From 488f22e916f08789e6f55de67ff415fd1a828645 Mon Sep 17 00:00:00 2001
From: abtreece <britt.treece@gmail.com>
Date: Fri, 24 Apr 2026 23:35:40 -0500
Subject: [PATCH 01/13] feat: add contributor CI workflow for fork-friendly
 testing

Add a credentialless CI workflow that runs on contributor forks and PRs,
enabling third-party contributors to validate their changes without
access to project infrastructure.

- Contributor CI workflow (ci-cd-contributor) builds Ruby packages for
  two representative distributions (Ubuntu 24.04 and EL 9) with
  applicable variants and runs smoke tests
- ok-to-test label gate lets maintainers trigger the full CI pipeline;
  a label guard workflow removes the label on new pushes, requiring
  re-review before re-triggering
- Main CI/CD workflow restricted to upstream repository only
- Respects variant_exclusions from config.yml (skips malloctrim for
  Ruby >= 3.3)
- Test script fixes: createrepo -> createrepo_c, added adduser package
- Updated CONTRIBUTING.md with fork CI and local build/test docs
---
 .github/workflows/ci-cd-contributor.yml     | 368 ++++++++++++++++++++
 .github/workflows/ci-cd-contributor.yml.erb | 290 +++++++++++++++
 .github/workflows/ci-cd-label-guard.yml     |  34 ++
 .github/workflows/ci-cd-main.yml            |  12 +
 .github/workflows/ci-cd-main.yml.erb        |  12 +
 CONTRIBUTING.md                             |  21 ++
 config.yml                                  |   7 +
 container-entrypoints/test-rpms-prepare     |   2 +-
 dev-handbook/building-packages-locally.md   |   2 +
 internal-scripts/generate-ci-cd-yaml.rb     |   1 +
 internal-scripts/test-debs                  |   2 +-
 lib/ci_workflow_support.rb                  |  18 +
 12 files changed, 767 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/ci-cd-contributor.yml
 create mode 100644 .github/workflows/ci-cd-contributor.yml.erb
 create mode 100644 .github/workflows/ci-cd-label-guard.yml

diff --git a/.github/workflows/ci-cd-contributor.yml b/.github/workflows/ci-cd-contributor.yml
new file mode 100644
index 00000000..2acc4e92
--- /dev/null
+++ b/.github/workflows/ci-cd-contributor.yml
@@ -0,0 +1,368 @@
+# WARNING: DO NOT EDIT THIS FILE!!!
+#
+# This file is autogenerated from .github/workflows/ci-cd-contributor.yml.erb
+# by ./internal-scripts/generate-ci-cd-yaml.rb.
+# Please edit the .erb file instead, then regenerate YAML
+# by running that script.
+#
+# TIP: run this on your development machine to ensure generate-ci-cd-yaml.rb
+# is run automatically as a Git pre-commit hook:
+#
+#   git config core.hooksPath .githooks
+
+name: 'CI/CD: contributor'
+
+on:
+  push:
+    paths-ignore:
+      - '**.md'
+      - 'dev-handbook/**'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+      - 'dev-handbook/**'
+  workflow_dispatch:
+
+jobs:
+  lint:
+    name: Check whether workflow is up-to-date
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+      - name: Check
+        run: ./internal-scripts/ci-cd/check-workflow-uptodate/check.sh
+
+
+  build_images:
+    name: Build Docker images
+    needs: lint
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: 'Build Docker image [ubuntu-24.04]'
+        run: ./internal-scripts/ci-cd/build-docker-images/build.sh
+        env:
+          IMAGE_NAME: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
+          IMAGE_TAG: 'ubuntu-24.04-v2'
+          SOURCE_DIR: 'environments/ubuntu-24.04'
+      - name: 'Dump Docker image [ubuntu-24.04]'
+        run: ./internal-scripts/ci-cd/build-docker-images/dump-image.sh
+        env:
+          IMAGE_NAME: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
+          IMAGE_TAG: 'ubuntu-24.04-v2'
+      - name: 'Upload Docker image artifact [ubuntu-24.04]'
+        uses: actions/upload-artifact@v4
+        with:
+          name: 'docker-image-ubuntu-24.04'
+          path: output
+      - name: Clean up Docker image output
+        run: rm -rf output
+
+      - name: 'Build Docker image [el-9]'
+        run: ./internal-scripts/ci-cd/build-docker-images/build.sh
+        env:
+          IMAGE_NAME: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
+          IMAGE_TAG: 'el-9-v2'
+          SOURCE_DIR: 'environments/el-9'
+      - name: 'Dump Docker image [el-9]'
+        run: ./internal-scripts/ci-cd/build-docker-images/dump-image.sh
+        env:
+          IMAGE_NAME: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
+          IMAGE_TAG: 'el-9-v2'
+      - name: 'Upload Docker image artifact [el-9]'
+        uses: actions/upload-artifact@v4
+        with:
+          name: 'docker-image-el-9'
+          path: output
+      - name: Clean up Docker image output
+        run: rm -rf output
+
+      - name: 'Build Docker image [utility]'
+        run: ./internal-scripts/ci-cd/build-docker-images/build.sh
+        env:
+          IMAGE_NAME: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
+          IMAGE_TAG: 'utility-v3'
+          SOURCE_DIR: 'environments/utility'
+      - name: 'Dump Docker image [utility]'
+        run: ./internal-scripts/ci-cd/build-docker-images/dump-image.sh
+        env:
+          IMAGE_NAME: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
+          IMAGE_TAG: 'utility-v3'
+      - name: 'Upload Docker image artifact [utility]'
+        uses: actions/upload-artifact@v4
+        with:
+          name: 'docker-image-utility'
+          path: output
+      - name: Clean up Docker image output
+        run: rm -rf output
+
+
+  build_packages:
+    name: Build packages
+    needs: build_images
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+
+      ### Download and load Docker images ###
+
+      - name: 'Download Docker image artifact [ubuntu-24.04]'
+        uses: actions/download-artifact@v4
+        with:
+          name: 'docker-image-ubuntu-24.04'
+          path: docker-image-ubuntu-24.04
+      - name: 'Load Docker image [ubuntu-24.04]'
+        run: ./internal-scripts/ci-cd/load-docker-image.sh
+        env:
+          TARBALL: docker-image-ubuntu-24.04/image.tar.zst
+
+      - name: 'Download Docker image artifact [el-9]'
+        uses: actions/download-artifact@v4
+        with:
+          name: 'docker-image-el-9'
+          path: docker-image-el-9
+      - name: 'Load Docker image [el-9]'
+        run: ./internal-scripts/ci-cd/load-docker-image.sh
+        env:
+          TARBALL: docker-image-el-9/image.tar.zst
+
+      - name: 'Download Docker image artifact [utility]'
+        uses: actions/download-artifact@v4
+        with:
+          name: 'docker-image-utility'
+          path: docker-image-utility
+      - name: 'Load Docker image [utility]'
+        run: ./internal-scripts/ci-cd/load-docker-image.sh
+        env:
+          TARBALL: docker-image-utility/image.tar.zst
+
+      ### Download sources ###
+
+      - name: Download Ruby source
+        run: curl -fsSL -o ruby-src.tar.gz 'https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.6.tar.gz'
+      - name: Download Jemalloc source
+        run: curl -fsSL -o jemalloc-src.tar.bz2 'https://github.com/jemalloc/jemalloc/releases/download/3.6.0/jemalloc-3.6.0.tar.bz2'
+      - name: Clone Rbenv source
+        run: |
+          git clone 'https://github.com/fullstaq-ruby/rbenv.git' rbenv-src
+          cd rbenv-src
+          git checkout 'fbaa15993171bf'
+
+      ### Build Jemalloc ###
+
+      - name: 'Build Jemalloc [ubuntu-24.04]'
+        run: |
+          ./build-jemalloc \
+            -n 'ubuntu-24.04' \
+            -s "$(pwd)/jemalloc-src.tar.bz2" \
+            -o "$(pwd)/jemalloc-bin-ubuntu-24.04.tar.gz" \
+            -j 2
+
+      - name: 'Build Jemalloc [el-9]'
+        run: |
+          ./build-jemalloc \
+            -n 'el-9' \
+            -s "$(pwd)/jemalloc-src.tar.bz2" \
+            -o "$(pwd)/jemalloc-bin-el-9.tar.gz" \
+            -j 2
+
+      ### Build Ruby binaries ###
+
+      - name: 'Build Ruby binaries [ubuntu-24.04/normal]'
+        run: |
+          ./build-ruby \
+            -n 'ubuntu-24.04' \
+            -s "$(pwd)/ruby-src.tar.gz" \
+            -v '4.0' \
+            -o "$(pwd)/ruby-bin-ubuntu-24.04-normal.tar.gz" \
+            -j 2
+
+      - name: 'Build Ruby binaries [ubuntu-24.04/jemalloc]'
+        run: |
+          ./build-ruby \
+            -n 'ubuntu-24.04' \
+            -s "$(pwd)/ruby-src.tar.gz" \
+            -v '4.0' \
+            -o "$(pwd)/ruby-bin-ubuntu-24.04-jemalloc.tar.gz" \
+            -m "$(pwd)/jemalloc-bin-ubuntu-24.04.tar.gz" \
+            -j 2
+
+      - name: 'Build Ruby binaries [el-9/normal]'
+        run: |
+          ./build-ruby \
+            -n 'el-9' \
+            -s "$(pwd)/ruby-src.tar.gz" \
+            -v '4.0' \
+            -o "$(pwd)/ruby-bin-el-9-normal.tar.gz" \
+            -j 2
+
+      - name: 'Build Ruby binaries [el-9/jemalloc]'
+        run: |
+          ./build-ruby \
+            -n 'el-9' \
+            -s "$(pwd)/ruby-src.tar.gz" \
+            -v '4.0' \
+            -o "$(pwd)/ruby-bin-el-9-jemalloc.tar.gz" \
+            -m "$(pwd)/jemalloc-bin-el-9.tar.gz" \
+            -j 2
+
+      - name: Create packages directory
+        run: mkdir -p packages
+
+      ### Build Ruby packages ###
+
+      - name: 'Build Ruby package [ubuntu-24.04/normal]'
+        run: |
+          ./build-ruby-deb \
+            -b "$(pwd)/ruby-bin-ubuntu-24.04-normal.tar.gz" \
+            -o "$(pwd)/packages/fullstaq-ruby-4.0_4-ubuntu-24.04_amd64.deb" \
+            -r '4'
+
+      - name: 'Build Ruby package [ubuntu-24.04/jemalloc]'
+        run: |
+          ./build-ruby-deb \
+            -b "$(pwd)/ruby-bin-ubuntu-24.04-jemalloc.tar.gz" \
+            -o "$(pwd)/packages/fullstaq-ruby-4.0-jemalloc_4-ubuntu-24.04_amd64.deb" \
+            -r '4'
+
+      - name: 'Build Ruby package [el-9/normal]'
+        run: |
+          ./build-ruby-rpm \
+            -b "$(pwd)/ruby-bin-el-9-normal.tar.gz" \
+            -o "$(pwd)/packages/fullstaq-ruby-4.0-rev4-el9.x86_64.rpm" \
+            -r '4'
+
+      - name: 'Build Ruby package [el-9/jemalloc]'
+        run: |
+          ./build-ruby-rpm \
+            -b "$(pwd)/ruby-bin-el-9-jemalloc.tar.gz" \
+            -o "$(pwd)/packages/fullstaq-ruby-4.0-jemalloc-rev4-el9.x86_64.rpm" \
+            -r '4'
+
+      ### Build Rbenv packages ###
+
+      - name: Build Rbenv DEB
+        run: |
+          ./build-rbenv-deb \
+            -s "$(pwd)/rbenv-src" \
+            -o "$(pwd)/packages/fullstaq-rbenv_1.1.2-16-1_all.deb" \
+            -n '1.1.2-16' \
+            -r '1'
+      - name: Build Rbenv RPM
+        run: |
+          ./build-rbenv-rpm \
+            -s "$(pwd)/rbenv-src" \
+            -o "$(pwd)/packages/fullstaq-rbenv-1.1.2_16-1.noarch.rpm" \
+            -n '1.1.2-16' \
+            -r '1'
+
+      ### Build common packages ###
+
+      - name: Build common DEB
+        run: |
+          ./build-common-deb \
+            -o "$(pwd)/packages/fullstaq-ruby-common_1.0-1_all.deb"
+      - name: Build common RPM
+        run: |
+          ./build-common-rpm \
+            -o "$(pwd)/packages/fullstaq-ruby-common-1.0-1.noarch.rpm"
+
+      ### Upload all packages ###
+
+      - name: Upload packages
+        uses: actions/upload-artifact@v4
+        with:
+          name: contributor-packages
+          path: packages
+
+
+  test_packages:
+    name: 'Test [${{ matrix.distro }}/${{ matrix.variant }}]'
+    needs: build_packages
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - distro: 'ubuntu-24.04'
+            variant: 'normal'
+            test_image: 'ubuntu:24.04'
+            package_format: 'DEB'
+          - distro: 'ubuntu-24.04'
+            variant: 'jemalloc'
+            test_image: 'ubuntu:24.04'
+            package_format: 'DEB'
+          - distro: 'el-9'
+            variant: 'normal'
+            test_image: 'rockylinux:9'
+            package_format: 'RPM'
+          - distro: 'el-9'
+            variant: 'jemalloc'
+            test_image: 'rockylinux:9'
+            package_format: 'RPM'
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download packages
+        uses: actions/download-artifact@v4
+        with:
+          name: contributor-packages
+          path: packages
+
+      - name: Download utility Docker image
+        uses: actions/download-artifact@v4
+        with:
+          name: 'docker-image-utility'
+          path: docker-image-utility
+      - name: Load utility Docker image
+        run: ./internal-scripts/ci-cd/load-docker-image.sh
+        env:
+          TARBALL: docker-image-utility/image.tar.zst
+
+      - name: Determine Ruby package filename
+        id: ruby_pkg
+        run: |
+          VARIANT="${{ matrix.variant }}"
+          DISTRO="${{ matrix.distro }}"
+          FORMAT="${{ matrix.package_format }}"
+          if [ "$VARIANT" = "normal" ]; then
+            VARIANT_SUFFIX=""
+          else
+            VARIANT_SUFFIX="-${VARIANT}"
+          fi
+          if [ "$FORMAT" = "DEB" ]; then
+            FILENAME="fullstaq-ruby-4.0${VARIANT_SUFFIX}_4-${DISTRO}_amd64.deb"
+          else
+            SANITIZED_DISTRO=$(echo "$DISTRO" | tr -d '-')
+            FILENAME="fullstaq-ruby-4.0${VARIANT_SUFFIX}-rev4-${SANITIZED_DISTRO}.x86_64.rpm"
+          fi
+          echo "filename=${FILENAME}" >> "$GITHUB_OUTPUT"
+
+      - name: Test DEBs
+        if: matrix.package_format == 'DEB'
+        run: |
+          ./test-debs \
+            -i '${{ matrix.test_image }}' \
+            -v '${{ matrix.variant }}' \
+            -r "$(pwd)/packages/${{ steps.ruby_pkg.outputs.filename }}" \
+            -b "$(pwd)/packages/fullstaq-rbenv_1.1.2-16-1_all.deb" \
+            -c "$(pwd)/packages/fullstaq-ruby-common_1.0-1_all.deb"
+      - name: Test RPMs
+        if: matrix.package_format == 'RPM'
+        run: |
+          ./test-rpms \
+            -i '${{ matrix.test_image }}' \
+            -v '${{ matrix.variant }}' \
+            -r "$(pwd)/packages/${{ steps.ruby_pkg.outputs.filename }}" \
+            -b "$(pwd)/packages/fullstaq-rbenv-1.1.2_16-1.noarch.rpm" \
+            -c "$(pwd)/packages/fullstaq-ruby-common-1.0-1.noarch.rpm"
diff --git a/.github/workflows/ci-cd-contributor.yml.erb b/.github/workflows/ci-cd-contributor.yml.erb
new file mode 100644
index 00000000..bbb32b77
--- /dev/null
+++ b/.github/workflows/ci-cd-contributor.yml.erb
@@ -0,0 +1,290 @@
+<%= editing_warning_comment('ci-cd-contributor') %>
+<%- rpv = latest_ruby_package_version -%>
+
+name: 'CI/CD: contributor'
+
+on:
+  push:
+    paths-ignore:
+      - '**.md'
+      - 'dev-handbook/**'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+      - 'dev-handbook/**'
+  workflow_dispatch:
+
+jobs:
+  lint:
+    name: Check whether workflow is up-to-date
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+      - name: Check
+        run: ./internal-scripts/ci-cd/check-workflow-uptodate/check.sh
+
+
+  build_images:
+    name: Build Docker images
+    needs: lint
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    steps:
+      - uses: actions/checkout@v4
+
+      <%- contributor_distributions.each do |distro| -%>
+      <%- image = docker_images.find { |img| img[:id] == distro[:name] } -%>
+      - name: 'Build Docker image [<%= distro[:name] %>]'
+        run: ./internal-scripts/ci-cd/build-docker-images/build.sh
+        env:
+          IMAGE_NAME: '<%= image[:name] %>'
+          IMAGE_TAG: '<%= image[:tag] %>'
+          SOURCE_DIR: 'environments/<%= image[:id] %>'
+      - name: 'Dump Docker image [<%= distro[:name] %>]'
+        run: ./internal-scripts/ci-cd/build-docker-images/dump-image.sh
+        env:
+          IMAGE_NAME: '<%= image[:name] %>'
+          IMAGE_TAG: '<%= image[:tag] %>'
+      - name: 'Upload Docker image artifact [<%= distro[:name] %>]'
+        uses: actions/upload-artifact@v4
+        with:
+          name: '<%= docker_image_artifact_name(distro[:name]) %>'
+          path: output
+      - name: Clean up Docker image output
+        run: rm -rf output
+
+      <%- end -%>
+      <%- utility_image = docker_images.find { |img| img[:id] == 'utility' } -%>
+      - name: 'Build Docker image [utility]'
+        run: ./internal-scripts/ci-cd/build-docker-images/build.sh
+        env:
+          IMAGE_NAME: '<%= utility_image[:name] %>'
+          IMAGE_TAG: '<%= utility_image[:tag] %>'
+          SOURCE_DIR: 'environments/utility'
+      - name: 'Dump Docker image [utility]'
+        run: ./internal-scripts/ci-cd/build-docker-images/dump-image.sh
+        env:
+          IMAGE_NAME: '<%= utility_image[:name] %>'
+          IMAGE_TAG: '<%= utility_image[:tag] %>'
+      - name: 'Upload Docker image artifact [utility]'
+        uses: actions/upload-artifact@v4
+        with:
+          name: '<%= docker_image_artifact_name('utility') %>'
+          path: output
+      - name: Clean up Docker image output
+        run: rm -rf output
+
+
+  build_packages:
+    name: Build packages
+    needs: build_images
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+
+      ### Download and load Docker images ###
+
+      <%- contributor_distributions.each do |distro| -%>
+      - name: 'Download Docker image artifact [<%= distro[:name] %>]'
+        uses: actions/download-artifact@v4
+        with:
+          name: '<%= docker_image_artifact_name(distro[:name]) %>'
+          path: docker-image-<%= distro[:name] %>
+      - name: 'Load Docker image [<%= distro[:name] %>]'
+        run: ./internal-scripts/ci-cd/load-docker-image.sh
+        env:
+          TARBALL: docker-image-<%= distro[:name] %>/image.tar.zst
+
+      <%- end -%>
+      - name: 'Download Docker image artifact [utility]'
+        uses: actions/download-artifact@v4
+        with:
+          name: '<%= docker_image_artifact_name('utility') %>'
+          path: docker-image-utility
+      - name: 'Load Docker image [utility]'
+        run: ./internal-scripts/ci-cd/load-docker-image.sh
+        env:
+          TARBALL: docker-image-utility/image.tar.zst
+
+      ### Download sources ###
+
+      - name: Download Ruby source
+        run: curl -fsSL -o ruby-src.tar.gz '<%= ruby_source_url(rpv[:full_version]) %>'
+      - name: Download Jemalloc source
+        run: curl -fsSL -o jemalloc-src.tar.bz2 '<%= jemalloc_source_url %>'
+      - name: Clone Rbenv source
+        run: |
+          git clone '<%= config[:rbenv][:repo] %>' rbenv-src
+          cd rbenv-src
+          git checkout '<%= config[:rbenv][:ref] %>'
+
+      ### Build Jemalloc ###
+
+      <%- contributor_distributions.each do |distro| -%>
+      - name: 'Build Jemalloc [<%= distro[:name] %>]'
+        run: |
+          ./build-jemalloc \
+            -n '<%= distro[:name] %>' \
+            -s "$(pwd)/jemalloc-src.tar.bz2" \
+            -o "$(pwd)/jemalloc-bin-<%= distro[:name] %>.tar.gz" \
+            -j 2
+
+      <%- end -%>
+      ### Build Ruby binaries ###
+
+      <%- contributor_distributions.each do |distro| -%>
+      <%- variants_for_ruby_version(rpv).each do |variant| -%>
+      - name: 'Build Ruby binaries [<%= distro[:name] %>/<%= variant[:name] %>]'
+        run: |
+          ./build-ruby \
+            -n '<%= distro[:name] %>' \
+            -s "$(pwd)/ruby-src.tar.gz" \
+            -v '<%= rpv[:id] %>' \
+            -o "$(pwd)/ruby-bin-<%= distro[:name] %>-<%= variant[:name] %>.tar.gz" \
+      <%- if variant[:name] == 'jemalloc' -%>
+            -m "$(pwd)/jemalloc-bin-<%= distro[:name] %>.tar.gz" \
+      <%- elsif variant[:name] == 'malloctrim' -%>
+            -t \
+      <%- end -%>
+            -j 2
+
+      <%- end -%>
+      <%- end -%>
+      - name: Create packages directory
+        run: mkdir -p packages
+
+      ### Build Ruby packages ###
+
+      <%- contributor_distributions.each do |distro| -%>
+      <%- variants_for_ruby_version(rpv).each do |variant| -%>
+      <%- pkg_basename = ruby_package_basename(rpv, distro, variant) -%>
+      - name: 'Build Ruby package [<%= distro[:name] %>/<%= variant[:name] %>]'
+        run: |
+      <%- if distro[:package_format] == :DEB -%>
+          ./build-ruby-deb \
+      <%- else -%>
+          ./build-ruby-rpm \
+      <%- end -%>
+            -b "$(pwd)/ruby-bin-<%= distro[:name] %>-<%= variant[:name] %>.tar.gz" \
+            -o "$(pwd)/packages/<%= pkg_basename %>" \
+            -r '<%= rpv[:package_revision] %>'
+
+      <%- end -%>
+      <%- end -%>
+      ### Build Rbenv packages ###
+
+      - name: Build Rbenv DEB
+        run: |
+          ./build-rbenv-deb \
+            -s "$(pwd)/rbenv-src" \
+            -o "$(pwd)/packages/<%= rbenv_package_basename(:DEB) %>" \
+            -n '<%= rbenv_version %>' \
+            -r '<%= rbenv_package_revision %>'
+      - name: Build Rbenv RPM
+        run: |
+          ./build-rbenv-rpm \
+            -s "$(pwd)/rbenv-src" \
+            -o "$(pwd)/packages/<%= rbenv_package_basename(:RPM) %>" \
+            -n '<%= rbenv_version %>' \
+            -r '<%= rbenv_package_revision %>'
+
+      ### Build common packages ###
+
+      - name: Build common DEB
+        run: |
+          ./build-common-deb \
+            -o "$(pwd)/packages/<%= common_package_basename(:DEB) %>"
+      - name: Build common RPM
+        run: |
+          ./build-common-rpm \
+            -o "$(pwd)/packages/<%= common_package_basename(:RPM) %>"
+
+      ### Upload all packages ###
+
+      - name: Upload packages
+        uses: actions/upload-artifact@v4
+        with:
+          name: contributor-packages
+          path: packages
+
+
+  test_packages:
+    name: 'Test [${{ matrix.distro }}/${{ matrix.variant }}]'
+    needs: build_packages
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          <%- contributor_distributions.each do |distro| -%>
+          <%- variants_for_ruby_version(rpv).each do |variant| -%>
+          - distro: '<%= distro[:name] %>'
+            variant: '<%= variant[:name] %>'
+            test_image: '<%= distro[:test_image] %>'
+            package_format: '<%= distro[:package_format] %>'
+          <%- end -%>
+          <%- end -%>
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download packages
+        uses: actions/download-artifact@v4
+        with:
+          name: contributor-packages
+          path: packages
+
+      - name: Download utility Docker image
+        uses: actions/download-artifact@v4
+        with:
+          name: '<%= docker_image_artifact_name('utility') %>'
+          path: docker-image-utility
+      - name: Load utility Docker image
+        run: ./internal-scripts/ci-cd/load-docker-image.sh
+        env:
+          TARBALL: docker-image-utility/image.tar.zst
+
+      - name: Determine Ruby package filename
+        id: ruby_pkg
+        run: |
+          VARIANT="${{ matrix.variant }}"
+          DISTRO="${{ matrix.distro }}"
+          FORMAT="${{ matrix.package_format }}"
+          if [ "$VARIANT" = "normal" ]; then
+            VARIANT_SUFFIX=""
+          else
+            VARIANT_SUFFIX="-${VARIANT}"
+          fi
+          if [ "$FORMAT" = "DEB" ]; then
+            FILENAME="fullstaq-ruby-<%= rpv[:id] %>${VARIANT_SUFFIX}_<%= rpv[:package_revision] %>-${DISTRO}_amd64.deb"
+          else
+            SANITIZED_DISTRO=$(echo "$DISTRO" | tr -d '-')
+            FILENAME="fullstaq-ruby-<%= rpv[:id] %>${VARIANT_SUFFIX}-rev<%= rpv[:package_revision] %>-${SANITIZED_DISTRO}.x86_64.rpm"
+          fi
+          echo "filename=${FILENAME}" >> "$GITHUB_OUTPUT"
+
+      - name: Test DEBs
+        if: matrix.package_format == 'DEB'
+        run: |
+          ./test-debs \
+            -i '${{ matrix.test_image }}' \
+            -v '${{ matrix.variant }}' \
+            -r "$(pwd)/packages/${{ steps.ruby_pkg.outputs.filename }}" \
+            -b "$(pwd)/packages/<%= rbenv_package_basename(:DEB) %>" \
+            -c "$(pwd)/packages/<%= common_package_basename(:DEB) %>"
+      - name: Test RPMs
+        if: matrix.package_format == 'RPM'
+        run: |
+          ./test-rpms \
+            -i '${{ matrix.test_image }}' \
+            -v '${{ matrix.variant }}' \
+            -r "$(pwd)/packages/${{ steps.ruby_pkg.outputs.filename }}" \
+            -b "$(pwd)/packages/<%= rbenv_package_basename(:RPM) %>" \
+            -c "$(pwd)/packages/<%= common_package_basename(:RPM) %>"
diff --git a/.github/workflows/ci-cd-label-guard.yml b/.github/workflows/ci-cd-label-guard.yml
new file mode 100644
index 00000000..dcf44fd6
--- /dev/null
+++ b/.github/workflows/ci-cd-label-guard.yml
@@ -0,0 +1,34 @@
+name: 'CI/CD: label guard'
+
+on:
+  pull_request_target:
+    types: [synchronize]
+
+jobs:
+  remove_ok_to_test:
+    name: Remove ok-to-test label on new push
+    runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Remove ok-to-test label if present
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const issue_number = context.payload.pull_request.number;
+            try {
+              await github.rest.issues.removeLabel({
+                owner,
+                repo,
+                issue_number,
+                name: 'ok-to-test'
+              });
+              console.log('Removed ok-to-test label');
+            } catch (e) {
+              if (e.status === 404) {
+                console.log('Label ok-to-test not present, nothing to remove');
+              } else {
+                throw e;
+              }
+            }
diff --git a/.github/workflows/ci-cd-main.yml b/.github/workflows/ci-cd-main.yml
index 0e9e9f43..91c5b011 100644
--- a/.github/workflows/ci-cd-main.yml
+++ b/.github/workflows/ci-cd-main.yml
@@ -22,6 +22,11 @@ on:
     paths-ignore:
       - '**.md'
       - 'dev-handbook/**'
+  pull_request_target:
+    types: [labeled]
+    paths-ignore:
+      - '**.md'
+      - 'dev-handbook/**'
 
