,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ needs.export-registry.outputs.tag }}
 
diff --git a/.github/workflows/squad-ci.yml b/.github/workflows/squad-ci.yml
index 923e97d8d..c5e2a3981 100644
--- a/.github/workflows/squad-ci.yml
+++ b/.github/workflows/squad-ci.yml
@@ -15,7 +15,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Build and test
         run: |
diff --git a/.github/workflows/squad-docs.yml b/.github/workflows/squad-docs.yml
index 21e80ae2b..209349bfe 100644
--- a/.github/workflows/squad-docs.yml
+++ b/.github/workflows/squad-docs.yml
@@ -18,7 +18,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Build docs
         run: |
diff --git a/.github/workflows/squad-heartbeat.yml b/.github/workflows/squad-heartbeat.yml
index edc1eac28..2df698756 100644
--- a/.github/workflows/squad-heartbeat.yml
+++ b/.github/workflows/squad-heartbeat.yml
@@ -25,7 +25,7 @@ jobs:
   heartbeat:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Check triage script
         id: check-script
diff --git a/.github/workflows/squad-insider-release.yml b/.github/workflows/squad-insider-release.yml
index c54d0f2e9..c46826aa8 100644
--- a/.github/workflows/squad-insider-release.yml
+++ b/.github/workflows/squad-insider-release.yml
@@ -12,7 +12,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/squad-issue-assign.yml b/.github/workflows/squad-issue-assign.yml
index 0137b6d4e..024ac92bd 100644
--- a/.github/workflows/squad-issue-assign.yml
+++ b/.github/workflows/squad-issue-assign.yml
@@ -14,7 +14,7 @@ jobs:
     if: startsWith(github.event.label.name, 'squad:')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Identify assigned member and trigger work
         uses: actions/github-script@v7
diff --git a/.github/workflows/squad-label-enforce.yml b/.github/workflows/squad-label-enforce.yml
index df6ef8a03..10cce2682 100644
--- a/.github/workflows/squad-label-enforce.yml
+++ b/.github/workflows/squad-label-enforce.yml
@@ -12,7 +12,7 @@ jobs:
   enforce:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Enforce mutual exclusivity
         uses: actions/github-script@v7
diff --git a/.github/workflows/squad-preview.yml b/.github/workflows/squad-preview.yml
index 11465a651..3a2887517 100644
--- a/.github/workflows/squad-preview.yml
+++ b/.github/workflows/squad-preview.yml
@@ -12,7 +12,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Build and test
         run: |
diff --git a/.github/workflows/squad-promote.yml b/.github/workflows/squad-promote.yml
index 2406d51b4..daf829671 100644
--- a/.github/workflows/squad-promote.yml
+++ b/.github/workflows/squad-promote.yml
@@ -18,7 +18,7 @@ jobs:
     name: Promote dev → preview
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -70,7 +70,7 @@ jobs:
     needs: dev-to-preview
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/squad-release.yml b/.github/workflows/squad-release.yml
index 069ba384e..15e6c0e67 100644
--- a/.github/workflows/squad-release.yml
+++ b/.github/workflows/squad-release.yml
@@ -12,7 +12,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/squad-triage.yml b/.github/workflows/squad-triage.yml
index ad50639c6..6a2b5f12a 100644
--- a/.github/workflows/squad-triage.yml
+++ b/.github/workflows/squad-triage.yml
@@ -13,7 +13,7 @@ jobs:
     if: github.event.label.name == 'squad'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Triage issue via Lead agent
         uses: actions/github-script@v7
diff --git a/.github/workflows/sync-squad-labels.yml b/.github/workflows/sync-squad-labels.yml
index 999bed8ef..25cb5b945 100644
--- a/.github/workflows/sync-squad-labels.yml
+++ b/.github/workflows/sync-squad-labels.yml
@@ -15,7 +15,7 @@ jobs:
   sync-labels:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Parse roster and sync labels
         uses: actions/github-script@v7
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 39847d24a..16e680adf 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -44,7 +44,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Login to ${{ env.REGISTRY }}
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
diff --git a/.github/workflows/upgrade.yml b/.github/workflows/upgrade.yml
index e77931bc3..9db234726 100644
--- a/.github/workflows/upgrade.yml
+++ b/.github/workflows/upgrade.yml
@@ -44,7 +44,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Fetch the history of all branches and tags.
           # This is needed for the test suite to switch between releases.
@@ -127,7 +127,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Fetch the history of all branches and tags.
           # This is needed for the test suite to switch between releases.
@@ -210,7 +210,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Fetch the history of all branches and tags.
           # This is needed for the test suite to switch between releases.

From d83bc16cf0634dfac2834aed62e4e8bb5e8ee42e Mon Sep 17 00:00:00 2001
From: Muhammad Haseeb <171536921+haseebnizami@users.noreply.github.com>
Date: Wed, 15 Jul 2026 23:55:19 +0500
Subject: [PATCH 2/9] ci: add actionlint + shellcheck workflow linting (#747)

Signed-off-by: Muhammad Haseeb <171536921+haseebnizami@users.noreply.github.com>
---
 .github/actionlint.yaml               |  3 ++
 .github/workflows/ci.yml              |  4 +--
 .github/workflows/release.yml         |  2 +-
 .github/workflows/setup-release.yml   |  8 +++--
 .github/workflows/squad-heartbeat.yml |  4 +--
 .github/workflows/trivy.yml           | 10 +++---
 .github/workflows/upgrade.yml         | 24 +++++++-------
 .github/workflows/workflow-lint.yml   | 45 +++++++++++++++++++++++++++
 8 files changed, 75 insertions(+), 25 deletions(-)
 create mode 100644 .github/actionlint.yaml
 create mode 100644 .github/workflows/workflow-lint.yml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 000000000..20a8cccf5
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - oracle-vm-16cpu-64gb-x86-64
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0a37ee82e..5a24d79a4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,9 +50,9 @@ jobs:
       
       - name: Prepare necessary environment variables
         run: |
-          echo "CGO_ENABLED=1" >> $GITHUB_ENV
+          echo "CGO_ENABLED=1" >> "$GITHUB_ENV"
           KUBEBUILDER_ASSETS=$(make --silent kubebuilder-assets-path)
-          echo "KUBEBUILDER_ASSETS="$KUBEBUILDER_ASSETS"" >> $GITHUB_ENV
+          echo "KUBEBUILDER_ASSETS=$KUBEBUILDER_ASSETS" >> "$GITHUB_ENV"
 