 env:
   ## Set the following variable to a specific number to make the
@@ -39,6 +44,10 @@ jobs:
   determine_necessary_jobs:
     name: Determine necessary jobs
     runs-on: ubuntu-24.04
+    if: >
+      github.repository == 'fullstaq-ruby/server-edition'
+      && (github.event_name != 'pull_request_target'
+      || github.event.label.name == 'ok-to-test')
     environment: test
     permissions:
       id-token: write
@@ -54,6 +63,8 @@ jobs:
         if: github.event_name == 'push' && github.ref == 'refs/heads/fix/cicd-new-workflows'
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -83,6 +94,7 @@ jobs:
   check_workflow_uptodate:
     name: Check whether workflow is up-to-date
     runs-on: ubuntu-24.04
+    if: github.repository == 'fullstaq-ruby/server-edition'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check
diff --git a/.github/workflows/ci-cd-main.yml.erb b/.github/workflows/ci-cd-main.yml.erb
index 1ad46986..d6bbd4e0 100644
--- a/.github/workflows/ci-cd-main.yml.erb
+++ b/.github/workflows/ci-cd-main.yml.erb
@@ -12,6 +12,11 @@ on:
     paths-ignore:
       - '**.md'
       - 'dev-handbook/**'
+  pull_request_target:
+    types: [labeled]
+    paths-ignore:
+      - '**.md'
+      - 'dev-handbook/**'
 
 env:
   ## Set the following variable to a specific number to make the
@@ -29,6 +34,10 @@ jobs:
   determine_necessary_jobs:
     name: Determine necessary jobs
     runs-on: ubuntu-24.04
+    if: >
+      github.repository == 'fullstaq-ruby/server-edition'
+      && (github.event_name != 'pull_request_target'
+      || github.event.label.name == 'ok-to-test')
     environment: test
     permissions:
       id-token: write
@@ -44,6 +53,8 @@ jobs:
         if: github.event_name == 'push' && github.ref == 'refs/heads/fix/cicd-new-workflows'
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -73,6 +84,7 @@ jobs:
   check_workflow_uptodate:
     name: Check whether workflow is up-to-date
     runs-on: ubuntu-24.04
+    if: github.repository == 'fullstaq-ruby/server-edition'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 0a113448..88ec7864 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -26,6 +26,27 @@ Have a look at our [issue tracker](https://github.com/fullstaq-ruby/server-editi
 
 To learn how the Fullstaq Ruby Server Edition codebase works and how to develop it, please read our [development handbook](dev-handbook/README.md).
 
+## Testing your changes
+
+### Automated CI on forks
+
+When you push to your fork or open a pull request, a contributor CI workflow runs automatically. It:
+
+ * Validates CI/CD workflow YAML is up-to-date.
+ * Builds Ruby packages for two representative distributions (Ubuntu 24.04 and Enterprise Linux 9) with all three variants (normal, jemalloc, malloctrim).
+ * Runs smoke tests that install the packages and verify Ruby works correctly.
+
+No cloud credentials or special setup are needed — the workflow uses only Docker and GitHub Actions.
+
+If a maintainer wants to run the full CI pipeline against your PR (which tests all distributions and publishes to test repositories), they will add the `ok-to-test` label. This label is automatically removed when you push new commits, so the maintainer must re-review and re-label after each update.
+
+### Local builds and testing
+
+For faster iteration, you can build and test packages on your own machine. You only need Docker and Ruby >= 3.2:
+
+ * **Building packages:** see [Building packages locally](dev-handbook/building-packages-locally.md)
+ * **Testing packages:** see [Testing packages locally](dev-handbook/testing-packages-locally.md)
+
 ## Stuck? Need help?
 
 Please post something on our [discussion forum](https://github.com/fullstaq-ruby/server-edition/discussions).
diff --git a/config.yml b/config.yml
index 7bf5a4b6..ae9175e3 100644
--- a/config.yml
+++ b/config.yml
@@ -105,6 +105,13 @@ variant_exclusions:
 ## `package_revision` numbers too!
 jemalloc_version: '3.6.0'
 
+## (Optional)
+## Which distributions to include in the contributor CI workflow.
+## This is a small subset used for fast feedback on forks.
+contributor_distributions:
+  - ubuntu-24.04
+  - el-9
+
 ## (Required)
 ## Specify which distributions to build packages for.
 ## When set to 'all', will build for all supported distributions.
diff --git a/container-entrypoints/test-rpms-prepare b/container-entrypoints/test-rpms-prepare
index 7b32b120..be928908 100755
--- a/container-entrypoints/test-rpms-prepare
+++ b/container-entrypoints/test-rpms-prepare
@@ -14,4 +14,4 @@ require_container_mount "$OUTPUT_PATH"
 
 
 run cp /input/* /output/
-run createrepo /output
+run createrepo_c /output
diff --git a/dev-handbook/building-packages-locally.md b/dev-handbook/building-packages-locally.md
index 62c12b33..8ef60a93 100644
--- a/dev-handbook/building-packages-locally.md
+++ b/dev-handbook/building-packages-locally.md
@@ -1,5 +1,7 @@
 # Building packages locally
 
+> **Tip:** If you just want to validate that your changes compile and pass tests, the contributor CI workflow does this automatically when you push to your fork. See [CONTRIBUTING.md](../CONTRIBUTING.md#testing-your-changes) for details. The instructions below are for local builds when you want faster iteration or need to debug packaging issues.
+
 This tutorial shows how you can build packages on your own computer.
 
 Because we follow [the "minimal dependencies" principle](minimal-dependencies-principle.md), you can build packages for any distribution, regardless of which OS or distribution you're running on.
diff --git a/internal-scripts/generate-ci-cd-yaml.rb b/internal-scripts/generate-ci-cd-yaml.rb
index db4f87c3..e8ef5a0a 100755
--- a/internal-scripts/generate-ci-cd-yaml.rb
+++ b/internal-scripts/generate-ci-cd-yaml.rb
@@ -35,6 +35,7 @@ def main
     end
     generate_yaml_file_from_template(template_name: 'ci-cd-publish-test-test')
     generate_yaml_file_from_template(template_name: 'ci-cd-publish-test-production')
+    generate_yaml_file_from_template(template_name: 'ci-cd-contributor')
   end
 
 private
diff --git a/internal-scripts/test-debs b/internal-scripts/test-debs
index 3e07aa4d..edbf41d0 100755
--- a/internal-scripts/test-debs
+++ b/internal-scripts/test-debs
@@ -9,7 +9,7 @@ source "$SELFDIR/../lib/library.sh"
 
 
 header "Installing packages"
-ESSENTIAL_PACKAGES=(perl sudo binutils)
+ESSENTIAL_PACKAGES=(perl sudo binutils adduser)
 
 if [[ "$SERVER" = "" ]]; then
     echo "+ Create /etc/apt/sources.list.d/local.list"
diff --git a/lib/ci_workflow_support.rb b/lib/ci_workflow_support.rb
index 5255440d..a8fa265e 100644
--- a/lib/ci_workflow_support.rb
+++ b/lib/ci_workflow_support.rb
@@ -76,6 +76,20 @@ def distributions
     end
   end
 
+  def contributor_distributions
+    @contributor_distributions ||= begin
+      names = config[:contributor_distributions]
+      return [] if names.nil?
+      names.map do |name|
+        {
+          name: name,
+          package_format: autodetect_package_format(name),
+          test_image: determine_test_image_for(name),
+        }
+      end
+    end
+  end
+
   def distribution_buckets
     @distribution_buckets ||= GeneralSupport.bucketize(distributions,
       DISTRIBUTIONS_BUCKETS_MAX_NUM)
@@ -261,6 +275,10 @@ def ruby_package_versions
     end
   end
 
+  def latest_ruby_package_version
+    ruby_package_versions.first
+  end
+
   def ruby_package_versions_for_distro(distro)
     result = ruby_package_versions.find_all do |ruby_package_version|
       !ruby_package_version_excluded_from_distro?(ruby_package_version, distro)

From a84e39d417ab1648c35849f719c3dd45cfb37e4c Mon Sep 17 00:00:00 2001
From: abtreece <britt.treece@gmail.com>
Date: Fri, 22 May 2026 12:52:16 -0500
Subject: [PATCH 02/13] refactor(ci): extract build_distribution_entries helper

Deduplicates the distribution entry mapping between `distributions` and
`contributor_distributions`, and fixes a memoization break where
`return [] if names.nil?` exited the method without assigning the
`||= begin` block.
---
 lib/ci_workflow_support.rb | 28 +++++++++++-----------------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/lib/ci_workflow_support.rb b/lib/ci_workflow_support.rb
index a8fa265e..c9a1af07 100644
--- a/lib/ci_workflow_support.rb
+++ b/lib/ci_workflow_support.rb
@@ -66,27 +66,21 @@ def distributions
         abort "Config error: 'distributions' must be set to 'all' or to a list"
       end
 
-      names.map do |name|
-        {
-          name: name,
-          package_format: autodetect_package_format(name),
-          test_image: determine_test_image_for(name),
-        }
-      end
+      build_distribution_entries(names)
     end
   end
 
   def contributor_distributions
-    @contributor_distributions ||= begin
-      names = config[:contributor_distributions]
-      return [] if names.nil?
-      names.map do |name|
-        {
-          name: name,
-          package_format: autodetect_package_format(name),
-          test_image: determine_test_image_for(name),
-        }
-      end
+    @contributor_distributions ||= build_distribution_entries(config[:contributor_distributions] || [])
+  end
+
+  def build_distribution_entries(names)
+    names.map do |name|
+      {
+        name: name,
+        package_format: autodetect_package_format(name),
+        test_image: determine_test_image_for(name),
+      }
     end
   end
 

From 78a335288d3f162d5b3238d26954d45c799947f4 Mon Sep 17 00:00:00 2001
From: abtreece <britt.treece@gmail.com>
Date: Fri, 22 May 2026 13:00:46 -0500
Subject: [PATCH 03/13] fix(ci): make latest_ruby_package_version independent
 of YAML order

Previously relied on `ruby_package_versions.first`, which in turn
depended on the order of `minor_version_packages` and
`tiny_version_packages` in `config.yml`. Use `max_by` with
`Gem::Version` so the result is deterministic regardless of config
ordering.

Considered sorting the full `ruby_package_versions` list (the broader
fix Noah suggested), but that interleaves minor/tiny entries and
produces a ~9000-line rendered-YAML diff with no functional change to
which version is "latest". Targeting `latest_ruby_package_version`
directly addresses the robustness concern with minimal blast radius.
---
 lib/ci_workflow_support.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ci_workflow_support.rb b/lib/ci_workflow_support.rb
index c9a1af07..71407734 100644
--- a/lib/ci_workflow_support.rb
+++ b/lib/ci_workflow_support.rb
@@ -270,7 +270,7 @@ def ruby_package_versions
   end
 
   def latest_ruby_package_version
-    ruby_package_versions.first
+    ruby_package_versions.max_by { |entry| Gem::Version.new(entry[:full_version]) }
   end
 
   def ruby_package_versions_for_distro(distro)

From b7efdb2e0c0290372483edd9fdb0d95cb96be129 Mon Sep 17 00:00:00 2001
From: abtreece <britt.treece@gmail.com>
Date: Fri, 22 May 2026 13:14:13 -0500
Subject: [PATCH 04/13] fix(ci): skip contributor workflow for same-repo PRs

The previous guard `event_name == 'pull_request' || repository != upstream`
fired for both fork PRs AND same-repo PRs, causing the contributor
workflow to run alongside ci-cd-main on internal branches and
duplicating every build.

Tighten the condition so the workflow only runs when either (a) it's
executing in a fork's own repo, or (b) it's executing in upstream for
a PR whose head is in a fork.
---
 .github/workflows/ci-cd-contributor.yml     | 20 ++++++++++++++++----
 .github/workflows/ci-cd-contributor.yml.erb | 20 ++++++++++++++++----
 2 files changed, 32 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci-cd-contributor.yml b/.github/workflows/ci-cd-contributor.yml
index 2acc4e92..a2a993e4 100644
--- a/.github/workflows/ci-cd-contributor.yml
+++ b/.github/workflows/ci-cd-contributor.yml
@@ -27,7 +27,10 @@ jobs:
   lint:
     name: Check whether workflow is up-to-date
     runs-on: ubuntu-24.04
-    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    if: >
+      github.repository != 'fullstaq-ruby/server-edition'
+      || (github.event_name == 'pull_request'
+      && github.event.pull_request.head.repo.full_name != github.repository)
     steps:
       - uses: actions/checkout@v4
       - uses: ruby/setup-ruby@v1
@@ -41,7 +44,10 @@ jobs:
     name: Build Docker images
     needs: lint
     runs-on: ubuntu-24.04
-    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    if: >
+      github.repository != 'fullstaq-ruby/server-edition'
+      || (github.event_name == 'pull_request'
+      && github.event.pull_request.head.repo.full_name != github.repository)
     steps:
       - uses: actions/checkout@v4
 
@@ -107,7 +113,10 @@ jobs:
     name: Build packages
     needs: build_images
     runs-on: ubuntu-24.04
-    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    if: >
+      github.repository != 'fullstaq-ruby/server-edition'
+      || (github.event_name == 'pull_request'
+      && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
@@ -288,7 +297,10 @@ jobs:
     name: 'Test [${{ matrix.distro }}/${{ matrix.variant }}]'
     needs: build_packages
     runs-on: ubuntu-24.04
-    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    if: >
+      github.repository != 'fullstaq-ruby/server-edition'
+      || (github.event_name == 'pull_request'
+      && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 30
     strategy:
       fail-fast: false
diff --git a/.github/workflows/ci-cd-contributor.yml.erb b/.github/workflows/ci-cd-contributor.yml.erb
index bbb32b77..e6ce3a16 100644
--- a/.github/workflows/ci-cd-contributor.yml.erb
+++ b/.github/workflows/ci-cd-contributor.yml.erb
@@ -18,7 +18,10 @@ jobs:
   lint:
     name: Check whether workflow is up-to-date
     runs-on: ubuntu-24.04
-    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    if: >
+      github.repository != 'fullstaq-ruby/server-edition'
+      || (github.event_name == 'pull_request'
+      && github.event.pull_request.head.repo.full_name != github.repository)
     steps:
       - uses: actions/checkout@v4
       - uses: ruby/setup-ruby@v1
@@ -32,7 +35,10 @@ jobs:
     name: Build Docker images
     needs: lint
     runs-on: ubuntu-24.04
-    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    if: >
+      github.repository != 'fullstaq-ruby/server-edition'
+      || (github.event_name == 'pull_request'
+      && github.event.pull_request.head.repo.full_name != github.repository)
     steps:
       - uses: actions/checkout@v4
 
@@ -83,7 +89,10 @@ jobs:
     name: Build packages
     needs: build_images
     runs-on: ubuntu-24.04
-    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    if: >
+      github.repository != 'fullstaq-ruby/server-edition'
+      || (github.event_name == 'pull_request'
+      && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
@@ -218,7 +227,10 @@ jobs:
     name: 'Test [${{ matrix.distro }}/${{ matrix.variant }}]'
     needs: build_packages
     runs-on: ubuntu-24.04
-    if: github.event_name == 'pull_request' || github.repository != 'fullstaq-ruby/server-edition'
+    if: >
+      github.repository != 'fullstaq-ruby/server-edition'
+      || (github.event_name == 'pull_request'
+      && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 30
     strategy:
       fail-fast: false

From 78e9a3b25f6f023dd277972ebfde275a175e4432 Mon Sep 17 00:00:00 2001
From: abtreece <britt.treece@gmail.com>
Date: Fri, 22 May 2026 13:15:25 -0500
Subject: [PATCH 05/13] fix(ci): add timeout-minutes to contributor lint and
 build_images jobs

Prevents stuck runners from lingering at the default 360-minute timeout.
build_packages (60m) and test_packages (30m) already had explicit
timeouts; this adds 10m for lint and 30m for build_images.
---
 .github/workflows/ci-cd-contributor.yml     | 2 ++
 .github/workflows/ci-cd-contributor.yml.erb | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/ci-cd-contributor.yml b/.github/workflows/ci-cd-contributor.yml
index a2a993e4..7eb664ab 100644
--- a/.github/workflows/ci-cd-contributor.yml
+++ b/.github/workflows/ci-cd-contributor.yml
@@ -31,6 +31,7 @@ jobs:
       github.repository != 'fullstaq-ruby/server-edition'
       || (github.event_name == 'pull_request'
       && github.event.pull_request.head.repo.full_name != github.repository)
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - uses: ruby/setup-ruby@v1
@@ -48,6 +49,7 @@ jobs:
       github.repository != 'fullstaq-ruby/server-edition'
       || (github.event_name == 'pull_request'
       && github.event.pull_request.head.repo.full_name != github.repository)
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/ci-cd-contributor.yml.erb b/.github/workflows/ci-cd-contributor.yml.erb
index e6ce3a16..a33870a7 100644
--- a/.github/workflows/ci-cd-contributor.yml.erb
+++ b/.github/workflows/ci-cd-contributor.yml.erb
@@ -22,6 +22,7 @@ jobs:
       github.repository != 'fullstaq-ruby/server-edition'
       || (github.event_name == 'pull_request'
       && github.event.pull_request.head.repo.full_name != github.repository)
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - uses: ruby/setup-ruby@v1
@@ -39,6 +40,7 @@ jobs:
       github.repository != 'fullstaq-ruby/server-edition'
       || (github.event_name == 'pull_request'
       && github.event.pull_request.head.repo.full_name != github.repository)
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
 

From c942fbdd5cd8802aa4e12eeea4f33dc9b2367fec Mon Sep 17 00:00:00 2001
From: abtreece <britt.treece@gmail.com>
Date: Fri, 22 May 2026 14:10:47 -0500
Subject: [PATCH 06/13] refactor(ci): parallelize contributor builds via matrix
 jobs

Splits the contributor workflow's previously-monolithic build_images
and build_packages jobs into per-distro matrix jobs, and extracts
distro-agnostic packages (rbenv, common) into a separate
build_common_packages job that runs in parallel.