       # Certain tests that require special setup (e.g., those that should be run with Ginkgo CLI only) will
       # be skipped in this step.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 21401ea03..c446f0865 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -90,7 +90,7 @@ jobs:
           echo "✅ Published images:"
           for IMAGE in ${{ env.HUB_AGENT_IMAGE_NAME }} ${{ env.MEMBER_AGENT_IMAGE_NAME }} ${{ env.REFRESH_TOKEN_IMAGE_NAME }}; do
             echo "  - ${{ env.REGISTRY }}/${IMAGE}:${{ env.TAG }}"
-            if [[ "${{ env.TAG }}" != *-rc.* ]]; then
+            if [[ "${TAG}" != *-rc.* ]]; then
               echo "  - ${{ env.REGISTRY }}/${IMAGE}:${VERSION}"
             fi
           done
diff --git a/.github/workflows/setup-release.yml b/.github/workflows/setup-release.yml
index dfa0a3ef8..ab7aadcaf 100644
--- a/.github/workflows/setup-release.yml
+++ b/.github/workflows/setup-release.yml
@@ -38,7 +38,9 @@ jobs:
                   fi
 
                   # registry must be in lowercase
-                  echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
-                  echo "tag=${TAG}" >> $GITHUB_OUTPUT
-                  echo "version=${TAG#v}" >> $GITHUB_OUTPUT
+                  {
+                    echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr '[:upper:]' '[:lower:]')"
+                    echo "tag=${TAG}"
+                    echo "version=${TAG#v}"
+                  } >> "$GITHUB_OUTPUT"
                   echo "Release tag: ${TAG}, version: ${TAG#v}"
diff --git a/.github/workflows/squad-heartbeat.yml b/.github/workflows/squad-heartbeat.yml
index 2df698756..e572d2116 100644
--- a/.github/workflows/squad-heartbeat.yml
+++ b/.github/workflows/squad-heartbeat.yml
@@ -31,9 +31,9 @@ jobs:
         id: check-script
         run: |
           if [ -f ".squad/templates/ralph-triage.js" ]; then
-            echo "has_script=true" >> $GITHUB_OUTPUT
+            echo "has_script=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_script=false" >> $GITHUB_OUTPUT
+            echo "has_script=false" >> "$GITHUB_OUTPUT"
             echo "⚠️ ralph-triage.js not found — run 'squad upgrade' to install"
           fi
 
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 16e680adf..d2ac0b71b 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -3,9 +3,9 @@ on:
   push:
     branches:
       - main
-  create:
     # Publish semver tags as releases.
-    tags: [ 'v*.*.*' ]
+    tags:
+      - 'v*.*.*'
   workflow_dispatch: {}
 
 permissions:
@@ -31,7 +31,7 @@ jobs:
           # registry must be in lowercase
           # store the images under dev
           # TODO: need to cleanup dev images periodically 
-          echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr [:upper:] [:lower:])"  >> $GITHUB_OUTPUT
+          echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
   scan-images:
     needs: export-registry
     env:
@@ -44,7 +44,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Login to ${{ env.REGISTRY }}
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
@@ -54,7 +54,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: generate image version
-        run: echo IMAGE_VERSION=$(git rev-parse --short=7 HEAD) >> $GITHUB_ENV
+        run: echo "IMAGE_VERSION=$(git rev-parse --short=7 HEAD)" >> "$GITHUB_ENV"
 
       - name: Build and push images to registry with tag ${{ env.IMAGE_VERSION }}
         run: |
diff --git a/.github/workflows/upgrade.yml b/.github/workflows/upgrade.yml
index 9db234726..29e6f5d40 100644
--- a/.github/workflows/upgrade.yml
+++ b/.github/workflows/upgrade.yml
@@ -69,7 +69,7 @@ jobs:
               echo "Fetch all tags..."
 
               git fetch --all
-              GIT_TAG=$(git describe --tags --exclude='*-rc.*' $(git rev-list --tags --exclude='*-rc.*' --max-count=1))
+              GIT_TAG=$(git describe --tags --exclude='*-rc.*' "$(git rev-list --tags --exclude='*-rc.*' --max-count=1)")
           else
               echo "A tag is specified; go back to the state tracked by the specified tag."
               echo "Fetch all tags..."
@@ -77,7 +77,7 @@ jobs:
               git fetch --all
           fi
 
-          git checkout $GIT_TAG
+          git checkout "$GIT_TAG"
           echo "Checked out source code at $GIT_TAG."
 
       - name: Prepare the fleet using the before upgrade version
@@ -86,7 +86,7 @@ jobs:
         # Note that the `git checkout` command below only checks out the `test/upgrade` directory (at
         # the current commit); the rest of the source code is still at the before-upgrade version.
         run: |
-          git checkout $CURRENT_BRANCH -- test/upgrade
+          git checkout "$CURRENT_BRANCH" -- test/upgrade
           cd test/upgrade && chmod +x setup.sh && cd -
           ./test/upgrade/setup.sh 3
         env:
@@ -96,7 +96,7 @@ jobs:
       - name: Travel to the current state
         # Run the test suite from the current version, i.e., the commit that triggered the workflow.
         run: |
-          git checkout $CURRENT_BRANCH
+          git checkout "$CURRENT_BRANCH"
           echo "Checked out source code at $CURRENT_BRANCH."
 
       - name: Run the Before suite
@@ -152,7 +152,7 @@ jobs:
               echo "Fetch all tags..."
 
               git fetch --all
-              GIT_TAG=$(git describe --tags --exclude='*-rc.*' $(git rev-list --tags --exclude='*-rc.*' --max-count=1)) 
+              GIT_TAG=$(git describe --tags --exclude='*-rc.*' "$(git rev-list --tags --exclude='*-rc.*' --max-count=1)") 
           else
               echo "A tag is specified; go back to the state tracked by the specified tag."
               echo "Fetch all tags..."
@@ -160,7 +160,7 @@ jobs:
               git fetch --all
           fi
 
-          git checkout $GIT_TAG
+          git checkout "$GIT_TAG"
           echo "Checked out source code at $GIT_TAG."
 
       - name: Prepare the fleet using the before upgrade version
@@ -169,7 +169,7 @@ jobs:
         # Note that the `git checkout` command below only checks out the `test/upgrade` directory (at
         # the current commit); the rest of the source code is still at the before-upgrade version.
         run: |
-          git checkout $CURRENT_BRANCH -- test/upgrade
+          git checkout "$CURRENT_BRANCH" -- test/upgrade
           cd test/upgrade && chmod +x setup.sh && cd -
           ./test/upgrade/setup.sh 3
         env:
@@ -179,7 +179,7 @@ jobs:
       - name: Travel to the current state
         # Run the test suite from the current version, i.e., the commit that triggered the workflow.
         run: |
-          git checkout $CURRENT_BRANCH
+          git checkout "$CURRENT_BRANCH"
           echo "Checked out source code at $CURRENT_BRANCH."
 