Also sets retention-days: 1 on all contributor artifacts -- they're
purely job-to-job intermediate state and don't need the default
90-day retention.
---
 .github/workflows/ci-cd-contributor.yml     | 266 ++++++++++----------
 .github/workflows/ci-cd-contributor.yml.erb | 198 +++++++++------
 2 files changed, 245 insertions(+), 219 deletions(-)

diff --git a/.github/workflows/ci-cd-contributor.yml b/.github/workflows/ci-cd-contributor.yml
index 7eb664ab..c0600f4b 100644
--- a/.github/workflows/ci-cd-contributor.yml
+++ b/.github/workflows/ci-cd-contributor.yml
@@ -42,7 +42,7 @@ jobs:
 
 
   build_images:
-    name: Build Docker images
+    name: 'Build Docker image [${{ matrix.distro }}]'
     needs: lint
     runs-on: ubuntu-24.04
     if: >
@@ -50,69 +50,48 @@ jobs:
       || (github.event_name == 'pull_request'
       && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - distro: 'ubuntu-24.04'
+            image_name: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
+            image_tag: 'ubuntu-24.04-v2'
+            source_dir: 'environments/ubuntu-24.04'
+            artifact_name: 'docker-image-ubuntu-24.04'
+          - distro: 'el-9'
+            image_name: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
+            image_tag: 'el-9-v2'
+            source_dir: 'environments/el-9'
+            artifact_name: 'docker-image-el-9'
+          - distro: 'utility'
+            image_name: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
+            image_tag: 'utility-v3'
+            source_dir: 'environments/utility'
+            artifact_name: 'docker-image-utility'
     steps:
       - uses: actions/checkout@v4
-
-      - name: 'Build Docker image [ubuntu-24.04]'
-        run: ./internal-scripts/ci-cd/build-docker-images/build.sh
-        env:
-          IMAGE_NAME: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
-          IMAGE_TAG: 'ubuntu-24.04-v2'
-          SOURCE_DIR: 'environments/ubuntu-24.04'
-      - name: 'Dump Docker image [ubuntu-24.04]'
-        run: ./internal-scripts/ci-cd/build-docker-images/dump-image.sh
-        env:
-          IMAGE_NAME: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
-          IMAGE_TAG: 'ubuntu-24.04-v2'
-      - name: 'Upload Docker image artifact [ubuntu-24.04]'
-        uses: actions/upload-artifact@v4
-        with:
-          name: 'docker-image-ubuntu-24.04'
-          path: output
-      - name: Clean up Docker image output
-        run: rm -rf output
-
-      - name: 'Build Docker image [el-9]'
-        run: ./internal-scripts/ci-cd/build-docker-images/build.sh
-        env:
-          IMAGE_NAME: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
-          IMAGE_TAG: 'el-9-v2'
-          SOURCE_DIR: 'environments/el-9'
-      - name: 'Dump Docker image [el-9]'
-        run: ./internal-scripts/ci-cd/build-docker-images/dump-image.sh
-        env:
-          IMAGE_NAME: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
-          IMAGE_TAG: 'el-9-v2'
-      - name: 'Upload Docker image artifact [el-9]'
-        uses: actions/upload-artifact@v4
-        with:
-          name: 'docker-image-el-9'
-          path: output
-      - name: Clean up Docker image output
-        run: rm -rf output
-
-      - name: 'Build Docker image [utility]'
+      - name: Build Docker image
         run: ./internal-scripts/ci-cd/build-docker-images/build.sh
         env:
-          IMAGE_NAME: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
-          IMAGE_TAG: 'utility-v3'
-          SOURCE_DIR: 'environments/utility'
-      - name: 'Dump Docker image [utility]'
+          IMAGE_NAME: '${{ matrix.image_name }}'
+          IMAGE_TAG: '${{ matrix.image_tag }}'
+          SOURCE_DIR: '${{ matrix.source_dir }}'
+      - name: Dump Docker image
         run: ./internal-scripts/ci-cd/build-docker-images/dump-image.sh
         env:
-          IMAGE_NAME: 'ghcr.io/fullstaq-ruby/server-edition-ci-images'
-          IMAGE_TAG: 'utility-v3'
-      - name: 'Upload Docker image artifact [utility]'
+          IMAGE_NAME: '${{ matrix.image_name }}'
+          IMAGE_TAG: '${{ matrix.image_tag }}'
+      - name: Upload Docker image artifact
         uses: actions/upload-artifact@v4
         with:
-          name: 'docker-image-utility'
+          name: '${{ matrix.artifact_name }}'
           path: output
-      - name: Clean up Docker image output
-        run: rm -rf output
+          retention-days: 1
 
 
   build_packages:
-    name: Build packages
+    name: 'Build packages [${{ matrix.distro }}]'
     needs: build_images
     runs-on: ubuntu-24.04
     if: >
@@ -120,37 +99,36 @@ jobs:
       || (github.event_name == 'pull_request'
       && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - distro: 'ubuntu-24.04'
+            package_format: 'DEB'
+            image_artifact_name: 'docker-image-ubuntu-24.04'
+          - distro: 'el-9'
+            package_format: 'RPM'
+            image_artifact_name: 'docker-image-el-9'
     steps:
       - uses: actions/checkout@v4
 
       ### Download and load Docker images ###
 
-      - name: 'Download Docker image artifact [ubuntu-24.04]'
-        uses: actions/download-artifact@v4
-        with:
-          name: 'docker-image-ubuntu-24.04'
-          path: docker-image-ubuntu-24.04
-      - name: 'Load Docker image [ubuntu-24.04]'
-        run: ./internal-scripts/ci-cd/load-docker-image.sh
-        env:
-          TARBALL: docker-image-ubuntu-24.04/image.tar.zst
-
-      - name: 'Download Docker image artifact [el-9]'
+      - name: Download distro Docker image
         uses: actions/download-artifact@v4
         with:
-          name: 'docker-image-el-9'
-          path: docker-image-el-9
-      - name: 'Load Docker image [el-9]'
+          name: '${{ matrix.image_artifact_name }}'
+          path: docker-image-distro
+      - name: Load distro Docker image
         run: ./internal-scripts/ci-cd/load-docker-image.sh
         env:
-          TARBALL: docker-image-el-9/image.tar.zst
-
-      - name: 'Download Docker image artifact [utility]'
+          TARBALL: docker-image-distro/image.tar.zst
+      - name: Download utility Docker image
         uses: actions/download-artifact@v4
         with:
           name: 'docker-image-utility'
           path: docker-image-utility
-      - name: 'Load Docker image [utility]'
+      - name: Load utility Docker image
         run: ./internal-scripts/ci-cd/load-docker-image.sh
         env:
           TARBALL: docker-image-utility/image.tar.zst
@@ -161,68 +139,36 @@ jobs:
         run: curl -fsSL -o ruby-src.tar.gz 'https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.6.tar.gz'
       - name: Download Jemalloc source
         run: curl -fsSL -o jemalloc-src.tar.bz2 'https://github.com/jemalloc/jemalloc/releases/download/3.6.0/jemalloc-3.6.0.tar.bz2'
-      - name: Clone Rbenv source
-        run: |
-          git clone 'https://github.com/fullstaq-ruby/rbenv.git' rbenv-src
-          cd rbenv-src
-          git checkout 'fbaa15993171bf'
 
       ### Build Jemalloc ###
 
-      - name: 'Build Jemalloc [ubuntu-24.04]'
-        run: |
-          ./build-jemalloc \
-            -n 'ubuntu-24.04' \
-            -s "$(pwd)/jemalloc-src.tar.bz2" \
-            -o "$(pwd)/jemalloc-bin-ubuntu-24.04.tar.gz" \
-            -j 2
-
-      - name: 'Build Jemalloc [el-9]'
+      - name: Build Jemalloc
         run: |
           ./build-jemalloc \
-            -n 'el-9' \
+            -n '${{ matrix.distro }}' \
             -s "$(pwd)/jemalloc-src.tar.bz2" \
-            -o "$(pwd)/jemalloc-bin-el-9.tar.gz" \
+            -o "$(pwd)/jemalloc-bin.tar.gz" \
             -j 2
 
       ### Build Ruby binaries ###
 
-      - name: 'Build Ruby binaries [ubuntu-24.04/normal]'
-        run: |
-          ./build-ruby \
-            -n 'ubuntu-24.04' \
-            -s "$(pwd)/ruby-src.tar.gz" \
-            -v '4.0' \
-            -o "$(pwd)/ruby-bin-ubuntu-24.04-normal.tar.gz" \
-            -j 2
-
-      - name: 'Build Ruby binaries [ubuntu-24.04/jemalloc]'
+      - name: 'Build Ruby binaries [${{ matrix.distro }}/normal]'
         run: |
           ./build-ruby \
-            -n 'ubuntu-24.04' \
+            -n '${{ matrix.distro }}' \
             -s "$(pwd)/ruby-src.tar.gz" \
             -v '4.0' \
-            -o "$(pwd)/ruby-bin-ubuntu-24.04-jemalloc.tar.gz" \
-            -m "$(pwd)/jemalloc-bin-ubuntu-24.04.tar.gz" \
+            -o "$(pwd)/ruby-bin-normal.tar.gz" \
             -j 2
 
-      - name: 'Build Ruby binaries [el-9/normal]'
+      - name: 'Build Ruby binaries [${{ matrix.distro }}/jemalloc]'
         run: |
           ./build-ruby \
-            -n 'el-9' \
+            -n '${{ matrix.distro }}' \
             -s "$(pwd)/ruby-src.tar.gz" \
             -v '4.0' \
-            -o "$(pwd)/ruby-bin-el-9-normal.tar.gz" \
-            -j 2
-
-      - name: 'Build Ruby binaries [el-9/jemalloc]'
-        run: |
-          ./build-ruby \
-            -n 'el-9' \
-            -s "$(pwd)/ruby-src.tar.gz" \
-            -v '4.0' \
-            -o "$(pwd)/ruby-bin-el-9-jemalloc.tar.gz" \
-            -m "$(pwd)/jemalloc-bin-el-9.tar.gz" \
+            -o "$(pwd)/ruby-bin-jemalloc.tar.gz" \
+            -m "$(pwd)/jemalloc-bin.tar.gz" \
             -j 2
 
       - name: Create packages directory
@@ -230,35 +176,78 @@ jobs:
 
       ### Build Ruby packages ###
 
-      - name: 'Build Ruby package [ubuntu-24.04/normal]'
+      - name: 'Build Ruby DEB [${{ matrix.distro }}/normal]'
+        if: matrix.package_format == 'DEB'
         run: |
           ./build-ruby-deb \
-            -b "$(pwd)/ruby-bin-ubuntu-24.04-normal.tar.gz" \
-            -o "$(pwd)/packages/fullstaq-ruby-4.0_4-ubuntu-24.04_amd64.deb" \
+            -b "$(pwd)/ruby-bin-normal.tar.gz" \
+            -o "$(pwd)/packages/fullstaq-ruby-4.0_4-${{ matrix.distro }}_amd64.deb" \
+            -r '4'
+      - name: 'Build Ruby RPM [${{ matrix.distro }}/normal]'
+        if: matrix.package_format == 'RPM'
+        run: |
+          SANITIZED_DISTRO=$(echo '${{ matrix.distro }}' | tr -d '-')
+          ./build-ruby-rpm \
+            -b "$(pwd)/ruby-bin-normal.tar.gz" \
+            -o "$(pwd)/packages/fullstaq-ruby-4.0-rev4-${SANITIZED_DISTRO}.x86_64.rpm" \
             -r '4'
 
-      - name: 'Build Ruby package [ubuntu-24.04/jemalloc]'
+      - name: 'Build Ruby DEB [${{ matrix.distro }}/jemalloc]'
+        if: matrix.package_format == 'DEB'
         run: |
           ./build-ruby-deb \
-            -b "$(pwd)/ruby-bin-ubuntu-24.04-jemalloc.tar.gz" \
-            -o "$(pwd)/packages/fullstaq-ruby-4.0-jemalloc_4-ubuntu-24.04_amd64.deb" \
+            -b "$(pwd)/ruby-bin-jemalloc.tar.gz" \
+            -o "$(pwd)/packages/fullstaq-ruby-4.0-jemalloc_4-${{ matrix.distro }}_amd64.deb" \
             -r '4'
-
-      - name: 'Build Ruby package [el-9/normal]'
+      - name: 'Build Ruby RPM [${{ matrix.distro }}/jemalloc]'
+        if: matrix.package_format == 'RPM'
         run: |
+          SANITIZED_DISTRO=$(echo '${{ matrix.distro }}' | tr -d '-')
           ./build-ruby-rpm \
-            -b "$(pwd)/ruby-bin-el-9-normal.tar.gz" \
-            -o "$(pwd)/packages/fullstaq-ruby-4.0-rev4-el9.x86_64.rpm" \
+            -b "$(pwd)/ruby-bin-jemalloc.tar.gz" \
+            -o "$(pwd)/packages/fullstaq-ruby-4.0-jemalloc-rev4-${SANITIZED_DISTRO}.x86_64.rpm" \
             -r '4'
 
-      - name: 'Build Ruby package [el-9/jemalloc]'
+      ### Upload packages ###
+
+      - name: Upload packages
+        uses: actions/upload-artifact@v4
+        with:
+          name: 'contributor-packages-${{ matrix.distro }}'
+          path: packages
+          retention-days: 1
+
+
+  build_common_packages:
+    name: Build common and rbenv packages
+    needs: build_images
+    runs-on: ubuntu-24.04
+    if: >
+      github.repository != 'fullstaq-ruby/server-edition'
+      || (github.event_name == 'pull_request'
+      && github.event.pull_request.head.repo.full_name != github.repository)
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download utility Docker image
+        uses: actions/download-artifact@v4
+        with:
+          name: 'docker-image-utility'
+          path: docker-image-utility
+      - name: Load utility Docker image
+        run: ./internal-scripts/ci-cd/load-docker-image.sh
+        env:
+          TARBALL: docker-image-utility/image.tar.zst
+
+      - name: Clone Rbenv source
         run: |
-          ./build-ruby-rpm \
-            -b "$(pwd)/ruby-bin-el-9-jemalloc.tar.gz" \
-            -o "$(pwd)/packages/fullstaq-ruby-4.0-jemalloc-rev4-el9.x86_64.rpm" \
-            -r '4'
+          git clone 'https://github.com/fullstaq-ruby/rbenv.git' rbenv-src
+          cd rbenv-src
+          git checkout 'fbaa15993171bf'
 
-      ### Build Rbenv packages ###
+      - name: Create packages directory
+        run: mkdir -p packages
 
       - name: Build Rbenv DEB
         run: |
@@ -274,9 +263,6 @@ jobs:
             -o "$(pwd)/packages/fullstaq-rbenv-1.1.2_16-1.noarch.rpm" \
             -n '1.1.2-16' \
             -r '1'
-
-      ### Build common packages ###
-
       - name: Build common DEB
         run: |
           ./build-common-deb \
@@ -286,18 +272,19 @@ jobs:
           ./build-common-rpm \
             -o "$(pwd)/packages/fullstaq-ruby-common-1.0-1.noarch.rpm"
 
-      ### Upload all packages ###
-
       - name: Upload packages
         uses: actions/upload-artifact@v4
         with:
-          name: contributor-packages
+          name: contributor-packages-common
           path: packages
+          retention-days: 1
 
 
   test_packages:
     name: 'Test [${{ matrix.distro }}/${{ matrix.variant }}]'
-    needs: build_packages
+    needs:
+      - build_packages
+      - build_common_packages
     runs-on: ubuntu-24.04
     if: >
       github.repository != 'fullstaq-ruby/server-edition'
@@ -327,10 +314,15 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Download packages
+      - name: Download distro packages
+        uses: actions/download-artifact@v4
+        with:
+          name: 'contributor-packages-${{ matrix.distro }}'
+          path: packages
+      - name: Download common packages
         uses: actions/download-artifact@v4
         with:
-          name: contributor-packages
+          name: contributor-packages-common
           path: packages
 
       - name: Download utility Docker image
diff --git a/.github/workflows/ci-cd-contributor.yml.erb b/.github/workflows/ci-cd-contributor.yml.erb
index a33870a7..bc1ac66b 100644
--- a/.github/workflows/ci-cd-contributor.yml.erb
+++ b/.github/workflows/ci-cd-contributor.yml.erb
@@ -33,7 +33,7 @@ jobs:
 
 
   build_images:
-    name: Build Docker images
+    name: 'Build Docker image [${{ matrix.distro }}]'
     needs: lint
     runs-on: ubuntu-24.04
     if: >
@@ -41,54 +41,47 @@ jobs:
       || (github.event_name == 'pull_request'
       && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          <%- contributor_distributions.each do |distro| -%>
+          <%- image = docker_images.find { |img| img[:id] == distro[:name] } -%>
+          - distro: '<%= distro[:name] %>'
+            image_name: '<%= image[:name] %>'
+            image_tag: '<%= image[:tag] %>'
+            source_dir: 'environments/<%= image[:id] %>'
+            artifact_name: '<%= docker_image_artifact_name(distro[:name]) %>'
+          <%- end -%>
+          <%- utility_image = docker_images.find { |img| img[:id] == 'utility' } -%>
+          - distro: 'utility'
+            image_name: '<%= utility_image[:name] %>'
+            image_tag: '<%= utility_image[:tag] %>'
+            source_dir: 'environments/utility'
+            artifact_name: '<%= docker_image_artifact_name('utility') %>'
     steps:
       - uses: actions/checkout@v4
-
-      <%- contributor_distributions.each do |distro| -%>
-      <%- image = docker_images.find { |img| img[:id] == distro[:name] } -%>
-      - name: 'Build Docker image [<%= distro[:name] %>]'
+      - name: Build Docker image
         run: ./internal-scripts/ci-cd/build-docker-images/build.sh
         env:
-          IMAGE_NAME: '<%= image[:name] %>'
-          IMAGE_TAG: '<%= image[:tag] %>'
-          SOURCE_DIR: 'environments/<%= image[:id] %>'
-      - name: 'Dump Docker image [<%= distro[:name] %>]'
+          IMAGE_NAME: '${{ matrix.image_name }}'
+          IMAGE_TAG: '${{ matrix.image_tag }}'
+          SOURCE_DIR: '${{ matrix.source_dir }}'
+      - name: Dump Docker image
         run: ./internal-scripts/ci-cd/build-docker-images/dump-image.sh
         env:
-          IMAGE_NAME: '<%= image[:name] %>'
-          IMAGE_TAG: '<%= image[:tag] %>'
-      - name: 'Upload Docker image artifact [<%= distro[:name] %>]'
+          IMAGE_NAME: '${{ matrix.image_name }}'
+          IMAGE_TAG: '${{ matrix.image_tag }}'
+      - name: Upload Docker image artifact
         uses: actions/upload-artifact@v4
         with:
-          name: '<%= docker_image_artifact_name(distro[:name]) %>'
+          name: '${{ matrix.artifact_name }}'
           path: output
-      - name: Clean up Docker image output
-        run: rm -rf output
-
-      <%- end -%>
-      <%- utility_image = docker_images.find { |img| img[:id] == 'utility' } -%>
-      - name: 'Build Docker image [utility]'
-        run: ./internal-scripts/ci-cd/build-docker-images/build.sh
-        env:
-          IMAGE_NAME: '<%= utility_image[:name] %>'
-          IMAGE_TAG: '<%= utility_image[:tag] %>'
-          SOURCE_DIR: 'environments/utility'
-      - name: 'Dump Docker image [utility]'
-        run: ./internal-scripts/ci-cd/build-docker-images/dump-image.sh
-        env:
-          IMAGE_NAME: '<%= utility_image[:name] %>'
-          IMAGE_TAG: '<%= utility_image[:tag] %>'
-      - name: 'Upload Docker image artifact [utility]'
-        uses: actions/upload-artifact@v4
-        with:
-          name: '<%= docker_image_artifact_name('utility') %>'
-          path: output
-      - name: Clean up Docker image output
-        run: rm -rf output
+          retention-days: 1
 
 
   build_packages:
-    name: Build packages
+    name: 'Build packages [${{ matrix.distro }}]'
     needs: build_images
     runs-on: ubuntu-24.04
     if: >
@@ -96,29 +89,35 @@ jobs:
       || (github.event_name == 'pull_request'
       && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          <%- contributor_distributions.each do |distro| -%>
+          - distro: '<%= distro[:name] %>'
+            package_format: '<%= distro[:package_format] %>'
+            image_artifact_name: '<%= docker_image_artifact_name(distro[:name]) %>'
+          <%- end -%>
     steps:
       - uses: actions/checkout@v4
 
       ### Download and load Docker images ###
 
-      <%- contributor_distributions.each do |distro| -%>
-      - name: 'Download Docker image artifact [<%= distro[:name] %>]'
+      - name: Download distro Docker image
         uses: actions/download-artifact@v4
         with:
-          name: '<%= docker_image_artifact_name(distro[:name]) %>'
-          path: docker-image-<%= distro[:name] %>
-      - name: 'Load Docker image [<%= distro[:name] %>]'
+          name: '${{ matrix.image_artifact_name }}'
+          path: docker-image-distro
+      - name: Load distro Docker image
         run: ./internal-scripts/ci-cd/load-docker-image.sh
         env:
-          TARBALL: docker-image-<%= distro[:name] %>/image.tar.zst
-
-      <%- end -%>
-      - name: 'Download Docker image artifact [utility]'
+          TARBALL: docker-image-distro/image.tar.zst
+      - name: Download utility Docker image
         uses: actions/download-artifact@v4
         with:
           name: '<%= docker_image_artifact_name('utility') %>'
           path: docker-image-utility
-      - name: 'Load Docker image [utility]'
+      - name: Load utility Docker image
         run: ./internal-scripts/ci-cd/load-docker-image.sh
         env:
           TARBALL: docker-image-utility/image.tar.zst
@@ -129,66 +128,98 @@ jobs:
         run: curl -fsSL -o ruby-src.tar.gz '<%= ruby_source_url(rpv[:full_version]) %>'
       - name: Download Jemalloc source
         run: curl -fsSL -o jemalloc-src.tar.bz2 '<%= jemalloc_source_url %>'
-      - name: Clone Rbenv source
-        run: |
-          git clone '<%= config[:rbenv][:repo] %>' rbenv-src
-          cd rbenv-src
-          git checkout '<%= config[:rbenv][:ref] %>'
 
       ### Build Jemalloc ###
 
-      <%- contributor_distributions.each do |distro| -%>
-      - name: 'Build Jemalloc [<%= distro[:name] %>]'
+      - name: Build Jemalloc
         run: |
           ./build-jemalloc \
-            -n '<%= distro[:name] %>' \
+            -n '${{ matrix.distro }}' \
             -s "$(pwd)/jemalloc-src.tar.bz2" \
-            -o "$(pwd)/jemalloc-bin-<%= distro[:name] %>.tar.gz" \
+            -o "$(pwd)/jemalloc-bin.tar.gz" \
             -j 2
 
-      <%- end -%>
       ### Build Ruby binaries ###
 
-      <%- contributor_distributions.each do |distro| -%>
       <%- variants_for_ruby_version(rpv).each do |variant| -%>
-      - name: 'Build Ruby binaries [<%= distro[:name] %>/<%= variant[:name] %>]'
+      - name: 'Build Ruby binaries [${{ matrix.distro }}/<%= variant[:name] %>]'
         run: |
           ./build-ruby \
-            -n '<%= distro[:name] %>' \
+            -n '${{ matrix.distro }}' \
             -s "$(pwd)/ruby-src.tar.gz" \
             -v '<%= rpv[:id] %>' \
-            -o "$(pwd)/ruby-bin-<%= distro[:name] %>-<%= variant[:name] %>.tar.gz" \
+            -o "$(pwd)/ruby-bin-<%= variant[:name] %>.tar.gz" \
       <%- if variant[:name] == 'jemalloc' -%>
-            -m "$(pwd)/jemalloc-bin-<%= distro[:name] %>.tar.gz" \
+            -m "$(pwd)/jemalloc-bin.tar.gz" \
       <%- elsif variant[:name] == 'malloctrim' -%>
             -t \
       <%- end -%>
             -j 2
 