       - name: Run the Before suite
@@ -235,7 +235,7 @@ jobs:
               echo "Fetch all tags..."
 
               git fetch --all
-              GIT_TAG=$(git describe --tags --exclude='*-rc.*' $(git rev-list --tags --exclude='*-rc.*' --max-count=1)) 
+              GIT_TAG=$(git describe --tags --exclude='*-rc.*' "$(git rev-list --tags --exclude='*-rc.*' --max-count=1)") 
           else
               echo "A tag is specified; go back to the state tracked by the specified tag."
               echo "Fetch all tags..."
@@ -243,7 +243,7 @@ jobs:
               git fetch --all
           fi
 
-          git checkout $GIT_TAG
+          git checkout "$GIT_TAG"
           echo "Checked out source code at $GIT_TAG."
 
       - name: Prepare the fleet using the before upgrade version
@@ -252,7 +252,7 @@ jobs:
         # Note that the `git checkout` command below only checks out the `test/upgrade` directory (at
         # the current commit); the rest of the source code is still at the before-upgrade version.
         run: |
-          git checkout $CURRENT_BRANCH -- test/upgrade
+          git checkout "$CURRENT_BRANCH" -- test/upgrade
           cd test/upgrade && chmod +x setup.sh && cd -
           ./test/upgrade/setup.sh 3
         env:
@@ -262,7 +262,7 @@ jobs:
       - name: Travel to the current state
         # Run the test suite from the current version, i.e., the commit that triggered the workflow.
         run: |
-          git checkout $CURRENT_BRANCH
+          git checkout "$CURRENT_BRANCH"
           echo "Checked out source code at $CURRENT_BRANCH."
 
       - name: Run the Before suite
diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml
new file mode 100644
index 000000000..793bbcdcd
--- /dev/null
+++ b/.github/workflows/workflow-lint.yml
@@ -0,0 +1,45 @@
+name: Workflow Lint
+
+on:
+  push:
+    branches: [main, "release-*"]
+    paths:
+      - ".github/workflows/**"
+      - ".github/release.yml"
+  pull_request:
+    branches: [main, "release-*"]
+    paths:
+      - ".github/workflows/**"
+      - ".github/release.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    name: actionlint + shellcheck
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9ca718d3bf646d6534007c269a635b3e54cadf99 # v2.19.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Verify shellcheck is available
+        run: shellcheck --version
+
+      - name: Install actionlint
+        env:
+          ACTIONLINT_VERSION: "1.7.12"
+        run: |
+          curl -sSfL "https://raw.githubusercontent.com/rhysd/actionlint/v${ACTIONLINT_VERSION}/scripts/download-actionlint.bash" -o download-actionlint.bash
+          bash download-actionlint.bash "${ACTIONLINT_VERSION}"
+          rm -f download-actionlint.bash
+          echo "${PWD}" >> "${GITHUB_PATH}"
+
+      - name: Run actionlint
+        run: actionlint -color

From b170abb38608905456e1477f7b67d41b7b234497 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 11:55:45 -0700
Subject: [PATCH 3/9] chore: bump distroless/base from `ab7554b` to `b78832f`
 in /docker (#753)

Bumps distroless/base from `ab7554b` to `b78832f`.

---
updated-dependencies:
- dependency-name: distroless/base
  dependency-version: nonroot
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 docker/hub-agent.Dockerfile     | 2 +-
 docker/member-agent.Dockerfile  | 2 +-
 docker/refresh-token.Dockerfile | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docker/hub-agent.Dockerfile b/docker/hub-agent.Dockerfile
index 759a3d6cb..1aca147cb 100644
--- a/docker/hub-agent.Dockerfile
+++ b/docker/hub-agent.Dockerfile
@@ -23,7 +23,7 @@ RUN CGO_ENABLED=1 GOOS=$GOOS GOARCH=$GOARCH GOEXPERIMENT=systemcrypto GO111MODUL
 
 # Use distroless as minimal base image to package the hubagent binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/base:nonroot@sha256:ab7554b6d07ad354fad31957f8a1a813e65dfb93a8ad160568c79c3f2be6884f
+FROM gcr.io/distroless/base:nonroot@sha256:b78832f41c8128046807c24840ebee4f1c18ba7870eed423d8750c272c15e147
 WORKDIR /
 COPY --from=builder /workspace/hubagent .
 USER 65532:65532
diff --git a/docker/member-agent.Dockerfile b/docker/member-agent.Dockerfile
index 8423f7868..0dc1624d6 100644
--- a/docker/member-agent.Dockerfile
+++ b/docker/member-agent.Dockerfile
@@ -23,7 +23,7 @@ RUN CGO_ENABLED=1 GOOS=$GOOS GOARCH=$GOARCH GOEXPERIMENT=systemcrypto GO111MODUL
 
 # Use distroless as minimal base image to package the memberagent binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/base:nonroot@sha256:ab7554b6d07ad354fad31957f8a1a813e65dfb93a8ad160568c79c3f2be6884f
+FROM gcr.io/distroless/base:nonroot@sha256:b78832f41c8128046807c24840ebee4f1c18ba7870eed423d8750c272c15e147
 WORKDIR /
 COPY --from=builder /workspace/memberagent .
 USER 65532:65532
diff --git a/docker/refresh-token.Dockerfile b/docker/refresh-token.Dockerfile
index 084381678..e9ead78de 100644
--- a/docker/refresh-token.Dockerfile
+++ b/docker/refresh-token.Dockerfile
@@ -26,7 +26,7 @@ RUN CGO_ENABLED=1 GOOS=$GOOS GOARCH=$GOARCH GOEXPERIMENT=systemcrypto GO111MODUL
 
 # Use distroless as minimal base image to package the refreshtoken binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/base:nonroot@sha256:ab7554b6d07ad354fad31957f8a1a813e65dfb93a8ad160568c79c3f2be6884f
+FROM gcr.io/distroless/base:nonroot@sha256:b78832f41c8128046807c24840ebee4f1c18ba7870eed423d8750c272c15e147
 WORKDIR /
 COPY --from=builder /workspace/refreshtoken .
 USER 65532:65532

From c458e9519cee080b6f82cdec47e6faccaa44ea5c Mon Sep 17 00:00:00 2001
From: Yetkin Timocin <ytimocin@microsoft.com>
Date: Tue, 21 Jul 2026 15:55:26 -0700
Subject: [PATCH 4/9] feat: publish a standalone CRD tarball as a release asset
 (#743)

Add a crd-package Make target that bundles the CRDs the charts install
into kubefleet-crds-<tag>.tgz, split into crds/hub and crds/member, with a
portable SHA-256 checksum. A new publish-crds job in release.yml builds the
bundle and attaches it to the GitHub release for the tag, creating the
release as a draft first and publishing it only after the upload succeeds.