-      <%- end -%>
       <%- end -%>
       - name: Create packages directory
         run: mkdir -p packages
 
       ### Build Ruby packages ###
 
-      <%- contributor_distributions.each do |distro| -%>
       <%- variants_for_ruby_version(rpv).each do |variant| -%>
-      <%- pkg_basename = ruby_package_basename(rpv, distro, variant) -%>
-      - name: 'Build Ruby package [<%= distro[:name] %>/<%= variant[:name] %>]'
+      - name: 'Build Ruby DEB [${{ matrix.distro }}/<%= variant[:name] %>]'
+        if: matrix.package_format == 'DEB'
         run: |
-      <%- if distro[:package_format] == :DEB -%>
           ./build-ruby-deb \
-      <%- else -%>
+            -b "$(pwd)/ruby-bin-<%= variant[:name] %>.tar.gz" \
+            -o "$(pwd)/packages/fullstaq-ruby-<%= rpv[:id] %><%= variant[:package_suffix] %>_<%= rpv[:package_revision] %>-${{ matrix.distro }}_amd64.deb" \
+            -r '<%= rpv[:package_revision] %>'
+      - name: 'Build Ruby RPM [${{ matrix.distro }}/<%= variant[:name] %>]'
+        if: matrix.package_format == 'RPM'
+        run: |
+          SANITIZED_DISTRO=$(echo '${{ matrix.distro }}' | tr -d '-')
           ./build-ruby-rpm \
-      <%- end -%>
-            -b "$(pwd)/ruby-bin-<%= distro[:name] %>-<%= variant[:name] %>.tar.gz" \
-            -o "$(pwd)/packages/<%= pkg_basename %>" \
+            -b "$(pwd)/ruby-bin-<%= variant[:name] %>.tar.gz" \
+            -o "$(pwd)/packages/fullstaq-ruby-<%= rpv[:id] %><%= variant[:package_suffix] %>-rev<%= rpv[:package_revision] %>-${SANITIZED_DISTRO}.x86_64.rpm" \
             -r '<%= rpv[:package_revision] %>'
 
       <%- end -%>
-      <%- end -%>
-      ### Build Rbenv packages ###
+      ### Upload packages ###
+
+      - name: Upload packages
+        uses: actions/upload-artifact@v4
+        with:
+          name: 'contributor-packages-${{ matrix.distro }}'
+          path: packages
+          retention-days: 1
+
+
+  build_common_packages:
+    name: Build common and rbenv packages
+    needs: build_images
+    runs-on: ubuntu-24.04
+    if: >
+      github.repository != 'fullstaq-ruby/server-edition'
+      || (github.event_name == 'pull_request'
+      && github.event.pull_request.head.repo.full_name != github.repository)
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download utility Docker image
+        uses: actions/download-artifact@v4
+        with:
+          name: '<%= docker_image_artifact_name('utility') %>'
+          path: docker-image-utility
+      - name: Load utility Docker image
+        run: ./internal-scripts/ci-cd/load-docker-image.sh
+        env:
+          TARBALL: docker-image-utility/image.tar.zst
+
+      - name: Clone Rbenv source
+        run: |
+          git clone '<%= config[:rbenv][:repo] %>' rbenv-src
+          cd rbenv-src
+          git checkout '<%= config[:rbenv][:ref] %>'
+
+      - name: Create packages directory
+        run: mkdir -p packages
 
       - name: Build Rbenv DEB
         run: |
@@ -204,9 +235,6 @@ jobs:
             -o "$(pwd)/packages/<%= rbenv_package_basename(:RPM) %>" \
             -n '<%= rbenv_version %>' \
             -r '<%= rbenv_package_revision %>'
-
-      ### Build common packages ###
-
       - name: Build common DEB
         run: |
           ./build-common-deb \
@@ -216,18 +244,19 @@ jobs:
           ./build-common-rpm \
             -o "$(pwd)/packages/<%= common_package_basename(:RPM) %>"
 
-      ### Upload all packages ###
-
       - name: Upload packages
         uses: actions/upload-artifact@v4
         with:
-          name: contributor-packages
+          name: contributor-packages-common
           path: packages
+          retention-days: 1
 
 
   test_packages:
     name: 'Test [${{ matrix.distro }}/${{ matrix.variant }}]'
-    needs: build_packages
+    needs:
+      - build_packages
+      - build_common_packages
     runs-on: ubuntu-24.04
     if: >
       github.repository != 'fullstaq-ruby/server-edition'
@@ -249,10 +278,15 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Download packages
+      - name: Download distro packages
+        uses: actions/download-artifact@v4
+        with:
+          name: 'contributor-packages-${{ matrix.distro }}'
+          path: packages
+      - name: Download common packages
         uses: actions/download-artifact@v4
         with:
-          name: contributor-packages
+          name: contributor-packages-common
           path: packages
 
       - name: Download utility Docker image

From 03b77ed04421c15df342b81d0a50295e41184cf3 Mon Sep 17 00:00:00 2001
From: abtreece <britt.treece@gmail.com>
Date: Fri, 22 May 2026 14:14:48 -0500
Subject: [PATCH 07/13] chore(ci): pin action SHAs in contributor and
 label-guard workflows

Pins all third-party action references in the workflows introduced by
this PR to commit SHAs, with a trailing tag comment for readability.
Mitigates supply-chain risk from mutable tag re-pointing in workflows
that run untrusted contributor code.

Also adds .github/dependabot.yml so the github-actions ecosystem
tracks SHA updates automatically.

Scope: ci-cd-contributor.yml.erb and ci-cd-label-guard.yml. Pinning
the pre-existing workflows (main, prepare, build-packages-N,
publish-test-*) is out of scope here and can land separately.
---
 .github/dependabot.yml                      |  6 +++++
 .github/workflows/ci-cd-contributor.yml     | 30 ++++++++++-----------
 .github/workflows/ci-cd-contributor.yml.erb | 30 ++++++++++-----------
 .github/workflows/ci-cd-label-guard.yml     |  2 +-
 4 files changed, 37 insertions(+), 31 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..5ace4600
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/ci-cd-contributor.yml b/.github/workflows/ci-cd-contributor.yml
index c0600f4b..da8f9923 100644
--- a/.github/workflows/ci-cd-contributor.yml
+++ b/.github/workflows/ci-cd-contributor.yml
@@ -33,8 +33,8 @@ jobs:
       && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1
         with:
           ruby-version: '3.3'
       - name: Check
@@ -70,7 +70,7 @@ jobs:
             source_dir: 'environments/utility'
             artifact_name: 'docker-image-utility'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Build Docker image
         run: ./internal-scripts/ci-cd/build-docker-images/build.sh
         env:
@@ -83,7 +83,7 @@ jobs:
           IMAGE_NAME: '${{ matrix.image_name }}'
           IMAGE_TAG: '${{ matrix.image_tag }}'
       - name: Upload Docker image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: '${{ matrix.artifact_name }}'
           path: output
@@ -110,12 +110,12 @@ jobs:
             package_format: 'RPM'
             image_artifact_name: 'docker-image-el-9'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       ### Download and load Docker images ###
 
       - name: Download distro Docker image
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: '${{ matrix.image_artifact_name }}'
           path: docker-image-distro
@@ -124,7 +124,7 @@ jobs:
         env:
           TARBALL: docker-image-distro/image.tar.zst
       - name: Download utility Docker image
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: 'docker-image-utility'
           path: docker-image-utility
@@ -211,7 +211,7 @@ jobs:
       ### Upload packages ###
 
       - name: Upload packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: 'contributor-packages-${{ matrix.distro }}'
           path: packages
@@ -228,10 +228,10 @@ jobs:
       && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Download utility Docker image
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: 'docker-image-utility'
           path: docker-image-utility
@@ -273,7 +273,7 @@ jobs:
             -o "$(pwd)/packages/fullstaq-ruby-common-1.0-1.noarch.rpm"
 
       - name: Upload packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: contributor-packages-common
           path: packages
@@ -312,21 +312,21 @@ jobs:
             test_image: 'rockylinux:9'
             package_format: 'RPM'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Download distro packages
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: 'contributor-packages-${{ matrix.distro }}'
           path: packages
       - name: Download common packages
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: contributor-packages-common
           path: packages
 
       - name: Download utility Docker image
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: 'docker-image-utility'
           path: docker-image-utility
diff --git a/.github/workflows/ci-cd-contributor.yml.erb b/.github/workflows/ci-cd-contributor.yml.erb
index bc1ac66b..140bde1e 100644
--- a/.github/workflows/ci-cd-contributor.yml.erb
+++ b/.github/workflows/ci-cd-contributor.yml.erb
@@ -24,8 +24,8 @@ jobs:
       && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1
         with:
           ruby-version: '3.3'
       - name: Check
@@ -60,7 +60,7 @@ jobs:
             source_dir: 'environments/utility'
             artifact_name: '<%= docker_image_artifact_name('utility') %>'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Build Docker image
         run: ./internal-scripts/ci-cd/build-docker-images/build.sh
         env:
@@ -73,7 +73,7 @@ jobs:
           IMAGE_NAME: '${{ matrix.image_name }}'
           IMAGE_TAG: '${{ matrix.image_tag }}'
       - name: Upload Docker image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: '${{ matrix.artifact_name }}'
           path: output
@@ -99,12 +99,12 @@ jobs:
             image_artifact_name: '<%= docker_image_artifact_name(distro[:name]) %>'
           <%- end -%>
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       ### Download and load Docker images ###
 
       - name: Download distro Docker image
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: '${{ matrix.image_artifact_name }}'
           path: docker-image-distro
@@ -113,7 +113,7 @@ jobs:
         env:
           TARBALL: docker-image-distro/image.tar.zst
       - name: Download utility Docker image
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: '<%= docker_image_artifact_name('utility') %>'
           path: docker-image-utility
@@ -183,7 +183,7 @@ jobs:
       ### Upload packages ###
 
       - name: Upload packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: 'contributor-packages-${{ matrix.distro }}'
           path: packages
@@ -200,10 +200,10 @@ jobs:
       && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Download utility Docker image
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: '<%= docker_image_artifact_name('utility') %>'
           path: docker-image-utility
@@ -245,7 +245,7 @@ jobs:
             -o "$(pwd)/packages/<%= common_package_basename(:RPM) %>"
 
       - name: Upload packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: contributor-packages-common
           path: packages
@@ -276,21 +276,21 @@ jobs:
           <%- end -%>
           <%- end -%>
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Download distro packages
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: 'contributor-packages-${{ matrix.distro }}'
           path: packages
       - name: Download common packages
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: contributor-packages-common
           path: packages
 
       - name: Download utility Docker image
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: '<%= docker_image_artifact_name('utility') %>'
           path: docker-image-utility
diff --git a/.github/workflows/ci-cd-label-guard.yml b/.github/workflows/ci-cd-label-guard.yml
index dcf44fd6..4737773e 100644
--- a/.github/workflows/ci-cd-label-guard.yml
+++ b/.github/workflows/ci-cd-label-guard.yml
@@ -12,7 +12,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Remove ok-to-test label if present
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const { owner, repo } = context.repo;

From 1806c209b6abe3831cd8950021c91992bb91269d Mon Sep 17 00:00:00 2001
From: abtreece <britt.treece@gmail.com>
Date: Fri, 22 May 2026 14:18:18 -0500
Subject: [PATCH 08/13] fix(ci): gate check_workflow_uptodate with ok-to-test
 and check out PR head

Under pull_request_target the bare actions/checkout@v4 was checking
out the base branch, so the "is the generated YAML up-to-date with
the ERB?" check silently passed regardless of what the PR changed,
making the check meaningless for fork PRs.

Add the same ref: override and ok-to-test label gate used by
determine_necessary_jobs so the check actually validates PR-head
contents, and only runs after a maintainer has labeled the PR.
---
 .github/workflows/ci-cd-main.yml     | 7 ++++++-
 .github/workflows/ci-cd-main.yml.erb | 7 ++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci-cd-main.yml b/.github/workflows/ci-cd-main.yml
index 91c5b011..cd166b98 100644
--- a/.github/workflows/ci-cd-main.yml
+++ b/.github/workflows/ci-cd-main.yml
@@ -94,9 +94,14 @@ jobs:
   check_workflow_uptodate:
     name: Check whether workflow is up-to-date
     runs-on: ubuntu-24.04
-    if: github.repository == 'fullstaq-ruby/server-edition'
+    if: >
+      github.repository == 'fullstaq-ruby/server-edition'
+      && (github.event_name != 'pull_request_target'
+      || github.event.label.name == 'ok-to-test')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
       - name: Check
         run: ./internal-scripts/ci-cd/check-workflow-uptodate/check.sh
 
diff --git a/.github/workflows/ci-cd-main.yml.erb b/.github/workflows/ci-cd-main.yml.erb
index d6bbd4e0..a4b2614a 100644
--- a/.github/workflows/ci-cd-main.yml.erb
+++ b/.github/workflows/ci-cd-main.yml.erb
@@ -84,9 +84,14 @@ jobs:
   check_workflow_uptodate:
     name: Check whether workflow is up-to-date
     runs-on: ubuntu-24.04
-    if: github.repository == 'fullstaq-ruby/server-edition'
+    if: >
+      github.repository == 'fullstaq-ruby/server-edition'
+      && (github.event_name != 'pull_request_target'
+      || github.event.label.name == 'ok-to-test')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
       - name: Check
         run: ./internal-scripts/ci-cd/check-workflow-uptodate/check.sh
 

From c461ee0001eb1e80596fe7e26f7ff0f32c86a5ef Mon Sep 17 00:00:00 2001
From: abtreece <britt.treece@gmail.com>
Date: Fri, 22 May 2026 14:22:56 -0500
Subject: [PATCH 09/13] docs(ci): document pull_request/pull_request_target
 invariant in workflow headers

Adds a short header comment to ci-cd-main, ci-cd-contributor, and
ci-cd-label-guard describing how the three files combine to form the
fork-PR security boundary. A future change to any single file (e.g.,
flipping pull_request_target to pull_request, removing the label
gate, renaming the ok-to-test label) silently breaks the model
otherwise.
---
 .github/workflows/ci-cd-contributor.yml     | 17 +++++++++++++++++
 .github/workflows/ci-cd-contributor.yml.erb | 17 +++++++++++++++++
 .github/workflows/ci-cd-label-guard.yml     | 17 +++++++++++++++++
 .github/workflows/ci-cd-main.yml            | 17 +++++++++++++++++
 .github/workflows/ci-cd-main.yml.erb        | 17 +++++++++++++++++
 5 files changed, 85 insertions(+)

diff --git a/.github/workflows/ci-cd-contributor.yml b/.github/workflows/ci-cd-contributor.yml
index da8f9923..3d9f769f 100644
--- a/.github/workflows/ci-cd-contributor.yml
+++ b/.github/workflows/ci-cd-contributor.yml
@@ -10,6 +10,23 @@
 #
 #   git config core.hooksPath .githooks
 
+# Security invariant: the contributor pipeline is split across three workflows.
+#
+#   ci-cd-main         - Privileged (secrets, OIDC, write tokens). Runs on
+#                        push to upstream branches, and on pull_request_target
+#                        when a maintainer applies the ok-to-test label.
+#                        Checks out PR head only when label-gated.
+#   ci-cd-contributor  - Unprivileged. Runs on pull_request for fork PRs and
+#                        on push in forks. No secrets. Safe on arbitrary
+#                        contributor commits.
+#   ci-cd-label-guard  - Strips ok-to-test on every push to a labeled PR
+#                        (pull_request_target: synchronize), forcing
+#                        maintainer re-review before the privileged
+#                        pipeline re-runs.
+#
+# Changing triggers, if-guards, or the label name in any of these files
+# without considering the others can break the security model.
+
 name: 'CI/CD: contributor'
 
 on:
diff --git a/.github/workflows/ci-cd-contributor.yml.erb b/.github/workflows/ci-cd-contributor.yml.erb
index 140bde1e..a42716cd 100644
--- a/.github/workflows/ci-cd-contributor.yml.erb
+++ b/.github/workflows/ci-cd-contributor.yml.erb
@@ -1,6 +1,23 @@
 <%= editing_warning_comment('ci-cd-contributor') %>
 <%- rpv = latest_ruby_package_version -%>
 
+# Security invariant: the contributor pipeline is split across three workflows.
+#
+#   ci-cd-main         - Privileged (secrets, OIDC, write tokens). Runs on
+#                        push to upstream branches, and on pull_request_target
+#                        when a maintainer applies the ok-to-test label.
+#                        Checks out PR head only when label-gated.
+#   ci-cd-contributor  - Unprivileged. Runs on pull_request for fork PRs and
+#                        on push in forks. No secrets. Safe on arbitrary
+#                        contributor commits.
+#   ci-cd-label-guard  - Strips ok-to-test on every push to a labeled PR
+#                        (pull_request_target: synchronize), forcing
+#                        maintainer re-review before the privileged
+#                        pipeline re-runs.
+#
+# Changing triggers, if-guards, or the label name in any of these files
+# without considering the others can break the security model.
+
 name: 'CI/CD: contributor'
 
 on:
diff --git a/.github/workflows/ci-cd-label-guard.yml b/.github/workflows/ci-cd-label-guard.yml
index 4737773e..a73f6366 100644
--- a/.github/workflows/ci-cd-label-guard.yml
+++ b/.github/workflows/ci-cd-label-guard.yml
@@ -1,3 +1,20 @@
+# Security invariant: the contributor pipeline is split across three workflows.
+#
+#   ci-cd-main         - Privileged (secrets, OIDC, write tokens). Runs on
+#                        push to upstream branches, and on pull_request_target
+#                        when a maintainer applies the ok-to-test label.
+#                        Checks out PR head only when label-gated.
+#   ci-cd-contributor  - Unprivileged. Runs on pull_request for fork PRs and
+#                        on push in forks. No secrets. Safe on arbitrary
+#                        contributor commits.
+#   ci-cd-label-guard  - This file. Strips ok-to-test on every push to a
+#                        labeled PR (pull_request_target: synchronize),
+#                        forcing maintainer re-review before the privileged
+#                        pipeline re-runs.
+#
+# Changing triggers, if-guards, or the label name in any of these files
+# without considering the others can break the security model.
+
 name: 'CI/CD: label guard'
 
 on:
diff --git a/.github/workflows/ci-cd-main.yml b/.github/workflows/ci-cd-main.yml
index cd166b98..c52a1617 100644
--- a/.github/workflows/ci-cd-main.yml
+++ b/.github/workflows/ci-cd-main.yml
@@ -10,6 +10,23 @@
 #
 #   git config core.hooksPath .githooks
 
+# Security invariant: the contributor pipeline is split across three workflows.
+#
+#   ci-cd-main         - Privileged (secrets, OIDC, write tokens). Runs on
+#                        push to upstream branches, and on pull_request_target
+#                        when a maintainer applies the ok-to-test label.
+#                        Checks out PR head only when label-gated.
+#   ci-cd-contributor  - Unprivileged. Runs on pull_request for fork PRs and
+#                        on push in forks. No secrets. Safe on arbitrary
+#                        contributor commits.
+#   ci-cd-label-guard  - Strips ok-to-test on every push to a labeled PR
+#                        (pull_request_target: synchronize), forcing
+#                        maintainer re-review before the privileged
+#                        pipeline re-runs.
+#
+# Changing triggers, if-guards, or the label name in any of these files
+# without considering the others can break the security model.
+
 name: 'CI/CD: main'
 
 on:
diff --git a/.github/workflows/ci-cd-main.yml.erb b/.github/workflows/ci-cd-main.yml.erb
index a4b2614a..5c1302cf 100644
--- a/.github/workflows/ci-cd-main.yml.erb
+++ b/.github/workflows/ci-cd-main.yml.erb
@@ -1,5 +1,22 @@
 <%= editing_warning_comment('ci-cd-main') %>
 
+# Security invariant: the contributor pipeline is split across three workflows.
+#
+#   ci-cd-main         - Privileged (secrets, OIDC, write tokens). Runs on
+#                        push to upstream branches, and on pull_request_target
+#                        when a maintainer applies the ok-to-test label.
+#                        Checks out PR head only when label-gated.
+#   ci-cd-contributor  - Unprivileged. Runs on pull_request for fork PRs and
+#                        on push in forks. No secrets. Safe on arbitrary
+#                        contributor commits.
+#   ci-cd-label-guard  - Strips ok-to-test on every push to a labeled PR
+#                        (pull_request_target: synchronize), forcing
+#                        maintainer re-review before the privileged
+#                        pipeline re-runs.
+#
+# Changing triggers, if-guards, or the label name in any of these files
+# without considering the others can break the security model.
+
 name: 'CI/CD: main'
 
 on:

From 5017b96094f6bb235ec571ac3c047d4c7081b966 Mon Sep 17 00:00:00 2001
From: abtreece <britt.treece@gmail.com>
Date: Wed, 23 Sep 2026 21:12:19 -0500
Subject: [PATCH 10/13] chore(ci): align contributor and label-guard action
 pins with repo versions

Upstream bumped the pinned actions used by the main CI workflows while
this PR was open. Match those versions so each action has one pin
across the repo: checkout v7.0.1, upload-artifact v7.0.1,
github-script v9.0.0, setup-ruby v1.321.0.

download-artifact is not used by any upstream workflow, so it moves to
the latest release (v8.0.1). All downloads are by name, so the v5
by-ID path change does not apply; v8 now fails on digest mismatch by
default. The label-guard script only uses github.rest and context, so
the github-script v9 require/getOctokit changes do not affect it.
---
 .github/workflows/ci-cd-contributor.yml     | 30 ++++++++++-----------
 .github/workflows/ci-cd-contributor.yml.erb | 30 ++++++++++-----------
 .github/workflows/ci-cd-label-guard.yml     |  2 +-
 3 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/.github/workflows/ci-cd-contributor.yml b/.github/workflows/ci-cd-contributor.yml
index 3d9f769f..fb5907e6 100644
--- a/.github/workflows/ci-cd-contributor.yml
+++ b/.github/workflows/ci-cd-contributor.yml
@@ -50,8 +50,8 @@ jobs:
       && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '3.3'
       - name: Check
@@ -87,7 +87,7 @@ jobs:
             source_dir: 'environments/utility'
             artifact_name: 'docker-image-utility'
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build Docker image
         run: ./internal-scripts/ci-cd/build-docker-images/build.sh
         env:
@@ -100,7 +100,7 @@ jobs:
           IMAGE_NAME: '${{ matrix.image_name }}'
           IMAGE_TAG: '${{ matrix.image_tag }}'
       - name: Upload Docker image artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: '${{ matrix.artifact_name }}'
           path: output
@@ -127,12 +127,12 @@ jobs:
             package_format: 'RPM'
             image_artifact_name: 'docker-image-el-9'
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       ### Download and load Docker images ###
 
       - name: Download distro Docker image
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: '${{ matrix.image_artifact_name }}'
           path: docker-image-distro
@@ -141,7 +141,7 @@ jobs:
         env:
           TARBALL: docker-image-distro/image.tar.zst
       - name: Download utility Docker image
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: 'docker-image-utility'
           path: docker-image-utility
@@ -228,7 +228,7 @@ jobs:
       ### Upload packages ###
 
       - name: Upload packages
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: 'contributor-packages-${{ matrix.distro }}'
           path: packages
@@ -245,10 +245,10 @@ jobs:
       && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download utility Docker image
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: 'docker-image-utility'
           path: docker-image-utility
@@ -290,7 +290,7 @@ jobs:
             -o "$(pwd)/packages/fullstaq-ruby-common-1.0-1.noarch.rpm"
 
       - name: Upload packages
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: contributor-packages-common
           path: packages
@@ -329,21 +329,21 @@ jobs:
             test_image: 'rockylinux:9'
             package_format: 'RPM'
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download distro packages
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: 'contributor-packages-${{ matrix.distro }}'
           path: packages
       - name: Download common packages
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: contributor-packages-common
           path: packages
 
       - name: Download utility Docker image
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: 'docker-image-utility'
           path: docker-image-utility
diff --git a/.github/workflows/ci-cd-contributor.yml.erb b/.github/workflows/ci-cd-contributor.yml.erb
index a42716cd..2052aeb3 100644
--- a/.github/workflows/ci-cd-contributor.yml.erb
+++ b/.github/workflows/ci-cd-contributor.yml.erb
@@ -41,8 +41,8 @@ jobs:
       && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '3.3'
       - name: Check
@@ -77,7 +77,7 @@ jobs:
             source_dir: 'environments/utility'
             artifact_name: '<%= docker_image_artifact_name('utility') %>'
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build Docker image
         run: ./internal-scripts/ci-cd/build-docker-images/build.sh
         env:
@@ -90,7 +90,7 @@ jobs:
           IMAGE_NAME: '${{ matrix.image_name }}'
           IMAGE_TAG: '${{ matrix.image_tag }}'
       - name: Upload Docker image artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: '${{ matrix.artifact_name }}'
           path: output
@@ -116,12 +116,12 @@ jobs:
             image_artifact_name: '<%= docker_image_artifact_name(distro[:name]) %>'
           <%- end -%>
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       ### Download and load Docker images ###
 
       - name: Download distro Docker image
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: '${{ matrix.image_artifact_name }}'
           path: docker-image-distro
@@ -130,7 +130,7 @@ jobs:
         env:
           TARBALL: docker-image-distro/image.tar.zst
       - name: Download utility Docker image
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: '<%= docker_image_artifact_name('utility') %>'
           path: docker-image-utility
@@ -200,7 +200,7 @@ jobs:
       ### Upload packages ###
 
       - name: Upload packages
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: 'contributor-packages-${{ matrix.distro }}'
           path: packages
@@ -217,10 +217,10 @@ jobs:
       && github.event.pull_request.head.repo.full_name != github.repository)
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download utility Docker image
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: '<%= docker_image_artifact_name('utility') %>'
           path: docker-image-utility
@@ -262,7 +262,7 @@ jobs:
             -o "$(pwd)/packages/<%= common_package_basename(:RPM) %>"
 
       - name: Upload packages
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: contributor-packages-common
           path: packages
@@ -293,21 +293,21 @@ jobs:
           <%- end -%>
           <%- end -%>
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download distro packages
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: 'contributor-packages-${{ matrix.distro }}'
           path: packages
       - name: Download common packages
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: contributor-packages-common
           path: packages
 
       - name: Download utility Docker image
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: '<%= docker_image_artifact_name('utility') %>'
           path: docker-image-utility
diff --git a/.github/workflows/ci-cd-label-guard.yml b/.github/workflows/ci-cd-label-guard.yml
index a73f6366..c23870eb 100644
--- a/.github/workflows/ci-cd-label-guard.yml
+++ b/.github/workflows/ci-cd-label-guard.yml
@@ -29,7 +29,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Remove ok-to-test label if present
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const { owner, repo } = context.repo;

From 194a5e93f4e5ef08700f452457e2f54ed5bff064 Mon Sep 17 00:00:00 2001
From: Hongli Lai <hongli@hongli.nl>
Date: Tue, 20 Oct 2026 15:10:40 +0200
Subject: [PATCH 11/13] Pass correct Git commit from ci-cd-main to all
 sub-workflows

---
 .github/workflows/ci-cd-build-packages-1.yml  |  85 +++++-
 .github/workflows/ci-cd-build-packages-2.yml  |  85 +++++-
 .github/workflows/ci-cd-build-packages-3.yml  |  85 +++++-
 .github/workflows/ci-cd-build-packages-4.yml  |  35 ++-
 .../workflows/ci-cd-build-packages.yml.erb    |  13 +-
 .github/workflows/ci-cd-main.yml              |  39 ++-
 .github/workflows/ci-cd-main.yml.erb          |  24 +-
 .github/workflows/ci-cd-prepare.yml           |  46 +++-
 .github/workflows/ci-cd-prepare.yml.erb       |  26 +-
 .../ci-cd-publish-test-production.yml         | 249 ++++++++++++++++-
 .../ci-cd-publish-test-production.yml.erb     |  11 +-
 .github/workflows/ci-cd-publish-test-test.yml | 250 +++++++++++++++++-
 .../workflows/ci-cd-publish-test-test.yml.erb |  12 +-
 13 files changed, 904 insertions(+), 56 deletions(-)

diff --git a/.github/workflows/ci-cd-build-packages-1.yml b/.github/workflows/ci-cd-build-packages-1.yml
index be75a6cc..ae7f7509 100644
--- a/.github/workflows/ci-cd-build-packages-1.yml
+++ b/.github/workflows/ci-cd-build-packages-1.yml
@@ -15,12 +15,15 @@ name: 'CI/CD: build packages [1]'
 on:
   workflow_call:
     inputs:
+      git_commit:
+        type: string
+        required: false
       ci_artifacts_run_number:
-        required: true
         type: string
-      necessary_jobs:
         required: true
+      necessary_jobs:
         type: string
+        required: true
 
 env:
   CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number }}
@@ -40,6 +43,8 @@ jobs:
       packages: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -99,6 +104,8 @@ jobs:
       packages: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -171,6 +178,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -270,6 +279,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [centos-8];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -369,6 +380,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -468,6 +481,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [centos-8];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -567,6 +582,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -666,6 +683,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [centos-8];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -765,6 +784,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -864,6 +885,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [centos-8];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -963,6 +986,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1056,6 +1081,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1155,6 +1182,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [centos-8];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1254,6 +1283,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1353,6 +1384,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [centos-8];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1452,6 +1485,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1551,6 +1586,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [centos-8];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1650,6 +1687,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1749,6 +1788,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [centos-8];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1848,6 +1889,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1942,6 +1985,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2041,6 +2086,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [el-9];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2140,6 +2187,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2239,6 +2288,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [el-9];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2338,6 +2389,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2437,6 +2490,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [el-9];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2536,6 +2591,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2635,6 +2692,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [el-9];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2734,6 +2793,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2827,6 +2888,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2926,6 +2989,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [el-9];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3025,6 +3090,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3124,6 +3191,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [el-9];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3223,6 +3292,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3322,6 +3393,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [el-9];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3421,6 +3494,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3520,6 +3595,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [el-9];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3619,6 +3696,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3766,6 +3845,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
diff --git a/.github/workflows/ci-cd-build-packages-2.yml b/.github/workflows/ci-cd-build-packages-2.yml
index be0b198a..14daf5a2 100644
--- a/.github/workflows/ci-cd-build-packages-2.yml
+++ b/.github/workflows/ci-cd-build-packages-2.yml
@@ -15,12 +15,15 @@ name: 'CI/CD: build packages [2]'
 on:
   workflow_call:
     inputs:
+      git_commit:
+        type: string
+        required: false
       ci_artifacts_run_number:
-        required: true
         type: string
-      necessary_jobs:
         required: true
+      necessary_jobs:
         type: string
+        required: true
 
 env:
   CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number }}
@@ -40,6 +43,8 @@ jobs:
       packages: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -99,6 +104,8 @@ jobs:
       packages: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -171,6 +178,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -270,6 +279,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-11];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -369,6 +380,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -468,6 +481,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-11];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -567,6 +582,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -666,6 +683,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-11];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -765,6 +784,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -864,6 +885,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-11];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -963,6 +986,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1056,6 +1081,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1155,6 +1182,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-11];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1254,6 +1283,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1353,6 +1384,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-11];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1452,6 +1485,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1551,6 +1586,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-11];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1650,6 +1687,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1749,6 +1788,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-11];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1848,6 +1889,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1942,6 +1985,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2041,6 +2086,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-22.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2140,6 +2187,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2239,6 +2288,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-22.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2338,6 +2389,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2437,6 +2490,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-22.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2536,6 +2591,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2635,6 +2692,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-22.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2734,6 +2793,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2827,6 +2888,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2926,6 +2989,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-22.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3025,6 +3090,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3124,6 +3191,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-22.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3223,6 +3292,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3322,6 +3393,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-22.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3421,6 +3494,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3520,6 +3595,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-22.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3619,6 +3696,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3766,6 +3845,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
diff --git a/.github/workflows/ci-cd-build-packages-3.yml b/.github/workflows/ci-cd-build-packages-3.yml
index 65b62255..80482c4c 100644
--- a/.github/workflows/ci-cd-build-packages-3.yml
+++ b/.github/workflows/ci-cd-build-packages-3.yml
@@ -15,12 +15,15 @@ name: 'CI/CD: build packages [3]'
 on:
   workflow_call:
     inputs:
+      git_commit:
+        type: string
+        required: false
       ci_artifacts_run_number:
-        required: true
         type: string
-      necessary_jobs:
         required: true
+      necessary_jobs:
         type: string
+        required: true
 
 env:
   CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number }}
@@ -40,6 +43,8 @@ jobs:
       packages: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -99,6 +104,8 @@ jobs:
       packages: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -171,6 +178,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -270,6 +279,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-12];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -369,6 +380,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -468,6 +481,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-12];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -567,6 +582,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -666,6 +683,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-12];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -765,6 +784,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -864,6 +885,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-12];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -963,6 +986,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1056,6 +1081,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1155,6 +1182,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-12];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1254,6 +1283,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1353,6 +1384,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-12];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1452,6 +1485,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1551,6 +1586,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-12];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1650,6 +1687,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1749,6 +1788,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-12];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1848,6 +1889,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1942,6 +1985,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2041,6 +2086,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-24.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2140,6 +2187,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2239,6 +2288,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-24.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2338,6 +2389,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2437,6 +2490,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-24.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2536,6 +2591,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2635,6 +2692,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-24.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2734,6 +2793,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2827,6 +2888,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2926,6 +2989,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-24.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3025,6 +3090,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3124,6 +3191,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-24.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3223,6 +3292,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3322,6 +3393,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-24.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3421,6 +3494,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3520,6 +3595,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [ubuntu-24.04];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3619,6 +3696,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3766,6 +3845,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
diff --git a/.github/workflows/ci-cd-build-packages-4.yml b/.github/workflows/ci-cd-build-packages-4.yml
index 5e7d10a8..8f59a47a 100644
--- a/.github/workflows/ci-cd-build-packages-4.yml
+++ b/.github/workflows/ci-cd-build-packages-4.yml
@@ -15,12 +15,15 @@ name: 'CI/CD: build packages [4]'
 on:
   workflow_call:
     inputs:
+      git_commit:
+        type: string
+        required: false
       ci_artifacts_run_number:
-        required: true
         type: string
-      necessary_jobs:
         required: true
+      necessary_jobs:
         type: string
+        required: true
 
 env:
   CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number }}
@@ -40,6 +43,8 @@ jobs:
       packages: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -112,6 +117,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -211,6 +218,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-13];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -310,6 +319,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -409,6 +420,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-13];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -508,6 +521,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -607,6 +622,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-13];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -706,6 +723,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -805,6 +824,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-13];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -904,6 +925,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1003,6 +1026,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-13];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1102,6 +1127,8 @@ jobs:
       
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1201,6 +1228,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Jemalloc [debian-13];')        
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1318,6 +1347,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
diff --git a/.github/workflows/ci-cd-build-packages.yml.erb b/.github/workflows/ci-cd-build-packages.yml.erb
index b31f3a62..85a5394f 100644
--- a/.github/workflows/ci-cd-build-packages.yml.erb
+++ b/.github/workflows/ci-cd-build-packages.yml.erb
@@ -5,12 +5,15 @@ name: 'CI/CD: build packages [<%= part_number %>]'
 on:
   workflow_call:
     inputs:
+      git_commit:
+        type: string
+        required: false
       ci_artifacts_run_number:
-        required: true
         type: string
-      necessary_jobs:
         required: true
+      necessary_jobs:
         type: string
+        required: true
 
 env:
   CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number }}
@@ -31,6 +34,8 @@ jobs:
         packages: read
       steps:
         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            ref: ${{ inputs.git_commit }}
         - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
           with:
             project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -119,6 +124,8 @@ jobs:
         <% end %>
 
         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            ref: ${{ inputs.git_commit }}
         - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
           with:
             project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -232,6 +239,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
diff --git a/.github/workflows/ci-cd-main.yml b/.github/workflows/ci-cd-main.yml
index c52a1617..9cd7b584 100644
--- a/.github/workflows/ci-cd-main.yml
+++ b/.github/workflows/ci-cd-main.yml
@@ -70,6 +70,7 @@ jobs:
       id-token: write
       packages: read
     outputs:
+      git_commit: ${{ steps.checkout.outputs.commit }}
       ci_artifacts_run_number: ${{ steps.get_ci_artifacts_run_number.outputs.number }}
       necessary_jobs: ${{ steps.check.outputs.necessary_jobs }}
     steps:
@@ -79,7 +80,8 @@ jobs:
           exit 1
         if: github.event_name == 'push' && github.ref == 'refs/heads/fix/cicd-new-workflows'
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - id: checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
@@ -134,8 +136,9 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/ci-cd-prepare.yml
     with:
-        ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
-        necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
+      git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
+      necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
 
 
 
@@ -151,12 +154,9 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/ci-cd-build-packages-1.yml
     with:
+      git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
-    # # Run even if a transitively dependent job has been skipped
-    # if: |
-    #   needs.prepare.result == 'success'
-    #   && !failure() && !cancelled()
 
   build_packages_2:
     name: Build [2]
@@ -169,12 +169,9 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/ci-cd-build-packages-2.yml
     with:
+      git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
-    # # Run even if a transitively dependent job has been skipped
-    # if: |
-    #   needs.prepare.result == 'success'
-    #   && !failure() && !cancelled()
 
   build_packages_3:
     name: Build [3]
@@ -187,12 +184,9 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/ci-cd-build-packages-3.yml
     with:
+      git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
-    # # Run even if a transitively dependent job has been skipped
-    # if: |
-    #   needs.prepare.result == 'success'
-    #   && !failure() && !cancelled()
 
   build_packages_4:
     name: Build [4]
@@ -205,12 +199,9 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/ci-cd-build-packages-4.yml
     with:
+      git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
-    # # Run even if a transitively dependent job has been skipped
-    # if: |
-    #   needs.prepare.result == 'success'
-    #   && !failure() && !cancelled()
 
 
   publish_test:
@@ -233,8 +224,9 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/ci-cd-publish-test-test.yml
     with:
-        ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
-        necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
+      git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
+      necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
 
 
   publish_production:
@@ -250,5 +242,6 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/ci-cd-publish-test-production.yml
     with:
-        ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
-        necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
+      git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
+      necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
diff --git a/.github/workflows/ci-cd-main.yml.erb b/.github/workflows/ci-cd-main.yml.erb
index 5c1302cf..ddd86cc1 100644
--- a/.github/workflows/ci-cd-main.yml.erb
+++ b/.github/workflows/ci-cd-main.yml.erb
@@ -60,6 +60,7 @@ jobs:
       id-token: write
       packages: read
     outputs:
+      git_commit: ${{ steps.checkout.outputs.commit }}
       ci_artifacts_run_number: ${{ steps.get_ci_artifacts_run_number.outputs.number }}
       necessary_jobs: ${{ steps.check.outputs.necessary_jobs }}
     steps:
@@ -69,7 +70,8 @@ jobs:
           exit 1
         if: github.event_name == 'push' && github.ref == 'refs/heads/fix/cicd-new-workflows'
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - id: checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
@@ -124,8 +126,9 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/ci-cd-prepare.yml
     with:
-        ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
-        necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
+      git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
+      necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
 
 
   <%- distribution_buckets.each_with_index do |distributions, i| %>
@@ -141,12 +144,9 @@ jobs:
       secrets: inherit
       uses: ./.github/workflows/ci-cd-build-packages-<%= i + 1 %>.yml
       with:
+        git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
         ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
         necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
-      # # Run even if a transitively dependent job has been skipped
-      # if: |
-      #   needs.prepare.result == 'success'
-      #   && !failure() && !cancelled()
   <%- end -%>
   <%- end %>
 
@@ -165,8 +165,9 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/ci-cd-publish-test-test.yml
     with:
-        ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
-        necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
+      git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
+      necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
 
 
   publish_production:
@@ -182,5 +183,6 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/ci-cd-publish-test-production.yml
     with:
-        ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
-        necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
+      git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
+      necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
diff --git a/.github/workflows/ci-cd-prepare.yml b/.github/workflows/ci-cd-prepare.yml
index 8f93e343..e28341ab 100644
--- a/.github/workflows/ci-cd-prepare.yml
+++ b/.github/workflows/ci-cd-prepare.yml
@@ -15,12 +15,15 @@ name: 'CI/CD: prepare'
 on:
   workflow_call:
     inputs:
-      ci_artifacts_run_number:
+      git_commit:
         type: string
         required: false
-      necessary_jobs:
+      ci_artifacts_run_number:
+        type: string
         required: true
+      necessary_jobs:
         type: string
+        required: true
 
 env:
   CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number }}
@@ -46,6 +49,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -102,6 +106,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Install gem bundle;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -138,6 +144,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Build Docker image centos-8;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -180,6 +188,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Build Docker image debian-11;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -222,6 +232,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Build Docker image debian-12;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -264,6 +276,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Build Docker image debian-13;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -306,6 +320,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Build Docker image el-9;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -348,6 +364,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Build Docker image ubuntu-22.04;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -390,6 +408,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Build Docker image ubuntu-24.04;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -432,6 +452,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Build Docker image utility;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -479,6 +501,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Download Ruby source 4.0.6;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -513,6 +537,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Download Ruby source 3.4.10;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -547,6 +573,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Download Ruby source 3.3.12;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -581,6 +609,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Download Ruby source 3.2.11;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -617,6 +647,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Download Rbenv source;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -671,6 +703,8 @@ jobs:
           && contains(inputs.necessary_jobs.outputs.necessary_jobs, ';Build Docker image utility;')
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -738,6 +772,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Docker image utility;')
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -813,6 +849,8 @@ jobs:
           )
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -893,6 +931,8 @@ jobs:
           )
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -977,6 +1017,8 @@ jobs:
     if: 'always()'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
diff --git a/.github/workflows/ci-cd-prepare.yml.erb b/.github/workflows/ci-cd-prepare.yml.erb
index ee15b078..ce2946ae 100644
--- a/.github/workflows/ci-cd-prepare.yml.erb
+++ b/.github/workflows/ci-cd-prepare.yml.erb
@@ -5,12 +5,15 @@ name: 'CI/CD: prepare'
 on:
   workflow_call:
     inputs:
-      ci_artifacts_run_number:
+      git_commit:
         type: string
         required: false
-      necessary_jobs:
+      ci_artifacts_run_number:
+        type: string
         required: true
+      necessary_jobs:
         type: string
+        required: true
 
 env:
   CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number }}
@@ -36,6 +39,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -92,6 +96,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Install gem bundle;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -129,6 +135,8 @@ jobs:
       if: contains(inputs.necessary_jobs, ';Build Docker image <%= image[:id] %>;')
       steps:
         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            ref: ${{ inputs.git_commit }}
         - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
           with:
             tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -178,6 +186,8 @@ jobs:
       if: contains(inputs.necessary_jobs, ';Download Ruby source <%= ruby_version %>;')
       steps:
         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            ref: ${{ inputs.git_commit }}
         - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
           with:
             tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -216,6 +226,8 @@ jobs:
     if: contains(inputs.necessary_jobs, ';Download Rbenv source;')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -270,6 +282,8 @@ jobs:
           && contains(inputs.necessary_jobs.outputs.necessary_jobs, ';Build Docker image utility;')
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -337,6 +351,8 @@ jobs:
           && contains(inputs.necessary_jobs, ';Build Docker image utility;')
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -412,6 +428,8 @@ jobs:
           )
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -492,6 +510,8 @@ jobs:
           )
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -570,6 +590,8 @@ jobs:
     if: 'always()'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
diff --git a/.github/workflows/ci-cd-publish-test-production.yml b/.github/workflows/ci-cd-publish-test-production.yml
index 0aaa4101..b158ff80 100644
--- a/.github/workflows/ci-cd-publish-test-production.yml
+++ b/.github/workflows/ci-cd-publish-test-production.yml
@@ -15,12 +15,15 @@ name: 'CI/CD: publish & test against production repos'
 on:
   workflow_call:
     inputs:
+      git_commit:
+        type: string
+        required: false
       ci_artifacts_run_number:
-        required: true
         type: string
-      necessary_jobs:
         required: true
+      necessary_jobs:
         type: string
+        required: true
 
 env:
   CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number || github.run_number }}
@@ -40,6 +43,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          ref: ${{ inputs.git_commit }}
       - name: Clean disk space
         run: ./internal-scripts/ci-cd/publish/clean-disk-space.sh
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
@@ -148,6 +152,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -191,6 +197,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -234,6 +242,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -277,6 +287,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -320,6 +332,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -363,6 +377,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -406,6 +422,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -449,6 +467,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -492,6 +512,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -535,6 +557,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -578,6 +602,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -621,6 +647,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -664,6 +692,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -707,6 +737,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -750,6 +782,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -793,6 +827,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -836,6 +872,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -879,6 +917,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -923,6 +963,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -966,6 +1008,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1009,6 +1053,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1052,6 +1098,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1095,6 +1143,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1138,6 +1188,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1181,6 +1233,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1224,6 +1278,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1267,6 +1323,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1310,6 +1368,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1353,6 +1413,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1396,6 +1458,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1439,6 +1503,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1482,6 +1548,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1525,6 +1593,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1568,6 +1638,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1611,6 +1683,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1654,6 +1728,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1698,6 +1774,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1741,6 +1819,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1784,6 +1864,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1827,6 +1909,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1870,6 +1954,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1913,6 +1999,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1956,6 +2044,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1999,6 +2089,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2042,6 +2134,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2085,6 +2179,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2128,6 +2224,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2171,6 +2269,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2214,6 +2314,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2257,6 +2359,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2300,6 +2404,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2343,6 +2449,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2386,6 +2494,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2429,6 +2539,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2473,6 +2585,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2516,6 +2630,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2559,6 +2675,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2602,6 +2720,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2645,6 +2765,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2688,6 +2810,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2731,6 +2855,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2774,6 +2900,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2817,6 +2945,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2860,6 +2990,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2903,6 +3035,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2946,6 +3080,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2990,6 +3126,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3033,6 +3171,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3076,6 +3216,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3119,6 +3261,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3162,6 +3306,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3205,6 +3351,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3248,6 +3396,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3291,6 +3441,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3334,6 +3486,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3377,6 +3531,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3420,6 +3576,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3463,6 +3621,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3506,6 +3666,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3549,6 +3711,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3592,6 +3756,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3635,6 +3801,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3678,6 +3846,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3721,6 +3891,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3765,6 +3937,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3808,6 +3982,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3851,6 +4027,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3894,6 +4072,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3937,6 +4117,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3980,6 +4162,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4023,6 +4207,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4066,6 +4252,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4109,6 +4297,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4152,6 +4342,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4195,6 +4387,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4238,6 +4432,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4281,6 +4477,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4324,6 +4522,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4367,6 +4567,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4410,6 +4612,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4453,6 +4657,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4496,6 +4702,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4540,6 +4748,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4583,6 +4793,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4626,6 +4838,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4669,6 +4883,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4712,6 +4928,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4755,6 +4973,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4798,6 +5018,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4841,6 +5063,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4884,6 +5108,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4927,6 +5153,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4970,6 +5198,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5013,6 +5243,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5056,6 +5288,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5099,6 +5333,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5142,6 +5378,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5185,6 +5423,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5228,6 +5468,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5271,6 +5513,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5438,6 +5682,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          ref: ${{ inputs.git_commit }}
 