Also add a crd-lint target, wired into make reviewable and the helm-lint CI
job, that fails if config/crd/bases and the chart CRD directories drift, so a
newly added CRD cannot be silently dropped from the bundle.

Refs #693

Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/code-lint.yml |  3 +++
 .github/workflows/release.yml   | 46 +++++++++++++++++++++++++++++++++
 .gitignore                      |  4 +++
 Makefile                        | 42 +++++++++++++++++++++++++++++-
 4 files changed, 94 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/code-lint.yml b/.github/workflows/code-lint.yml
index 296a29060..688d1e1a6 100644
--- a/.github/workflows/code-lint.yml
+++ b/.github/workflows/code-lint.yml
@@ -87,3 +87,6 @@ jobs:
         run: |
           helm lint charts/hub-agent
           helm lint charts/member-agent
+
+      - name: Verify chart CRDs cover config/crd/bases
+        run: make crd-verify
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c446f0865..10b9c4375 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -94,3 +94,49 @@ jobs:
               echo "  - ${{ env.REGISTRY }}/${IMAGE}:${VERSION}"
             fi
           done
+
+  # Publish the raw CRDs as a standalone release asset so consumers can install
+  # them without pulling a Helm chart. The bundle carries the unmodified CRDs the
+  # charts install (no downstream-specific labels), split into crds/hub and
+  # crds/member so each set can be applied to the right cluster. Runs after the
+  # images are published so a release is only created once the build succeeds.
+  publish-crds:
+    needs: [export-registry, build-and-publish]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      TAG: ${{ needs.export-registry.outputs.tag }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ needs.export-registry.outputs.tag }}
+
+      - name: Package CRDs
+        run: make crd-package TAG="${TAG}"
+
+      - name: Create or update the release and upload the CRD bundle
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          created_draft=""
+          if ! gh release view "${TAG}" >/dev/null 2>&1; then
+            # Any semver pre-release suffix (-rc.N, -alpha, -beta, ...) is a prerelease.
+            prerelease=""
+            case "${TAG}" in *-*) prerelease="--prerelease" ;; esac
+            # Create as a draft first so a partially uploaded release is never public.
+            gh release create "${TAG}" --title "${TAG}" --generate-notes --draft ${prerelease}
+            created_draft="true"
+          fi
+          gh release upload "${TAG}" \
+            "_crd-package/kubefleet-crds-${TAG}.tgz" \
+            "_crd-package/kubefleet-crds-${TAG}.tgz.sha256" \
+            --clobber
+          # Only publish releases this job created; never flip a maintainer's existing release.
+          if [ "${created_draft}" = "true" ]; then
+            gh release edit "${TAG}" --draft=false
+          elif [ "$(gh release view "${TAG}" --json isDraft --jq .isDraft)" = "true" ]; then
+            echo "::warning::Release ${TAG} already existed as a draft; the CRD bundle was uploaded but the release was left unpublished. Publish it manually."
+          fi
diff --git a/.gitignore b/.gitignore
index 31ff4ed6f..7dba3ac7f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,6 +38,10 @@ ut-coverage.xml
 
 # Helm chart packaging
 .helm-packages/
+
+# CRD release bundle
+_crd-package/
+
 # Squad: ignore runtime state (logs, inbox, sessions)
 .squad/orchestration-log/
 .squad/log/
diff --git a/Makefile b/Makefile
index 210ed1a6e..66f589b70 100644
--- a/Makefile
+++ b/Makefile
@@ -195,7 +195,7 @@ collect-e2e-logs: ## Collect logs from hub and member agent pods after e2e tests
 
 ## reviewable
 .PHONY: reviewable
-reviewable: fmt vet lint staticcheck ## Run all quality checks before PR
+reviewable: fmt vet lint staticcheck crd-verify ## Run all quality checks before PR
 	go mod tidy
 
 ## --------------------------------------
@@ -255,6 +255,46 @@ helm-push: ## Package and push Helm charts to OCI registry
 	helm push .helm-packages/member-agent-$(CHART_VERSION).tgz oci://$(REGISTRY)
 	rm -rf .helm-packages
 
+## --------------------------------------
+## CRD release bundle
+## --------------------------------------
+
+# Directory and artifact names for the standalone CRD release tarball.
+CRD_PACKAGE_DIR ?= _crd-package
+CRD_PACKAGE_NAME ?= kubefleet-crds-$(TAG)
+# Use sha256sum when available (Linux/CI), fall back to shasum (macOS).
+SHA256SUM ?= $(shell command -v sha256sum >/dev/null 2>&1 && echo "sha256sum" || echo "shasum -a 256")
+
+.PHONY: crd-package
+crd-package: ## Package the raw CRDs into a release tarball with a SHA-256 checksum
+	rm -rf $(CRD_PACKAGE_DIR)
+	mkdir -p $(CRD_PACKAGE_DIR)/crds/hub $(CRD_PACKAGE_DIR)/crds/member
+	# Source from the charts' CRD sets (symlinks into config/crd/bases) so the
+	# bundle mirrors exactly what each agent installs: hub-cluster CRDs under
+	# crds/hub, member-cluster CRDs under crds/member. cp -L dereferences the
+	# symlinks so the archive holds the raw CRD YAML, not dangling links.
+	cp -L charts/hub-agent/templates/crds/*.yaml $(CRD_PACKAGE_DIR)/crds/hub/
+	cp -L charts/member-agent/templates/crds/*.yaml $(CRD_PACKAGE_DIR)/crds/member/
+	tar -czf $(CRD_PACKAGE_DIR)/$(CRD_PACKAGE_NAME).tgz -C $(CRD_PACKAGE_DIR) crds
+	cd $(CRD_PACKAGE_DIR) && $(SHA256SUM) $(CRD_PACKAGE_NAME).tgz > $(CRD_PACKAGE_NAME).tgz.sha256
+	@echo "Packaged CRDs into $(CRD_PACKAGE_DIR)/$(CRD_PACKAGE_NAME).tgz"
+
+.PHONY: crd-verify
+crd-verify: ## Verify the chart CRD directories cover every CRD in config/crd/bases
+	@bases="$$(mktemp)"; charts="$$(mktemp)"; \
+	ls config/crd/bases/ | sort > "$$bases"; \
+	{ ls charts/hub-agent/templates/crds/; ls charts/member-agent/templates/crds/; } | sort > "$$charts"; \
+	missing="$$(comm -3 "$$bases" "$$charts")"; \
+	rm -f "$$bases" "$$charts"; \
+	if [ -n "$$missing" ]; then \
+		echo "ERROR: chart CRD directories are out of sync with config/crd/bases."; \
+		echo "Left column = only in config/crd/bases; right column = only in the charts:"; \
+		echo "$$missing"; \
+		echo "If you added a CRD, symlink it into charts/hub-agent/templates/crds/ or charts/member-agent/templates/crds/."; \
+		exit 1; \
+	fi; \
+	echo "crd-verify: chart CRD directories cover all CRDs in config/crd/bases"
+
 # By default, docker buildx create will pull image moby/buildkit:buildx-stable-1 and hit the too many requests error
 .PHONY: docker-buildx-builder
 # Note (chenyu1): the step below sets up emulation for building/running non-native binaries on the host. The original