 
       ### Check whether dependent jobs failed ###
diff --git a/.github/workflows/ci-cd-publish-test-production.yml.erb b/.github/workflows/ci-cd-publish-test-production.yml.erb
index c763ba5a..338cc01a 100644
--- a/.github/workflows/ci-cd-publish-test-production.yml.erb
+++ b/.github/workflows/ci-cd-publish-test-production.yml.erb
@@ -5,12 +5,15 @@ name: 'CI/CD: publish & test against production repos'
 on:
   workflow_call:
     inputs:
+      git_commit:
+        type: string
+        required: false
       ci_artifacts_run_number:
-        required: true
         type: string
-      necessary_jobs:
         required: true
+      necessary_jobs:
         type: string
+        required: true
 
 env:
   CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number || github.run_number }}
@@ -30,6 +33,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          ref: ${{ inputs.git_commit }}
       - name: Clean disk space
         run: ./internal-scripts/ci-cd/publish/clean-disk-space.sh
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
@@ -140,6 +144,8 @@ jobs:
         id-token: write
       steps:
         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            ref: ${{ inputs.git_commit }}
         - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
           with:
             project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -198,6 +204,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          ref: ${{ inputs.git_commit }}
 
 
       ### Check whether dependent jobs failed ###
diff --git a/.github/workflows/ci-cd-publish-test-test.yml b/.github/workflows/ci-cd-publish-test-test.yml
index 80769ca5..4966dcda 100644
--- a/.github/workflows/ci-cd-publish-test-test.yml
+++ b/.github/workflows/ci-cd-publish-test-test.yml
@@ -15,12 +15,15 @@ name: 'CI/CD: publish & test against test repos'
 on:
   workflow_call:
     inputs:
+      git_commit:
+        type: string
+        required: false
       ci_artifacts_run_number:
-        required: true
         type: string
-      necessary_jobs:
         required: true
+      necessary_jobs:
         type: string
+        required: true
 
 env:
   CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number || github.run_number }}
@@ -40,6 +43,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          ref: ${{ inputs.git_commit }}
       - name: Clean disk space
         run: ./internal-scripts/ci-cd/publish/clean-disk-space.sh
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
@@ -125,6 +129,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -167,6 +173,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -209,6 +217,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -251,6 +261,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -293,6 +305,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -335,6 +349,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -377,6 +393,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -419,6 +437,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -461,6 +481,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -503,6 +525,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -545,6 +569,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -587,6 +613,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -629,6 +657,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -671,6 +701,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -713,6 +745,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -755,6 +789,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -797,6 +833,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -839,6 +877,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -882,6 +922,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -924,6 +966,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -966,6 +1010,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1008,6 +1054,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1050,6 +1098,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1092,6 +1142,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1134,6 +1186,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1176,6 +1230,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1218,6 +1274,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1260,6 +1318,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1302,6 +1362,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1344,6 +1406,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1386,6 +1450,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1428,6 +1494,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1470,6 +1538,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1512,6 +1582,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1554,6 +1626,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1596,6 +1670,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1639,6 +1715,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1681,6 +1759,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1723,6 +1803,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1765,6 +1847,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1807,6 +1891,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1849,6 +1935,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1891,6 +1979,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1933,6 +2023,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1975,6 +2067,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2017,6 +2111,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2059,6 +2155,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2101,6 +2199,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2143,6 +2243,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2185,6 +2287,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2227,6 +2331,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2269,6 +2375,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2311,6 +2419,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2353,6 +2463,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2396,6 +2508,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2438,6 +2552,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2480,6 +2596,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2522,6 +2640,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2564,6 +2684,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2606,6 +2728,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2648,6 +2772,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2690,6 +2816,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2732,6 +2860,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2774,6 +2904,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2816,6 +2948,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2858,6 +2992,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2901,6 +3037,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2943,6 +3081,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2985,6 +3125,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3027,6 +3169,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3069,6 +3213,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3111,6 +3257,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3153,6 +3301,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3195,6 +3345,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3237,6 +3389,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3279,6 +3433,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3321,6 +3477,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3363,6 +3521,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3405,6 +3565,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3447,6 +3609,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3489,6 +3653,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3531,6 +3697,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3573,6 +3741,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3615,6 +3785,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3658,6 +3830,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3700,6 +3874,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3742,6 +3918,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3784,6 +3962,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3826,6 +4006,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3868,6 +4050,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3910,6 +4094,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3952,6 +4138,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3994,6 +4182,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4036,6 +4226,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4078,6 +4270,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4120,6 +4314,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4162,6 +4358,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4204,6 +4402,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4246,6 +4446,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4288,6 +4490,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4330,6 +4534,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4372,6 +4578,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4415,6 +4623,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4457,6 +4667,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4499,6 +4711,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4541,6 +4755,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4583,6 +4799,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4625,6 +4843,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4667,6 +4887,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4709,6 +4931,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4751,6 +4975,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4793,6 +5019,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4835,6 +5063,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4877,6 +5107,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4919,6 +5151,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4961,6 +5195,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5003,6 +5239,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5045,6 +5283,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5087,6 +5327,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5129,6 +5371,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5294,6 +5538,8 @@ jobs:
     if: 'always()'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
 
 
       ### Check whether dependent jobs failed ###
diff --git a/.github/workflows/ci-cd-publish-test-test.yml.erb b/.github/workflows/ci-cd-publish-test-test.yml.erb
index 5b7268fc..5f13690a 100644
--- a/.github/workflows/ci-cd-publish-test-test.yml.erb
+++ b/.github/workflows/ci-cd-publish-test-test.yml.erb
@@ -5,12 +5,15 @@ name: 'CI/CD: publish & test against test repos'
 on:
   workflow_call:
     inputs:
+      git_commit:
+        type: string
+        required: false
       ci_artifacts_run_number:
-        required: true
         type: string
-      necessary_jobs:
         required: true
+      necessary_jobs:
         type: string
+        required: true
 
 env:
   CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number || github.run_number }}
@@ -30,6 +33,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          ref: ${{ inputs.git_commit }}
       - name: Clean disk space
         run: ./internal-scripts/ci-cd/publish/clean-disk-space.sh
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
@@ -117,6 +121,8 @@ jobs:
         id-token: write
       steps:
         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            ref: ${{ inputs.git_commit }}
         - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
           with:
             project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -172,6 +178,8 @@ jobs:
     if: 'always()'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.git_commit }}
 
 
       ### Check whether dependent jobs failed ###

From 737bd030a8d79af7a2fc69ea0b84f3f4c2d3a839 Mon Sep 17 00:00:00 2001
From: Hongli Lai <hongli@hongli.nl>
Date: Tue, 20 Oct 2026 15:59:18 +0200
Subject: [PATCH 12/13] Do not trigger production release from pull requests

---
 .github/workflows/ci-cd-main.yml              |   3 +
 .github/workflows/ci-cd-main.yml.erb          |   3 +
 .../ci-cd-publish-test-production.yml         | 493 +++++++++---------
 .../ci-cd-publish-test-production.yml.erb     |  17 +-
 4 files changed, 264 insertions(+), 252 deletions(-)

diff --git a/.github/workflows/ci-cd-main.yml b/.github/workflows/ci-cd-main.yml
index 9cd7b584..9e7458a0 100644
--- a/.github/workflows/ci-cd-main.yml
+++ b/.github/workflows/ci-cd-main.yml
@@ -245,3 +245,6 @@ jobs:
       git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
+      # For pull_request_target events, github.ref refers to the base branch, not the contributor branch,
+      # so we can't check for `github.ref == 'refs/heads/main'` to determine whether to release to production.
+      release: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main' }}
diff --git a/.github/workflows/ci-cd-main.yml.erb b/.github/workflows/ci-cd-main.yml.erb
index ddd86cc1..cae16ed8 100644
--- a/.github/workflows/ci-cd-main.yml.erb
+++ b/.github/workflows/ci-cd-main.yml.erb
@@ -186,3 +186,6 @@ jobs:
       git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
+      # For pull_request_target events, github.ref refers to the base branch, not the contributor branch,
+      # so we can't check for `github.ref == 'refs/heads/main'` to determine whether to release to production.
+      release: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main' }}
diff --git a/.github/workflows/ci-cd-publish-test-production.yml b/.github/workflows/ci-cd-publish-test-production.yml
index b158ff80..0e2d9439 100644
--- a/.github/workflows/ci-cd-publish-test-production.yml
+++ b/.github/workflows/ci-cd-publish-test-production.yml
@@ -24,6 +24,9 @@ on:
       necessary_jobs:
         type: string
         required: true
+      release:
+        type: boolean
+        required: true
 
 env:
   CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number || github.run_number }}
@@ -102,7 +105,7 @@ jobs:
           CI_ARTIFACTS_BUCKET_NAME: ${{ vars.CI_ARTIFACTS_BUCKET }}
           TESTING: false
           OVERWRITE_EXISTING: false
-          DRY_RUN: ${{ github.ref != 'refs/heads/main' }}
+          DRY_RUN: ${{ !inputs.release }}
           CLEANUP: true
 
       - name: Upload RPMs to repo
@@ -112,11 +115,11 @@ jobs:
           CI_ARTIFACTS_BUCKET_NAME: ${{ vars.CI_ARTIFACTS_BUCKET }}
           TESTING: false
           OVERWRITE_EXISTING: false
-          DRY_RUN: ${{ github.ref != 'refs/heads/main' }}
+          DRY_RUN: ${{ !inputs.release }}
 
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: get-id-token
-        if: github.ref == 'refs/heads/main'
+        if: inputs.release
         with:
           script: |
             const fs = require('fs');
@@ -129,7 +132,7 @@ jobs:
 
       - name: Restart web server
         run: ./internal-scripts/ci-cd/publish/restart-web-server.rb
-        if: github.ref == 'refs/heads/main'
+        if: inputs.release
         env:
           ID_TOKEN: ${{ steps.get-id-token.outputs.id_token }}
 
@@ -146,7 +149,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/4.0/normal];')
     permissions:
       id-token: write
@@ -191,7 +194,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/4.0/jemalloc];')
     permissions:
       id-token: write
@@ -236,7 +239,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.4/normal];')
     permissions:
       id-token: write
@@ -281,7 +284,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.4/jemalloc];')
     permissions:
       id-token: write
@@ -326,7 +329,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.3/normal];')
     permissions:
       id-token: write
@@ -371,7 +374,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.3/jemalloc];')
     permissions:
       id-token: write
@@ -416,7 +419,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.2/normal];')
     permissions:
       id-token: write
@@ -461,7 +464,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.2/jemalloc];')
     permissions:
       id-token: write
@@ -506,7 +509,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.2/malloctrim];')
     permissions:
       id-token: write
@@ -551,7 +554,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/4.0.6/normal];')
     permissions:
       id-token: write
@@ -596,7 +599,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/4.0.6/jemalloc];')
     permissions:
       id-token: write
@@ -641,7 +644,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.4.10/normal];')
     permissions:
       id-token: write
@@ -686,7 +689,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.4.10/jemalloc];')
     permissions:
       id-token: write
@@ -731,7 +734,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.3.12/normal];')
     permissions:
       id-token: write
@@ -776,7 +779,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.3.12/jemalloc];')
     permissions:
       id-token: write
@@ -821,7 +824,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.2.11/normal];')
     permissions:
       id-token: write
@@ -866,7 +869,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.2.11/jemalloc];')
     permissions:
       id-token: write
@@ -911,7 +914,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.2.11/malloctrim];')
     permissions:
       id-token: write
@@ -957,7 +960,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/4.0/normal];')
     permissions:
       id-token: write
@@ -1002,7 +1005,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/4.0/jemalloc];')
     permissions:
       id-token: write
@@ -1047,7 +1050,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.4/normal];')
     permissions:
       id-token: write
@@ -1092,7 +1095,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.4/jemalloc];')
     permissions:
       id-token: write
@@ -1137,7 +1140,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.3/normal];')
     permissions:
       id-token: write
@@ -1182,7 +1185,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.3/jemalloc];')
     permissions:
       id-token: write
@@ -1227,7 +1230,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.2/normal];')
     permissions:
       id-token: write
@@ -1272,7 +1275,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.2/jemalloc];')
     permissions:
       id-token: write
@@ -1317,7 +1320,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.2/malloctrim];')
     permissions:
       id-token: write
@@ -1362,7 +1365,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/4.0.6/normal];')
     permissions:
       id-token: write
@@ -1407,7 +1410,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/4.0.6/jemalloc];')
     permissions:
       id-token: write
@@ -1452,7 +1455,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.4.10/normal];')
     permissions:
       id-token: write
@@ -1497,7 +1500,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.4.10/jemalloc];')
     permissions:
       id-token: write
@@ -1542,7 +1545,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.3.12/normal];')
     permissions:
       id-token: write
@@ -1587,7 +1590,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.3.12/jemalloc];')
     permissions:
       id-token: write
@@ -1632,7 +1635,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.2.11/normal];')
     permissions:
       id-token: write
@@ -1677,7 +1680,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.2.11/jemalloc];')
     permissions:
       id-token: write
@@ -1722,7 +1725,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.2.11/malloctrim];')
     permissions:
       id-token: write
@@ -1768,7 +1771,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/4.0/normal];')
     permissions:
       id-token: write
@@ -1813,7 +1816,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/4.0/jemalloc];')
     permissions:
       id-token: write
@@ -1858,7 +1861,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.4/normal];')
     permissions:
       id-token: write
@@ -1903,7 +1906,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.4/jemalloc];')
     permissions:
       id-token: write
@@ -1948,7 +1951,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.3/normal];')
     permissions:
       id-token: write
@@ -1993,7 +1996,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.3/jemalloc];')
     permissions:
       id-token: write
@@ -2038,7 +2041,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.2/normal];')
     permissions:
       id-token: write
@@ -2083,7 +2086,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.2/jemalloc];')
     permissions:
       id-token: write
@@ -2128,7 +2131,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.2/malloctrim];')
     permissions:
       id-token: write
@@ -2173,7 +2176,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/4.0.6/normal];')
     permissions:
       id-token: write
@@ -2218,7 +2221,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/4.0.6/jemalloc];')
     permissions:
       id-token: write
@@ -2263,7 +2266,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.4.10/normal];')
     permissions:
       id-token: write
@@ -2308,7 +2311,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.4.10/jemalloc];')
     permissions:
       id-token: write
@@ -2353,7 +2356,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.3.12/normal];')
     permissions:
       id-token: write
@@ -2398,7 +2401,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.3.12/jemalloc];')
     permissions:
       id-token: write
@@ -2443,7 +2446,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.2.11/normal];')
     permissions:
       id-token: write
@@ -2488,7 +2491,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.2.11/jemalloc];')
     permissions:
       id-token: write
@@ -2533,7 +2536,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.2.11/malloctrim];')
     permissions:
       id-token: write
@@ -2579,7 +2582,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-13/4.0/normal];')
     permissions:
       id-token: write
@@ -2624,7 +2627,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-13/4.0/jemalloc];')
     permissions:
       id-token: write
@@ -2669,7 +2672,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.4/normal];')
     permissions:
       id-token: write
@@ -2714,7 +2717,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.4/jemalloc];')
     permissions:
       id-token: write
@@ -2759,7 +2762,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.3/normal];')
     permissions:
       id-token: write
@@ -2804,7 +2807,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.3/jemalloc];')
     permissions:
       id-token: write
@@ -2849,7 +2852,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-13/4.0.6/normal];')
     permissions:
       id-token: write
@@ -2894,7 +2897,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-13/4.0.6/jemalloc];')
     permissions:
       id-token: write
@@ -2939,7 +2942,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.4.10/normal];')
     permissions:
       id-token: write
@@ -2984,7 +2987,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.4.10/jemalloc];')
     permissions:
       id-token: write
@@ -3029,7 +3032,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.3.12/normal];')
     permissions:
       id-token: write
@@ -3074,7 +3077,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.3.12/jemalloc];')
     permissions:
       id-token: write
@@ -3120,7 +3123,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/4.0/normal];')
     permissions:
       id-token: write
@@ -3165,7 +3168,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/4.0/jemalloc];')
     permissions:
       id-token: write
@@ -3210,7 +3213,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.4/normal];')
     permissions:
       id-token: write
@@ -3255,7 +3258,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.4/jemalloc];')
     permissions:
       id-token: write
@@ -3300,7 +3303,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.3/normal];')
     permissions:
       id-token: write
@@ -3345,7 +3348,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.3/jemalloc];')
     permissions:
       id-token: write
@@ -3390,7 +3393,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.2/normal];')
     permissions:
       id-token: write
@@ -3435,7 +3438,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.2/jemalloc];')
     permissions:
       id-token: write
@@ -3480,7 +3483,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.2/malloctrim];')
     permissions:
       id-token: write
@@ -3525,7 +3528,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/4.0.6/normal];')
     permissions:
       id-token: write
@@ -3570,7 +3573,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/4.0.6/jemalloc];')
     permissions:
       id-token: write
@@ -3615,7 +3618,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.4.10/normal];')
     permissions:
       id-token: write
@@ -3660,7 +3663,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.4.10/jemalloc];')
     permissions:
       id-token: write
@@ -3705,7 +3708,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.3.12/normal];')
     permissions:
       id-token: write
@@ -3750,7 +3753,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.3.12/jemalloc];')
     permissions:
       id-token: write
@@ -3795,7 +3798,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.2.11/normal];')
     permissions:
       id-token: write
@@ -3840,7 +3843,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.2.11/jemalloc];')
     permissions:
       id-token: write
@@ -3885,7 +3888,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.2.11/malloctrim];')
     permissions:
       id-token: write
@@ -3931,7 +3934,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/4.0/normal];')
     permissions:
       id-token: write
@@ -3976,7 +3979,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/4.0/jemalloc];')
     permissions:
       id-token: write
@@ -4021,7 +4024,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.4/normal];')
     permissions:
       id-token: write
@@ -4066,7 +4069,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.4/jemalloc];')
     permissions:
       id-token: write
@@ -4111,7 +4114,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.3/normal];')
     permissions:
       id-token: write
@@ -4156,7 +4159,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.3/jemalloc];')
     permissions:
       id-token: write
@@ -4201,7 +4204,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.2/normal];')
     permissions:
       id-token: write
@@ -4246,7 +4249,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.2/jemalloc];')
     permissions:
       id-token: write
@@ -4291,7 +4294,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.2/malloctrim];')
     permissions:
       id-token: write
@@ -4336,7 +4339,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/4.0.6/normal];')
     permissions:
       id-token: write
@@ -4381,7 +4384,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/4.0.6/jemalloc];')
     permissions:
       id-token: write
@@ -4426,7 +4429,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.4.10/normal];')
     permissions:
       id-token: write
@@ -4471,7 +4474,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.4.10/jemalloc];')
     permissions:
       id-token: write
@@ -4516,7 +4519,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.3.12/normal];')
     permissions:
       id-token: write
@@ -4561,7 +4564,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.3.12/jemalloc];')
     permissions:
       id-token: write
@@ -4606,7 +4609,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.2.11/normal];')
     permissions:
       id-token: write
@@ -4651,7 +4654,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.2.11/jemalloc];')
     permissions:
       id-token: write
@@ -4696,7 +4699,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.2.11/malloctrim];')
     permissions:
       id-token: write
@@ -4742,7 +4745,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/4.0/normal];')
     permissions:
       id-token: write
@@ -4787,7 +4790,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/4.0/jemalloc];')
     permissions:
       id-token: write
@@ -4832,7 +4835,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.4/normal];')
     permissions:
       id-token: write
@@ -4877,7 +4880,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.4/jemalloc];')
     permissions:
       id-token: write
@@ -4922,7 +4925,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.3/normal];')
     permissions:
       id-token: write
@@ -4967,7 +4970,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.3/jemalloc];')
     permissions:
       id-token: write
@@ -5012,7 +5015,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.2/normal];')
     permissions:
       id-token: write
@@ -5057,7 +5060,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.2/jemalloc];')
     permissions:
       id-token: write
@@ -5102,7 +5105,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.2/malloctrim];')
     permissions:
       id-token: write
@@ -5147,7 +5150,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/4.0.6/normal];')
     permissions:
       id-token: write
@@ -5192,7 +5195,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/4.0.6/jemalloc];')
     permissions:
       id-token: write
@@ -5237,7 +5240,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.4.10/normal];')
     permissions:
       id-token: write
@@ -5282,7 +5285,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.4.10/jemalloc];')
     permissions:
       id-token: write
@@ -5327,7 +5330,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.3.12/normal];')
     permissions:
       id-token: write
@@ -5372,7 +5375,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.3.12/jemalloc];')
     permissions:
       id-token: write
@@ -5417,7 +5420,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.2.11/normal];')
     permissions:
       id-token: write
@@ -5462,7 +5465,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.2.11/jemalloc];')
     permissions:
       id-token: write
@@ -5507,7 +5510,7 @@ jobs:
     environment: test
     timeout-minutes: 30
     if: |
-      github.ref == 'refs/heads/main'
+      inputs.release
       && contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.2.11/malloctrim];')
     permissions:
       id-token: write
@@ -5694,840 +5697,840 @@ jobs:
       - name: Check whether 'Test [centos-8/4.0/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-4_0-normal.result != 'success'
           && (needs.test_centos_8-4_0-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/4.0/normal];'))
       - name: Check whether 'Test [centos-8/4.0/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-4_0-jemalloc.result != 'success'
           && (needs.test_centos_8-4_0-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/4.0/jemalloc];'))
       - name: Check whether 'Test [centos-8/3.4/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_4-normal.result != 'success'
           && (needs.test_centos_8-3_4-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.4/normal];'))
       - name: Check whether 'Test [centos-8/3.4/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_4-jemalloc.result != 'success'
           && (needs.test_centos_8-3_4-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.4/jemalloc];'))
       - name: Check whether 'Test [centos-8/3.3/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_3-normal.result != 'success'
           && (needs.test_centos_8-3_3-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.3/normal];'))
       - name: Check whether 'Test [centos-8/3.3/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_3-jemalloc.result != 'success'
           && (needs.test_centos_8-3_3-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.3/jemalloc];'))
       - name: Check whether 'Test [centos-8/3.2/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_2-normal.result != 'success'
           && (needs.test_centos_8-3_2-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.2/normal];'))
       - name: Check whether 'Test [centos-8/3.2/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_2-jemalloc.result != 'success'
           && (needs.test_centos_8-3_2-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.2/jemalloc];'))
       - name: Check whether 'Test [centos-8/3.2/malloctrim]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_2-malloctrim.result != 'success'
           && (needs.test_centos_8-3_2-malloctrim.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.2/malloctrim];'))
       - name: Check whether 'Test [centos-8/4.0.6/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-4_0_6-normal.result != 'success'
           && (needs.test_centos_8-4_0_6-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/4.0.6/normal];'))
       - name: Check whether 'Test [centos-8/4.0.6/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-4_0_6-jemalloc.result != 'success'
           && (needs.test_centos_8-4_0_6-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/4.0.6/jemalloc];'))
       - name: Check whether 'Test [centos-8/3.4.10/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_4_10-normal.result != 'success'
           && (needs.test_centos_8-3_4_10-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.4.10/normal];'))
       - name: Check whether 'Test [centos-8/3.4.10/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_4_10-jemalloc.result != 'success'
           && (needs.test_centos_8-3_4_10-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.4.10/jemalloc];'))
       - name: Check whether 'Test [centos-8/3.3.12/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_3_12-normal.result != 'success'
           && (needs.test_centos_8-3_3_12-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.3.12/normal];'))
       - name: Check whether 'Test [centos-8/3.3.12/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_3_12-jemalloc.result != 'success'
           && (needs.test_centos_8-3_3_12-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.3.12/jemalloc];'))
       - name: Check whether 'Test [centos-8/3.2.11/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_2_11-normal.result != 'success'
           && (needs.test_centos_8-3_2_11-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.2.11/normal];'))
       - name: Check whether 'Test [centos-8/3.2.11/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_2_11-jemalloc.result != 'success'
           && (needs.test_centos_8-3_2_11-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.2.11/jemalloc];'))
       - name: Check whether 'Test [centos-8/3.2.11/malloctrim]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_centos_8-3_2_11-malloctrim.result != 'success'
           && (needs.test_centos_8-3_2_11-malloctrim.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [centos-8/3.2.11/malloctrim];'))
       - name: Check whether 'Test [debian-11/4.0/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-4_0-normal.result != 'success'
           && (needs.test_debian_11-4_0-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/4.0/normal];'))
       - name: Check whether 'Test [debian-11/4.0/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-4_0-jemalloc.result != 'success'
           && (needs.test_debian_11-4_0-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/4.0/jemalloc];'))
       - name: Check whether 'Test [debian-11/3.4/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_4-normal.result != 'success'
           && (needs.test_debian_11-3_4-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.4/normal];'))
       - name: Check whether 'Test [debian-11/3.4/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_4-jemalloc.result != 'success'
           && (needs.test_debian_11-3_4-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.4/jemalloc];'))
       - name: Check whether 'Test [debian-11/3.3/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_3-normal.result != 'success'
           && (needs.test_debian_11-3_3-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.3/normal];'))
       - name: Check whether 'Test [debian-11/3.3/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_3-jemalloc.result != 'success'
           && (needs.test_debian_11-3_3-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.3/jemalloc];'))
       - name: Check whether 'Test [debian-11/3.2/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_2-normal.result != 'success'
           && (needs.test_debian_11-3_2-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.2/normal];'))
       - name: Check whether 'Test [debian-11/3.2/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_2-jemalloc.result != 'success'
           && (needs.test_debian_11-3_2-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.2/jemalloc];'))
       - name: Check whether 'Test [debian-11/3.2/malloctrim]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_2-malloctrim.result != 'success'
           && (needs.test_debian_11-3_2-malloctrim.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.2/malloctrim];'))
       - name: Check whether 'Test [debian-11/4.0.6/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-4_0_6-normal.result != 'success'
           && (needs.test_debian_11-4_0_6-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/4.0.6/normal];'))
       - name: Check whether 'Test [debian-11/4.0.6/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-4_0_6-jemalloc.result != 'success'
           && (needs.test_debian_11-4_0_6-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/4.0.6/jemalloc];'))
       - name: Check whether 'Test [debian-11/3.4.10/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_4_10-normal.result != 'success'
           && (needs.test_debian_11-3_4_10-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.4.10/normal];'))
       - name: Check whether 'Test [debian-11/3.4.10/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_4_10-jemalloc.result != 'success'
           && (needs.test_debian_11-3_4_10-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.4.10/jemalloc];'))
       - name: Check whether 'Test [debian-11/3.3.12/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_3_12-normal.result != 'success'
           && (needs.test_debian_11-3_3_12-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.3.12/normal];'))
       - name: Check whether 'Test [debian-11/3.3.12/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_3_12-jemalloc.result != 'success'
           && (needs.test_debian_11-3_3_12-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.3.12/jemalloc];'))
       - name: Check whether 'Test [debian-11/3.2.11/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_2_11-normal.result != 'success'
           && (needs.test_debian_11-3_2_11-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.2.11/normal];'))
       - name: Check whether 'Test [debian-11/3.2.11/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_2_11-jemalloc.result != 'success'
           && (needs.test_debian_11-3_2_11-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.2.11/jemalloc];'))
       - name: Check whether 'Test [debian-11/3.2.11/malloctrim]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_11-3_2_11-malloctrim.result != 'success'
           && (needs.test_debian_11-3_2_11-malloctrim.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-11/3.2.11/malloctrim];'))
       - name: Check whether 'Test [debian-12/4.0/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-4_0-normal.result != 'success'
           && (needs.test_debian_12-4_0-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/4.0/normal];'))
       - name: Check whether 'Test [debian-12/4.0/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-4_0-jemalloc.result != 'success'
           && (needs.test_debian_12-4_0-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/4.0/jemalloc];'))
       - name: Check whether 'Test [debian-12/3.4/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_4-normal.result != 'success'
           && (needs.test_debian_12-3_4-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.4/normal];'))
       - name: Check whether 'Test [debian-12/3.4/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_4-jemalloc.result != 'success'
           && (needs.test_debian_12-3_4-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.4/jemalloc];'))
       - name: Check whether 'Test [debian-12/3.3/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_3-normal.result != 'success'
           && (needs.test_debian_12-3_3-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.3/normal];'))
       - name: Check whether 'Test [debian-12/3.3/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_3-jemalloc.result != 'success'
           && (needs.test_debian_12-3_3-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.3/jemalloc];'))
       - name: Check whether 'Test [debian-12/3.2/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_2-normal.result != 'success'
           && (needs.test_debian_12-3_2-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.2/normal];'))
       - name: Check whether 'Test [debian-12/3.2/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_2-jemalloc.result != 'success'
           && (needs.test_debian_12-3_2-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.2/jemalloc];'))
       - name: Check whether 'Test [debian-12/3.2/malloctrim]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_2-malloctrim.result != 'success'
           && (needs.test_debian_12-3_2-malloctrim.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.2/malloctrim];'))
       - name: Check whether 'Test [debian-12/4.0.6/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-4_0_6-normal.result != 'success'
           && (needs.test_debian_12-4_0_6-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/4.0.6/normal];'))
       - name: Check whether 'Test [debian-12/4.0.6/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-4_0_6-jemalloc.result != 'success'
           && (needs.test_debian_12-4_0_6-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/4.0.6/jemalloc];'))
       - name: Check whether 'Test [debian-12/3.4.10/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_4_10-normal.result != 'success'
           && (needs.test_debian_12-3_4_10-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.4.10/normal];'))
       - name: Check whether 'Test [debian-12/3.4.10/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_4_10-jemalloc.result != 'success'
           && (needs.test_debian_12-3_4_10-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.4.10/jemalloc];'))
       - name: Check whether 'Test [debian-12/3.3.12/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_3_12-normal.result != 'success'
           && (needs.test_debian_12-3_3_12-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.3.12/normal];'))
       - name: Check whether 'Test [debian-12/3.3.12/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_3_12-jemalloc.result != 'success'
           && (needs.test_debian_12-3_3_12-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.3.12/jemalloc];'))
       - name: Check whether 'Test [debian-12/3.2.11/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_2_11-normal.result != 'success'
           && (needs.test_debian_12-3_2_11-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.2.11/normal];'))
       - name: Check whether 'Test [debian-12/3.2.11/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_2_11-jemalloc.result != 'success'
           && (needs.test_debian_12-3_2_11-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.2.11/jemalloc];'))
       - name: Check whether 'Test [debian-12/3.2.11/malloctrim]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_12-3_2_11-malloctrim.result != 'success'
           && (needs.test_debian_12-3_2_11-malloctrim.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-12/3.2.11/malloctrim];'))
       - name: Check whether 'Test [debian-13/4.0/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_13-4_0-normal.result != 'success'
           && (needs.test_debian_13-4_0-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-13/4.0/normal];'))
       - name: Check whether 'Test [debian-13/4.0/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_13-4_0-jemalloc.result != 'success'
           && (needs.test_debian_13-4_0-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-13/4.0/jemalloc];'))
       - name: Check whether 'Test [debian-13/3.4/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_13-3_4-normal.result != 'success'
           && (needs.test_debian_13-3_4-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.4/normal];'))
       - name: Check whether 'Test [debian-13/3.4/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_13-3_4-jemalloc.result != 'success'
           && (needs.test_debian_13-3_4-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.4/jemalloc];'))
       - name: Check whether 'Test [debian-13/3.3/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_13-3_3-normal.result != 'success'
           && (needs.test_debian_13-3_3-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.3/normal];'))
       - name: Check whether 'Test [debian-13/3.3/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_13-3_3-jemalloc.result != 'success'
           && (needs.test_debian_13-3_3-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.3/jemalloc];'))
       - name: Check whether 'Test [debian-13/4.0.6/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_13-4_0_6-normal.result != 'success'
           && (needs.test_debian_13-4_0_6-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-13/4.0.6/normal];'))
       - name: Check whether 'Test [debian-13/4.0.6/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_13-4_0_6-jemalloc.result != 'success'
           && (needs.test_debian_13-4_0_6-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-13/4.0.6/jemalloc];'))
       - name: Check whether 'Test [debian-13/3.4.10/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_13-3_4_10-normal.result != 'success'
           && (needs.test_debian_13-3_4_10-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.4.10/normal];'))
       - name: Check whether 'Test [debian-13/3.4.10/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_13-3_4_10-jemalloc.result != 'success'
           && (needs.test_debian_13-3_4_10-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.4.10/jemalloc];'))
       - name: Check whether 'Test [debian-13/3.3.12/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_13-3_3_12-normal.result != 'success'
           && (needs.test_debian_13-3_3_12-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.3.12/normal];'))
       - name: Check whether 'Test [debian-13/3.3.12/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_debian_13-3_3_12-jemalloc.result != 'success'
           && (needs.test_debian_13-3_3_12-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [debian-13/3.3.12/jemalloc];'))
       - name: Check whether 'Test [el-9/4.0/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-4_0-normal.result != 'success'
           && (needs.test_el_9-4_0-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/4.0/normal];'))
       - name: Check whether 'Test [el-9/4.0/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-4_0-jemalloc.result != 'success'
           && (needs.test_el_9-4_0-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/4.0/jemalloc];'))
       - name: Check whether 'Test [el-9/3.4/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_4-normal.result != 'success'
           && (needs.test_el_9-3_4-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.4/normal];'))
       - name: Check whether 'Test [el-9/3.4/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_4-jemalloc.result != 'success'
           && (needs.test_el_9-3_4-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.4/jemalloc];'))
       - name: Check whether 'Test [el-9/3.3/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_3-normal.result != 'success'
           && (needs.test_el_9-3_3-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.3/normal];'))
       - name: Check whether 'Test [el-9/3.3/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_3-jemalloc.result != 'success'
           && (needs.test_el_9-3_3-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.3/jemalloc];'))
       - name: Check whether 'Test [el-9/3.2/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_2-normal.result != 'success'
           && (needs.test_el_9-3_2-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.2/normal];'))
       - name: Check whether 'Test [el-9/3.2/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_2-jemalloc.result != 'success'
           && (needs.test_el_9-3_2-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.2/jemalloc];'))
       - name: Check whether 'Test [el-9/3.2/malloctrim]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_2-malloctrim.result != 'success'
           && (needs.test_el_9-3_2-malloctrim.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.2/malloctrim];'))
       - name: Check whether 'Test [el-9/4.0.6/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-4_0_6-normal.result != 'success'
           && (needs.test_el_9-4_0_6-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/4.0.6/normal];'))
       - name: Check whether 'Test [el-9/4.0.6/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-4_0_6-jemalloc.result != 'success'
           && (needs.test_el_9-4_0_6-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/4.0.6/jemalloc];'))
       - name: Check whether 'Test [el-9/3.4.10/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_4_10-normal.result != 'success'
           && (needs.test_el_9-3_4_10-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.4.10/normal];'))
       - name: Check whether 'Test [el-9/3.4.10/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_4_10-jemalloc.result != 'success'
           && (needs.test_el_9-3_4_10-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.4.10/jemalloc];'))
       - name: Check whether 'Test [el-9/3.3.12/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_3_12-normal.result != 'success'
           && (needs.test_el_9-3_3_12-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.3.12/normal];'))
       - name: Check whether 'Test [el-9/3.3.12/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_3_12-jemalloc.result != 'success'
           && (needs.test_el_9-3_3_12-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.3.12/jemalloc];'))
       - name: Check whether 'Test [el-9/3.2.11/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_2_11-normal.result != 'success'
           && (needs.test_el_9-3_2_11-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.2.11/normal];'))
       - name: Check whether 'Test [el-9/3.2.11/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_2_11-jemalloc.result != 'success'
           && (needs.test_el_9-3_2_11-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.2.11/jemalloc];'))
       - name: Check whether 'Test [el-9/3.2.11/malloctrim]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_el_9-3_2_11-malloctrim.result != 'success'
           && (needs.test_el_9-3_2_11-malloctrim.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [el-9/3.2.11/malloctrim];'))
       - name: Check whether 'Test [ubuntu-22.04/4.0/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-4_0-normal.result != 'success'
           && (needs.test_ubuntu_22_04-4_0-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/4.0/normal];'))
       - name: Check whether 'Test [ubuntu-22.04/4.0/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-4_0-jemalloc.result != 'success'
           && (needs.test_ubuntu_22_04-4_0-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/4.0/jemalloc];'))
       - name: Check whether 'Test [ubuntu-22.04/3.4/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_4-normal.result != 'success'
           && (needs.test_ubuntu_22_04-3_4-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.4/normal];'))
       - name: Check whether 'Test [ubuntu-22.04/3.4/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_4-jemalloc.result != 'success'
           && (needs.test_ubuntu_22_04-3_4-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.4/jemalloc];'))
       - name: Check whether 'Test [ubuntu-22.04/3.3/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_3-normal.result != 'success'
           && (needs.test_ubuntu_22_04-3_3-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.3/normal];'))
       - name: Check whether 'Test [ubuntu-22.04/3.3/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_3-jemalloc.result != 'success'
           && (needs.test_ubuntu_22_04-3_3-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.3/jemalloc];'))
       - name: Check whether 'Test [ubuntu-22.04/3.2/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_2-normal.result != 'success'
           && (needs.test_ubuntu_22_04-3_2-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.2/normal];'))
       - name: Check whether 'Test [ubuntu-22.04/3.2/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_2-jemalloc.result != 'success'
           && (needs.test_ubuntu_22_04-3_2-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.2/jemalloc];'))
       - name: Check whether 'Test [ubuntu-22.04/3.2/malloctrim]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_2-malloctrim.result != 'success'
           && (needs.test_ubuntu_22_04-3_2-malloctrim.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.2/malloctrim];'))
       - name: Check whether 'Test [ubuntu-22.04/4.0.6/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-4_0_6-normal.result != 'success'
           && (needs.test_ubuntu_22_04-4_0_6-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/4.0.6/normal];'))
       - name: Check whether 'Test [ubuntu-22.04/4.0.6/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-4_0_6-jemalloc.result != 'success'
           && (needs.test_ubuntu_22_04-4_0_6-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/4.0.6/jemalloc];'))
       - name: Check whether 'Test [ubuntu-22.04/3.4.10/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_4_10-normal.result != 'success'
           && (needs.test_ubuntu_22_04-3_4_10-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.4.10/normal];'))
       - name: Check whether 'Test [ubuntu-22.04/3.4.10/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_4_10-jemalloc.result != 'success'
           && (needs.test_ubuntu_22_04-3_4_10-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.4.10/jemalloc];'))
       - name: Check whether 'Test [ubuntu-22.04/3.3.12/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_3_12-normal.result != 'success'
           && (needs.test_ubuntu_22_04-3_3_12-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.3.12/normal];'))
       - name: Check whether 'Test [ubuntu-22.04/3.3.12/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_3_12-jemalloc.result != 'success'
           && (needs.test_ubuntu_22_04-3_3_12-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.3.12/jemalloc];'))
       - name: Check whether 'Test [ubuntu-22.04/3.2.11/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_2_11-normal.result != 'success'
           && (needs.test_ubuntu_22_04-3_2_11-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.2.11/normal];'))
       - name: Check whether 'Test [ubuntu-22.04/3.2.11/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_2_11-jemalloc.result != 'success'
           && (needs.test_ubuntu_22_04-3_2_11-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.2.11/jemalloc];'))
       - name: Check whether 'Test [ubuntu-22.04/3.2.11/malloctrim]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_22_04-3_2_11-malloctrim.result != 'success'
           && (needs.test_ubuntu_22_04-3_2_11-malloctrim.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-22.04/3.2.11/malloctrim];'))
       - name: Check whether 'Test [ubuntu-24.04/4.0/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-4_0-normal.result != 'success'
           && (needs.test_ubuntu_24_04-4_0-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/4.0/normal];'))
       - name: Check whether 'Test [ubuntu-24.04/4.0/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-4_0-jemalloc.result != 'success'
           && (needs.test_ubuntu_24_04-4_0-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/4.0/jemalloc];'))
       - name: Check whether 'Test [ubuntu-24.04/3.4/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_4-normal.result != 'success'
           && (needs.test_ubuntu_24_04-3_4-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.4/normal];'))
       - name: Check whether 'Test [ubuntu-24.04/3.4/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_4-jemalloc.result != 'success'
           && (needs.test_ubuntu_24_04-3_4-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.4/jemalloc];'))
       - name: Check whether 'Test [ubuntu-24.04/3.3/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_3-normal.result != 'success'
           && (needs.test_ubuntu_24_04-3_3-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.3/normal];'))
       - name: Check whether 'Test [ubuntu-24.04/3.3/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_3-jemalloc.result != 'success'
           && (needs.test_ubuntu_24_04-3_3-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.3/jemalloc];'))
       - name: Check whether 'Test [ubuntu-24.04/3.2/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_2-normal.result != 'success'
           && (needs.test_ubuntu_24_04-3_2-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.2/normal];'))
       - name: Check whether 'Test [ubuntu-24.04/3.2/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_2-jemalloc.result != 'success'
           && (needs.test_ubuntu_24_04-3_2-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.2/jemalloc];'))
       - name: Check whether 'Test [ubuntu-24.04/3.2/malloctrim]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_2-malloctrim.result != 'success'
           && (needs.test_ubuntu_24_04-3_2-malloctrim.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.2/malloctrim];'))
       - name: Check whether 'Test [ubuntu-24.04/4.0.6/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-4_0_6-normal.result != 'success'
           && (needs.test_ubuntu_24_04-4_0_6-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/4.0.6/normal];'))
       - name: Check whether 'Test [ubuntu-24.04/4.0.6/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-4_0_6-jemalloc.result != 'success'
           && (needs.test_ubuntu_24_04-4_0_6-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/4.0.6/jemalloc];'))
       - name: Check whether 'Test [ubuntu-24.04/3.4.10/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_4_10-normal.result != 'success'
           && (needs.test_ubuntu_24_04-3_4_10-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.4.10/normal];'))
       - name: Check whether 'Test [ubuntu-24.04/3.4.10/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_4_10-jemalloc.result != 'success'
           && (needs.test_ubuntu_24_04-3_4_10-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.4.10/jemalloc];'))
       - name: Check whether 'Test [ubuntu-24.04/3.3.12/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_3_12-normal.result != 'success'
           && (needs.test_ubuntu_24_04-3_3_12-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.3.12/normal];'))
       - name: Check whether 'Test [ubuntu-24.04/3.3.12/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_3_12-jemalloc.result != 'success'
           && (needs.test_ubuntu_24_04-3_3_12-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.3.12/jemalloc];'))
       - name: Check whether 'Test [ubuntu-24.04/3.2.11/normal]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_2_11-normal.result != 'success'
           && (needs.test_ubuntu_24_04-3_2_11-normal.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.2.11/normal];'))
       - name: Check whether 'Test [ubuntu-24.04/3.2.11/jemalloc]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_2_11-jemalloc.result != 'success'
           && (needs.test_ubuntu_24_04-3_2_11-jemalloc.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.2.11/jemalloc];'))
       - name: Check whether 'Test [ubuntu-24.04/3.2.11/malloctrim]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_ubuntu_24_04-3_2_11-malloctrim.result != 'success'
           && (needs.test_ubuntu_24_04-3_2_11-malloctrim.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [ubuntu-24.04/3.2.11/malloctrim];'))
@@ -6547,5 +6550,5 @@ jobs:
         run: git tag epic-${{ env.NEXT_RELEASE_VERSION }}
 
       - name: Push Git tag
-        if: github.ref == 'refs/heads/main'
+        if: inputs.release
         run: git push origin epic-${{ env.NEXT_RELEASE_VERSION }}
diff --git a/.github/workflows/ci-cd-publish-test-production.yml.erb b/.github/workflows/ci-cd-publish-test-production.yml.erb
index 338cc01a..b3051ebb 100644
--- a/.github/workflows/ci-cd-publish-test-production.yml.erb
+++ b/.github/workflows/ci-cd-publish-test-production.yml.erb
@@ -14,6 +14,9 @@ on:
       necessary_jobs:
         type: string
         required: true
+      release:
+        type: boolean
+        required: true
 
 env:
   CI_ARTIFACTS_RUN_NUMBER: ${{ inputs.ci_artifacts_run_number || github.run_number }}
@@ -92,7 +95,7 @@ jobs:
           CI_ARTIFACTS_BUCKET_NAME: ${{ vars.CI_ARTIFACTS_BUCKET }}
           TESTING: false
           OVERWRITE_EXISTING: false
-          DRY_RUN: ${{ github.ref != 'refs/heads/main' }}
+          DRY_RUN: ${{ !inputs.release }}
           CLEANUP: true
 
       - name: Upload RPMs to repo
@@ -102,11 +105,11 @@ jobs:
           CI_ARTIFACTS_BUCKET_NAME: ${{ vars.CI_ARTIFACTS_BUCKET }}
           TESTING: false
           OVERWRITE_EXISTING: false
-          DRY_RUN: ${{ github.ref != 'refs/heads/main' }}
+          DRY_RUN: ${{ !inputs.release }}
 
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: get-id-token
-        if: github.ref == 'refs/heads/main'
+        if: inputs.release
         with:
           script: |
             const fs = require('fs');
@@ -119,7 +122,7 @@ jobs:
 
       - name: Restart web server
         run: ./internal-scripts/ci-cd/publish/restart-web-server.rb
-        if: github.ref == 'refs/heads/main'
+        if: inputs.release
         env:
           ID_TOKEN: ${{ steps.get-id-token.outputs.id_token }}
 
@@ -138,7 +141,7 @@ jobs:
       environment: test
       timeout-minutes: 30
       if: |
-        github.ref == 'refs/heads/main'
+        inputs.release
         && contains(inputs.necessary_jobs, ';Test against production repo [<%= distribution[:name] %>/<%= ruby_package_version[:id] %>/<%= variant[:name] %>];')
       permissions:
         id-token: write
@@ -219,7 +222,7 @@ jobs:
       - name: Check whether 'Test [<%= distribution[:name] %>/<%= ruby_package_version[:id] %>/<%= variant[:name] %>]' did not fail
         run: 'false'
         if: |
-          github.ref == 'refs/heads/main'
+          inputs.release
           && needs.test_<%= slug(distribution[:name]) %>-<%= slug(ruby_package_version[:id]) %>-<%= slug(variant[:name]) %>.result != 'success'
           && (needs.test_<%= slug(distribution[:name]) %>-<%= slug(ruby_package_version[:id]) %>-<%= slug(variant[:name]) %>.result != 'skipped'
             || contains(inputs.necessary_jobs, ';Test against production repo [<%= distribution[:name] %>/<%= ruby_package_version[:id] %>/<%= variant[:name] %>];'))
@@ -242,5 +245,5 @@ jobs:
         run: git tag epic-${{ env.NEXT_RELEASE_VERSION }}
 