From 42a1df03b2597ad55ca771c668d0db64aac1aae0 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 10:30:33 -0700
Subject: [PATCH 5/9] fix: bump golang.org/x/net and golang.org/x/text for
 CVE-2026-46600 and CVE-2026-56852 (#758)

fix: bump x/net to v0.56.0 and x/text to v0.39.0 for CVE fixes

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
---
 go.mod | 14 +++++++-------
 go.sum | 28 ++++++++++++++--------------
 2 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/go.mod b/go.mod
index 1891398c2..53277740a 100644
--- a/go.mod
+++ b/go.mod
@@ -22,7 +22,7 @@ require (
 	go.goms.io/fleet-networking v0.3.3
 	go.uber.org/atomic v1.11.0
 	go.uber.org/zap v1.27.0
-	golang.org/x/sync v0.20.0
+	golang.org/x/sync v0.21.0
 	golang.org/x/time v0.11.0
 	gomodules.xyz/jsonpatch/v2 v2.4.0
 	k8s.io/api v0.34.1
@@ -109,14 +109,14 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
 	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect
-	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.29.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/term v0.43.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/term v0.44.0 // indirect
+	golang.org/x/text v0.39.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
diff --git a/go.sum b/go.sum
index 14f6a2a88..eb34b6ebf 100644
--- a/go.sum
+++ b/go.sum
@@ -326,8 +326,8 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -336,35 +336,35 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
 golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
+golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
 golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
 golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

From 030e39c510708a25583cee13ce342b564b35c7c3 Mon Sep 17 00:00:00 2001
From: Britania Rodriguez Reyes <britaniar@microsoft.com>
Date: Wed, 22 Jul 2026 10:50:09 -0700
Subject: [PATCH 6/9] chore: backport kubefleet/main to Azure/fleet

Merge cncf/main into fleet, replace github.com/kubefleet-dev/kubefleet
imports with go.goms.io/fleet, remove new CRD symlinks, and remove
crd-verify target that doesn't apply to fleet's chart structure.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 ...rkgenerator-controller-interface-refactor.md |  4 ++--
 Makefile                                        | 17 +----------------
 README.md                                       |  2 +-
 charts/README.md                                |  2 +-
 docker/hub-agent.Dockerfile                     |  6 +++---
 docker/member-agent.Dockerfile                  |  6 +++---
 docker/refresh-token.Dockerfile                 |  6 +++---
 go.mod                                          |  5 +++--
 go.sum                                          |  4 ++--
 hack/Azure/property-based-scheduling.md         |  8 ++++----
 10 files changed, 23 insertions(+), 37 deletions(-)

diff --git a/.github/.copilot/breadcrumbs/2025-01-06-2200-workgenerator-controller-interface-refactor.md b/.github/.copilot/breadcrumbs/2025-01-06-2200-workgenerator-controller-interface-refactor.md
index 077d36afb..7f4894431 100644
--- a/.github/.copilot/breadcrumbs/2025-01-06-2200-workgenerator-controller-interface-refactor.md
+++ b/.github/.copilot/breadcrumbs/2025-01-06-2200-workgenerator-controller-interface-refactor.md
@@ -189,7 +189,7 @@ The resource snapshot resolver is now fully aligned with the interface refactori
 ### What Was Done
 1. **Fixed Missing Imports**: Added required imports to `binding_resolver.go`
    - Added `"fmt"` import for error formatting
-   - Added `"github.com/kubefleet-dev/kubefleet/pkg/scheduler/queue"` import for `queue.PlacementKey` type
+   - Added `"go.goms.io/fleet/pkg/scheduler/queue"` import for `queue.PlacementKey` type
 
 2. **Compilation Success**: Fixed all compilation errors
    - No more "undefined: queue" errors
@@ -204,7 +204,7 @@ The resource snapshot resolver is now fully aligned with the interface refactori
 ### File Changes Made
 - `/Users/ryanzhang/Workspace/github/kubefleet/pkg/utils/controller/binding_resolver.go`
   - Added missing `"fmt"` import
-  - Added missing `"github.com/kubefleet-dev/kubefleet/pkg/scheduler/queue"` import
+  - Added missing `"go.goms.io/fleet/pkg/scheduler/queue"` import
 
 ### Status
 ✅ **ALL CONTROLLER UTILITY TESTS PASSING**: No test failures found
diff --git a/Makefile b/Makefile
index b4164b946..3358d00e9 100644
--- a/Makefile
+++ b/Makefile
@@ -237,7 +237,7 @@ collect-e2e-logs: ## Collect logs from hub and member agent pods after e2e tests
 
 ## reviewable
 .PHONY: reviewable
-reviewable: fmt vet lint staticcheck crd-verify ## Run all quality checks before PR
+reviewable: fmt vet lint staticcheck ## Run all quality checks before PR
 	go mod tidy
 
 ## --------------------------------------
@@ -334,21 +334,6 @@ crd-package: ## Package the raw CRDs into a release tarball with a SHA-256 check
 	cd $(CRD_PACKAGE_DIR) && $(SHA256SUM) $(CRD_PACKAGE_NAME).tgz > $(CRD_PACKAGE_NAME).tgz.sha256
 	@echo "Packaged CRDs into $(CRD_PACKAGE_DIR)/$(CRD_PACKAGE_NAME).tgz"
 