       - name: Push Git tag
-        if: github.ref == 'refs/heads/main'
+        if: inputs.release
         run: git push origin epic-${{ env.NEXT_RELEASE_VERSION }}

From d3d9dbd085351b136a2206c6c55727aad9592aef Mon Sep 17 00:00:00 2001
From: Hongli Lai <hongli@hongli.nl>
Date: Tue, 20 Oct 2026 16:10:08 +0200
Subject: [PATCH 13/13] Fix checking out forks, fix checkout race condition

---
 .github/workflows/ci-cd-build-packages-1.yml  |  42 ++++++
 .github/workflows/ci-cd-build-packages-2.yml  |  42 ++++++
 .github/workflows/ci-cd-build-packages-3.yml  |  42 ++++++
 .github/workflows/ci-cd-build-packages-4.yml  |  17 +++
 .../workflows/ci-cd-build-packages.yml.erb    |   6 +
 .github/workflows/ci-cd-main.yml              |  13 +-
 .github/workflows/ci-cd-main.yml.erb          |  10 +-
 .github/workflows/ci-cd-prepare.yml           |  23 ++++
 .github/workflows/ci-cd-prepare.yml.erb       |  13 ++
 .../ci-cd-publish-test-production.yml         | 125 ++++++++++++++++++
 .../ci-cd-publish-test-production.yml.erb     |   6 +
 .github/workflows/ci-cd-publish-test-test.yml | 125 ++++++++++++++++++
 .../workflows/ci-cd-publish-test-test.yml.erb |   6 +
 13 files changed, 466 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci-cd-build-packages-1.yml b/.github/workflows/ci-cd-build-packages-1.yml
index ae7f7509..cd676d36 100644
--- a/.github/workflows/ci-cd-build-packages-1.yml
+++ b/.github/workflows/ci-cd-build-packages-1.yml
@@ -18,6 +18,9 @@ on:
       git_commit:
         type: string
         required: false
+      allow_unsafe_pr_checkout:
+        type: boolean
+        required: false
       ci_artifacts_run_number:
         type: string
         required: true
@@ -45,6 +48,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -106,6 +110,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -180,6 +185,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -281,6 +287,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -382,6 +389,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -483,6 +491,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -584,6 +593,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -685,6 +695,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -786,6 +797,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -887,6 +899,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -988,6 +1001,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1083,6 +1097,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1184,6 +1199,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1285,6 +1301,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1386,6 +1403,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1487,6 +1505,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1588,6 +1607,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1689,6 +1709,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1790,6 +1811,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1891,6 +1913,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1987,6 +2010,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2088,6 +2112,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2189,6 +2214,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2290,6 +2316,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2391,6 +2418,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2492,6 +2520,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2593,6 +2622,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2694,6 +2724,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2795,6 +2826,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2890,6 +2922,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2991,6 +3024,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3092,6 +3126,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3193,6 +3228,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3294,6 +3330,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3395,6 +3432,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3496,6 +3534,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3597,6 +3636,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3698,6 +3738,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3847,6 +3888,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
diff --git a/.github/workflows/ci-cd-build-packages-2.yml b/.github/workflows/ci-cd-build-packages-2.yml
index 14daf5a2..6f0fc861 100644
--- a/.github/workflows/ci-cd-build-packages-2.yml
+++ b/.github/workflows/ci-cd-build-packages-2.yml
@@ -18,6 +18,9 @@ on:
       git_commit:
         type: string
         required: false
+      allow_unsafe_pr_checkout:
+        type: boolean
+        required: false
       ci_artifacts_run_number:
         type: string
         required: true
@@ -45,6 +48,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -106,6 +110,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -180,6 +185,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -281,6 +287,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -382,6 +389,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -483,6 +491,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -584,6 +593,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -685,6 +695,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -786,6 +797,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -887,6 +899,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -988,6 +1001,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1083,6 +1097,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1184,6 +1199,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1285,6 +1301,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1386,6 +1403,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1487,6 +1505,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1588,6 +1607,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1689,6 +1709,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1790,6 +1811,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1891,6 +1913,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1987,6 +2010,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2088,6 +2112,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2189,6 +2214,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2290,6 +2316,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2391,6 +2418,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2492,6 +2520,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2593,6 +2622,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2694,6 +2724,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2795,6 +2826,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2890,6 +2922,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2991,6 +3024,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3092,6 +3126,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3193,6 +3228,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3294,6 +3330,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3395,6 +3432,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3496,6 +3534,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3597,6 +3636,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3698,6 +3738,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3847,6 +3888,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
diff --git a/.github/workflows/ci-cd-build-packages-3.yml b/.github/workflows/ci-cd-build-packages-3.yml
index 80482c4c..507e2421 100644
--- a/.github/workflows/ci-cd-build-packages-3.yml
+++ b/.github/workflows/ci-cd-build-packages-3.yml
@@ -18,6 +18,9 @@ on:
       git_commit:
         type: string
         required: false
+      allow_unsafe_pr_checkout:
+        type: boolean
+        required: false
       ci_artifacts_run_number:
         type: string
         required: true
@@ -45,6 +48,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -106,6 +110,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -180,6 +185,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -281,6 +287,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -382,6 +389,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -483,6 +491,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -584,6 +593,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -685,6 +695,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -786,6 +797,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -887,6 +899,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -988,6 +1001,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1083,6 +1097,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1184,6 +1199,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1285,6 +1301,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1386,6 +1403,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1487,6 +1505,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1588,6 +1607,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1689,6 +1709,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1790,6 +1811,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1891,6 +1913,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1987,6 +2010,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2088,6 +2112,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2189,6 +2214,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2290,6 +2316,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2391,6 +2418,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2492,6 +2520,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2593,6 +2622,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2694,6 +2724,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2795,6 +2826,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2890,6 +2922,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2991,6 +3024,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3092,6 +3126,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3193,6 +3228,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3294,6 +3330,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3395,6 +3432,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3496,6 +3534,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3597,6 +3636,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3698,6 +3738,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3847,6 +3888,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
diff --git a/.github/workflows/ci-cd-build-packages-4.yml b/.github/workflows/ci-cd-build-packages-4.yml
index 8f59a47a..e7b8d46a 100644
--- a/.github/workflows/ci-cd-build-packages-4.yml
+++ b/.github/workflows/ci-cd-build-packages-4.yml
@@ -18,6 +18,9 @@ on:
       git_commit:
         type: string
         required: false
+      allow_unsafe_pr_checkout:
+        type: boolean
+        required: false
       ci_artifacts_run_number:
         type: string
         required: true
@@ -45,6 +48,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -119,6 +123,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -220,6 +225,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -321,6 +327,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -422,6 +429,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -523,6 +531,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -624,6 +633,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -725,6 +735,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -826,6 +837,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -927,6 +939,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1028,6 +1041,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1129,6 +1143,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1230,6 +1245,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1349,6 +1365,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
diff --git a/.github/workflows/ci-cd-build-packages.yml.erb b/.github/workflows/ci-cd-build-packages.yml.erb
index 85a5394f..d9094c8e 100644
--- a/.github/workflows/ci-cd-build-packages.yml.erb
+++ b/.github/workflows/ci-cd-build-packages.yml.erb
@@ -8,6 +8,9 @@ on:
       git_commit:
         type: string
         required: false
+      allow_unsafe_pr_checkout:
+        type: boolean
+        required: false
       ci_artifacts_run_number:
         type: string
         required: true
@@ -36,6 +39,7 @@ jobs:
         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
           with:
             ref: ${{ inputs.git_commit }}
+            allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
         - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
           with:
             project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -126,6 +130,7 @@ jobs:
         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
           with:
             ref: ${{ inputs.git_commit }}
+            allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
         - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
           with:
             project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -241,6 +246,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
diff --git a/.github/workflows/ci-cd-main.yml b/.github/workflows/ci-cd-main.yml
index 9e7458a0..50014672 100644
--- a/.github/workflows/ci-cd-main.yml
+++ b/.github/workflows/ci-cd-main.yml
@@ -83,7 +83,8 @@ jobs:
       - id: checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
+          allow-unsafe-pr-checkout: ${{ github.event_name == 'pull_request_target' }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -120,7 +121,8 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
+          allow-unsafe-pr-checkout: ${{ github.event_name == 'pull_request_target' }}
       - name: Check
         run: ./internal-scripts/ci-cd/check-workflow-uptodate/check.sh
 
@@ -137,6 +139,7 @@ jobs:
     uses: ./.github/workflows/ci-cd-prepare.yml
     with:
       git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      allow_unsafe_pr_checkout: ${{ github.event_name == 'pull_request_target' }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
 
@@ -155,6 +158,7 @@ jobs:
     uses: ./.github/workflows/ci-cd-build-packages-1.yml
     with:
       git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      allow_unsafe_pr_checkout: ${{ github.event_name == 'pull_request_target' }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
 
@@ -170,6 +174,7 @@ jobs:
     uses: ./.github/workflows/ci-cd-build-packages-2.yml
     with:
       git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      allow_unsafe_pr_checkout: ${{ github.event_name == 'pull_request_target' }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
 
@@ -185,6 +190,7 @@ jobs:
     uses: ./.github/workflows/ci-cd-build-packages-3.yml
     with:
       git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      allow_unsafe_pr_checkout: ${{ github.event_name == 'pull_request_target' }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
 
@@ -200,6 +206,7 @@ jobs:
     uses: ./.github/workflows/ci-cd-build-packages-4.yml
     with:
       git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      allow_unsafe_pr_checkout: ${{ github.event_name == 'pull_request_target' }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
 
@@ -225,6 +232,7 @@ jobs:
     uses: ./.github/workflows/ci-cd-publish-test-test.yml
     with:
       git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      allow_unsafe_pr_checkout: ${{ github.event_name == 'pull_request_target' }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
 
@@ -243,6 +251,7 @@ jobs:
     uses: ./.github/workflows/ci-cd-publish-test-production.yml
     with:
       git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      allow_unsafe_pr_checkout: ${{ github.event_name == 'pull_request_target' }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
       # For pull_request_target events, github.ref refers to the base branch, not the contributor branch,
diff --git a/.github/workflows/ci-cd-main.yml.erb b/.github/workflows/ci-cd-main.yml.erb
index cae16ed8..38db5d7b 100644
--- a/.github/workflows/ci-cd-main.yml.erb
+++ b/.github/workflows/ci-cd-main.yml.erb
@@ -73,7 +73,8 @@ jobs:
       - id: checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
+          allow-unsafe-pr-checkout: ${{ github.event_name == 'pull_request_target' }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -110,7 +111,8 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
+          allow-unsafe-pr-checkout: ${{ github.event_name == 'pull_request_target' }}
       - name: Check
         run: ./internal-scripts/ci-cd/check-workflow-uptodate/check.sh
 
@@ -127,6 +129,7 @@ jobs:
     uses: ./.github/workflows/ci-cd-prepare.yml
     with:
       git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      allow_unsafe_pr_checkout: ${{ github.event_name == 'pull_request_target' }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
 
@@ -145,6 +148,7 @@ jobs:
       uses: ./.github/workflows/ci-cd-build-packages-<%= i + 1 %>.yml
       with:
         git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+        allow_unsafe_pr_checkout: ${{ github.event_name == 'pull_request_target' }}
         ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
         necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
   <%- end -%>
@@ -166,6 +170,7 @@ jobs:
     uses: ./.github/workflows/ci-cd-publish-test-test.yml
     with:
       git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      allow_unsafe_pr_checkout: ${{ github.event_name == 'pull_request_target' }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
 
@@ -184,6 +189,7 @@ jobs:
     uses: ./.github/workflows/ci-cd-publish-test-production.yml
     with:
       git_commit: ${{ needs.determine_necessary_jobs.outputs.git_commit }}
+      allow_unsafe_pr_checkout: ${{ github.event_name == 'pull_request_target' }}
       ci_artifacts_run_number: ${{ needs.determine_necessary_jobs.outputs.ci_artifacts_run_number }}
       necessary_jobs: ${{ needs.determine_necessary_jobs.outputs.necessary_jobs }}
       # For pull_request_target events, github.ref refers to the base branch, not the contributor branch,
diff --git a/.github/workflows/ci-cd-prepare.yml b/.github/workflows/ci-cd-prepare.yml
index e28341ab..a6c18d55 100644
--- a/.github/workflows/ci-cd-prepare.yml
+++ b/.github/workflows/ci-cd-prepare.yml
@@ -18,6 +18,9 @@ on:
       git_commit:
         type: string
         required: false
+      allow_unsafe_pr_checkout:
+        type: boolean
+        required: false
       ci_artifacts_run_number:
         type: string
         required: true
@@ -50,6 +53,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -108,6 +112,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -146,6 +151,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -190,6 +196,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -234,6 +241,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -278,6 +286,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -322,6 +331,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -366,6 +376,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -410,6 +421,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -454,6 +466,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -503,6 +516,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -539,6 +553,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -575,6 +590,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -611,6 +627,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -649,6 +666,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -705,6 +723,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -774,6 +793,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -851,6 +871,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -933,6 +954,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -1019,6 +1041,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
diff --git a/.github/workflows/ci-cd-prepare.yml.erb b/.github/workflows/ci-cd-prepare.yml.erb
index ce2946ae..0fcab265 100644
--- a/.github/workflows/ci-cd-prepare.yml.erb
+++ b/.github/workflows/ci-cd-prepare.yml.erb
@@ -8,6 +8,9 @@ on:
       git_commit:
         type: string
         required: false
+      allow_unsafe_pr_checkout:
+        type: boolean
+        required: false
       ci_artifacts_run_number:
         type: string
         required: true
@@ -40,6 +43,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -98,6 +102,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -137,6 +142,7 @@ jobs:
         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
           with:
             ref: ${{ inputs.git_commit }}
+            allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
         - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
           with:
             tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -188,6 +194,7 @@ jobs:
         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
           with:
             ref: ${{ inputs.git_commit }}
+            allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
         - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
           with:
             tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -228,6 +235,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -284,6 +292,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -353,6 +362,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -430,6 +440,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -512,6 +523,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -592,6 +604,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
         with:
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
diff --git a/.github/workflows/ci-cd-publish-test-production.yml b/.github/workflows/ci-cd-publish-test-production.yml
index 0e2d9439..162fce43 100644
--- a/.github/workflows/ci-cd-publish-test-production.yml
+++ b/.github/workflows/ci-cd-publish-test-production.yml
@@ -18,6 +18,9 @@ on:
       git_commit:
         type: string
         required: false
+      allow_unsafe_pr_checkout:
+        type: boolean
+        required: false
       ci_artifacts_run_number:
         type: string
         required: true
@@ -47,6 +50,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - name: Clean disk space
         run: ./internal-scripts/ci-cd/publish/clean-disk-space.sh
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
@@ -157,6 +161,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -202,6 +207,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -247,6 +253,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -292,6 +299,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -337,6 +345,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -382,6 +391,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -427,6 +437,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -472,6 +483,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -517,6 +529,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -562,6 +575,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -607,6 +621,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -652,6 +667,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -697,6 +713,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -742,6 +759,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -787,6 +805,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -832,6 +851,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -877,6 +897,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -922,6 +943,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -968,6 +990,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1013,6 +1036,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1058,6 +1082,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1103,6 +1128,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1148,6 +1174,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1193,6 +1220,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1238,6 +1266,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1283,6 +1312,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1328,6 +1358,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1373,6 +1404,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1418,6 +1450,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1463,6 +1496,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1508,6 +1542,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1553,6 +1588,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1598,6 +1634,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1643,6 +1680,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1688,6 +1726,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1733,6 +1772,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1779,6 +1819,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1824,6 +1865,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1869,6 +1911,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1914,6 +1957,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1959,6 +2003,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2004,6 +2049,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2049,6 +2095,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2094,6 +2141,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2139,6 +2187,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2184,6 +2233,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2229,6 +2279,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2274,6 +2325,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2319,6 +2371,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2364,6 +2417,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2409,6 +2463,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2454,6 +2509,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2499,6 +2555,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2544,6 +2601,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2590,6 +2648,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2635,6 +2694,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2680,6 +2740,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2725,6 +2786,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2770,6 +2832,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2815,6 +2878,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2860,6 +2924,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2905,6 +2970,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2950,6 +3016,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2995,6 +3062,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3040,6 +3108,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3085,6 +3154,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3131,6 +3201,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3176,6 +3247,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3221,6 +3293,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3266,6 +3339,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3311,6 +3385,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3356,6 +3431,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3401,6 +3477,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3446,6 +3523,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3491,6 +3569,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3536,6 +3615,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3581,6 +3661,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3626,6 +3707,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3671,6 +3753,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3716,6 +3799,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3761,6 +3845,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3806,6 +3891,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3851,6 +3937,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3896,6 +3983,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3942,6 +4030,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3987,6 +4076,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4032,6 +4122,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4077,6 +4168,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4122,6 +4214,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4167,6 +4260,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4212,6 +4306,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4257,6 +4352,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4302,6 +4398,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4347,6 +4444,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4392,6 +4490,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4437,6 +4536,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4482,6 +4582,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4527,6 +4628,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4572,6 +4674,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4617,6 +4720,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4662,6 +4766,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4707,6 +4812,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4753,6 +4859,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4798,6 +4905,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4843,6 +4951,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4888,6 +4997,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4933,6 +5043,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4978,6 +5089,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5023,6 +5135,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5068,6 +5181,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5113,6 +5227,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5158,6 +5273,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5203,6 +5319,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5248,6 +5365,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5293,6 +5411,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5338,6 +5457,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5383,6 +5503,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5428,6 +5549,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5473,6 +5595,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5518,6 +5641,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5686,6 +5810,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
 
 
       ### Check whether dependent jobs failed ###
diff --git a/.github/workflows/ci-cd-publish-test-production.yml.erb b/.github/workflows/ci-cd-publish-test-production.yml.erb
index b3051ebb..e40759a8 100644
--- a/.github/workflows/ci-cd-publish-test-production.yml.erb
+++ b/.github/workflows/ci-cd-publish-test-production.yml.erb
@@ -8,6 +8,9 @@ on:
       git_commit:
         type: string
         required: false
+      allow_unsafe_pr_checkout:
+        type: boolean
+        required: false
       ci_artifacts_run_number:
         type: string
         required: true
@@ -37,6 +40,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - name: Clean disk space
         run: ./internal-scripts/ci-cd/publish/clean-disk-space.sh
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
@@ -149,6 +153,7 @@ jobs:
         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
           with:
             ref: ${{ inputs.git_commit }}
+            allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
         - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
           with:
             project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -208,6 +213,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
 
 
       ### Check whether dependent jobs failed ###
diff --git a/.github/workflows/ci-cd-publish-test-test.yml b/.github/workflows/ci-cd-publish-test-test.yml
index 4966dcda..a87c04fc 100644
--- a/.github/workflows/ci-cd-publish-test-test.yml
+++ b/.github/workflows/ci-cd-publish-test-test.yml
@@ -18,6 +18,9 @@ on:
       git_commit:
         type: string
         required: false
+      allow_unsafe_pr_checkout:
+        type: boolean
+        required: false
       ci_artifacts_run_number:
         type: string
         required: true
@@ -44,6 +47,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - name: Clean disk space
         run: ./internal-scripts/ci-cd/publish/clean-disk-space.sh
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
@@ -131,6 +135,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -175,6 +180,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -219,6 +225,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -263,6 +270,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -307,6 +315,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -351,6 +360,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -395,6 +405,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -439,6 +450,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -483,6 +495,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -527,6 +540,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -571,6 +585,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -615,6 +630,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -659,6 +675,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -703,6 +720,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -747,6 +765,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -791,6 +810,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -835,6 +855,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -879,6 +900,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -924,6 +946,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -968,6 +991,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1012,6 +1036,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1056,6 +1081,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1100,6 +1126,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1144,6 +1171,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1188,6 +1216,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1232,6 +1261,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1276,6 +1306,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1320,6 +1351,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1364,6 +1396,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1408,6 +1441,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1452,6 +1486,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1496,6 +1531,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1540,6 +1576,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1584,6 +1621,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1628,6 +1666,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1672,6 +1711,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1717,6 +1757,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1761,6 +1802,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1805,6 +1847,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1849,6 +1892,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1893,6 +1937,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1937,6 +1982,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -1981,6 +2027,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2025,6 +2072,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2069,6 +2117,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2113,6 +2162,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2157,6 +2207,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2201,6 +2252,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2245,6 +2297,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2289,6 +2342,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2333,6 +2387,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2377,6 +2432,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2421,6 +2477,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2465,6 +2522,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2510,6 +2568,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2554,6 +2613,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2598,6 +2658,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2642,6 +2703,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2686,6 +2748,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2730,6 +2793,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2774,6 +2838,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2818,6 +2883,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2862,6 +2928,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2906,6 +2973,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2950,6 +3018,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -2994,6 +3063,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3039,6 +3109,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3083,6 +3154,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3127,6 +3199,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3171,6 +3244,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3215,6 +3289,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3259,6 +3334,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3303,6 +3379,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3347,6 +3424,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3391,6 +3469,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3435,6 +3514,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3479,6 +3559,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3523,6 +3604,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3567,6 +3649,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3611,6 +3694,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3655,6 +3739,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3699,6 +3784,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3743,6 +3829,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3787,6 +3874,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3832,6 +3920,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3876,6 +3965,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3920,6 +4010,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -3964,6 +4055,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4008,6 +4100,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4052,6 +4145,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4096,6 +4190,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4140,6 +4235,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4184,6 +4280,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4228,6 +4325,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4272,6 +4370,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4316,6 +4415,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4360,6 +4460,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4404,6 +4505,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4448,6 +4550,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4492,6 +4595,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4536,6 +4640,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4580,6 +4685,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4625,6 +4731,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4669,6 +4776,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4713,6 +4821,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4757,6 +4866,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4801,6 +4911,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4845,6 +4956,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4889,6 +5001,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4933,6 +5046,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -4977,6 +5091,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5021,6 +5136,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5065,6 +5181,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5109,6 +5226,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5153,6 +5271,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5197,6 +5316,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5241,6 +5361,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5285,6 +5406,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5329,6 +5451,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5373,6 +5496,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -5540,6 +5664,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
 
 
       ### Check whether dependent jobs failed ###
diff --git a/.github/workflows/ci-cd-publish-test-test.yml.erb b/.github/workflows/ci-cd-publish-test-test.yml.erb
index 5f13690a..f9dcfcf5 100644
--- a/.github/workflows/ci-cd-publish-test-test.yml.erb
+++ b/.github/workflows/ci-cd-publish-test-test.yml.erb
@@ -8,6 +8,9 @@ on:
       git_commit:
         type: string
         required: false
+      allow_unsafe_pr_checkout:
+        type: boolean
+        required: false
       ci_artifacts_run_number:
         type: string
         required: true
@@ -34,6 +37,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
       - name: Clean disk space
         run: ./internal-scripts/ci-cd/publish/clean-disk-space.sh
       - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
@@ -123,6 +127,7 @@ jobs:
         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
           with:
             ref: ${{ inputs.git_commit }}
+            allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
         - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
           with:
             project_id: ${{ vars.GCLOUD_PROJECT_ID }}
@@ -180,6 +185,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.git_commit }}
+          allow-unsafe-pr-checkout: ${{ inputs.allow_unsafe_pr_checkout }}
 
 
       ### Check whether dependent jobs failed ###