-.PHONY: crd-verify
-crd-verify: ## Verify the chart CRD directories cover every CRD in config/crd/bases
-	@bases="$$(mktemp)"; charts="$$(mktemp)"; \
-	ls config/crd/bases/ | sort > "$$bases"; \
-	{ ls charts/hub-agent/templates/crds/; ls charts/member-agent/templates/crds/; } | sort > "$$charts"; \
-	missing="$$(comm -3 "$$bases" "$$charts")"; \
-	rm -f "$$bases" "$$charts"; \
-	if [ -n "$$missing" ]; then \
-		echo "ERROR: chart CRD directories are out of sync with config/crd/bases."; \
-		echo "Left column = only in config/crd/bases; right column = only in the charts:"; \
-		echo "$$missing"; \
-		echo "If you added a CRD, symlink it into charts/hub-agent/templates/crds/ or charts/member-agent/templates/crds/."; \
-		exit 1; \
-	fi; \
-	echo "crd-verify: chart CRD directories cover all CRDs in config/crd/bases"
 
 # By default, docker buildx create will pull image moby/buildkit:buildx-stable-1 and hit the too many requests error
 #
diff --git a/README.md b/README.md
index 73e5ffaa6..ee95a8283 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@ To learn more about KubeFleet go to the [KubeFleet documentation](https://kubefl
 
 You can reach the KubeFleet community and developers via the following channels:
 
-* Q & A: [GitHub Discussions](https://github.com/kubefleet-dev/kubefleet/discussions)
+* Q & A: [GitHub Discussions](https://go.goms.io/fleet/discussions)
 * Slack: [The #KubeFleet Slack channel](https://cloud-native.slack.com/archives/C08KR7589R8) 
 * Mailing list: [mailing list](https://groups.google.com/g/kubefleet-dev)
 
diff --git a/charts/README.md b/charts/README.md
index da0068a4b..7456a8759 100644
--- a/charts/README.md
+++ b/charts/README.md
@@ -187,4 +187,4 @@ When making changes to charts:
 For issues or questions about KubeFleet Helm charts, please:
 - Check the [main documentation](https://kubefleet.dev/docs/)
 - Review chart-specific READMEs
-- Open an issue in the [GitHub repository](https://github.com/kubefleet-dev/kubefleet/issues)
+- Open an issue in the [GitHub repository](https://go.goms.io/fleet/issues)
diff --git a/docker/hub-agent.Dockerfile b/docker/hub-agent.Dockerfile
index ac01c253a..ccd52829a 100644
--- a/docker/hub-agent.Dockerfile
+++ b/docker/hub-agent.Dockerfile
@@ -21,9 +21,9 @@ COPY pkg/ pkg/
 RUN echo "Building for GOOS=$GOOS GOARCH=$GOARCH"
 RUN CGO_ENABLED=1 GOOS=$GOOS GOARCH=$GOARCH GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o hubagent  cmd/hubagent/main.go
 
-# Use distroless as minimal base image to package the hubagent binary
-# Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/base:nonroot@sha256:b78832f41c8128046807c24840ebee4f1c18ba7870eed423d8750c272c15e147
+# Use Azure Linux distroless base image to package the hubagent binary
+# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/base/about for more details
+FROM mcr.microsoft.com/azurelinux/distroless/base:3.0
 WORKDIR /
 COPY --from=builder /workspace/hubagent .
 USER 65532:65532
diff --git a/docker/member-agent.Dockerfile b/docker/member-agent.Dockerfile
index 0dc1624d6..362c61418 100644
--- a/docker/member-agent.Dockerfile
+++ b/docker/member-agent.Dockerfile
@@ -21,9 +21,9 @@ COPY pkg/ pkg/
 RUN echo "Building images with GOOS=$GOOS GOARCH=$GOARCH"
 RUN CGO_ENABLED=1 GOOS=$GOOS GOARCH=$GOARCH GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o memberagent cmd/memberagent/main.go
 
-# Use distroless as minimal base image to package the memberagent binary
-# Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/base:nonroot@sha256:b78832f41c8128046807c24840ebee4f1c18ba7870eed423d8750c272c15e147
+# Use Azure Linux distroless base image to package the memberagent binary
+# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/base/about for more details
+FROM mcr.microsoft.com/azurelinux/distroless/base:3.0
 WORKDIR /
 COPY --from=builder /workspace/memberagent .
 USER 65532:65532
diff --git a/docker/refresh-token.Dockerfile b/docker/refresh-token.Dockerfile
index e9ead78de..189751804 100644
--- a/docker/refresh-token.Dockerfile
+++ b/docker/refresh-token.Dockerfile
@@ -24,9 +24,9 @@ ARG TARGETARCH
 RUN echo "Building images with GOOS=${GOOS} GOARCH=${GOARCH}"
 RUN CGO_ENABLED=1 GOOS=$GOOS GOARCH=$GOARCH GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o refreshtoken main.go
 
-# Use distroless as minimal base image to package the refreshtoken binary
-# Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/base:nonroot@sha256:b78832f41c8128046807c24840ebee4f1c18ba7870eed423d8750c272c15e147
+# Use Azure Linux distroless base image to package the refreshtoken binary
+# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/base/about for more details
+FROM mcr.microsoft.com/azurelinux/distroless/base:3.0
 WORKDIR /
 COPY --from=builder /workspace/refreshtoken .
 USER 65532:65532
diff --git a/go.mod b/go.mod
index 6cb57fbc4..e4eaec236 100644
--- a/go.mod
+++ b/go.mod
@@ -116,12 +116,13 @@ require (
 	golang.org/x/crypto v0.53.0 // indirect
 	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect
 	golang.org/x/net v0.56.0 // indirect
-	golang.org/x/oauth2 v0.29.0 // indirect
+	golang.org/x/oauth2 v0.34.0 // indirect
 	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/term v0.44.0 // indirect
 	golang.org/x/text v0.39.0 // indirect
 	golang.org/x/tools v0.47.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/go.sum b/go.sum
index 5251863e9..197826168 100644
--- a/go.sum
+++ b/go.sum
@@ -344,8 +344,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
 golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
-golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
-golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
+golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
diff --git a/hack/Azure/property-based-scheduling.md b/hack/Azure/property-based-scheduling.md
index 41645abe9..ec5026889 100644
--- a/hack/Azure/property-based-scheduling.md
+++ b/hack/Azure/property-based-scheduling.md
@@ -103,7 +103,7 @@ To set up Fleet using the clusters you just created, you will need to install Fl
 First, clone the Fleet source code repository, which contains the Helm charts used for Fleet agent installation:
 
 ```sh
-git clone https://github.com/kubefleet-dev/kubefleet.git
+git clone https://go.goms.io/fleet.git
 cd fleet
 git checkout demo
 ```
@@ -409,7 +409,7 @@ spec:
 EOF
 ```
 
-The CRP API enables great flexibility; you can set up different requirements/preferences in combination, such as finding all clusters with at least 5 nodes and 10 available CPU cores, or 4 of all the clusters with the cheapest memory cost and the most amount of available memory. [Read Fleet's API definition to learn more](https://github.com/kubefleet-dev/kubefleet/blob/main/apis/placement/v1beta1/clusterresourceplacement_types.go).
+The CRP API enables great flexibility; you can set up different requirements/preferences in combination, such as finding all clusters with at least 5 nodes and 10 available CPU cores, or 4 of all the clusters with the cheapest memory cost and the most amount of available memory. [Read Fleet's API definition to learn more](https://go.goms.io/fleet/blob/main/apis/placement/v1beta1/clusterresourceplacement_types.go).
 
 ## Clean things up
 
@@ -423,9 +423,9 @@ All the AKS clusters in the resource group will be removed.
 
 ## What's next
 
-Congrats! We hope that property-based scheduling (preview) has improved your overall Fleet experience. If you have any questions, feedback, or concerns, please raise [a GitHub issue](https://github.com/kubefleet-dev/kubefleet/issues).
+Congrats! We hope that property-based scheduling (preview) has improved your overall Fleet experience. If you have any questions, feedback, or concerns, please raise [a GitHub issue](https://go.goms.io/fleet/issues).
 
 Aside from property-based scheduling, Fleet offers many other scheduling features that are useful in a
 multi-cluster environment; check out the [How-to Guide: Using the Fleet `ClusterResourcePlacement` API](https://kubefleet.dev/docs/how-tos/crp/) for more information.
 
-You can also review Fleet's [source code](https://github.com/kubefleet-dev/kubefleet/) or review its [documentation](https://kubefleet.dev/docs/) on GitHub.
+You can also review Fleet's [source code](https://go.goms.io/fleet/) or review its [documentation](https://kubefleet.dev/docs/) on GitHub.

From a4fa01d64c8b91466c15c2a943bbdf066a130591 Mon Sep 17 00:00:00 2001
From: Britania Rodriguez Reyes <britaniar@microsoft.com>
Date: Wed, 22 Jul 2026 11:56:16 -0700
Subject: [PATCH 7/9] fix: resolve actionlint errors in workflow files

- Add 1ES pool labels to actionlint.yaml config
- Fix publish-image.yml: replace invalid 'create' event tags filter with
  push tags trigger
- Update ubuntu-20.04 to ubuntu-latest in publish-image.yml

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/actionlint.yaml             | 2 ++
 .github/workflows/publish-image.yml | 6 ++----
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 20a8cccf5..544b852db 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -1,3 +1,5 @@
 self-hosted-runner:
   labels:
     - oracle-vm-16cpu-64gb-x86-64
+    - 1ES.Pool=1es-aks-fleet-pool-ubuntu
+    - 1ES.Pool=1es-aks-fleet-pool-ubuntu-arm64
diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index c78a90e62..44c3d7e44 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -4,8 +4,6 @@ on:
   push:
     branches:
       - main
-  create:
-     # Publish semver tags as releases.
     tags: [ 'v*.*.*' ]
 
 permissions:
@@ -23,7 +21,7 @@ env:
 
 jobs:
   export-registry:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     outputs:
       registry: ${{ steps.export.outputs.registry }}
     steps:
@@ -35,7 +33,7 @@ jobs:
     needs: export-registry
     env:
       REGISTRY: ${{ needs.export-registry.outputs.registry }}
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
         with:

From de99bb2f6c3e1add141ed3f03d57dedb580235eb Mon Sep 17 00:00:00 2001
From: Britania Rodriguez Reyes <britaniar@microsoft.com>
Date: Wed, 22 Jul 2026 12:00:40 -0700
Subject: [PATCH 8/9] fix: remove kubefleet-specific crd-verify and crd-package
 from CI

- Remove crd-verify step from code-lint.yml (fleet uses different chart structure)
- Remove publish-crds job from release.yml (depends on removed crd-package target)
- Remove crd-package Makefile target (references non-existent member-agent CRDs dir)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/code-lint.yml |  3 ---
 .github/workflows/release.yml   | 46 ---------------------------------
 Makefile                        | 23 -----------------
 3 files changed, 72 deletions(-)

diff --git a/.github/workflows/code-lint.yml b/.github/workflows/code-lint.yml
index 688d1e1a6..296a29060 100644
--- a/.github/workflows/code-lint.yml
+++ b/.github/workflows/code-lint.yml
@@ -87,6 +87,3 @@ jobs:
         run: |
           helm lint charts/hub-agent
           helm lint charts/member-agent
-
-      - name: Verify chart CRDs cover config/crd/bases
-        run: make crd-verify
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 10b9c4375..c446f0865 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -94,49 +94,3 @@ jobs:
               echo "  - ${{ env.REGISTRY }}/${IMAGE}:${VERSION}"
             fi
           done
-
-  # Publish the raw CRDs as a standalone release asset so consumers can install
-  # them without pulling a Helm chart. The bundle carries the unmodified CRDs the
-  # charts install (no downstream-specific labels), split into crds/hub and
-  # crds/member so each set can be applied to the right cluster. Runs after the
-  # images are published so a release is only created once the build succeeds.
-  publish-crds:
-    needs: [export-registry, build-and-publish]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    env:
-      TAG: ${{ needs.export-registry.outputs.tag }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          ref: ${{ needs.export-registry.outputs.tag }}
-
-      - name: Package CRDs
-        run: make crd-package TAG="${TAG}"
-
-      - name: Create or update the release and upload the CRD bundle
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          created_draft=""
-          if ! gh release view "${TAG}" >/dev/null 2>&1; then
-            # Any semver pre-release suffix (-rc.N, -alpha, -beta, ...) is a prerelease.
-            prerelease=""
-            case "${TAG}" in *-*) prerelease="--prerelease" ;; esac
-            # Create as a draft first so a partially uploaded release is never public.
-            gh release create "${TAG}" --title "${TAG}" --generate-notes --draft ${prerelease}
-            created_draft="true"
-          fi
-          gh release upload "${TAG}" \
-            "_crd-package/kubefleet-crds-${TAG}.tgz" \
-            "_crd-package/kubefleet-crds-${TAG}.tgz.sha256" \
-            --clobber
-          # Only publish releases this job created; never flip a maintainer's existing release.
-          if [ "${created_draft}" = "true" ]; then
-            gh release edit "${TAG}" --draft=false
-          elif [ "$(gh release view "${TAG}" --json isDraft --jq .isDraft)" = "true" ]; then
-            echo "::warning::Release ${TAG} already existed as a draft; the CRD bundle was uploaded but the release was left unpublished. Publish it manually."
-          fi
diff --git a/Makefile b/Makefile
index 3358d00e9..529dbe33e 100644
--- a/Makefile
+++ b/Makefile
@@ -310,29 +310,6 @@ helm-push: ## Package and push Helm charts to OCI registry
 	helm push .helm-packages/member-agent-$(CHART_VERSION).tgz oci://$(REGISTRY)
 	rm -rf .helm-packages
 
-## --------------------------------------
-## CRD release bundle
-## --------------------------------------
-
-# Directory and artifact names for the standalone CRD release tarball.
-CRD_PACKAGE_DIR ?= _crd-package
-CRD_PACKAGE_NAME ?= kubefleet-crds-$(TAG)
-# Use sha256sum when available (Linux/CI), fall back to shasum (macOS).
-SHA256SUM ?= $(shell command -v sha256sum >/dev/null 2>&1 && echo "sha256sum" || echo "shasum -a 256")
-
-.PHONY: crd-package
-crd-package: ## Package the raw CRDs into a release tarball with a SHA-256 checksum
-	rm -rf $(CRD_PACKAGE_DIR)
-	mkdir -p $(CRD_PACKAGE_DIR)/crds/hub $(CRD_PACKAGE_DIR)/crds/member
-	# Source from the charts' CRD sets (symlinks into config/crd/bases) so the
-	# bundle mirrors exactly what each agent installs: hub-cluster CRDs under
-	# crds/hub, member-cluster CRDs under crds/member. cp -L dereferences the
-	# symlinks so the archive holds the raw CRD YAML, not dangling links.
-	cp -L charts/hub-agent/templates/crds/*.yaml $(CRD_PACKAGE_DIR)/crds/hub/
-	cp -L charts/member-agent/templates/crds/*.yaml $(CRD_PACKAGE_DIR)/crds/member/
-	tar -czf $(CRD_PACKAGE_DIR)/$(CRD_PACKAGE_NAME).tgz -C $(CRD_PACKAGE_DIR) crds
-	cd $(CRD_PACKAGE_DIR) && $(SHA256SUM) $(CRD_PACKAGE_NAME).tgz > $(CRD_PACKAGE_NAME).tgz.sha256
-	@echo "Packaged CRDs into $(CRD_PACKAGE_DIR)/$(CRD_PACKAGE_NAME).tgz"
 
 
 # By default, docker buildx create will pull image moby/buildkit:buildx-stable-1 and hit the too many requests error

From 950f653a9ca51b5f28c48b38a5559159f5375cb5 Mon Sep 17 00:00:00 2001
From: Britania Rodriguez Reyes <britaniar@microsoft.com>
Date: Wed, 22 Jul 2026 12:44:36 -0700
Subject: [PATCH 9/9] fix: resolve shellcheck warnings in workflow scripts

---
 .github/workflows/build-publish-mcr.yml | 12 ++++++------
 .github/workflows/publish-image.yml     | 10 ++++++----
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index 32008ba1b..8ffb5bf82 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -37,20 +37,20 @@ jobs:
           # set the image version
           RELEASE_TAG=${{ inputs.releaseTag }}
           if [ -z "$RELEASE_TAG" ]; then
-            RELEASE_TAG=`git describe --tags $(git rev-list --tags --max-count=1)`
+            RELEASE_TAG=$(git describe --tags "$(git rev-list --tags --max-count=1)")
             echo "The user input release tag is empty, will use the latest tag $RELEASE_TAG."
           fi
-          echo "release_tag=$RELEASE_TAG" >> $GITHUB_OUTPUT
+          echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
 
           # Strip 'v' prefix from RELEASE_TAG for helm chart version
           ARC_HELMCHART_VERSION="${RELEASE_TAG#v}"
-          echo "arc_helmchart_version=$ARC_HELMCHART_VERSION" >> $GITHUB_OUTPUT
+          echo "arc_helmchart_version=$ARC_HELMCHART_VERSION" >> "$GITHUB_OUTPUT"
           echo "Using Arc Helm Chart version: $ARC_HELMCHART_VERSION"
 
           # Fetch the latest fleet-networking version
           # NOTE: The fleet-networking image must be cut and pushed to MCR first before retrieving this version
           FLEET_NETWORKING_VERSION="${FLEET_NETWORKING_VERSION:-$(curl "https://api.github.com/repos/Azure/fleet-networking/tags" | jq -r '.[0].name')}"
-          echo "fleet_networking_version=$FLEET_NETWORKING_VERSION" >> $GITHUB_OUTPUT
+          echo "fleet_networking_version=$FLEET_NETWORKING_VERSION" >> "$GITHUB_OUTPUT"
           echo "Using Fleet Networking version: $FLEET_NETWORKING_VERSION"
 
           # NOTE: As exporting a variable from a secret is not possible, the shared variable registry obtained
@@ -150,9 +150,9 @@ jobs:
         run: |
           sudo groupadd docker || true
           echo "Adding $USER to the docker group"
-          sudo usermod -aG docker $USER
+          sudo usermod -aG docker "$USER"
           newgrp docker
-          sudo setfacl --modify user:$USER:rw /var/run/docker.sock
+          sudo setfacl --modify "user:$USER:rw" /var/run/docker.sock
       - name: 'Login the ACR'
         # Note (chenyu1): must not use root privileges; the system seems to have some trouble
         # retrieving credentials when sudo is used.
diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 44c3d7e44..84abf2305 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -28,7 +28,7 @@ jobs:
       - id: export
         run: |
           # registry must be in lowercase
-          echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr [:upper:] [:lower:])" >> $GITHUB_OUTPUT
+          echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
   publish-images:
     needs: export-registry
     env:
@@ -42,9 +42,11 @@ jobs:
       - name: Set image version for a new release
         if: startsWith(github.ref, 'refs/tags/')
         run: |
-          echo "HUB_AGENT_IMAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-          echo "MEMBER_AGENT_IMAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-          echo "REFRESH_TOKEN_IMAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+          {
+            echo "HUB_AGENT_IMAGE_VERSION=${GITHUB_REF#refs/tags/}"
+            echo "MEMBER_AGENT_IMAGE_VERSION=${GITHUB_REF#refs/tags/}"
+            echo "REFRESH_TOKEN_IMAGE_VERSION=${GITHUB_REF#refs/tags/}"
+          } >> "$GITHUB_ENV"
       - name: Login to ${{ env.REGISTRY }}
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
         with: