From ee5231cbbbf50fc6d29bf216c150aa545f7044a0 Mon Sep 17 00:00:00 2001
From: Megan Wilhite <mwilhite@vmware.com>
Date: Thu, 5 Oct 2023 09:07:16 -0600
Subject: [PATCH 01/29] Increase code coverage on salt/state.py

---
 .../pytests/unit/state/test_state_compiler.py | 159 ++++++++++++++++++
 1 file changed, 159 insertions(+)

diff --git a/tests/pytests/unit/state/test_state_compiler.py b/tests/pytests/unit/state/test_state_compiler.py
index e03d4caee5a..8012010abd8 100644
--- a/tests/pytests/unit/state/test_state_compiler.py
+++ b/tests/pytests/unit/state/test_state_compiler.py
@@ -1143,3 +1143,162 @@ def test_verify_high_too_many_functions_declared_error_message(
         res = state_obj.verify_high(high)
         assert isinstance(res, list)
         assert any(err_msg in x for x in res)
+
+
+def test_load_modules_pkg(minion_opts):
+    """
+    Test load_modules when using this state:
+    nginx:
+      pkg.installed:
+        - provider: pacmanpkg
+    """
+    data = {
+        "state": "pkg",
+        "name": "nginx",
+        "__sls__": "test",
+        "__env__": "base",
+        "__id__": "nginx",
+        "provider": "pacmanpkg",
+        "order": 10000,
+        "fun": "installed",
+    }
+    with patch("salt.state.State._gather_pillar"):
+        state_obj = salt.state.State(minion_opts)
+        state_obj.load_modules(data)
+        for func in [
+            "pkg.available_version",
+            "pkg.file_list",
+            "pkg.group_diff",
+            "pkg.group_info",
+        ]:
+            assert func in state_obj.functions
+
+
+def test_load_modules_list(minion_opts):
+    """
+    Test load_modules when using providers in state
+    as a list, with this state:
+    nginx:
+      pkg.installed:
+        - provider:
+          - cmd: cmdmod
+    """
+    data = {
+        "state": "pkg",
+        "name": "nginx",
+        "__sls__": "test",
+        "__env__": "base",
+        "__id__": "nginx",
+        "provider": [OrderedDict([("cmd", "cmdmod")])],
+        "order": 10000,
+        "fun": "installed",
+    }
+    with patch("salt.state.State._gather_pillar"):
+        state_obj = salt.state.State(minion_opts)
+        state_obj.load_modules(data)
+        for func in ["cmd.exec_code", "cmd.run", "cmd.script"]:
+            assert func in state_obj.functions
+
+
+def test_load_modules_dict(minion_opts):
+    """
+    Test load_modules when providers is a dict, which is
+    not valid. Testing this state:
+    nginx:
+      pkg.installed:
+        - provider: {cmd: test}
+    """
+    data = {
+        "state": "pkg",
+        "name": "nginx",
+        "__sls__": "test",
+        "__env__": "base",
+        "__id__": "nginx",
+        "provider": OrderedDict([("cmd", "test")]),
+        "order": 10000,
+        "fun": "installed",
+    }
+    mock_raw_mod = MagicMock()
+    patch_raw_mod = patch("salt.loader.raw_mod", mock_raw_mod)
+    with patch("salt.state.State._gather_pillar"):
+        with patch_raw_mod:
+            state_obj = salt.state.State(minion_opts)
+            state_obj.load_modules(data)
+            mock_raw_mod.assert_not_called()
+
+
+def test_check_refresh_grains(minion_opts):
+    """
+    Test check_refresh when using this state:
+    grains_refresh:
+      module.run:
+       - name: saltutil.refresh_grains
+       - reload_grains: true
+    Ensure that the grains are loaded when reload_grains
+    is set.
+    """
+    data = {
+        "state": "module",
+        "name": "saltutil.refresh_grains",
+        "__sls__": "test",
+        "__env__": "base",
+        "__id__": "grains_refresh",
+        "reload_grains": True,
+        "order": 10000,
+        "fun": "run",
+    }
+    ret = {
+        "name": "saltutil.refresh_grains",
+        "changes": {"ret": True},
+        "comment": "Module function saltutil.refresh_grains executed",
+        "result": True,
+        "__sls__": "test",
+        "__run_num__": 0,
+    }
+    mock_refresh = MagicMock()
+    patch_refresh = patch("salt.state.State.module_refresh", mock_refresh)
+    with patch("salt.state.State._gather_pillar"):
+        with patch_refresh:
+            state_obj = salt.state.State(minion_opts)
+            state_obj.check_refresh(data, ret)
+            mock_refresh.assert_called_once()
+            assert "cwd" in state_obj.opts["grains"]
+
+
+def test_check_refresh_pillar(minion_opts, caplog):
+    """
+    Test check_refresh when using this state:
+    pillar_refresh:
+      module.run:
+       - name: saltutil.refresh_pillar
+       - reload_pillar: true
+    Ensure the pillar is refreshed.
+    """
+    data = {
+        "state": "module",
+        "name": "saltutil.refresh_pillar",
+        "__sls__": "test",
+        "__env__": "base",
+        "__id__": "pillar_refresh",
+        "reload_pillar": True,
+        "order": 10000,
+        "fun": "run",
+    }
+    ret = {
+        "name": "saltutil.refresh_pillar",
+        "changes": {"ret": False},
+        "comment": "Module function saltutil.refresh_pillar executed",
+        "result": False,
+        "__sls__": "test",
+        "__run_num__": 0,
+    }
+    mock_refresh = MagicMock()
+    patch_refresh = patch("salt.state.State.module_refresh", mock_refresh)
+    mock_pillar = MagicMock()
+    patch_pillar = patch("salt.state.State._gather_pillar", mock_pillar)
+    with patch_pillar, patch_refresh:
+        with caplog.at_level(logging.DEBUG):
+            state_obj = salt.state.State(minion_opts)
+            state_obj.check_refresh(data, ret)
+            mock_refresh.assert_called_once()
+            assert "Refreshing pillar..." in caplog.text

From 90259a7729c74a89bf1042010e79553380e3e368 Mon Sep 17 00:00:00 2001
From: twangboy <shane.d.lee@gmail.com>
Date: Tue, 12 Sep 2023 15:37:22 -0600
Subject: [PATCH 02/29] Unskip the chocolatey tests on Windows

---
 tests/pytests/functional/states/test_chocolatey_1_2_1.py  | 1 -
 tests/pytests/functional/states/test_chocolatey_latest.py | 1 -
 2 files changed, 2 deletions(-)

diff --git a/tests/pytests/functional/states/test_chocolatey_1_2_1.py b/tests/pytests/functional/states/test_chocolatey_1_2_1.py
index 04e1d3ece1a..9dcc186636a 100644
--- a/tests/pytests/functional/states/test_chocolatey_1_2_1.py
+++ b/tests/pytests/functional/states/test_chocolatey_1_2_1.py
@@ -14,7 +14,6 @@ pytestmark = [
     pytest.mark.skip_unless_on_windows,
     pytest.mark.slow_test,
     pytest.mark.destructive_test,
-    pytest.mark.skip_on_windows,
 ]
 
 
diff --git a/tests/pytests/functional/states/test_chocolatey_latest.py b/tests/pytests/functional/states/test_chocolatey_latest.py
index 6e2f55405d8..9d329d5fc59 100644
--- a/tests/pytests/functional/states/test_chocolatey_latest.py
+++ b/tests/pytests/functional/states/test_chocolatey_latest.py
@@ -14,7 +14,6 @@ pytestmark = [
     pytest.mark.skip_unless_on_windows,
     pytest.mark.slow_test,
     pytest.mark.destructive_test,
-    pytest.mark.skip_on_windows,
 ]
 
 

From 960bd47c062e8906a3a1b27d3bd471cd526ddafa Mon Sep 17 00:00:00 2001
From: Thomas Phipps <tphipps@vmware.com>
Date: Tue, 26 Sep 2023 20:50:55 +0000
Subject: [PATCH 03/29] starter tests for salt.utils.cloud also includes
 framework for more tests

---
 tests/pytests/unit/utils/test_cloud.py | 277 ++++++++++++++++++++++++-
 1 file changed, 274 insertions(+), 3 deletions(-)

diff --git a/tests/pytests/unit/utils/test_cloud.py b/tests/pytests/unit/utils/test_cloud.py
index db9d258d399..786e5370b8c 100644
--- a/tests/pytests/unit/utils/test_cloud.py
+++ b/tests/pytests/unit/utils/test_cloud.py
@@ -8,11 +8,13 @@
 
 
 import os
+import string
 import tempfile
 
 import pytest
 
 import salt.utils.cloud as cloud
+from salt.exceptions import SaltCloudException
 from salt.utils.cloud import __ssh_gateway_arguments as ssh_gateway_arguments
 from tests.support.mock import MagicMock, patch
 
@@ -74,7 +76,7 @@ def create_class(tmp_path):
         os.chdir(old_cwd)
 
 
-def test_ssh_password_regex(create_class):
+def test_ssh_password_regex():
     """Test matching ssh password patterns"""
     for pattern in (
         "Password for root@127.0.0.1:",
@@ -125,7 +127,7 @@ def test_retrieve_password_from_keyring(create_class):
     assert pw_in_keyring == "fake_password_c8231"
 
 
-def test_sftp_file_with_content_under_python3(create_class):
+def test_sftp_file_with_content_under_python3():
     with pytest.raises(Exception) as context:
         cloud.sftp_file("/tmp/test", "ТЕSТ test content")
         # we successful pass the place with os.write(tmpfd, ...
@@ -133,7 +135,7 @@ def test_sftp_file_with_content_under_python3(create_class):
 
 
 @pytest.mark.skip_on_windows(reason="Not applicable for Windows.")
-def test_check_key_path_and_mode(create_class):
+def test_check_key_path_and_mode():
     with tempfile.NamedTemporaryFile() as f:
         key_file = f.name
 
@@ -657,3 +659,272 @@ def test_deploy_windows_master(master, expected):
         expected_args = "/S /master={} /minion-name=None".format(expected)
         assert mock.call_args_list[0].args[0] == expected_cmd
         assert mock.call_args_list[0].args[1] == expected_args
+
+
+def test__render_script():
+    pass
+
+
+def test___ssh_gateway_config_dict():
+    assert cloud.__ssh_gateway_config_dict(None) == {}
+    gate = {
+        "ssh_gateway": "Gozar",
+        "ssh_gateway_key": "Zuul",
+        "ssh_gateway_user": "Vinz Clortho",
+        "ssh_gateway_command": "Are you the keymaster?",
+    }
+    assert cloud.__ssh_gateway_config_dict(gate) == gate
+
+
+def test_os_script():
+    pass
+
+
+def test_gen_keys():
+    pass
+
+
+def test_accept_key():
+    pass
+
+
+def test_remove_key():
+    pass
+
+
+def test_rename_key():
+    pass
+
+
+def test_minion_config():
+    pass
+
+
+def test_master_config():
+    pass
+
+
+def test_salt_config_to_yaml():
+    pass
+
+
+def test_bootstrap():  # this will be the big one
+    pass
+
+
+def test_ssh_usernames():
+    pass
+
+
+def test_wait_for_fun():
+    pass
+
+
+def test_wait_for_passwd():
+    pass
+
+
+def test_run_inline_script():
+    pass
+
+
+def test_filter_event():
+    pass
+
+
+def test__exec_ssh_cmd():
+    pass
+
+
+def test_ssh_file():
+    pass
+
+
+def test_win_cmd():
+    pass
+
+
+def test_winrm_cmd():
+    pass
+
+
+def test_root_cmd():
+    pass
+
+
+def test_check_auth():
+    pass
+
+
+def test_ip_to_int():
+    assert cloud.ip_to_int("127.0.0.1") == 2130706433
+
+
+def test_is_public_ip():
+    assert cloud.is_public_ip("8.8.8.8") is True
+    assert cloud.is_public_ip("127.0.0.1") is False
+    assert cloud.is_public_ip("172.17.3.1") is False
+    assert cloud.is_public_ip("192.168.30.4") is False
+    assert cloud.is_public_ip("10.145.1.1") is False
+    assert cloud.is_public_ip("fe80::123:ffff:ffff:ffff") is False
+    assert cloud.is_public_ip("2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF") is True
+
+
+def test_check_name():
+    try:
+        cloud.check_name("test", string.ascii_letters)
+    except SaltCloudException as exc:
+        assert False, f"cloud.check_name rasied SaltCloudException: {exc}"
+
+    with pytest.raises(SaltCloudException):
+        cloud.check_name("test", string.digits)
+
+
+def test_remove_sshkey():
+    pass
+
+
+def test_wait_for_ip():
+    pass
+
+
+def test_list_nodes_select():
+    pass
+
+
+def test_lock_file():
+    pass
+
+
+def test_unlock_file():
+    pass
+
+
+def test_cachedir_index_del():
+    pass
+
+
+def test_init_cachedir():
+    pass
+
+
+def test_request_minion_cachedir():
+    pass
+
+
+def test_change_minion_cachedir():
+    pass
+
+
+def test_activate_minion_cachedir():
+    pass
+
+
+def test_delete_minion_cachedir():
+    pass
+
+
+def test_list_cache_nodes_full():
+    pass
+
+
+def test_update_bootstrap():
+    pass
+
+
+def test_cache_node_list():
+    pass
+
+
+def test_cache_node():
+    pass
+
+
+def test_missing_node_cache():
+    pass
+
+
+def test_diff_node_cache():
+    pass
+
+
+def test__strip_cache_events():
+    events = {
+        "test": "foobar",
+        "passwd": "fakepass",
+    }
+    events2 = {"test1": "foobar", "test2": "foobar"}
+    opts = {"cache_event_strip_fields": ["passwd"]}
+    assert cloud._strip_cache_events(events, opts) == {"test": "foobar"}
+    assert cloud._strip_cache_events(events2, opts) == events2
+
+
+def test_salt_cloud_force_asciii():
+    try:
+        "\u0411".encode("iso-8859-15")
+    except UnicodeEncodeError as exc:
+        with pytest.raises(UnicodeEncodeError):
+            cloud._salt_cloud_force_ascii(exc)
+
+    with pytest.raises(TypeError):
+        cloud._salt_cloud_force_ascii("not the thing")
+
+    try:
+        "\xa0\u2013".encode("iso-8859-15")
+    except UnicodeEncodeError as exc:
+        assert cloud._salt_cloud_force_ascii(exc) == ("-", 2)
+
+
+def test__unwrap_dict():
+    assert cloud._unwrap_dict({"a": {"b": {"c": "foobar"}}}, "a,b,c") == "foobar"
+
+
+def test_run_func_until_ret_arg():
+    pass
+
+
+def test_get_salt_interface():
+    with patch(
+        "salt.config.get_cloud_config_value",
+        MagicMock(side_effect=[False, "public_ips"]),
+    ) as cloud_config:
+        assert cloud.get_salt_interface({}, {}) == "public_ips"
+        assert cloud_config.call_count == 2
+    with patch(
+        "salt.config.get_cloud_config_value", MagicMock(return_value="private_ips")
+    ) as cloud_config:
+        assert cloud.get_salt_interface({}, {}) == "private_ips"
+        assert cloud_config.call_count == 1
+
+
+def test_userdata_template():
+    assert cloud.userdata_template(opts=None, vm_=None, userdata=None) is None
+    with patch("salt.config.get_cloud_config_value", MagicMock(return_value=False)):
+        assert cloud.userdata_template(opts=None, vm_=None, userdata="test") == "test"
+    with patch("salt.config.get_cloud_config_value", MagicMock(return_value=None)):
+        opts = {"userdata_template": None}
+        assert cloud.userdata_template(opts=opts, vm_=None, userdata="test") == "test"
+
+    renders = {"jinja": MagicMock(return_value="test")}
+
+    with patch("salt.config.get_cloud_config_value", MagicMock(return_value="jinja")):
+        with patch("salt.loader.render", MagicMock(return_value=renders)):
+            opts = {
+                "userdata_template": "test",
+                "renderer_blacklist": None,
+                "renderer_whitelist": None,
+                "renderer": "jinja",
+            }
+            assert cloud.userdata_template(opts=opts, vm_={}, userdata="test") == "test"
+
+    renders = {"jinja": MagicMock(return_value=True)}
+
+    with patch("salt.config.get_cloud_config_value", MagicMock(return_value="jinja")):
+        with patch("salt.loader.render", MagicMock(return_value=renders)):
+            opts = {
+                "userdata_template": "test",
+                "renderer_blacklist": None,
+                "renderer_whitelist": None,
+                "renderer": "jinja",
+            }
+            assert cloud.userdata_template(opts=opts, vm_={}, userdata="test") == "True"

From 4612be8785f3a1e788dfb0778b48cf23581c0665 Mon Sep 17 00:00:00 2001
From: Thomas Phipps <tphipps@vmware.com>
Date: Thu, 5 Oct 2023 20:50:52 +0000
Subject: [PATCH 04/29] remove blank test templates.

---
 tests/pytests/unit/utils/test_cloud.py | 156 -------------------------
 1 file changed, 156 deletions(-)

diff --git a/tests/pytests/unit/utils/test_cloud.py b/tests/pytests/unit/utils/test_cloud.py
index 786e5370b8c..ea55af44ef5 100644
--- a/tests/pytests/unit/utils/test_cloud.py
+++ b/tests/pytests/unit/utils/test_cloud.py
@@ -661,10 +661,6 @@ def test_deploy_windows_master(master, expected):
         assert mock.call_args_list[0].args[1] == expected_args
 
 
-def test__render_script():
-    pass
-
-
 def test___ssh_gateway_config_dict():
     assert cloud.__ssh_gateway_config_dict(None) == {}
     gate = {
@@ -676,86 +672,6 @@ def test___ssh_gateway_config_dict():
     assert cloud.__ssh_gateway_config_dict(gate) == gate
 
 
-def test_os_script():
-    pass
-
-
-def test_gen_keys():
-    pass
-
-
-def test_accept_key():
-    pass
-
-
-def test_remove_key():
-    pass
-
-
-def test_rename_key():
-    pass
-
-
-def test_minion_config():
-    pass
-
-
-def test_master_config():
-    pass
-
-
-def test_salt_config_to_yaml():
-    pass
-
-
-def test_bootstrap():  # this will be the big one
-    pass
-
-
-def test_ssh_usernames():
-    pass
-
-
-def test_wait_for_fun():
-    pass
-
-
-def test_wait_for_passwd():
-    pass
-
-
-def test_run_inline_script():
-    pass
-
-
-def test_filter_event():
-    pass
-
-
-def test__exec_ssh_cmd():
-    pass
-
-
-def test_ssh_file():
-    pass
-
-
-def test_win_cmd():
-    pass
-
-
-def test_winrm_cmd():
-    pass
-
-
-def test_root_cmd():
-    pass
-
-
-def test_check_auth():
-    pass
-
-
 def test_ip_to_int():
     assert cloud.ip_to_int("127.0.0.1") == 2130706433
 
@@ -780,74 +696,6 @@ def test_check_name():
         cloud.check_name("test", string.digits)
 
 
-def test_remove_sshkey():
-    pass
-
-
-def test_wait_for_ip():
-    pass
-
-
-def test_list_nodes_select():
-    pass
-
-
-def test_lock_file():
-    pass
-
-
-def test_unlock_file():
-    pass
-
-
-def test_cachedir_index_del():
-    pass
-
-
-def test_init_cachedir():
-    pass
-
-
-def test_request_minion_cachedir():
-    pass
-
-
-def test_change_minion_cachedir():
-    pass
-
-
-def test_activate_minion_cachedir():
-    pass
-
-
-def test_delete_minion_cachedir():
-    pass
-
-
-def test_list_cache_nodes_full():
-    pass
-
-
-def test_update_bootstrap():
-    pass
-
-
-def test_cache_node_list():
-    pass
-
-
-def test_cache_node():
-    pass
-
-
-def test_missing_node_cache():
-    pass
-
-
-def test_diff_node_cache():
-    pass
-
-
 def test__strip_cache_events():
     events = {
         "test": "foobar",
@@ -879,10 +727,6 @@ def test__unwrap_dict():
     assert cloud._unwrap_dict({"a": {"b": {"c": "foobar"}}}, "a,b,c") == "foobar"
 
 
-def test_run_func_until_ret_arg():
-    pass
-
-
 def test_get_salt_interface():
     with patch(
         "salt.config.get_cloud_config_value",

From c5a40240ff95767f3ee9fd231c531155f60e7372 Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Sat, 16 Sep 2023 11:55:40 +0100
Subject: [PATCH 05/29] Update the codecov configuration file

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .codecov.yml | 151 +++++++++++++++++----------------------------------
 1 file changed, 49 insertions(+), 102 deletions(-)

diff --git a/.codecov.yml b/.codecov.yml
index 5b59b7fcbd4..0f57a7a304f 100644
--- a/.codecov.yml
+++ b/.codecov.yml
@@ -1,112 +1,72 @@
 codecov:
   ci:
-    - jenkins.saltproject.io
     - github.com
 
-  max_report_age: 24           # The age you want coverage reports to expire at, or if you
-                               # want to disable this check. Expired reports will not be processed by codecov.
-  require_ci_to_pass: yes      # Less spammy. Only notify on passing builds.
+  max_report_age: 24          # The age you want coverage reports to expire at, or if you
+                              # want to disable this check. Expired reports will not be processed by codecov.
+  require_ci_to_pass: yes     # Less spammy. Only notify on passing builds.
 
-
-#  notify:
-#    after_n_builds: 25           # Only notify after N builds
-#                                 # This value is the output of:
-#                                 #    sh -c 'echo "$(ls .ci/ | grep kitchen | wc -l)"'
-#    wait_for_ci: yes             # Should Codecov wait for all CI statuses to complete before sending ours.
-#                                 # Note: Codecov considers all non-codecov statues to be CI statuses
+  notify:
+    wait_for_ci: false        # Should Codecov wait for all CI statuses to complete before sending ours.
+                              # Note: Codecov considers all non-codecov statuses to be CI statuses
+    manual_trigger: true      # We manually tell codecov to merge and process all uploaded coverage reports
 
 
 ignore:
-  - ^*.py$                       # python files at the repo root, ie, setup.py
-  - doc/.*                       # ignore any code under doc/
-  - salt/ext/.*                  # ignore any code under salt/ext
+  - ^*.py$                    # python files at the repo root, ie, setup.py
+  - doc/.*                    # ignore any code under doc/
+  - salt/ext/.*               # ignore any code under salt/ext
 
 coverage:
   round: up
   range: 70..100
   precision: 2
 
-  notify: {}
-  status: false
+  status:
+    project:
+      default:
+        target: auto          # auto compares coverage to the previous base commit
+        threshold: 5%         # adjust accordingly based on how flaky your tests are
+                              # this allows a 5% drop from the previous base commit coverage
+        flags:
+          - salt
+          - tests
 
-#  status:
-#      project:                   # measuring the overall project coverage
-#        default:
-#          informational: true    # Use Codecov in informational mode. Default is false. If true is specified the
-#                                 # resulting status will pass no matter what the coverage is or what other settings
-#                                 # are specified. Informational mode is great to use if you want to expose codecov
-#                                 # information to other developers in your pull request without necessarily gating
-#                                 # PRs on that information.
-#          target: auto           # will use the coverage from the base commit (pull request base or parent commit) coverage to compare against.
-#          base: auto             # will use the pull request base if the commit is on a pull request. If not, the parent commit will be used.
-#          flags:
-#            - salt
-#            - tests
-#        salt:                    # declare a new status context "salt"
-#          informational: true
-#          paths: "!tests/"       # remove all files in "tests/"
-#          target: auto           # will use the coverage from the base commit (pull request base or parent commit) coverage to compare against.
-#          base: auto             # will use the pull request base if the commit is on a pull request. If not, the parent commit will be used.
-#          if_no_uploads: error   # will post commit status of "error" if no coverage reports were uploaded
-#                                 # options: success, error, failure
-#          if_not_found: success  # if parent is not found report status as success, error, or failure
-#          if_ci_failed: error    # if ci fails report status as success, error, or failure
-#          flags:
-#            - salt
-#        tests:                   # declare a new status context "tests"
-#          informational: true
-#          #target: 100%          # we always want 100% coverage here
-#          target: auto           # auto while we get this going
-#          base: auto             # will use the pull request base if the commit is on a pull request. If not, the parent commit will be used.
-#          paths: "!salt/"        # only include coverage in "tests/" folder
-#          if_no_uploads: error   # will post commit status of "error" if no coverage reports were uploaded
-#                                 # options: success, error, failure
-#          if_not_found: success  # if parent is not found report status as success, error, or failure
-#          if_ci_failed: error    # if ci fails report status as success, error, or failure
-#          flags:
-#            - tests
+      salt:                   # declare a new status context "salt"
+        paths:
+          - "!tests/"         # remove all files in "tests/"
+        target: auto          # will use the coverage from the base commit (pull request base or parent commit) coverage to compare against.
+        flags:
+          - salt
 
-#      patch:                     # pull requests only: this commit status will measure the
-#                                 # entire pull requests Coverage Diff. Checking if the lines
-#                                 # adjusted are covered at least X%.
-#        default:
-#          informational: true    # Use Codecov in informational mode. Default is false. If true is specified the
-#                                 # resulting status will pass no matter what the coverage is or what other settings
-#                                 # are specified. Informational mode is great to use if you want to expose codecov
-#                                 # information to other developers in your pull request without necessarily gating
-#                                 # PRs on that information.
-#          target: 100%           # Newly added lines must have 100% coverage
-#          if_no_uploads: error   # will post commit status of "error" if no coverage reports were uploaded
-#                                 # options: success, error, failure
-#          if_not_found: success
-#          if_ci_failed: error
-#          flags:
-#            - salt
-#            - tests
+      tests:                  # declare a new status context "tests"
+        paths:
+          - "!salt/"          # only include coverage in "tests/" folder
+        target: auto          # auto while we get this going
+        flags:
+          - tests
 
-#      changes:                   # if there are any unexpected changes in coverage
-#        default:
-#          informational: true    # Use Codecov in informational mode. Default is false. If true is specified the
-#                                 # resulting status will pass no matter what the coverage is or what other settings
-#                                 # are specified. Informational mode is great to use if you want to expose codecov
-#                                 # information to other developers in your pull request without necessarily gating
-#                                 # PRs on that information.
-#          if_no_uploads: error
-#          if_not_found: success
-#          if_ci_failed: error
-#          flags:
-#            - salt
-#            - tests
+    patch:                    # pull requests only: this commit status will measure the
+                              # entire pull requests Coverage Diff. Checking if the lines
+                              # adjusted are covered at least X%.
+      default:
+        target: auto          # auto compares coverage to the previous base commit
+        threshold: 5%         # adjust accordingly based on how flaky your tests are
+                              # this allows a 5% drop from the previous base commit coverage
 
 flags:
   salt:
     paths:
       - salt/
-    carryforward: true           # https://docs.codecov.io/docs/carryforward-flags
+    carryforward: true        # https://docs.codecov.io/docs/carryforward-flags
   tests:
     paths:
       - tests/
     carryforward: true
+  pkg:
+    paths:
+      - pkg/tests
+    carryforward: true
   unit:
     paths:
       - tests/unit
@@ -125,23 +85,10 @@ flags:
       - tests/integration
       - tests/pytests/integration
     carryforward: true
-  system:
-    paths:
-      - tests/integration
-      - tests/pytests/integration
-    carryforward: true
 
-#comment:
-#  layout: "reach, diff, flags, files"
-#  after_n_builds: 46             # Only comment on PRs after N builds
-#                                 # This value is the output of:
-#                                 #    sh -c 'echo "$(ls .ci/ | grep kitchen | wc -l)"'
-#
-#  behavior: new                  # Comment posting behaviour
-#                                 #   default: update, if exists. Otherwise post new.
-#                                 #   once: update, if exists. Otherwise post new. Skip if deleted.
-#                                 #   new: delete old and post new.
-#                                 #   spammy: post new (do not delete old comments).
-#
-# Disable Comments
-comment: off
+comment:
+  layout: "header, diff, flags, files"
+  behavior: default              # Comment posting behaviour
+                                 #   default: update, if exists. Otherwise post new.
+                                 #   once: update, if exists. Otherwise post new. Skip if deleted.
+                                 #   new: delete old and post new.

From 1307a657b0c120abc36fd7bdfa48e3c38923bd4b Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Tue, 3 Oct 2023 17:36:52 +0100
Subject: [PATCH 06/29] Re-Start publishing code coverage data to codecov

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/ci.yml                      | 50 +++++++++++++++++++
 .github/workflows/nightly.yml                 | 50 +++++++++++++++++++
 .github/workflows/scheduled.yml               | 50 +++++++++++++++++++
 .github/workflows/staging.yml                 | 41 +++++++++++++++
 .github/workflows/templates/ci.yml.jinja      |  9 ++++
 .github/workflows/templates/layout.yml.jinja  | 18 +++++++
 .../workflows/templates/test-salt.yml.jinja   |  3 ++
 .github/workflows/test-action-macos.yml       | 28 +++++++++++
 .github/workflows/test-action.yml             | 23 +++++++++
 .../test-package-downloads-action-linux.yml   | 23 +++++++++
 .../test-package-downloads-action-macos.yml   | 23 +++++++++
 .../test-package-downloads-action-windows.yml | 23 +++++++++
 12 files changed, 341 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b5e9b526c17..f00c133fa11 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -238,6 +238,23 @@ jobs:
         with:
           name: testrun-changed-files.txt
           path: testrun-changed-files.txt
+
+      - name: Install Codecov CLI
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Save Commit Metadata In Codecov
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            create-commit --git-service github --sha ${{ github.sha }}
+
+      - name: Create Codecov Coverage Report
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            create-report --git-service github --sha ${{ github.sha }}
   pre-commit:
     name: Pre-Commit
     if: ${{ fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
@@ -1650,6 +1667,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   windows-2019:
     name: Windows 2019
@@ -1670,6 +1688,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   windows-2022:
     name: Windows 2022
@@ -1690,6 +1709,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   macos-12:
     name: macOS 12
@@ -1710,6 +1730,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   almalinux-8:
     name: Alma Linux 8
@@ -1730,6 +1751,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   almalinux-9:
     name: Alma Linux 9
@@ -1750,6 +1772,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   amazonlinux-2:
     name: Amazon Linux 2
@@ -1770,6 +1793,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   archlinux-lts:
     name: Arch Linux LTS
@@ -1790,6 +1814,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   centos-7:
     name: CentOS 7
@@ -1810,6 +1835,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   centosstream-8:
     name: CentOS Stream 8
@@ -1830,6 +1856,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   centosstream-9:
     name: CentOS Stream 9
@@ -1850,6 +1877,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   debian-10:
     name: Debian 10
@@ -1870,6 +1898,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   debian-11:
     name: Debian 11
@@ -1890,6 +1919,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   debian-11-arm64:
     name: Debian 11 Arm64
@@ -1910,6 +1940,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   fedora-37:
     name: Fedora 37
@@ -1930,6 +1961,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   fedora-38:
     name: Fedora 38
@@ -1950,6 +1982,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   opensuse-15:
     name: Opensuse 15
@@ -1970,6 +2003,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   photonos-3:
     name: Photon OS 3
@@ -1990,6 +2024,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   photonos-4:
     name: Photon OS 4
@@ -2010,6 +2045,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   photonos-4-arm64:
     name: Photon OS 4 Arm64
@@ -2030,6 +2066,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   ubuntu-2004:
     name: Ubuntu 20.04
@@ -2050,6 +2087,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   ubuntu-2004-arm64:
     name: Ubuntu 20.04 Arm64
@@ -2070,6 +2108,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   ubuntu-2204:
     name: Ubuntu 22.04
@@ -2090,6 +2129,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   ubuntu-2204-arm64:
     name: Ubuntu 22.04 Arm64
@@ -2110,6 +2150,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+    secrets: inherit
 
   combine-all-code-coverage:
     name: Combine Code Coverage
@@ -2186,6 +2227,15 @@ jobs:
         run: |
           python3 -m pip install 'nox==2022.8.7'
 
+      - name: Install Codecov CLI
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Tell Codecov To Process Reports
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            send-notifications --git-service github --sha ${{ github.sha }}
+
       - name: Get coverage reports
         id: get-coverage-reports
         uses: actions/download-artifact@v3
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index e094519215d..7e96d50cdc1 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -282,6 +282,23 @@ jobs:
         with:
           name: testrun-changed-files.txt
           path: testrun-changed-files.txt
+
+      - name: Install Codecov CLI
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Save Commit Metadata In Codecov
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            create-commit --git-service github --sha ${{ github.sha }}
+
+      - name: Create Codecov Coverage Report
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            create-report --git-service github --sha ${{ github.sha }}
   pre-commit:
     name: Pre-Commit
     if: ${{ fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
@@ -1711,6 +1728,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   windows-2019:
     name: Windows 2019
@@ -1731,6 +1749,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   windows-2022:
     name: Windows 2022
@@ -1751,6 +1770,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   macos-12:
     name: macOS 12
@@ -1771,6 +1791,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   almalinux-8:
     name: Alma Linux 8
@@ -1791,6 +1812,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   almalinux-9:
     name: Alma Linux 9
@@ -1811,6 +1833,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   amazonlinux-2:
     name: Amazon Linux 2
@@ -1831,6 +1854,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   archlinux-lts:
     name: Arch Linux LTS
@@ -1851,6 +1875,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   centos-7:
     name: CentOS 7
@@ -1871,6 +1896,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   centosstream-8:
     name: CentOS Stream 8
@@ -1891,6 +1917,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   centosstream-9:
     name: CentOS Stream 9
@@ -1911,6 +1938,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   debian-10:
     name: Debian 10
@@ -1931,6 +1959,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   debian-11:
     name: Debian 11
@@ -1951,6 +1980,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   debian-11-arm64:
     name: Debian 11 Arm64
@@ -1971,6 +2001,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   fedora-37:
     name: Fedora 37
@@ -1991,6 +2022,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   fedora-38:
     name: Fedora 38
@@ -2011,6 +2043,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   opensuse-15:
     name: Opensuse 15
@@ -2031,6 +2064,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   photonos-3:
     name: Photon OS 3
@@ -2051,6 +2085,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   photonos-4:
     name: Photon OS 4
@@ -2071,6 +2106,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   photonos-4-arm64:
     name: Photon OS 4 Arm64
@@ -2091,6 +2127,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   ubuntu-2004:
     name: Ubuntu 20.04
@@ -2111,6 +2148,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   ubuntu-2004-arm64:
     name: Ubuntu 20.04 Arm64
@@ -2131,6 +2169,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   ubuntu-2204:
     name: Ubuntu 22.04
@@ -2151,6 +2190,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   ubuntu-2204-arm64:
     name: Ubuntu 22.04 Arm64
@@ -2171,6 +2211,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   combine-all-code-coverage:
     name: Combine Code Coverage
@@ -2247,6 +2288,15 @@ jobs:
         run: |
           python3 -m pip install 'nox==2022.8.7'
 
+      - name: Install Codecov CLI
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Tell Codecov To Process Reports
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            send-notifications --git-service github --sha ${{ github.sha }}
+
       - name: Get coverage reports
         id: get-coverage-reports
         uses: actions/download-artifact@v3
diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml
index 95cbc29b6e9..3153fa677f1 100644
--- a/.github/workflows/scheduled.yml
+++ b/.github/workflows/scheduled.yml
@@ -272,6 +272,23 @@ jobs:
         with:
           name: testrun-changed-files.txt
           path: testrun-changed-files.txt
+
+      - name: Install Codecov CLI
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Save Commit Metadata In Codecov
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            create-commit --git-service github --sha ${{ github.sha }}
+
+      - name: Create Codecov Coverage Report
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            create-report --git-service github --sha ${{ github.sha }}
   pre-commit:
     name: Pre-Commit
     if: ${{ fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
@@ -1684,6 +1701,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   windows-2019:
     name: Windows 2019
@@ -1704,6 +1722,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   windows-2022:
     name: Windows 2022
@@ -1724,6 +1743,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   macos-12:
     name: macOS 12
@@ -1744,6 +1764,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   almalinux-8:
     name: Alma Linux 8
@@ -1764,6 +1785,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   almalinux-9:
     name: Alma Linux 9
@@ -1784,6 +1806,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   amazonlinux-2:
     name: Amazon Linux 2
@@ -1804,6 +1827,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   archlinux-lts:
     name: Arch Linux LTS
@@ -1824,6 +1848,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   centos-7:
     name: CentOS 7
@@ -1844,6 +1869,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   centosstream-8:
     name: CentOS Stream 8
@@ -1864,6 +1890,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   centosstream-9:
     name: CentOS Stream 9
@@ -1884,6 +1911,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   debian-10:
     name: Debian 10
@@ -1904,6 +1932,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   debian-11:
     name: Debian 11
@@ -1924,6 +1953,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   debian-11-arm64:
     name: Debian 11 Arm64
@@ -1944,6 +1974,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   fedora-37:
     name: Fedora 37
@@ -1964,6 +1995,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   fedora-38:
     name: Fedora 38
@@ -1984,6 +2016,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   opensuse-15:
     name: Opensuse 15
@@ -2004,6 +2037,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   photonos-3:
     name: Photon OS 3
@@ -2024,6 +2058,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   photonos-4:
     name: Photon OS 4
@@ -2044,6 +2079,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   photonos-4-arm64:
     name: Photon OS 4 Arm64
@@ -2064,6 +2100,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   ubuntu-2004:
     name: Ubuntu 20.04
@@ -2084,6 +2121,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   ubuntu-2004-arm64:
     name: Ubuntu 20.04 Arm64
@@ -2104,6 +2142,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   ubuntu-2204:
     name: Ubuntu 22.04
@@ -2124,6 +2163,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   ubuntu-2204-arm64:
     name: Ubuntu 22.04 Arm64
@@ -2144,6 +2184,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
+    secrets: inherit
 
   combine-all-code-coverage:
     name: Combine Code Coverage
@@ -2220,6 +2261,15 @@ jobs:
         run: |
           python3 -m pip install 'nox==2022.8.7'
 
+      - name: Install Codecov CLI
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Tell Codecov To Process Reports
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            send-notifications --git-service github --sha ${{ github.sha }}
+
       - name: Get coverage reports
         id: get-coverage-reports
         uses: actions/download-artifact@v3
diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml
index e68541a55f0..0d39ffb3d8a 100644
--- a/.github/workflows/staging.yml
+++ b/.github/workflows/staging.yml
@@ -277,6 +277,23 @@ jobs:
         with:
           name: testrun-changed-files.txt
           path: testrun-changed-files.txt
+
+      - name: Install Codecov CLI
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Save Commit Metadata In Codecov
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            create-commit --git-service github --sha ${{ github.sha }}
+
+      - name: Create Codecov Coverage Report
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            create-report --git-service github --sha ${{ github.sha }}
   pre-commit:
     name: Pre-Commit
     if: ${{ fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
@@ -1706,6 +1723,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   windows-2019:
     name: Windows 2019
@@ -1726,6 +1744,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   windows-2022:
     name: Windows 2022
@@ -1746,6 +1765,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   macos-12:
     name: macOS 12
@@ -1766,6 +1786,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   almalinux-8:
     name: Alma Linux 8
@@ -1786,6 +1807,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   almalinux-9:
     name: Alma Linux 9
@@ -1806,6 +1828,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   amazonlinux-2:
     name: Amazon Linux 2
@@ -1826,6 +1849,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   archlinux-lts:
     name: Arch Linux LTS
@@ -1846,6 +1870,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   centos-7:
     name: CentOS 7
@@ -1866,6 +1891,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   centosstream-8:
     name: CentOS Stream 8
@@ -1886,6 +1912,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   centosstream-9:
     name: CentOS Stream 9
@@ -1906,6 +1933,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   debian-10:
     name: Debian 10
@@ -1926,6 +1954,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   debian-11:
     name: Debian 11
@@ -1946,6 +1975,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   debian-11-arm64:
     name: Debian 11 Arm64
@@ -1966,6 +1996,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   fedora-37:
     name: Fedora 37
@@ -1986,6 +2017,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   fedora-38:
     name: Fedora 38
@@ -2006,6 +2038,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   opensuse-15:
     name: Opensuse 15
@@ -2026,6 +2059,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   photonos-3:
     name: Photon OS 3
@@ -2046,6 +2080,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   photonos-4:
     name: Photon OS 4
@@ -2066,6 +2101,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   photonos-4-arm64:
     name: Photon OS 4 Arm64
@@ -2086,6 +2122,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   ubuntu-2004:
     name: Ubuntu 20.04
@@ -2106,6 +2143,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   ubuntu-2004-arm64:
     name: Ubuntu 20.04 Arm64
@@ -2126,6 +2164,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   ubuntu-2204:
     name: Ubuntu 22.04
@@ -2146,6 +2185,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   ubuntu-2204-arm64:
     name: Ubuntu 22.04 Arm64
@@ -2166,6 +2206,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
+    secrets: inherit
 
   build-src-repo:
     name: Build Source Repository
diff --git a/.github/workflows/templates/ci.yml.jinja b/.github/workflows/templates/ci.yml.jinja
index f09b92f64de..c8f9892385a 100644
--- a/.github/workflows/templates/ci.yml.jinja
+++ b/.github/workflows/templates/ci.yml.jinja
@@ -347,6 +347,15 @@
         run: |
           python3 -m pip install 'nox==<{ nox_version }>'
 
+      - name: Install Codecov CLI
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Tell Codecov To Process Reports
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            send-notifications --git-service github --sha ${{ github.sha }}
+
       - name: Get coverage reports
         id: get-coverage-reports
         uses: actions/download-artifact@v3
diff --git a/.github/workflows/templates/layout.yml.jinja b/.github/workflows/templates/layout.yml.jinja
index be681625f53..80c056b8fa7 100644
--- a/.github/workflows/templates/layout.yml.jinja
+++ b/.github/workflows/templates/layout.yml.jinja
@@ -302,6 +302,24 @@ jobs:
         with:
           name: testrun-changed-files.txt
           path: testrun-changed-files.txt
+
+      - name: Install Codecov CLI
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Save Commit Metadata In Codecov
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            create-commit --git-service github --sha ${{ github.sha }}
+
+      - name: Create Codecov Coverage Report
+        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            create-report --git-service github --sha ${{ github.sha }}
+
   <%- endblock prepare_workflow_job %>
   <%- endif %>
 
diff --git a/.github/workflows/templates/test-salt.yml.jinja b/.github/workflows/templates/test-salt.yml.jinja
index 688d9df5263..4ea79858ac2 100644
--- a/.github/workflows/templates/test-salt.yml.jinja
+++ b/.github/workflows/templates/test-salt.yml.jinja
@@ -23,6 +23,7 @@
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|<{ python_version }>
       skip-code-coverage: <{ skip_test_coverage_check }>
       skip-junit-reports: <{ skip_junit_reports_check }>
+    secrets: inherit
 
   <%- endfor %>
 
@@ -48,6 +49,7 @@
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|<{ python_version }>
       skip-code-coverage: <{ skip_test_coverage_check }>
       skip-junit-reports: <{ skip_junit_reports_check }>
+    secrets: inherit
 
   <%- endfor %>
 
@@ -92,5 +94,6 @@
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|<{ python_version }>
       skip-code-coverage: <{ skip_test_coverage_check }>
       skip-junit-reports: <{ skip_junit_reports_check }>
+    secrets: inherit
 
   <%- endfor %>
diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index 35699265067..5720c661f7a 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -314,6 +314,34 @@ jobs:
         run: |
           nox -e combine-coverage
 
+      - name: Create XML Coverage Reports
+        if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
+        run: |
+          nox -e create-xml-coverage-reports
+
+      - name: Install Codecov CLI
+        if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Upload Source Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            do-upload --git-service github --sha ${{ github.sha }} \
+            --file artifacts/coverage/salt.xml \
+            --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
+            --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
+
+      - name: Upload Tests Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            do-upload --git-service github --sha ${{ github.sha }} \
+            --file artifacts/coverage/tests.xml \
+            --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
+            --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
+
       - name: Prepare Test Run Artifacts
         id: download-artifacts-from-vm
         if: always() && job.status != 'cancelled'
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 53724030e46..5cb4a75531c 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -275,6 +275,29 @@ jobs:
         run: |
           tools --timestamps vm destroy --no-wait ${{ inputs.distro-slug }} || true
 
+      - name: Install Codecov CLI
+        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Upload Source Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            do-upload --git-service github --sha ${{ github.sha }} \
+            --file artifacts/coverage/salt.xml \
+            --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
+            --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
+
+      - name: Upload Tests Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            do-upload --git-service github --sha ${{ github.sha }} \
+            --file artifacts/coverage/tests.xml \
+            --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
+            --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
+
       - name: Upload Code Coverage Test Run Artifacts
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         uses: actions/upload-artifact@v3
diff --git a/.github/workflows/test-package-downloads-action-linux.yml b/.github/workflows/test-package-downloads-action-linux.yml
index 5bc62f53165..5c8f246539e 100644
--- a/.github/workflows/test-package-downloads-action-linux.yml
+++ b/.github/workflows/test-package-downloads-action-linux.yml
@@ -197,6 +197,29 @@ jobs:
         run: |
           sudo chown -R "$(id -un)" .
 
+      - name: Install Codecov CLI
+        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Upload Source Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            do-upload --git-service github --sha ${{ github.sha }} \
+            --file artifacts/coverage/salt.xml \
+            --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
+            --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+
+      - name: Upload Tests Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            do-upload --git-service github --sha ${{ github.sha }} \
+            --file artifacts/coverage/tests.xml \
+            --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
+            --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+
       - name: Upload Test Run Artifacts
         if: always() && steps.download-artifacts-from-vm.outcome == 'success'
         uses: actions/upload-artifact@v3
diff --git a/.github/workflows/test-package-downloads-action-macos.yml b/.github/workflows/test-package-downloads-action-macos.yml
index cab0016181c..0e8cd225f7d 100644
--- a/.github/workflows/test-package-downloads-action-macos.yml
+++ b/.github/workflows/test-package-downloads-action-macos.yml
@@ -180,6 +180,29 @@ jobs:
           rm -rf artifacts/salt*
           tree -a artifacts
 
+      - name: Install Codecov CLI
+        if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Upload Source Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            do-upload --git-service github --sha ${{ github.sha }} \
+            --file artifacts/coverage/salt.xml \
+            --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
+            --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+
+      - name: Upload Tests Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            do-upload --git-service github --sha ${{ github.sha }} \
+            --file artifacts/coverage/tests.xml \
+            --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
+            --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+
       - name: Upload Test Run Artifacts
         if: always() && job.status != 'cancelled'
         uses: actions/upload-artifact@v3
diff --git a/.github/workflows/test-package-downloads-action-windows.yml b/.github/workflows/test-package-downloads-action-windows.yml
index fe628957ca4..4447ef505e6 100644
--- a/.github/workflows/test-package-downloads-action-windows.yml
+++ b/.github/workflows/test-package-downloads-action-windows.yml
@@ -196,6 +196,29 @@ jobs:
         run: |
           sudo chown -R "$(id -un)" .
 
+      - name: Install Codecov CLI
+        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          python3 -m pip install codecov-cli
+
+      - name: Upload Source Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            do-upload --git-service github --sha ${{ github.sha }} \
+            --file artifacts/coverage/salt.xml \
+            --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
+            --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+
+      - name: Upload Tests Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+            do-upload --git-service github --sha ${{ github.sha }} \
+            --file artifacts/coverage/tests.xml \
+            --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
+            --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+
       - name: Upload Test Run Artifacts
         if: always() && steps.download-artifacts-from-vm.outcome == 'success'
         uses: actions/upload-artifact@v3

From ccf40465ff6d84ceef53a569c692f99d0a7d45b3 Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Sun, 17 Sep 2023 15:50:25 +0100
Subject: [PATCH 07/29] Tokenless coverage uploads are not supported by the
 codecov-cli tool

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .codecov.yml                                  |  8 ++--
 .github/workflows/ci.yml                      | 46 -------------------
 .github/workflows/nightly.yml                 | 46 -------------------
 .github/workflows/scheduled.yml               | 46 -------------------
 .github/workflows/staging.yml                 | 39 ----------------
 .github/workflows/templates/ci.yml.jinja      |  4 ++
 .github/workflows/templates/layout.yml.jinja  |  4 ++
 .../workflows/templates/test-salt.yml.jinja   |  3 --
 .github/workflows/test-action-macos.yml       | 35 ++++++++++----
 .github/workflows/test-action.yml             | 35 ++++++++++----
 .../test-package-downloads-action-linux.yml   | 35 ++++++++++----
 .../test-package-downloads-action-macos.yml   | 35 ++++++++++----
 .../test-package-downloads-action-windows.yml | 35 ++++++++++----
 13 files changed, 142 insertions(+), 229 deletions(-)

diff --git a/.codecov.yml b/.codecov.yml
index 0f57a7a304f..a7a94a5363f 100644
--- a/.codecov.yml
+++ b/.codecov.yml
@@ -9,7 +9,7 @@ codecov:
   notify:
     wait_for_ci: false        # Should Codecov wait for all CI statuses to complete before sending ours.
                               # Note: Codecov considers all non-codecov statuses to be CI statuses
-    manual_trigger: true      # We manually tell codecov to merge and process all uploaded coverage reports
+#    manual_trigger: true      # We manually tell codecov to merge and process all uploaded coverage reports
 
 
 ignore:
@@ -86,9 +86,9 @@ flags:
       - tests/pytests/integration
     carryforward: true
 
-comment:
-  layout: "header, diff, flags, files"
-  behavior: default              # Comment posting behaviour
+comment: off
+#  layout: "header, diff, flags, files"
+#  behavior: default              # Comment posting behaviour
                                  #   default: update, if exists. Otherwise post new.
                                  #   once: update, if exists. Otherwise post new. Skip if deleted.
                                  #   new: delete old and post new.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f00c133fa11..8ec7ce96d5e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -239,22 +239,7 @@ jobs:
           name: testrun-changed-files.txt
           path: testrun-changed-files.txt
 
-      - name: Install Codecov CLI
-        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
-        run: |
-          python3 -m pip install codecov-cli
 
-      - name: Save Commit Metadata In Codecov
-        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
-        run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            create-commit --git-service github --sha ${{ github.sha }}
-
-      - name: Create Codecov Coverage Report
-        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
-        run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            create-report --git-service github --sha ${{ github.sha }}
   pre-commit:
     name: Pre-Commit
     if: ${{ fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
@@ -1667,7 +1652,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   windows-2019:
     name: Windows 2019
@@ -1688,7 +1672,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   windows-2022:
     name: Windows 2022
@@ -1709,7 +1692,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   macos-12:
     name: macOS 12
@@ -1730,7 +1712,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   almalinux-8:
     name: Alma Linux 8
@@ -1751,7 +1732,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   almalinux-9:
     name: Alma Linux 9
@@ -1772,7 +1752,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   amazonlinux-2:
     name: Amazon Linux 2
@@ -1793,7 +1772,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   archlinux-lts:
     name: Arch Linux LTS
@@ -1814,7 +1792,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   centos-7:
     name: CentOS 7
@@ -1835,7 +1812,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   centosstream-8:
     name: CentOS Stream 8
@@ -1856,7 +1832,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   centosstream-9:
     name: CentOS Stream 9
@@ -1877,7 +1852,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   debian-10:
     name: Debian 10
@@ -1898,7 +1872,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   debian-11:
     name: Debian 11
@@ -1919,7 +1892,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   debian-11-arm64:
     name: Debian 11 Arm64
@@ -1940,7 +1912,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   fedora-37:
     name: Fedora 37
@@ -1961,7 +1932,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   fedora-38:
     name: Fedora 38
@@ -1982,7 +1952,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   opensuse-15:
     name: Opensuse 15
@@ -2003,7 +1972,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   photonos-3:
     name: Photon OS 3
@@ -2024,7 +1992,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   photonos-4:
     name: Photon OS 4
@@ -2045,7 +2012,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   photonos-4-arm64:
     name: Photon OS 4 Arm64
@@ -2066,7 +2032,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   ubuntu-2004:
     name: Ubuntu 20.04
@@ -2087,7 +2052,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   ubuntu-2004-arm64:
     name: Ubuntu 20.04 Arm64
@@ -2108,7 +2072,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   ubuntu-2204:
     name: Ubuntu 22.04
@@ -2129,7 +2092,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   ubuntu-2204-arm64:
     name: Ubuntu 22.04 Arm64
@@ -2150,7 +2112,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
-    secrets: inherit
 
   combine-all-code-coverage:
     name: Combine Code Coverage
@@ -2227,14 +2188,7 @@ jobs:
         run: |
           python3 -m pip install 'nox==2022.8.7'
 
-      - name: Install Codecov CLI
-        run: |
-          python3 -m pip install codecov-cli
 
-      - name: Tell Codecov To Process Reports
-        run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            send-notifications --git-service github --sha ${{ github.sha }}
 
       - name: Get coverage reports
         id: get-coverage-reports
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 7e96d50cdc1..ebd0e46c3ec 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -283,22 +283,7 @@ jobs:
           name: testrun-changed-files.txt
           path: testrun-changed-files.txt
 
-      - name: Install Codecov CLI
-        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
-        run: |
-          python3 -m pip install codecov-cli
 
-      - name: Save Commit Metadata In Codecov
-        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
-        run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            create-commit --git-service github --sha ${{ github.sha }}
-
-      - name: Create Codecov Coverage Report
-        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
-        run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            create-report --git-service github --sha ${{ github.sha }}
   pre-commit:
     name: Pre-Commit
     if: ${{ fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
@@ -1728,7 +1713,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   windows-2019:
     name: Windows 2019
@@ -1749,7 +1733,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   windows-2022:
     name: Windows 2022
@@ -1770,7 +1753,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   macos-12:
     name: macOS 12
@@ -1791,7 +1773,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   almalinux-8:
     name: Alma Linux 8
@@ -1812,7 +1793,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   almalinux-9:
     name: Alma Linux 9
@@ -1833,7 +1813,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   amazonlinux-2:
     name: Amazon Linux 2
@@ -1854,7 +1833,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   archlinux-lts:
     name: Arch Linux LTS
@@ -1875,7 +1853,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   centos-7:
     name: CentOS 7
@@ -1896,7 +1873,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   centosstream-8:
     name: CentOS Stream 8
@@ -1917,7 +1893,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   centosstream-9:
     name: CentOS Stream 9
@@ -1938,7 +1913,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   debian-10:
     name: Debian 10
@@ -1959,7 +1933,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   debian-11:
     name: Debian 11
@@ -1980,7 +1953,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   debian-11-arm64:
     name: Debian 11 Arm64
@@ -2001,7 +1973,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   fedora-37:
     name: Fedora 37
@@ -2022,7 +1993,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   fedora-38:
     name: Fedora 38
@@ -2043,7 +2013,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   opensuse-15:
     name: Opensuse 15
@@ -2064,7 +2033,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   photonos-3:
     name: Photon OS 3
@@ -2085,7 +2053,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   photonos-4:
     name: Photon OS 4
@@ -2106,7 +2073,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   photonos-4-arm64:
     name: Photon OS 4 Arm64
@@ -2127,7 +2093,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   ubuntu-2004:
     name: Ubuntu 20.04
@@ -2148,7 +2113,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   ubuntu-2004-arm64:
     name: Ubuntu 20.04 Arm64
@@ -2169,7 +2133,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   ubuntu-2204:
     name: Ubuntu 22.04
@@ -2190,7 +2153,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   ubuntu-2204-arm64:
     name: Ubuntu 22.04 Arm64
@@ -2211,7 +2173,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   combine-all-code-coverage:
     name: Combine Code Coverage
@@ -2288,14 +2249,7 @@ jobs:
         run: |
           python3 -m pip install 'nox==2022.8.7'
 
-      - name: Install Codecov CLI
-        run: |
-          python3 -m pip install codecov-cli
 
-      - name: Tell Codecov To Process Reports
-        run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            send-notifications --git-service github --sha ${{ github.sha }}
 
       - name: Get coverage reports
         id: get-coverage-reports
diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml
index 3153fa677f1..7d4eb15b89c 100644
--- a/.github/workflows/scheduled.yml
+++ b/.github/workflows/scheduled.yml
@@ -273,22 +273,7 @@ jobs:
           name: testrun-changed-files.txt
           path: testrun-changed-files.txt
 
-      - name: Install Codecov CLI
-        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
-        run: |
-          python3 -m pip install codecov-cli
 
-      - name: Save Commit Metadata In Codecov
-        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
-        run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            create-commit --git-service github --sha ${{ github.sha }}
-
-      - name: Create Codecov Coverage Report
-        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
-        run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            create-report --git-service github --sha ${{ github.sha }}
   pre-commit:
     name: Pre-Commit
     if: ${{ fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
@@ -1701,7 +1686,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   windows-2019:
     name: Windows 2019
@@ -1722,7 +1706,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   windows-2022:
     name: Windows 2022
@@ -1743,7 +1726,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   macos-12:
     name: macOS 12
@@ -1764,7 +1746,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   almalinux-8:
     name: Alma Linux 8
@@ -1785,7 +1766,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   almalinux-9:
     name: Alma Linux 9
@@ -1806,7 +1786,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   amazonlinux-2:
     name: Amazon Linux 2
@@ -1827,7 +1806,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   archlinux-lts:
     name: Arch Linux LTS
@@ -1848,7 +1826,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   centos-7:
     name: CentOS 7
@@ -1869,7 +1846,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   centosstream-8:
     name: CentOS Stream 8
@@ -1890,7 +1866,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   centosstream-9:
     name: CentOS Stream 9
@@ -1911,7 +1886,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   debian-10:
     name: Debian 10
@@ -1932,7 +1906,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   debian-11:
     name: Debian 11
@@ -1953,7 +1926,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   debian-11-arm64:
     name: Debian 11 Arm64
@@ -1974,7 +1946,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   fedora-37:
     name: Fedora 37
@@ -1995,7 +1966,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   fedora-38:
     name: Fedora 38
@@ -2016,7 +1986,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   opensuse-15:
     name: Opensuse 15
@@ -2037,7 +2006,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   photonos-3:
     name: Photon OS 3
@@ -2058,7 +2026,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   photonos-4:
     name: Photon OS 4
@@ -2079,7 +2046,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   photonos-4-arm64:
     name: Photon OS 4 Arm64
@@ -2100,7 +2066,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   ubuntu-2004:
     name: Ubuntu 20.04
@@ -2121,7 +2086,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   ubuntu-2004-arm64:
     name: Ubuntu 20.04 Arm64
@@ -2142,7 +2106,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   ubuntu-2204:
     name: Ubuntu 22.04
@@ -2163,7 +2126,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   ubuntu-2204-arm64:
     name: Ubuntu 22.04 Arm64
@@ -2184,7 +2146,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: false
       skip-junit-reports: false
-    secrets: inherit
 
   combine-all-code-coverage:
     name: Combine Code Coverage
@@ -2261,14 +2222,7 @@ jobs:
         run: |
           python3 -m pip install 'nox==2022.8.7'
 
-      - name: Install Codecov CLI
-        run: |
-          python3 -m pip install codecov-cli
 
-      - name: Tell Codecov To Process Reports
-        run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            send-notifications --git-service github --sha ${{ github.sha }}
 
       - name: Get coverage reports
         id: get-coverage-reports
diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml
index 0d39ffb3d8a..812a0e138ac 100644
--- a/.github/workflows/staging.yml
+++ b/.github/workflows/staging.yml
@@ -278,22 +278,7 @@ jobs:
           name: testrun-changed-files.txt
           path: testrun-changed-files.txt
 
-      - name: Install Codecov CLI
-        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
-        run: |
-          python3 -m pip install codecov-cli
 
-      - name: Save Commit Metadata In Codecov
-        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
-        run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            create-commit --git-service github --sha ${{ github.sha }}
-
-      - name: Create Codecov Coverage Report
-        if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
-        run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            create-report --git-service github --sha ${{ github.sha }}
   pre-commit:
     name: Pre-Commit
     if: ${{ fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
@@ -1723,7 +1708,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   windows-2019:
     name: Windows 2019
@@ -1744,7 +1728,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   windows-2022:
     name: Windows 2022
@@ -1765,7 +1748,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   macos-12:
     name: macOS 12
@@ -1786,7 +1768,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   almalinux-8:
     name: Alma Linux 8
@@ -1807,7 +1788,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   almalinux-9:
     name: Alma Linux 9
@@ -1828,7 +1808,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   amazonlinux-2:
     name: Amazon Linux 2
@@ -1849,7 +1828,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   archlinux-lts:
     name: Arch Linux LTS
@@ -1870,7 +1848,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   centos-7:
     name: CentOS 7
@@ -1891,7 +1868,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   centosstream-8:
     name: CentOS Stream 8
@@ -1912,7 +1888,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   centosstream-9:
     name: CentOS Stream 9
@@ -1933,7 +1908,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   debian-10:
     name: Debian 10
@@ -1954,7 +1928,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   debian-11:
     name: Debian 11
@@ -1975,7 +1948,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   debian-11-arm64:
     name: Debian 11 Arm64
@@ -1996,7 +1968,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   fedora-37:
     name: Fedora 37
@@ -2017,7 +1988,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   fedora-38:
     name: Fedora 38
@@ -2038,7 +2008,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   opensuse-15:
     name: Opensuse 15
@@ -2059,7 +2028,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   photonos-3:
     name: Photon OS 3
@@ -2080,7 +2048,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   photonos-4:
     name: Photon OS 4
@@ -2101,7 +2068,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   photonos-4-arm64:
     name: Photon OS 4 Arm64
@@ -2122,7 +2088,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   ubuntu-2004:
     name: Ubuntu 20.04
@@ -2143,7 +2108,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   ubuntu-2004-arm64:
     name: Ubuntu 20.04 Arm64
@@ -2164,7 +2128,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   ubuntu-2204:
     name: Ubuntu 22.04
@@ -2185,7 +2148,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   ubuntu-2204-arm64:
     name: Ubuntu 22.04 Arm64
@@ -2206,7 +2168,6 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
       skip-code-coverage: true
       skip-junit-reports: true
-    secrets: inherit
 
   build-src-repo:
     name: Build Source Repository
diff --git a/.github/workflows/templates/ci.yml.jinja b/.github/workflows/templates/ci.yml.jinja
index c8f9892385a..1fdb3d1ddf8 100644
--- a/.github/workflows/templates/ci.yml.jinja
+++ b/.github/workflows/templates/ci.yml.jinja
@@ -347,6 +347,8 @@
         run: |
           python3 -m pip install 'nox==<{ nox_version }>'
 
+{#  We can't yet use tokenless uploads with the codecov CLI
+
       - name: Install Codecov CLI
         run: |
           python3 -m pip install codecov-cli
@@ -356,6 +358,8 @@
           codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
             send-notifications --git-service github --sha ${{ github.sha }}
 
+#}
+
       - name: Get coverage reports
         id: get-coverage-reports
         uses: actions/download-artifact@v3
diff --git a/.github/workflows/templates/layout.yml.jinja b/.github/workflows/templates/layout.yml.jinja
index 80c056b8fa7..bf98f9c2277 100644
--- a/.github/workflows/templates/layout.yml.jinja
+++ b/.github/workflows/templates/layout.yml.jinja
@@ -303,6 +303,8 @@ jobs:
           name: testrun-changed-files.txt
           path: testrun-changed-files.txt
 
+{#  We can't yet use tokenless uploads with the codecov CLI
+
       - name: Install Codecov CLI
         if: ${{ fromJSON(steps.define-testrun.outputs.testrun)['skip_code_coverage'] == false }}
         run: |
@@ -320,6 +322,8 @@ jobs:
           codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
             create-report --git-service github --sha ${{ github.sha }}
 
+#}
+
   <%- endblock prepare_workflow_job %>
   <%- endif %>
 
diff --git a/.github/workflows/templates/test-salt.yml.jinja b/.github/workflows/templates/test-salt.yml.jinja
index 4ea79858ac2..688d9df5263 100644
--- a/.github/workflows/templates/test-salt.yml.jinja
+++ b/.github/workflows/templates/test-salt.yml.jinja
@@ -23,7 +23,6 @@
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|<{ python_version }>
       skip-code-coverage: <{ skip_test_coverage_check }>
       skip-junit-reports: <{ skip_junit_reports_check }>
-    secrets: inherit
 
   <%- endfor %>
 
@@ -49,7 +48,6 @@
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|<{ python_version }>
       skip-code-coverage: <{ skip_test_coverage_check }>
       skip-junit-reports: <{ skip_junit_reports_check }>
-    secrets: inherit
 
   <%- endfor %>
 
@@ -94,6 +92,5 @@
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|<{ python_version }>
       skip-code-coverage: <{ skip_test_coverage_check }>
       skip-junit-reports: <{ skip_junit_reports_check }>
-    secrets: inherit
 
   <%- endfor %>
diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index 5720c661f7a..a5993444dcf 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -322,24 +322,41 @@ jobs:
       - name: Install Codecov CLI
         if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
         run: |
-          python3 -m pip install codecov-cli
+          # We can't yet use tokenless uploads with the codecov CLI
+          # python3 -m pip install codecov-cli
+          #
+          curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --no-default-keyring --import
+          curl -Os https://uploader.codecov.io/latest/macos/codecov
+          curl -Os https://uploader.codecov.io/latest/macos/codecov.SHA256SUM
+          curl -Os https://uploader.codecov.io/latest/macos/codecov.SHA256SUM.sig
+          gpg --verify codecov.SHA256SUM.sig codecov.SHA256SUM
+          shasum -a 256 -c codecov.SHA256SUM
+          chmod +x codecov
 
       - name: Upload Source Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
         run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            do-upload --git-service github --sha ${{ github.sha }} \
-            --file artifacts/coverage/salt.xml \
-            --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/salt.xml \
+          #  --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
+          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
+          ./codecov --file artifacts/coverage/salt.xml \
+            --flags salt,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
         run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            do-upload --git-service github --sha ${{ github.sha }} \
-            --file artifacts/coverage/tests.xml \
-            --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/tests.xml \
+          #  --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
+          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
+          ./codecov --file artifacts/coverage/tests.xml \
+            --flags tests,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
       - name: Prepare Test Run Artifacts
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 5cb4a75531c..59b340022a2 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -278,24 +278,41 @@ jobs:
       - name: Install Codecov CLI
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
-          python3 -m pip install codecov-cli
+          # We can't yet use tokenless uploads with the codecov CLI
+          # python3 -m pip install codecov-cli
+          #
+          curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --no-default-keyring --import
+          curl -Os https://uploader.codecov.io/latest/linux/codecov
+          curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM
+          curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM.sig
+          gpg --verify codecov.SHA256SUM.sig codecov.SHA256SUM
+          shasum -a 256 -c codecov.SHA256SUM
+          chmod +x codecov
 
       - name: Upload Source Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            do-upload --git-service github --sha ${{ github.sha }} \
-            --file artifacts/coverage/salt.xml \
-            --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/salt.xml \
+          #  --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
+          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
+          ./codecov --file artifacts/coverage/salt.xml \
+            --flags salt,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            do-upload --git-service github --sha ${{ github.sha }} \
-            --file artifacts/coverage/tests.xml \
-            --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/tests.xml \
+          #  --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
+          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
+          ./codecov --file artifacts/coverage/tests.xml \
+            --flags tests,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
       - name: Upload Code Coverage Test Run Artifacts
diff --git a/.github/workflows/test-package-downloads-action-linux.yml b/.github/workflows/test-package-downloads-action-linux.yml
index 5c8f246539e..651c4eb36bd 100644
--- a/.github/workflows/test-package-downloads-action-linux.yml
+++ b/.github/workflows/test-package-downloads-action-linux.yml
@@ -200,24 +200,41 @@ jobs:
       - name: Install Codecov CLI
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
-          python3 -m pip install codecov-cli
+          # We can't yet use tokenless uploads with the codecov CLI
+          # python3 -m pip install codecov-cli
+          #
+          curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --no-default-keyring --import
+          curl -Os https://uploader.codecov.io/latest/linux/codecov
+          curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM
+          curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM.sig
+          gpg --verify codecov.SHA256SUM.sig codecov.SHA256SUM
+          shasum -a 256 -c codecov.SHA256SUM
+          chmod +x codecov
 
       - name: Upload Source Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            do-upload --git-service github --sha ${{ github.sha }} \
-            --file artifacts/coverage/salt.xml \
-            --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/salt.xml \
+          #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
+          #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          ./codecov --file artifacts/coverage/salt.xml \
+            --flags salt,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            do-upload --git-service github --sha ${{ github.sha }} \
-            --file artifacts/coverage/tests.xml \
-            --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/tests.xml \
+          #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
+          #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          ./codecov --file artifacts/coverage/tests.xml \
+            --flags tests,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
       - name: Upload Test Run Artifacts
diff --git a/.github/workflows/test-package-downloads-action-macos.yml b/.github/workflows/test-package-downloads-action-macos.yml
index 0e8cd225f7d..54683f4a35f 100644
--- a/.github/workflows/test-package-downloads-action-macos.yml
+++ b/.github/workflows/test-package-downloads-action-macos.yml
@@ -183,24 +183,41 @@ jobs:
       - name: Install Codecov CLI
         if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
         run: |
-          python3 -m pip install codecov-cli
+          # We can't yet use tokenless uploads with the codecov CLI
+          # python3 -m pip install codecov-cli
+          #
+          curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --no-default-keyring --import
+          curl -Os https://uploader.codecov.io/latest/macos/codecov
+          curl -Os https://uploader.codecov.io/latest/macos/codecov.SHA256SUM
+          curl -Os https://uploader.codecov.io/latest/macos/codecov.SHA256SUM.sig
+          gpg --verify codecov.SHA256SUM.sig codecov.SHA256SUM
+          shasum -a 256 -c codecov.SHA256SUM
+          chmod +x codecov
 
       - name: Upload Source Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
         run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            do-upload --git-service github --sha ${{ github.sha }} \
-            --file artifacts/coverage/salt.xml \
-            --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/salt.xml \
+          #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
+          #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          ./codecov --file artifacts/coverage/salt.xml \
+            --flags salt,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
         run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            do-upload --git-service github --sha ${{ github.sha }} \
-            --file artifacts/coverage/tests.xml \
-            --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/tests.xml \
+          #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
+          #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          ./codecov --file artifacts/coverage/tests.xml \
+            --flags tests,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
       - name: Upload Test Run Artifacts
diff --git a/.github/workflows/test-package-downloads-action-windows.yml b/.github/workflows/test-package-downloads-action-windows.yml
index 4447ef505e6..41763ec44af 100644
--- a/.github/workflows/test-package-downloads-action-windows.yml
+++ b/.github/workflows/test-package-downloads-action-windows.yml
@@ -199,24 +199,41 @@ jobs:
       - name: Install Codecov CLI
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
-          python3 -m pip install codecov-cli
+          # We can't yet use tokenless uploads with the codecov CLI
+          # python3 -m pip install codecov-cli
+          #
+          curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --no-default-keyring --import
+          curl -Os https://uploader.codecov.io/latest/linux/codecov
+          curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM
+          curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM.sig
+          gpg --verify codecov.SHA256SUM.sig codecov.SHA256SUM
+          shasum -a 256 -c codecov.SHA256SUM
+          chmod +x codecov
 
       - name: Upload Source Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            do-upload --git-service github --sha ${{ github.sha }} \
-            --file artifacts/coverage/salt.xml \
-            --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/salt.xml \
+          #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
+          #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          ./codecov --file artifacts/coverage/salt.xml \
+            --flags salt,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
-          codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-            do-upload --git-service github --sha ${{ github.sha }} \
-            --file artifacts/coverage/tests.xml \
-            --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/tests.xml \
+          #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
+          #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          ./codecov --file artifacts/coverage/tests.xml \
+            --flags tests,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
       - name: Upload Test Run Artifacts

From 688e5ac1b9b03f5eb077d2d970501f1bcee46f3e Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Sun, 17 Sep 2023 21:59:23 +0100
Subject: [PATCH 08/29] Re-enable codecov comments

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .codecov.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.codecov.yml b/.codecov.yml
index a7a94a5363f..1952de97f5b 100644
--- a/.codecov.yml
+++ b/.codecov.yml
@@ -4,10 +4,10 @@ codecov:
 
   max_report_age: 24          # The age you want coverage reports to expire at, or if you
                               # want to disable this check. Expired reports will not be processed by codecov.
-  require_ci_to_pass: yes     # Less spammy. Only notify on passing builds.
+  require_ci_to_pass: false
 
   notify:
-    wait_for_ci: false        # Should Codecov wait for all CI statuses to complete before sending ours.
+    wait_for_ci: true         # Should Codecov wait for all CI statuses to complete before sending ours.
                               # Note: Codecov considers all non-codecov statuses to be CI statuses
 #    manual_trigger: true      # We manually tell codecov to merge and process all uploaded coverage reports
 
@@ -86,9 +86,9 @@ flags:
       - tests/pytests/integration
     carryforward: true
 
-comment: off
-#  layout: "header, diff, flags, files"
-#  behavior: default              # Comment posting behaviour
+comment:
+  layout: "reach, diff, flags, files"
+  behavior: default              # Comment posting behaviour
                                  #   default: update, if exists. Otherwise post new.
                                  #   once: update, if exists. Otherwise post new. Skip if deleted.
                                  #   new: delete old and post new.

From d1e22b8647a2141cb6e40ef948fba9cb6ba6cb44 Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Mon, 18 Sep 2023 16:48:03 +0100
Subject: [PATCH 09/29] Pass the commit SHA explicitly

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/test-action-macos.yml                     | 2 ++
 .github/workflows/test-action.yml                           | 2 ++
 .github/workflows/test-package-downloads-action-linux.yml   | 2 ++
 .github/workflows/test-package-downloads-action-macos.yml   | 2 ++
 .github/workflows/test-package-downloads-action-windows.yml | 2 ++
 5 files changed, 10 insertions(+)

diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index a5993444dcf..69d8c3d6e5f 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -343,6 +343,7 @@ jobs:
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
           ./codecov --file artifacts/coverage/salt.xml \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
             --flags salt,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
@@ -356,6 +357,7 @@ jobs:
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
           ./codecov --file artifacts/coverage/tests.xml \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
             --flags tests,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 59b340022a2..e8d27b967c5 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -299,6 +299,7 @@ jobs:
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
           ./codecov --file artifacts/coverage/salt.xml \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
             --flags salt,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
@@ -312,6 +313,7 @@ jobs:
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
           ./codecov --file artifacts/coverage/tests.xml \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
             --flags tests,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
diff --git a/.github/workflows/test-package-downloads-action-linux.yml b/.github/workflows/test-package-downloads-action-linux.yml
index 651c4eb36bd..91352fd745c 100644
--- a/.github/workflows/test-package-downloads-action-linux.yml
+++ b/.github/workflows/test-package-downloads-action-linux.yml
@@ -221,6 +221,7 @@ jobs:
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           ./codecov --file artifacts/coverage/salt.xml \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
             --flags salt,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
@@ -234,6 +235,7 @@ jobs:
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           ./codecov --file artifacts/coverage/tests.xml \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
             --flags tests,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
diff --git a/.github/workflows/test-package-downloads-action-macos.yml b/.github/workflows/test-package-downloads-action-macos.yml
index 54683f4a35f..7c6ec2ad839 100644
--- a/.github/workflows/test-package-downloads-action-macos.yml
+++ b/.github/workflows/test-package-downloads-action-macos.yml
@@ -204,6 +204,7 @@ jobs:
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           ./codecov --file artifacts/coverage/salt.xml \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
             --flags salt,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
@@ -217,6 +218,7 @@ jobs:
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           ./codecov --file artifacts/coverage/tests.xml \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
             --flags tests,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
diff --git a/.github/workflows/test-package-downloads-action-windows.yml b/.github/workflows/test-package-downloads-action-windows.yml
index 41763ec44af..f4c4349dfe6 100644
--- a/.github/workflows/test-package-downloads-action-windows.yml
+++ b/.github/workflows/test-package-downloads-action-windows.yml
@@ -220,6 +220,7 @@ jobs:
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           ./codecov --file artifacts/coverage/salt.xml \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
             --flags salt,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
@@ -233,6 +234,7 @@ jobs:
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           ./codecov --file artifacts/coverage/tests.xml \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
             --flags tests,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 

From 91594e8f682d6ee10397394453a948eb014d962a Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Mon, 18 Sep 2023 16:59:25 +0100
Subject: [PATCH 10/29] Also pass the parent commit explicitly on PRs

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/test-action-macos.yml                     | 4 ++--
 .github/workflows/test-action.yml                           | 4 ++--
 .github/workflows/test-package-downloads-action-linux.yml   | 4 ++--
 .github/workflows/test-package-downloads-action-macos.yml   | 4 ++--
 .github/workflows/test-package-downloads-action-windows.yml | 4 ++--
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index 69d8c3d6e5f..9c32a50b9fa 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -343,7 +343,7 @@ jobs:
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
           ./codecov --file artifacts/coverage/salt.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
             --flags salt,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
@@ -357,7 +357,7 @@ jobs:
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
           ./codecov --file artifacts/coverage/tests.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
             --flags tests,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index e8d27b967c5..82c00dc6a0d 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -299,7 +299,7 @@ jobs:
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
           ./codecov --file artifacts/coverage/salt.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
             --flags salt,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
@@ -313,7 +313,7 @@ jobs:
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
           ./codecov --file artifacts/coverage/tests.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
             --flags tests,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
diff --git a/.github/workflows/test-package-downloads-action-linux.yml b/.github/workflows/test-package-downloads-action-linux.yml
index 91352fd745c..91254b036ef 100644
--- a/.github/workflows/test-package-downloads-action-linux.yml
+++ b/.github/workflows/test-package-downloads-action-linux.yml
@@ -221,7 +221,7 @@ jobs:
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           ./codecov --file artifacts/coverage/salt.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
             --flags salt,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
@@ -235,7 +235,7 @@ jobs:
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           ./codecov --file artifacts/coverage/tests.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
             --flags tests,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
diff --git a/.github/workflows/test-package-downloads-action-macos.yml b/.github/workflows/test-package-downloads-action-macos.yml
index 7c6ec2ad839..2b9a47688cf 100644
--- a/.github/workflows/test-package-downloads-action-macos.yml
+++ b/.github/workflows/test-package-downloads-action-macos.yml
@@ -204,7 +204,7 @@ jobs:
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           ./codecov --file artifacts/coverage/salt.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
             --flags salt,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
@@ -218,7 +218,7 @@ jobs:
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           ./codecov --file artifacts/coverage/tests.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
             --flags tests,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
diff --git a/.github/workflows/test-package-downloads-action-windows.yml b/.github/workflows/test-package-downloads-action-windows.yml
index f4c4349dfe6..f84c4c3d211 100644
--- a/.github/workflows/test-package-downloads-action-windows.yml
+++ b/.github/workflows/test-package-downloads-action-windows.yml
@@ -220,7 +220,7 @@ jobs:
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           ./codecov --file artifacts/coverage/salt.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
             --flags salt,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 
@@ -234,7 +234,7 @@ jobs:
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           ./codecov --file artifacts/coverage/tests.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
             --flags tests,${{ inputs.distro-slug }},pkg \
             --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
 

From f54ef8c4ddc9d7fe6fb97689145e5bad4f6887af Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Tue, 19 Sep 2023 11:19:08 +0100
Subject: [PATCH 11/29] Include the transport in the codecov flags

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/test-action-macos.yml | 8 ++++----
 .github/workflows/test-action.yml       | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index 9c32a50b9fa..d1830599228 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -339,12 +339,12 @@ jobs:
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
-          #  --file artifacts/coverage/salt.xml \
+          #  --file artifacts/coverage/salt.xml --flag ${{ matrix.transport }} \
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
           ./codecov --file artifacts/coverage/salt.xml \
             --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags salt,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
+            --flags salt,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
       - name: Upload Tests Code Coverage To Codecov
@@ -353,12 +353,12 @@ jobs:
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
-          #  --file artifacts/coverage/tests.xml \
+          #  --file artifacts/coverage/tests.xml --flag ${{ matrix.transport }} \
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
           ./codecov --file artifacts/coverage/tests.xml \
             --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags tests,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
+            --flags tests,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
       - name: Prepare Test Run Artifacts
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 82c00dc6a0d..046a8f5ffc6 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -295,12 +295,12 @@ jobs:
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
-          #  --file artifacts/coverage/salt.xml \
+          #  --file artifacts/coverage/salt.xml --flag ${{ matrix.transport }} \
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
           ./codecov --file artifacts/coverage/salt.xml \
             --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags salt,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
+            --flags salt,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
       - name: Upload Tests Code Coverage To Codecov
@@ -309,12 +309,12 @@ jobs:
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
-          #  --file artifacts/coverage/tests.xml \
+          #  --file artifacts/coverage/tests.xml --flag ${{ matrix.transport }} \
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
           ./codecov --file artifacts/coverage/tests.xml \
             --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags tests,${{ inputs.distro-slug }},${{ matrix.tests-chunk }} \
+            --flags tests,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
             --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
 
       - name: Upload Code Coverage Test Run Artifacts

From 7d767770f6488f47f90706a3841922d0a10a6bd9 Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Thu, 21 Sep 2023 13:11:06 +0100
Subject: [PATCH 12/29] Fail on problems uploading to codecov. Try a few times.

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/test-action-macos.yml       | 40 ++++++++++++++---
 .github/workflows/test-action.yml             | 44 +++++++++++++++----
 .../test-package-downloads-action-linux.yml   | 44 +++++++++++++++----
 .../test-package-downloads-action-macos.yml   | 44 +++++++++++++++----
 .../test-package-downloads-action-windows.yml | 44 +++++++++++++++----
 5 files changed, 178 insertions(+), 38 deletions(-)

diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index d1830599228..d65db1e8c7e 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -342,10 +342,24 @@ jobs:
           #  --file artifacts/coverage/salt.xml --flag ${{ matrix.transport }} \
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
-          ./codecov --file artifacts/coverage/salt.xml \
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+          if ./codecov --file artifacts/coverage/salt.xml \
             --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
             --flags salt,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
-            --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
+            --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }} --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
 
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
@@ -356,10 +370,24 @@ jobs:
           #  --file artifacts/coverage/tests.xml --flag ${{ matrix.transport }} \
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
-          ./codecov --file artifacts/coverage/tests.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags tests,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
-            --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+            if ./codecov --file artifacts/coverage/tests.xml \
+              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
+              --flags tests,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
+              --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }} --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
 
       - name: Prepare Test Run Artifacts
         id: download-artifacts-from-vm
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 046a8f5ffc6..1abe3bb9466 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -298,10 +298,24 @@ jobs:
           #  --file artifacts/coverage/salt.xml --flag ${{ matrix.transport }} \
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
-          ./codecov --file artifacts/coverage/salt.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags salt,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
-            --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+          if ./codecov --file artifacts/coverage/salt.xml \
+              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
+              --flags salt,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
+              --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }} --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
 
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
@@ -312,10 +326,24 @@ jobs:
           #  --file artifacts/coverage/tests.xml --flag ${{ matrix.transport }} \
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
           #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
-          ./codecov --file artifacts/coverage/tests.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags tests,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
-            --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+          if ./codecov --file artifacts/coverage/tests.xml \
+              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
+              --flags tests,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
+              --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }} --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
 
       - name: Upload Code Coverage Test Run Artifacts
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
diff --git a/.github/workflows/test-package-downloads-action-linux.yml b/.github/workflows/test-package-downloads-action-linux.yml
index 91254b036ef..499898ca8d2 100644
--- a/.github/workflows/test-package-downloads-action-linux.yml
+++ b/.github/workflows/test-package-downloads-action-linux.yml
@@ -220,10 +220,24 @@ jobs:
           #  --file artifacts/coverage/salt.xml \
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
-          ./codecov --file artifacts/coverage/salt.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags salt,${{ inputs.distro-slug }},pkg \
-            --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+          if ./codecov --file artifacts/coverage/salt.xml \
+              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
+              --flags salt,${{ inputs.distro-slug }},pkg \
+              --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
 
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
@@ -234,10 +248,24 @@ jobs:
           #  --file artifacts/coverage/tests.xml \
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
-          ./codecov --file artifacts/coverage/tests.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags tests,${{ inputs.distro-slug }},pkg \
-            --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+          if ./codecov --file artifacts/coverage/tests.xml \
+              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
+              --flags tests,${{ inputs.distro-slug }},pkg \
+              --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
 
       - name: Upload Test Run Artifacts
         if: always() && steps.download-artifacts-from-vm.outcome == 'success'
diff --git a/.github/workflows/test-package-downloads-action-macos.yml b/.github/workflows/test-package-downloads-action-macos.yml
index 2b9a47688cf..812f5f8506e 100644
--- a/.github/workflows/test-package-downloads-action-macos.yml
+++ b/.github/workflows/test-package-downloads-action-macos.yml
@@ -203,10 +203,24 @@ jobs:
           #  --file artifacts/coverage/salt.xml \
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
-          ./codecov --file artifacts/coverage/salt.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags salt,${{ inputs.distro-slug }},pkg \
-            --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+          if ./codecov --file artifacts/coverage/salt.xml \
+              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
+              --flags salt,${{ inputs.distro-slug }},pkg \
+              --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
 
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
@@ -217,10 +231,24 @@ jobs:
           #  --file artifacts/coverage/tests.xml \
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
-          ./codecov --file artifacts/coverage/tests.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags tests,${{ inputs.distro-slug }},pkg \
-            --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+          if ./codecov --file artifacts/coverage/tests.xml \
+              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
+              --flags tests,${{ inputs.distro-slug }},pkg \
+              --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
 
       - name: Upload Test Run Artifacts
         if: always() && job.status != 'cancelled'
diff --git a/.github/workflows/test-package-downloads-action-windows.yml b/.github/workflows/test-package-downloads-action-windows.yml
index f84c4c3d211..e90b5fc5c73 100644
--- a/.github/workflows/test-package-downloads-action-windows.yml
+++ b/.github/workflows/test-package-downloads-action-windows.yml
@@ -219,10 +219,24 @@ jobs:
           #  --file artifacts/coverage/salt.xml \
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
-          ./codecov --file artifacts/coverage/salt.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags salt,${{ inputs.distro-slug }},pkg \
-            --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+          if ./codecov --file artifacts/coverage/salt.xml \
+              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
+              --flags salt,${{ inputs.distro-slug }},pkg \
+              --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
 
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
@@ -233,10 +247,24 @@ jobs:
           #  --file artifacts/coverage/tests.xml \
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
           #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
-          ./codecov --file artifacts/coverage/tests.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags tests,${{ inputs.distro-slug }},pkg \
-            --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+          if ./codecov --file artifacts/coverage/tests.xml \
+              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
+              --flags tests,${{ inputs.distro-slug }},pkg \
+              --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
 
       - name: Upload Test Run Artifacts
         if: always() && steps.download-artifacts-from-vm.outcome == 'success'

From 6953b8167cfdde35a0dfa8b4c4d007dbad449aaf Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Tue, 3 Oct 2023 17:44:30 +0100
Subject: [PATCH 13/29] We need to send less reports to codecov.

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/test-action-macos.yml | 150 ++++++++++++------------
 .github/workflows/test-action.yml       | 145 ++++++++++++-----------
 2 files changed, 150 insertions(+), 145 deletions(-)

diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index d65db1e8c7e..cfa911fbdd1 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -314,81 +314,6 @@ jobs:
         run: |
           nox -e combine-coverage
 
-      - name: Create XML Coverage Reports
-        if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
-        run: |
-          nox -e create-xml-coverage-reports
-
-      - name: Install Codecov CLI
-        if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
-        run: |
-          # We can't yet use tokenless uploads with the codecov CLI
-          # python3 -m pip install codecov-cli
-          #
-          curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --no-default-keyring --import
-          curl -Os https://uploader.codecov.io/latest/macos/codecov
-          curl -Os https://uploader.codecov.io/latest/macos/codecov.SHA256SUM
-          curl -Os https://uploader.codecov.io/latest/macos/codecov.SHA256SUM.sig
-          gpg --verify codecov.SHA256SUM.sig codecov.SHA256SUM
-          shasum -a 256 -c codecov.SHA256SUM
-          chmod +x codecov
-
-      - name: Upload Source Code Coverage To Codecov
-        if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
-        run: |
-          # We can't yet use tokenless uploads with the codecov CLI
-          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-          #  do-upload --git-service github --sha ${{ github.sha }} \
-          #  --file artifacts/coverage/salt.xml --flag ${{ matrix.transport }} \
-          #  --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
-          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
-          n=0
-          until [ "$n" -ge 5 ]
-          do
-          if ./codecov --file artifacts/coverage/salt.xml \
-            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-            --flags salt,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
-            --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }} --nonZero; then
-              rc=$?
-              break
-          fi
-          rc=$?
-          n=$((n+1))
-          sleep 15
-          done
-          if [ "$rc" -ne 0 ]; then
-            echo "Failed to upload codecov stats"
-            exit 1
-          fi
-
-      - name: Upload Tests Code Coverage To Codecov
-        if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
-        run: |
-          # We can't yet use tokenless uploads with the codecov CLI
-          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-          #  do-upload --git-service github --sha ${{ github.sha }} \
-          #  --file artifacts/coverage/tests.xml --flag ${{ matrix.transport }} \
-          #  --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
-          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
-          n=0
-          until [ "$n" -ge 5 ]
-          do
-            if ./codecov --file artifacts/coverage/tests.xml \
-              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-              --flags tests,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
-              --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }} --nonZero; then
-              rc=$?
-              break
-          fi
-          rc=$?
-          n=$((n+1))
-          sleep 15
-          done
-          if [ "$rc" -ne 0 ]; then
-            echo "Failed to upload codecov stats"
-            exit 1
-          fi
-
       - name: Prepare Test Run Artifacts
         id: download-artifacts-from-vm
         if: always() && job.status != 'cancelled'
@@ -481,6 +406,81 @@ jobs:
         run: |
           nox --force-color -e combine-coverage
 
+      - name: Create XML Coverage Reports
+        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          nox -e create-xml-coverage-reports
+
+      - name: Install Codecov CLI
+        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          # We can't yet use tokenless uploads with the codecov CLI
+          # python3 -m pip install codecov-cli
+          #
+          curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --no-default-keyring --import
+          curl -Os https://uploader.codecov.io/latest/macos/codecov
+          curl -Os https://uploader.codecov.io/latest/macos/codecov.SHA256SUM
+          curl -Os https://uploader.codecov.io/latest/macos/codecov.SHA256SUM.sig
+          gpg --verify codecov.SHA256SUM.sig codecov.SHA256SUM
+          shasum -a 256 -c codecov.SHA256SUM
+          chmod +x codecov
+
+      - name: Upload Source Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/salt.xml \
+          #  --flag salt --flag ${{ inputs.distro-slug }} \
+          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+          if ./codecov --file artifacts/coverage/salt.xml \
+            --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
+            --flags salt,${{ inputs.distro-slug }} \
+            --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }} --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
+
+      - name: Upload Tests Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/tests.xml \
+          #  --flag tests --flag ${{ inputs.distro-slug }} \
+          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+            if ./codecov --file artifacts/coverage/tests.xml \
+              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
+              --flags tests,${{ inputs.distro-slug }} \
+              --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }} --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
+
       - name: Upload Code Coverage DB
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
         uses: actions/upload-artifact@v3
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 1abe3bb9466..48e25f985d1 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -275,76 +275,6 @@ jobs:
         run: |
           tools --timestamps vm destroy --no-wait ${{ inputs.distro-slug }} || true
 
-      - name: Install Codecov CLI
-        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
-        run: |
-          # We can't yet use tokenless uploads with the codecov CLI
-          # python3 -m pip install codecov-cli
-          #
-          curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --no-default-keyring --import
-          curl -Os https://uploader.codecov.io/latest/linux/codecov
-          curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM
-          curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM.sig
-          gpg --verify codecov.SHA256SUM.sig codecov.SHA256SUM
-          shasum -a 256 -c codecov.SHA256SUM
-          chmod +x codecov
-
-      - name: Upload Source Code Coverage To Codecov
-        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
-        run: |
-          # We can't yet use tokenless uploads with the codecov CLI
-          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-          #  do-upload --git-service github --sha ${{ github.sha }} \
-          #  --file artifacts/coverage/salt.xml --flag ${{ matrix.transport }} \
-          #  --flag salt --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
-          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
-          n=0
-          until [ "$n" -ge 5 ]
-          do
-          if ./codecov --file artifacts/coverage/salt.xml \
-              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-              --flags salt,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
-              --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }} --nonZero; then
-              rc=$?
-              break
-          fi
-          rc=$?
-          n=$((n+1))
-          sleep 15
-          done
-          if [ "$rc" -ne 0 ]; then
-            echo "Failed to upload codecov stats"
-            exit 1
-          fi
-
-      - name: Upload Tests Code Coverage To Codecov
-        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
-        run: |
-          # We can't yet use tokenless uploads with the codecov CLI
-          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
-          #  do-upload --git-service github --sha ${{ github.sha }} \
-          #  --file artifacts/coverage/tests.xml --flag ${{ matrix.transport }} \
-          #  --flag tests --flag ${{ inputs.distro-slug }} --flag ${{ matrix.tests-chunk }} \
-          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }}
-          n=0
-          until [ "$n" -ge 5 ]
-          do
-          if ./codecov --file artifacts/coverage/tests.xml \
-              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
-              --flags tests,${{ inputs.distro-slug }},${{ matrix.transport }},${{ matrix.tests-chunk }} \
-              --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}.${{ matrix.tests-chunk }} --nonZero; then
-              rc=$?
-              break
-          fi
-          rc=$?
-          n=$((n+1))
-          sleep 15
-          done
-          if [ "$rc" -ne 0 ]; then
-            echo "Failed to upload codecov stats"
-            exit 1
-          fi
-
       - name: Upload Code Coverage Test Run Artifacts
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         uses: actions/upload-artifact@v3
@@ -423,6 +353,81 @@ jobs:
         run: |
           nox --force-color -e combine-coverage
 
+      - name: Create XML Coverage Reports
+        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          nox -e create-xml-coverage-reports
+
+      - name: Install Codecov CLI
+        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          # We can't yet use tokenless uploads with the codecov CLI
+          # python3 -m pip install codecov-cli
+          #
+          curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --no-default-keyring --import
+          curl -Os https://uploader.codecov.io/latest/linux/codecov
+          curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM
+          curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM.sig
+          gpg --verify codecov.SHA256SUM.sig codecov.SHA256SUM
+          shasum -a 256 -c codecov.SHA256SUM
+          chmod +x codecov
+
+      - name: Upload Source Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/salt.xml \
+          #  --flag salt --flag ${{ inputs.distro-slug }} \
+          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+          if ./codecov --file artifacts/coverage/salt.xml \
+              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
+              --flags salt,${{ inputs.distro-slug }} \
+              --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }} --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
+
+      - name: Upload Tests Code Coverage To Codecov
+        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
+        run: |
+          # We can't yet use tokenless uploads with the codecov CLI
+          #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
+          #  do-upload --git-service github --sha ${{ github.sha }} \
+          #  --file artifacts/coverage/tests.xml \
+          #  --flag tests --flag ${{ inputs.distro-slug }} \
+          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}
+          n=0
+          until [ "$n" -ge 5 ]
+          do
+          if ./codecov --file artifacts/coverage/tests.xml \
+              --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
+              --flags tests,${{ inputs.distro-slug }} \
+              --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }} --nonZero; then
+              rc=$?
+              break
+          fi
+          rc=$?
+          n=$((n+1))
+          sleep 15
+          done
+          if [ "$rc" -ne 0 ]; then
+            echo "Failed to upload codecov stats"
+            exit 1
+          fi
+
       - name: Upload Code Coverage DB
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
         uses: actions/upload-artifact@v3

From 66b05b04a2077fbfaaed5503f9fa9446a07e4ea2 Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Wed, 4 Oct 2023 20:32:19 +0100
Subject: [PATCH 14/29] Minor splits adjustments

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 tools/ci.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/ci.py b/tools/ci.py
index aaca7e90a3c..066c9a13efa 100644
--- a/tools/ci.py
+++ b/tools/ci.py
@@ -621,10 +621,10 @@ def matrix(ctx: Context, distro_slug: str, full: bool = False):
     """
     _matrix = []
     _splits = {
-        "functional": 4,
-        "integration": 6,
+        "functional": 5,
+        "integration": 7,
         "scenarios": 2,
-        "unit": 3,
+        "unit": 4,
     }
     for transport in ("zeromq", "tcp"):
         if transport == "tcp":

From 4ebc2c367039758c356b57cc47dd01683ff6036d Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Thu, 5 Oct 2023 08:57:18 +0100
Subject: [PATCH 15/29] Expire reports only after 72 hours

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .codecov.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.codecov.yml b/.codecov.yml
index 1952de97f5b..2631d8344f5 100644
--- a/.codecov.yml
+++ b/.codecov.yml
@@ -2,7 +2,7 @@ codecov:
   ci:
     - github.com
 
-  max_report_age: 24          # The age you want coverage reports to expire at, or if you
+  max_report_age: 72          # The age, in hours, you want coverage reports to expire at, or if you
                               # want to disable this check. Expired reports will not be processed by codecov.
   require_ci_to_pass: false
 

From 5242d44474a7c93d85711aaed86b0e8dcb392802 Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Thu, 5 Oct 2023 09:57:50 +0100
Subject: [PATCH 16/29] Reduce code duplication and some code coverage
 reporting improvements

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .../workflows/build-deps-ci-action-macos.yml  |   1 +
 .github/workflows/ci.yml                      |  28 +-
 .github/workflows/nightly.yml                 |  28 +-
 .github/workflows/scheduled.yml               |  28 +-
 .github/workflows/templates/ci.yml.jinja      |  28 +-
 .github/workflows/test-action-macos.yml       |  12 -
 .github/workflows/test-action.yml             |  12 -
 .../test-package-downloads-action-linux.yml   |   4 +-
 .../test-package-downloads-action-macos.yml   |   4 +-
 .../test-package-downloads-action-windows.yml |   4 +-
 noxfile.py                                    | 371 ++++++------------
 tools/vm.py                                   |   6 +-
 12 files changed, 240 insertions(+), 286 deletions(-)

diff --git a/.github/workflows/build-deps-ci-action-macos.yml b/.github/workflows/build-deps-ci-action-macos.yml
index 1d3f0221628..ded5ad9c794 100644
--- a/.github/workflows/build-deps-ci-action-macos.yml
+++ b/.github/workflows/build-deps-ci-action-macos.yml
@@ -48,6 +48,7 @@ env:
   COLUMNS: 190
   PIP_INDEX_URL: "https://pypi-proxy.saltstack.net/root/local/+simple/"
   PIP_EXTRA_INDEX_URL: "https://pypi.org/simple"
+  GITHUB_ACTIONS_PIPELINE: "1"
 
 jobs:
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8ec7ce96d5e..a9aa04b9e87 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2204,6 +2204,14 @@ jobs:
         run: |
           nox --force-color -e combine-coverage
 
+      - name: Report Salt Code Coverage
+        run: |
+          nox --force-color -e coverage-report -- salt
+
+      - name: Create Salt Code Coverage HTML Report
+        run: |
+          nox --force-color -e create-html-coverage-report -- salt
+
       - name: Create Salt Code Coverage HTML Report
         run: |
           nox --force-color -e create-html-coverage-report -- salt
@@ -2216,11 +2224,27 @@ jobs:
           retention-days: 7
           if-no-files-found: error
 
-      - name: Create Full Code Coverage HTML Report
+      - name: Report Combined Code Coverage
+        run: |
+          nox --force-color -e coverage-report
+
+      - name: Create Combined Code Coverage JSON Report
+        run: |
+          nox --force-color -e create-json-coverage-reports
+
+      - name: Upload Combined Code Coverage JSON Report
+        uses: actions/upload-artifact@v3
+        with:
+          name: code-coverage-full-json-report
+          path: artifacts/coverage/coverage.json
+          retention-days: 7
+          if-no-files-found: error
+
+      - name: Create Combined Code Coverage HTML Report
         run: |
           nox --force-color -e create-html-coverage-report
 
-      - name: Upload Full Code Coverage HTML Report
+      - name: Upload Combined Code Coverage HTML Report
         uses: actions/upload-artifact@v3
         with:
           name: code-coverage-full-html-report
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index ebd0e46c3ec..558696de3d9 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -2265,6 +2265,14 @@ jobs:
         run: |
           nox --force-color -e combine-coverage
 
+      - name: Report Salt Code Coverage
+        run: |
+          nox --force-color -e coverage-report -- salt
+
+      - name: Create Salt Code Coverage HTML Report
+        run: |
+          nox --force-color -e create-html-coverage-report -- salt
+
       - name: Create Salt Code Coverage HTML Report
         run: |
           nox --force-color -e create-html-coverage-report -- salt
@@ -2277,11 +2285,27 @@ jobs:
           retention-days: 7
           if-no-files-found: error
 
-      - name: Create Full Code Coverage HTML Report
+      - name: Report Combined Code Coverage
+        run: |
+          nox --force-color -e coverage-report
+
+      - name: Create Combined Code Coverage JSON Report
+        run: |
+          nox --force-color -e create-json-coverage-reports
+
+      - name: Upload Combined Code Coverage JSON Report
+        uses: actions/upload-artifact@v3
+        with:
+          name: code-coverage-full-json-report
+          path: artifacts/coverage/coverage.json
+          retention-days: 7
+          if-no-files-found: error
+
+      - name: Create Combined Code Coverage HTML Report
         run: |
           nox --force-color -e create-html-coverage-report
 
-      - name: Upload Full Code Coverage HTML Report
+      - name: Upload Combined Code Coverage HTML Report
         uses: actions/upload-artifact@v3
         with:
           name: code-coverage-full-html-report
diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml
index 7d4eb15b89c..8282074b4d6 100644
--- a/.github/workflows/scheduled.yml
+++ b/.github/workflows/scheduled.yml
@@ -2238,6 +2238,14 @@ jobs:
         run: |
           nox --force-color -e combine-coverage
 
+      - name: Report Salt Code Coverage
+        run: |
+          nox --force-color -e coverage-report -- salt
+
+      - name: Create Salt Code Coverage HTML Report
+        run: |
+          nox --force-color -e create-html-coverage-report -- salt
+
       - name: Create Salt Code Coverage HTML Report
         run: |
           nox --force-color -e create-html-coverage-report -- salt
@@ -2250,11 +2258,27 @@ jobs:
           retention-days: 7
           if-no-files-found: error
 
-      - name: Create Full Code Coverage HTML Report
+      - name: Report Combined Code Coverage
+        run: |
+          nox --force-color -e coverage-report
+
+      - name: Create Combined Code Coverage JSON Report
+        run: |
+          nox --force-color -e create-json-coverage-reports
+
+      - name: Upload Combined Code Coverage JSON Report
+        uses: actions/upload-artifact@v3
+        with:
+          name: code-coverage-full-json-report
+          path: artifacts/coverage/coverage.json
+          retention-days: 7
+          if-no-files-found: error
+
+      - name: Create Combined Code Coverage HTML Report
         run: |
           nox --force-color -e create-html-coverage-report
 
-      - name: Upload Full Code Coverage HTML Report
+      - name: Upload Combined Code Coverage HTML Report
         uses: actions/upload-artifact@v3
         with:
           name: code-coverage-full-html-report
diff --git a/.github/workflows/templates/ci.yml.jinja b/.github/workflows/templates/ci.yml.jinja
index 1fdb3d1ddf8..e40a65b956a 100644
--- a/.github/workflows/templates/ci.yml.jinja
+++ b/.github/workflows/templates/ci.yml.jinja
@@ -374,6 +374,14 @@
         run: |
           nox --force-color -e combine-coverage
 
+      - name: Report Salt Code Coverage
+        run: |
+          nox --force-color -e coverage-report -- salt
+
+      - name: Create Salt Code Coverage HTML Report
+        run: |
+          nox --force-color -e create-html-coverage-report -- salt
+
       - name: Create Salt Code Coverage HTML Report
         run: |
           nox --force-color -e create-html-coverage-report -- salt
@@ -386,11 +394,27 @@
           retention-days: 7
           if-no-files-found: error
 
-      - name: Create Full Code Coverage HTML Report
+      - name: Report Combined Code Coverage
+        run: |
+          nox --force-color -e coverage-report
+
+      - name: Create Combined Code Coverage JSON Report
+        run: |
+          nox --force-color -e create-json-coverage-reports
+
+      - name: Upload Combined Code Coverage JSON Report
+        uses: actions/upload-artifact@v3
+        with:
+          name: code-coverage-full-json-report
+          path: artifacts/coverage/coverage.json
+          retention-days: 7
+          if-no-files-found: error
+
+      - name: Create Combined Code Coverage HTML Report
         run: |
           nox --force-color -e create-html-coverage-report
 
-      - name: Upload Full Code Coverage HTML Report
+      - name: Upload Combined Code Coverage HTML Report
         uses: actions/upload-artifact@v3
         with:
           name: code-coverage-full-html-report
diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index cfa911fbdd1..c332d4a5647 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -400,12 +400,6 @@ jobs:
         run: |
           python3 -m pip install 'nox==${{ inputs.nox-version }}'
 
-      - name: Combine Code Coverage
-        if: ${{ inputs.skip-code-coverage == false }}
-        continue-on-error: true
-        run: |
-          nox --force-color -e combine-coverage
-
       - name: Create XML Coverage Reports
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
         run: |
@@ -494,12 +488,6 @@ jobs:
         run: |
           nox --force-color -e report-coverage -- salt
 
-      - name: Report Tests Code Coverage
-        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
-        continue-on-error: true
-        run: |
-          nox --force-color -e report-coverage -- tests
-
       - name: Report Combined Code Coverage
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
         continue-on-error: true
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 48e25f985d1..dccbd3134b6 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -347,12 +347,6 @@ jobs:
         run: |
           python3 -m pip install 'nox==${{ inputs.nox-version }}'
 
-      - name: Combine Code Coverage
-        if: ${{ inputs.skip-code-coverage == false }}
-        continue-on-error: true
-        run: |
-          nox --force-color -e combine-coverage
-
       - name: Create XML Coverage Reports
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
         run: |
@@ -441,12 +435,6 @@ jobs:
         run: |
           nox --force-color -e report-coverage -- salt
 
-      - name: Report Tests Code Coverage
-        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
-        continue-on-error: true
-        run: |
-          nox --force-color -e report-coverage -- tests
-
       - name: Report Combined Code Coverage
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
         continue-on-error: true
diff --git a/.github/workflows/test-package-downloads-action-linux.yml b/.github/workflows/test-package-downloads-action-linux.yml
index 499898ca8d2..a9086d6634d 100644
--- a/.github/workflows/test-package-downloads-action-linux.yml
+++ b/.github/workflows/test-package-downloads-action-linux.yml
@@ -173,10 +173,10 @@ jobs:
           -E SALT_REPO_DOMAIN_RELEASE -E SALT_REPO_DOMAIN_STAGING  -E LATEST_SALT_RELEASE -E DOWNLOAD_TEST_PACKAGE_TYPE \
             --nox-session=${{ inputs.nox-session }}-pkgs --rerun-failures ${{ inputs.distro-slug }} -- download-pkgs
 
-      - name: Combine Coverage Reports
+      - name: Create XML Coverage Reports
         if: always() && inputs.skip-code-coverage == false && steps.spin-up-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
-          tools --timestamps vm combine-coverage ${{ inputs.distro-slug }}
+          tools --timestamps vm create-xml-coverage-reports ${{ inputs.distro-slug }}
 
       - name: Download Test Run Artifacts
         id: download-artifacts-from-vm
diff --git a/.github/workflows/test-package-downloads-action-macos.yml b/.github/workflows/test-package-downloads-action-macos.yml
index 812f5f8506e..2934889ce5f 100644
--- a/.github/workflows/test-package-downloads-action-macos.yml
+++ b/.github/workflows/test-package-downloads-action-macos.yml
@@ -166,10 +166,10 @@ jobs:
         run: |
           sudo chown -R "$(id -un)" .
 
-      - name: Combine Coverage Reports
+      - name: Create XML Coverage Reports
         if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
         run: |
-          nox --force-color -e combine-coverage
+          nox --force-color -e create-xml-coverage-reports
 
       - name: Prepare Test Run Artifacts
         id: download-artifacts-from-vm
diff --git a/.github/workflows/test-package-downloads-action-windows.yml b/.github/workflows/test-package-downloads-action-windows.yml
index e90b5fc5c73..4db10708173 100644
--- a/.github/workflows/test-package-downloads-action-windows.yml
+++ b/.github/workflows/test-package-downloads-action-windows.yml
@@ -172,10 +172,10 @@ jobs:
           -E SALT_REPO_DOMAIN_RELEASE -E SALT_REPO_DOMAIN_STAGING -E LATEST_SALT_RELEASE -E DOWNLOAD_TEST_PACKAGE_TYPE \
             --nox-session=${{ inputs.nox-session }}-pkgs --rerun-failures ${{ inputs.distro-slug }} -- download-pkgs
 
-      - name: Combine Coverage Reports
+      - name: Create XML Coverage Reports
         if: always() && inputs.skip-code-coverage == false && steps.spin-up-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
-          tools --timestamps vm combine-coverage ${{ inputs.distro-slug }}
+          tools --timestamps vm create-xml-coverage-reports ${{ inputs.distro-slug }}
 
       - name: Download Test Run Artifacts
         id: download-artifacts-from-vm
diff --git a/noxfile.py b/noxfile.py
index 7ebca469e84..83dc559a9d5 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -6,7 +6,9 @@ Nox configuration script
 """
 # pylint: disable=resource-leakage,3rd-party-module-not-gated
 
+import contextlib
 import datetime
+import glob
 import gzip
 import json
 import os
@@ -351,8 +353,6 @@ def _run_with_coverage(session, *test_cmd, env=None, on_rerun=False):
     if env is None:
         env = {}
 
-    coverage_base_env = {}
-
     sitecustomize_dir = session.run(
         "salt-factories", "--coverage", silent=True, log=True, stderr=None
     )
@@ -384,80 +384,36 @@ def _run_with_coverage(session, *test_cmd, env=None, on_rerun=False):
             python_path_entries.insert(0, str(sitecustomize_dir))
             python_path_env_var = os.pathsep.join(python_path_entries)
 
-        # The full path to the .coverage data file. Makes sure we always write
-        # them to the same directory
-        coverage_base_env["COVERAGE_FILE"] = COVERAGE_FILE
-
         env.update(
             {
                 # The updated python path so that sitecustomize is importable
                 "PYTHONPATH": python_path_env_var,
                 # Instruct sub processes to also run under coverage
                 "COVERAGE_PROCESS_START": str(REPO_ROOT / ".coveragerc"),
-            },
-            **coverage_base_env,
+                # The full path to the .coverage data file. Makes sure we always write
+                # them to the same directory
+                "COVERAGE_FILE": COVERAGE_FILE,
+            }
         )
 
-    try:
-        session.run(*test_cmd, env=env)
-    finally:
-        if os.environ.get("GITHUB_ACTIONS_PIPELINE", "0") == "0":
-            # Always combine and generate the XML coverage report
-            try:
-                session.run(
-                    "coverage",
-                    "combine",
-                    env=coverage_base_env,
-                )
-            except CommandFailed:
-                # Sometimes some of the coverage files are corrupt which would trigger a CommandFailed
-                # exception
-                pass
-            # Generate report for tests code coverage
-            session.run(
-                "coverage",
-                "xml",
-                "-o",
-                str(COVERAGE_OUTPUT_DIR.joinpath("tests.xml").relative_to(REPO_ROOT)),
-                "--omit=salt/*",
-                "--include=tests/*,pkg/tests/*",
-                env=coverage_base_env,
-            )
-            # Generate report for salt code coverage
-            session.run(
-                "coverage",
-                "xml",
-                "-o",
-                str(COVERAGE_OUTPUT_DIR.joinpath("salt.xml").relative_to(REPO_ROOT)),
-                "--omit=tests/*,pkg/tests/*",
-                "--include=salt/*",
-                env=coverage_base_env,
-            )
-            # Generate html report for tests code coverage
-            session.run(
-                "coverage",
-                "html",
-                "-d",
-                str(COVERAGE_OUTPUT_DIR.joinpath("html").relative_to(REPO_ROOT)),
-                "--omit=salt/*",
-                "--include=tests/*,pkg/tests/*",
-                env=coverage_base_env,
-            )
-            # Generate html report for salt code coverage
-            session.run(
-                "coverage",
-                "html",
-                "-d",
-                str(COVERAGE_OUTPUT_DIR.joinpath("html").relative_to(REPO_ROOT)),
-                "--omit=tests/*,pkg/tests/*",
-                "--include=salt/*",
-                env=coverage_base_env,
-            )
+    session.run(*test_cmd, env=env)
 
 
-def _report_coverage(session):
+def _report_coverage(
+    session,
+    combine=True,
+    cli_report=True,
+    html_report=False,
+    xml_report=False,
+    json_report=False,
+):
     _install_coverage_requirement(session)
 
+    if not any([combine, cli_report, html_report, xml_report, json_report]):
+        session.error(
+            "At least one of combine, cli_report, html_report, xml_report, json_report needs to be True"
+        )
+
     env = {
         # The full path to the .coverage data file. Makes sure we always write
         # them to the same directory
@@ -468,45 +424,56 @@ def _report_coverage(session):
     if session.posargs:
         report_section = session.posargs.pop(0)
         if report_section not in ("salt", "tests"):
-            session.error("The report section can only be one of 'salt', 'tests'.")
+            session.error(
+                f"The report section can only be one of 'salt', 'tests', not: {report_section}"
+            )
         if session.posargs:
             session.error(
                 "Only one argument can be passed to the session, which is optional "
                 "and is one of 'salt', 'tests'."
             )
 
-    # Always combine and generate the XML coverage report
-    try:
-        session.run("coverage", "combine", env=env)
-    except CommandFailed:
-        # Sometimes some of the coverage files are corrupt which would trigger a CommandFailed
-        # exception
-        pass
+    if combine is True:
+        coverage_db_files = glob.glob(f"{COVERAGE_FILE}.*")
+        if coverage_db_files:
+            with contextlib.suppress(CommandFailed):
+                # Sometimes some of the coverage files are corrupt which would trigger a CommandFailed
+                # exception
+                session.run("coverage", "combine", env=env)
+        elif os.path.exists(COVERAGE_FILE):
+            session_warn(session, "Coverage files already combined.")
 
-    if not IS_WINDOWS:
-        # The coverage file might have come from a windows machine, fix paths
-        with sqlite3.connect(COVERAGE_FILE) as db:
-            res = db.execute(r"SELECT * FROM file WHERE path LIKE '%salt\%'")
-            if res.fetchone():
-                session_warn(
-                    session,
-                    "Replacing backwards slashes with forward slashes on file "
-                    "paths in the coverage database",
-                )
-                db.execute(r"UPDATE OR IGNORE file SET path=replace(path, '\', '/');")
+        if os.path.exists(COVERAGE_FILE) and not IS_WINDOWS:
+            # Some coverage files might have come from a windows machine, fix paths
+            with sqlite3.connect(COVERAGE_FILE) as db:
+                res = db.execute(r"SELECT * FROM file WHERE path LIKE '%salt\%'")
+                if res.fetchone():
+                    session_warn(
+                        session,
+                        "Replacing backwards slashes with forward slashes on file "
+                        "paths in the coverage database",
+                    )
+                    db.execute(
+                        r"UPDATE OR IGNORE file SET path=replace(path, '\', '/');"
+                    )
+
+    if not os.path.exists(COVERAGE_FILE):
+        session.error("No coverage files found.")
 
     if report_section == "salt":
-        json_coverage_file = (
-            COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "coverage-salt.json"
-        )
+        json_coverage_file = COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "salt.json"
+        xml_coverage_file = COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "salt.xml"
+        html_coverage_dir = COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "html" / "salt"
         cmd_args = [
             "--omit=tests/*,pkg/tests/*",
             "--include=salt/*",
         ]
 
     elif report_section == "tests":
-        json_coverage_file = (
-            COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "coverage-tests.json"
+        json_coverage_file = COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "tests.json"
+        xml_coverage_file = COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "tests.xml"
+        html_coverage_dir = (
+            COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "html" / "tests"
         )
         cmd_args = [
             "--omit=salt/*",
@@ -516,25 +483,58 @@ def _report_coverage(session):
         json_coverage_file = (
             COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "coverage.json"
         )
+        xml_coverage_file = COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "coverage.xml"
+        html_coverage_dir = COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "html" / "full"
         cmd_args = [
             "--include=salt/*,tests/*,pkg/tests/*",
         ]
 
-    session.run(
-        "coverage",
-        "report",
-        *cmd_args,
-        env=env,
-    )
+    if cli_report:
+        session.run(
+            "coverage",
+            "report",
+            "--precision=2",
+            *cmd_args,
+            env=env,
+        )
 
-    session.run(
-        "coverage",
-        "json",
-        "-o",
-        str(json_coverage_file),
-        *cmd_args,
-        env=env,
-    )
+    if html_report:
+        session.run(
+            "coverage",
+            "html",
+            "-d",
+            str(html_coverage_dir),
+            "--show-contexts",
+            "--precision=2",
+            *cmd_args,
+            env=env,
+        )
+
+    if xml_report:
+        try:
+            session.run(
+                "coverage",
+                "xml",
+                "-o",
+                str(xml_coverage_file),
+                *cmd_args,
+                env=env,
+            )
+        except CommandFailed:
+            session_warn(
+                session, "Failed to generate the source XML code coverage report"
+            )
+
+    if json_report:
+        session.run(
+            "coverage",
+            "json",
+            "-o",
+            str(json_coverage_file),
+            "--show-contexts",
+            *cmd_args,
+            env=env,
+        )
 
 
 @nox.session(python=_PYTHON_VERSIONS, name="test-parametrized")
@@ -1208,7 +1208,12 @@ def ci_test_onedir_tcp(session):
 
 @nox.session(python="3", name="report-coverage")
 def report_coverage(session):
-    _report_coverage(session)
+    _report_coverage(session, combine=True, cli_report=True)
+
+
+@nox.session(python="3", name="coverage-report")
+def coverage_report(session):
+    _report_coverage(session, combine=True, cli_report=True)
 
 
 @nox.session(python=False, name="decompress-dependencies")
@@ -1335,20 +1340,7 @@ def pre_archive_cleanup(session, pkg):
 
 @nox.session(python="3", name="combine-coverage")
 def combine_coverage(session):
-    _install_coverage_requirement(session)
-    env = {
-        # The full path to the .coverage data file. Makes sure we always write
-        # them to the same directory
-        "COVERAGE_FILE": str(COVERAGE_FILE),
-    }
-
-    # Always combine and generate the XML coverage report
-    try:
-        session.run("coverage", "combine", env=env)
-    except CommandFailed:
-        # Sometimes some of the coverage files are corrupt which would trigger a CommandFailed
-        # exception
-        pass
+    _report_coverage(session, combine=True, cli_report=False)
 
 
 @nox.session(
@@ -1357,140 +1349,17 @@ def combine_coverage(session):
     venv_params=["--system-site-packages"],
 )
 def combine_coverage_onedir(session):
-    _install_coverage_requirement(session)
-    env = {
-        # The full path to the .coverage data file. Makes sure we always write
-        # them to the same directory
-        "COVERAGE_FILE": str(COVERAGE_FILE),
-    }
-
-    # Always combine and generate the XML coverage report
-    try:
-        session.run("coverage", "combine", env=env)
-    except CommandFailed:
-        # Sometimes some of the coverage files are corrupt which would trigger a CommandFailed
-        # exception
-        pass
+    _report_coverage(session, combine=True, cli_report=False)
 
 
 @nox.session(python="3", name="create-html-coverage-report")
 def create_html_coverage_report(session):
-    _install_coverage_requirement(session)
-    env = {
-        # The full path to the .coverage data file. Makes sure we always write
-        # them to the same directory
-        "COVERAGE_FILE": str(COVERAGE_FILE),
-    }
-
-    report_section = None
-    if session.posargs:
-        report_section = session.posargs.pop(0)
-        if report_section not in ("salt", "tests"):
-            session.error("The report section can only be one of 'salt', 'tests'.")
-        if session.posargs:
-            session.error(
-                "Only one argument can be passed to the session, which is optional "
-                "and is one of 'salt', 'tests'."
-            )
-
-    if not IS_WINDOWS:
-        # The coverage file might have come from a windows machine, fix paths
-        with sqlite3.connect(COVERAGE_FILE) as db:
-            res = db.execute(r"SELECT * FROM file WHERE path LIKE '%salt\%'")
-            if res.fetchone():
-                session_warn(
-                    session,
-                    "Replacing backwards slashes with forward slashes on file "
-                    "paths in the coverage database",
-                )
-                db.execute(r"UPDATE OR IGNORE file SET path=replace(path, '\', '/');")
-
-    if report_section == "salt":
-        report_dir = str(
-            COVERAGE_OUTPUT_DIR.joinpath("html", "salt").relative_to(REPO_ROOT)
-        )
-        json_coverage_file = (
-            COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "coverage-salt.json"
-        )
-        cmd_args = [
-            "--omit=tests/*,pkg/tests/*",
-            "--include=salt/*",
-        ]
-
-    elif report_section == "tests":
-        report_dir = str(
-            COVERAGE_OUTPUT_DIR.joinpath("html", "tests").relative_to(REPO_ROOT)
-        )
-        json_coverage_file = (
-            COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "coverage-tests.json"
-        )
-        cmd_args = [
-            "--omit=salt/*",
-            "--include=tests/*,pkg/tests/*",
-        ]
-    else:
-        report_dir = str(
-            COVERAGE_OUTPUT_DIR.joinpath("html", "full").relative_to(REPO_ROOT)
-        )
-        json_coverage_file = (
-            COVERAGE_OUTPUT_DIR.relative_to(REPO_ROOT) / "coverage.json"
-        )
-        cmd_args = [
-            "--include=salt/*,tests/*,pkg/tests/*",
-        ]
-
-    # Generate html report for Salt and tests combined code coverage
-    session.run(
-        "coverage",
-        "html",
-        "-d",
-        report_dir,
-        "--show-contexts",
-        *cmd_args,
-        env=env,
-    )
-
-
-def _create_xml_coverage_reports(session):
-    _install_coverage_requirement(session)
-    env = {
-        # The full path to the .coverage data file. Makes sure we always write
-        # them to the same directory
-        "COVERAGE_FILE": str(COVERAGE_FILE),
-    }
-
-    # Generate report for tests code coverage
-    try:
-        session.run(
-            "coverage",
-            "xml",
-            "-o",
-            str(COVERAGE_OUTPUT_DIR.joinpath("tests.xml").relative_to(REPO_ROOT)),
-            "--omit=salt/*",
-            "--include=tests/*,pkg/tests/*",
-            env=env,
-        )
-    except CommandFailed:
-        session_warn(session, "Failed to generate the tests XML code coverage report")
-
-    # Generate report for salt code coverage
-    try:
-        session.run(
-            "coverage",
-            "xml",
-            "-o",
-            str(COVERAGE_OUTPUT_DIR.joinpath("salt.xml").relative_to(REPO_ROOT)),
-            "--omit=tests/*,pkg/tests/*",
-            "--include=salt/*",
-            env=env,
-        )
-    except CommandFailed:
-        session_warn(session, "Failed to generate the source XML code coverage report")
+    _report_coverage(session, combine=True, cli_report=False, html_report=True)
 
 
 @nox.session(python="3", name="create-xml-coverage-reports")
 def create_xml_coverage_reports(session):
-    _create_xml_coverage_reports(session)
+    _report_coverage(session, combine=True, cli_report=False, xml_report=True)
 
 
 @nox.session(
@@ -1499,7 +1368,21 @@ def create_xml_coverage_reports(session):
     venv_params=["--system-site-packages"],
 )
 def create_xml_coverage_reports_onedir(session):
-    _create_xml_coverage_reports(session)
+    _report_coverage(session, combine=True, cli_report=False, xml_report=True)
+
+
+@nox.session(python="3", name="create-json-coverage-reports")
+def create_json_coverage_reports(session):
+    _report_coverage(session, combine=True, cli_report=False, json_report=True)
+
+
+@nox.session(
+    python=str(ONEDIR_PYTHON_PATH),
+    name="create-json-coverage-reports-onedir",
+    venv_params=["--system-site-packages"],
+)
+def create_json_coverage_reports_onedir(session):
+    _report_coverage(session, combine=True, cli_report=False, json_report=True)
 
 
 class Tee:
diff --git a/tools/vm.py b/tools/vm.py
index cbb531247d2..d4aefd9837b 100644
--- a/tools/vm.py
+++ b/tools/vm.py
@@ -1448,15 +1448,13 @@ class VM:
         """
         Combine the code coverage databases
         """
-        return self.run_nox("combine-coverage-onedir", session_args=[self.name])
+        return self.run_nox("combine-coverage-onedir")
 
     def create_xml_coverage_reports(self):
         """
         Create XML coverage reports
         """
-        return self.run_nox(
-            "create-xml-coverage-reports-onedir", session_args=[self.name]
-        )
+        return self.run_nox("create-xml-coverage-reports-onedir")
 
     def compress_dependencies(self):
         """

From e1e6e769adbe9ef11b37e13d302735e4b97d5342 Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Thu, 5 Oct 2023 11:17:56 +0100
Subject: [PATCH 17/29] Workflow improvements, namely UI grouping

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/ci.yml                      |  42 +++---
 .github/workflows/nightly.yml                 |  42 +++---
 .github/workflows/release.yml                 |  86 ++++++------
 .github/workflows/scheduled.yml               |  42 +++---
 .github/workflows/staging.yml                 | 128 +++++++++---------
 .github/workflows/templates/release.yml.jinja |   2 +-
 .github/workflows/templates/staging.yml.jinja |   2 +-
 ...=> test-salt-pkg-repo-downloads.yml.jinja} |  69 +++++-----
 .../templates/test-salt-pkg.yml.jinja         |   7 +-
 .../test-package-downloads-action-linux.yml   |   9 +-
 .../test-package-downloads-action-macos.yml   |   9 +-
 .../test-package-downloads-action-windows.yml |   9 +-
 .../workflows/test-packages-action-macos.yml  |   6 +-
 .github/workflows/test-packages-action.yml    |   6 +-
 tools/ci.py                                   |   2 -
 15 files changed, 239 insertions(+), 222 deletions(-)
 rename .github/workflows/templates/{test-pkg-repo-downloads.yml.jinja => test-salt-pkg-repo-downloads.yml.jinja} (85%)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a9aa04b9e87..cabeaf684cb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1172,7 +1172,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
 
   amazonlinux-2-pkg-tests:
-    name: Amazon Linux 2
+    name: Amazon Linux 2 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1194,7 +1194,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   centos-7-pkg-tests:
-    name: CentOS 7
+    name: CentOS 7 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1216,7 +1216,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   centosstream-8-pkg-tests:
-    name: CentOS Stream 8
+    name: CentOS Stream 8 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1238,7 +1238,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   centosstream-9-pkg-tests:
-    name: CentOS Stream 9
+    name: CentOS Stream 9 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1260,7 +1260,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   debian-10-pkg-tests:
-    name: Debian 10
+    name: Debian 10 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1282,7 +1282,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   debian-11-pkg-tests:
-    name: Debian 11
+    name: Debian 11 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1304,7 +1304,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   debian-11-arm64-pkg-tests:
-    name: Debian 11 Arm64
+    name: Debian 11 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1326,7 +1326,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   photonos-3-pkg-tests:
-    name: Photon OS 3
+    name: Photon OS 3 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1348,7 +1348,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   photonos-4-pkg-tests:
-    name: Photon OS 4
+    name: Photon OS 4 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1370,7 +1370,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   photonos-4-arm64-pkg-tests:
-    name: Photon OS 4 Arm64
+    name: Photon OS 4 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1392,7 +1392,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2004-pkg-tests:
-    name: Ubuntu 20.04
+    name: Ubuntu 20.04 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1414,7 +1414,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2004-arm64-pkg-tests:
-    name: Ubuntu 20.04 Arm64
+    name: Ubuntu 20.04 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1436,7 +1436,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2204-pkg-tests:
-    name: Ubuntu 22.04
+    name: Ubuntu 22.04 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1458,7 +1458,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2204-arm64-pkg-tests:
-    name: Ubuntu 22.04 Arm64
+    name: Ubuntu 22.04 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1480,7 +1480,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   macos-12-pkg-tests:
-    name: macOS 12
+    name: macOS 12 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
     needs:
       - prepare-workflow
@@ -1502,7 +1502,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2016-nsis-pkg-tests:
-    name: Windows 2016
+    name: Windows 2016 NSIS Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1524,7 +1524,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2016-msi-pkg-tests:
-    name: Windows 2016
+    name: Windows 2016 MSI Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1546,7 +1546,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2019-nsis-pkg-tests:
-    name: Windows 2019
+    name: Windows 2019 NSIS Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1568,7 +1568,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2019-msi-pkg-tests:
-    name: Windows 2019
+    name: Windows 2019 MSI Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1590,7 +1590,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2022-nsis-pkg-tests:
-    name: Windows 2022
+    name: Windows 2022 NSIS Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1612,7 +1612,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2022-msi-pkg-tests:
-    name: Windows 2022
+    name: Windows 2022 MSI Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 558696de3d9..dc54c93db45 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -1233,7 +1233,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
 
   amazonlinux-2-pkg-tests:
-    name: Amazon Linux 2
+    name: Amazon Linux 2 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1255,7 +1255,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   centos-7-pkg-tests:
-    name: CentOS 7
+    name: CentOS 7 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1277,7 +1277,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   centosstream-8-pkg-tests:
-    name: CentOS Stream 8
+    name: CentOS Stream 8 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1299,7 +1299,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   centosstream-9-pkg-tests:
-    name: CentOS Stream 9
+    name: CentOS Stream 9 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1321,7 +1321,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   debian-10-pkg-tests:
-    name: Debian 10
+    name: Debian 10 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1343,7 +1343,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   debian-11-pkg-tests:
-    name: Debian 11
+    name: Debian 11 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1365,7 +1365,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   debian-11-arm64-pkg-tests:
-    name: Debian 11 Arm64
+    name: Debian 11 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1387,7 +1387,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   photonos-3-pkg-tests:
-    name: Photon OS 3
+    name: Photon OS 3 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1409,7 +1409,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   photonos-4-pkg-tests:
-    name: Photon OS 4
+    name: Photon OS 4 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1431,7 +1431,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   photonos-4-arm64-pkg-tests:
-    name: Photon OS 4 Arm64
+    name: Photon OS 4 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1453,7 +1453,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2004-pkg-tests:
-    name: Ubuntu 20.04
+    name: Ubuntu 20.04 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1475,7 +1475,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2004-arm64-pkg-tests:
-    name: Ubuntu 20.04 Arm64
+    name: Ubuntu 20.04 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1497,7 +1497,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2204-pkg-tests:
-    name: Ubuntu 22.04
+    name: Ubuntu 22.04 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1519,7 +1519,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2204-arm64-pkg-tests:
-    name: Ubuntu 22.04 Arm64
+    name: Ubuntu 22.04 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1541,7 +1541,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   macos-12-pkg-tests:
-    name: macOS 12
+    name: macOS 12 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
     needs:
       - prepare-workflow
@@ -1563,7 +1563,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2016-nsis-pkg-tests:
-    name: Windows 2016
+    name: Windows 2016 NSIS Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1585,7 +1585,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2016-msi-pkg-tests:
-    name: Windows 2016
+    name: Windows 2016 MSI Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1607,7 +1607,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2019-nsis-pkg-tests:
-    name: Windows 2019
+    name: Windows 2019 NSIS Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1629,7 +1629,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2019-msi-pkg-tests:
-    name: Windows 2019
+    name: Windows 2019 MSI Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1651,7 +1651,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2022-nsis-pkg-tests:
-    name: Windows 2022
+    name: Windows 2022 NSIS Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1673,7 +1673,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2022-msi-pkg-tests:
-    name: Windows 2022
+    name: Windows 2022 MSI Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5e87d4ef2c6..ff9535b58d2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -224,7 +224,7 @@ jobs:
           tools pkg repo publish release ${{ needs.prepare-workflow.outputs.salt-version }}
 
   almalinux-8-package-download-tests:
-    name: Test Alma Linux 8 package Downloads
+    name: Alma Linux 8 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -247,7 +247,7 @@ jobs:
     secrets: inherit
 
   almalinux-8-arm64-package-download-tests:
-    name: Test Alma Linux 8 Arm64 package Downloads
+    name: Alma Linux 8 Arm64 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -270,7 +270,7 @@ jobs:
     secrets: inherit
 
   almalinux-9-package-download-tests:
-    name: Test Alma Linux 9 package Downloads
+    name: Alma Linux 9 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -293,7 +293,7 @@ jobs:
     secrets: inherit
 
   almalinux-9-arm64-package-download-tests:
-    name: Test Alma Linux 9 Arm64 package Downloads
+    name: Alma Linux 9 Arm64 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -316,7 +316,7 @@ jobs:
     secrets: inherit
 
   amazonlinux-2-package-download-tests:
-    name: Test Amazon Linux 2 package Downloads
+    name: Amazon Linux 2 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -339,7 +339,7 @@ jobs:
     secrets: inherit
 
   amazonlinux-2-arm64-package-download-tests:
-    name: Test Amazon Linux 2 Arm64 package Downloads
+    name: Amazon Linux 2 Arm64 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -362,7 +362,7 @@ jobs:
     secrets: inherit
 
   centos-7-package-download-tests:
-    name: Test CentOS 7 package Downloads
+    name: CentOS 7 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -385,7 +385,7 @@ jobs:
     secrets: inherit
 
   centos-7-arm64-package-download-tests:
-    name: Test CentOS 7 Arm64 package Downloads
+    name: CentOS 7 Arm64 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -408,7 +408,7 @@ jobs:
     secrets: inherit
 
   centosstream-8-package-download-tests:
-    name: Test CentOS Stream 8 package Downloads
+    name: CentOS Stream 8 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -431,7 +431,7 @@ jobs:
     secrets: inherit
 
   centosstream-8-arm64-package-download-tests:
-    name: Test CentOS Stream 8 Arm64 package Downloads
+    name: CentOS Stream 8 Arm64 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -454,7 +454,7 @@ jobs:
     secrets: inherit
 
   centosstream-9-package-download-tests:
-    name: Test CentOS Stream 9 package Downloads
+    name: CentOS Stream 9 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -477,7 +477,7 @@ jobs:
     secrets: inherit
 
   centosstream-9-arm64-package-download-tests:
-    name: Test CentOS Stream 9 Arm64 package Downloads
+    name: CentOS Stream 9 Arm64 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -500,7 +500,7 @@ jobs:
     secrets: inherit
 
   debian-10-package-download-tests:
-    name: Test Debian 10 package Downloads
+    name: Debian 10 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -523,7 +523,7 @@ jobs:
     secrets: inherit
 
   debian-11-package-download-tests:
-    name: Test Debian 11 package Downloads
+    name: Debian 11 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -546,7 +546,7 @@ jobs:
     secrets: inherit
 
   debian-11-arm64-package-download-tests:
-    name: Test Debian 11 Arm64 package Downloads
+    name: Debian 11 Arm64 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -569,7 +569,7 @@ jobs:
     secrets: inherit
 
   fedora-37-package-download-tests:
-    name: Test Fedora 37 package Downloads
+    name: Fedora 37 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -592,7 +592,7 @@ jobs:
     secrets: inherit
 
   fedora-37-arm64-package-download-tests:
-    name: Test Fedora 37 Arm64 package Downloads
+    name: Fedora 37 Arm64 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -615,7 +615,7 @@ jobs:
     secrets: inherit
 
   fedora-38-package-download-tests:
-    name: Test Fedora 38 package Downloads
+    name: Fedora 38 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -638,7 +638,7 @@ jobs:
     secrets: inherit
 
   fedora-38-arm64-package-download-tests:
-    name: Test Fedora 38 Arm64 package Downloads
+    name: Fedora 38 Arm64 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -661,7 +661,7 @@ jobs:
     secrets: inherit
 
   photonos-3-package-download-tests:
-    name: Test Photon OS 3 package Downloads
+    name: Photon OS 3 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -684,7 +684,7 @@ jobs:
     secrets: inherit
 
   photonos-4-package-download-tests:
-    name: Test Photon OS 4 package Downloads
+    name: Photon OS 4 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -707,7 +707,7 @@ jobs:
     secrets: inherit
 
   photonos-4-arm64-package-download-tests:
-    name: Test Photon OS 4 Arm64 package Downloads
+    name: Photon OS 4 Arm64 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -730,7 +730,7 @@ jobs:
     secrets: inherit
 
   ubuntu-2004-package-download-tests:
-    name: Test Ubuntu 20.04 package Downloads
+    name: Ubuntu 20.04 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -753,7 +753,7 @@ jobs:
     secrets: inherit
 
   ubuntu-2004-arm64-package-download-tests:
-    name: Test Ubuntu 20.04 Arm64 package Downloads
+    name: Ubuntu 20.04 Arm64 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -776,7 +776,7 @@ jobs:
     secrets: inherit
 
   ubuntu-2204-package-download-tests:
-    name: Test Ubuntu 22.04 package Downloads
+    name: Ubuntu 22.04 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -799,7 +799,7 @@ jobs:
     secrets: inherit
 
   ubuntu-2204-arm64-package-download-tests:
-    name: Test Ubuntu 22.04 Arm64 package Downloads
+    name: Ubuntu 22.04 Arm64 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -822,7 +822,7 @@ jobs:
     secrets: inherit
 
   ubuntu-2204-onedir-download-tests:
-    name: Test Ubuntu 22.04 onedir Downloads
+    name: Ubuntu 22.04 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -845,7 +845,7 @@ jobs:
     secrets: inherit
 
   ubuntu-2204-arm64-onedir-download-tests:
-    name: Test Ubuntu 22.04 Arm64 onedir Downloads
+    name: Ubuntu 22.04 Arm64 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -867,8 +867,8 @@ jobs:
       pkg-type: onedir
     secrets: inherit
 
-  macos-12-Package-download-tests:
-    name: Test macOS 12 Package Downloads
+  macos-12-package-download-tests:
+    name: macOS 12 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -890,8 +890,8 @@ jobs:
       pkg-type: package
     secrets: inherit
 
-  macos-12-Onedir-download-tests:
-    name: Test macOS 12 Onedir Downloads
+  macos-12-onedir-download-tests:
+    name: macOS 12 Package Download
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     needs:
       - prepare-workflow
@@ -913,9 +913,9 @@ jobs:
       pkg-type: onedir
     secrets: inherit
 
-  windows-2022-NSIS-amd64-download-tests:
+  windows-2022-nsis-amd64-download-tests:
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
-    name: Test Windows 2022 amd64 NSIS Package Downloads
+    name: Windows 2022 Package Download
     needs:
       - prepare-workflow
       - publish-repositories
@@ -936,9 +936,9 @@ jobs:
       latest-release: "${{ needs.prepare-workflow.outputs.latest-release }}"
     secrets: inherit
 
-  windows-2022-MSI-amd64-download-tests:
+  windows-2022-msi-amd64-download-tests:
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
-    name: Test Windows 2022 amd64 MSI Package Downloads
+    name: Windows 2022 Package Download
     needs:
       - prepare-workflow
       - publish-repositories
@@ -959,9 +959,9 @@ jobs:
       latest-release: "${{ needs.prepare-workflow.outputs.latest-release }}"
     secrets: inherit
 
-  windows-2022-Onedir-amd64-download-tests:
+  windows-2022-onedir-amd64-download-tests:
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
-    name: Test Windows 2022 amd64 Onedir Package Downloads
+    name: Windows 2022 Package Download
     needs:
       - prepare-workflow
       - publish-repositories
@@ -1021,11 +1021,11 @@ jobs:
       - ubuntu-2204-arm64-package-download-tests
       - ubuntu-2204-onedir-download-tests
       - ubuntu-2204-arm64-onedir-download-tests
-      - macos-12-Package-download-tests
-      - macos-12-Onedir-download-tests
-      - windows-2022-NSIS-amd64-download-tests
-      - windows-2022-MSI-amd64-download-tests
-      - windows-2022-Onedir-amd64-download-tests
+      - macos-12-package-download-tests
+      - macos-12-onedir-download-tests
+      - windows-2022-nsis-amd64-download-tests
+      - windows-2022-msi-amd64-download-tests
+      - windows-2022-onedir-amd64-download-tests
     environment: release
     steps:
       - name: Clone The Salt Repository
diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml
index 8282074b4d6..f0adb6704ba 100644
--- a/.github/workflows/scheduled.yml
+++ b/.github/workflows/scheduled.yml
@@ -1206,7 +1206,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
 
   amazonlinux-2-pkg-tests:
-    name: Amazon Linux 2
+    name: Amazon Linux 2 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1228,7 +1228,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   centos-7-pkg-tests:
-    name: CentOS 7
+    name: CentOS 7 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1250,7 +1250,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   centosstream-8-pkg-tests:
-    name: CentOS Stream 8
+    name: CentOS Stream 8 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1272,7 +1272,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   centosstream-9-pkg-tests:
-    name: CentOS Stream 9
+    name: CentOS Stream 9 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1294,7 +1294,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   debian-10-pkg-tests:
-    name: Debian 10
+    name: Debian 10 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1316,7 +1316,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   debian-11-pkg-tests:
-    name: Debian 11
+    name: Debian 11 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1338,7 +1338,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   debian-11-arm64-pkg-tests:
-    name: Debian 11 Arm64
+    name: Debian 11 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1360,7 +1360,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   photonos-3-pkg-tests:
-    name: Photon OS 3
+    name: Photon OS 3 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1382,7 +1382,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   photonos-4-pkg-tests:
-    name: Photon OS 4
+    name: Photon OS 4 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1404,7 +1404,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   photonos-4-arm64-pkg-tests:
-    name: Photon OS 4 Arm64
+    name: Photon OS 4 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1426,7 +1426,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2004-pkg-tests:
-    name: Ubuntu 20.04
+    name: Ubuntu 20.04 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1448,7 +1448,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2004-arm64-pkg-tests:
-    name: Ubuntu 20.04 Arm64
+    name: Ubuntu 20.04 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1470,7 +1470,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2204-pkg-tests:
-    name: Ubuntu 22.04
+    name: Ubuntu 22.04 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1492,7 +1492,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2204-arm64-pkg-tests:
-    name: Ubuntu 22.04 Arm64
+    name: Ubuntu 22.04 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1514,7 +1514,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   macos-12-pkg-tests:
-    name: macOS 12
+    name: macOS 12 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
     needs:
       - prepare-workflow
@@ -1536,7 +1536,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2016-nsis-pkg-tests:
-    name: Windows 2016
+    name: Windows 2016 NSIS Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1558,7 +1558,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2016-msi-pkg-tests:
-    name: Windows 2016
+    name: Windows 2016 MSI Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1580,7 +1580,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2019-nsis-pkg-tests:
-    name: Windows 2019
+    name: Windows 2019 NSIS Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1602,7 +1602,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2019-msi-pkg-tests:
-    name: Windows 2019
+    name: Windows 2019 MSI Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1624,7 +1624,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2022-nsis-pkg-tests:
-    name: Windows 2022
+    name: Windows 2022 NSIS Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1646,7 +1646,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2022-msi-pkg-tests:
-    name: Windows 2022
+    name: Windows 2022 MSI Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml
index 812a0e138ac..ef40f32310b 100644
--- a/.github/workflows/staging.yml
+++ b/.github/workflows/staging.yml
@@ -1228,7 +1228,7 @@ jobs:
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
 
   amazonlinux-2-pkg-tests:
-    name: Amazon Linux 2
+    name: Amazon Linux 2 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1250,7 +1250,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   centos-7-pkg-tests:
-    name: CentOS 7
+    name: CentOS 7 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1272,7 +1272,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   centosstream-8-pkg-tests:
-    name: CentOS Stream 8
+    name: CentOS Stream 8 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1294,7 +1294,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   centosstream-9-pkg-tests:
-    name: CentOS Stream 9
+    name: CentOS Stream 9 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1316,7 +1316,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   debian-10-pkg-tests:
-    name: Debian 10
+    name: Debian 10 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1338,7 +1338,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   debian-11-pkg-tests:
-    name: Debian 11
+    name: Debian 11 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1360,7 +1360,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   debian-11-arm64-pkg-tests:
-    name: Debian 11 Arm64
+    name: Debian 11 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1382,7 +1382,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   photonos-3-pkg-tests:
-    name: Photon OS 3
+    name: Photon OS 3 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1404,7 +1404,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   photonos-4-pkg-tests:
-    name: Photon OS 4
+    name: Photon OS 4 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1426,7 +1426,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   photonos-4-arm64-pkg-tests:
-    name: Photon OS 4 Arm64
+    name: Photon OS 4 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1448,7 +1448,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2004-pkg-tests:
-    name: Ubuntu 20.04
+    name: Ubuntu 20.04 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1470,7 +1470,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2004-arm64-pkg-tests:
-    name: Ubuntu 20.04 Arm64
+    name: Ubuntu 20.04 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1492,7 +1492,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2204-pkg-tests:
-    name: Ubuntu 22.04
+    name: Ubuntu 22.04 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1514,7 +1514,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   ubuntu-2204-arm64-pkg-tests:
-    name: Ubuntu 22.04 Arm64
+    name: Ubuntu 22.04 Arm64 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1536,7 +1536,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   macos-12-pkg-tests:
-    name: macOS 12
+    name: macOS 12 Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
     needs:
       - prepare-workflow
@@ -1558,7 +1558,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2016-nsis-pkg-tests:
-    name: Windows 2016
+    name: Windows 2016 NSIS Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1580,7 +1580,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2016-msi-pkg-tests:
-    name: Windows 2016
+    name: Windows 2016 MSI Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1602,7 +1602,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2019-nsis-pkg-tests:
-    name: Windows 2019
+    name: Windows 2019 NSIS Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1624,7 +1624,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2019-msi-pkg-tests:
-    name: Windows 2019
+    name: Windows 2019 MSI Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1646,7 +1646,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2022-nsis-pkg-tests:
-    name: Windows 2022
+    name: Windows 2022 NSIS Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -1668,7 +1668,7 @@ jobs:
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
   windows-2022-msi-pkg-tests:
-    name: Windows 2022
+    name: Windows 2022 MSI Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -2915,7 +2915,7 @@ jobs:
           if-no-files-found: error
 
   almalinux-8-package-download-tests:
-    name: Test Alma Linux 8 package Downloads
+    name: Alma Linux 8 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -2937,7 +2937,7 @@ jobs:
     secrets: inherit
 
   almalinux-8-arm64-package-download-tests:
-    name: Test Alma Linux 8 Arm64 package Downloads
+    name: Alma Linux 8 Arm64 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -2959,7 +2959,7 @@ jobs:
     secrets: inherit
 
   almalinux-9-package-download-tests:
-    name: Test Alma Linux 9 package Downloads
+    name: Alma Linux 9 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -2981,7 +2981,7 @@ jobs:
     secrets: inherit
 
   almalinux-9-arm64-package-download-tests:
-    name: Test Alma Linux 9 Arm64 package Downloads
+    name: Alma Linux 9 Arm64 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3003,7 +3003,7 @@ jobs:
     secrets: inherit
 
   amazonlinux-2-package-download-tests:
-    name: Test Amazon Linux 2 package Downloads
+    name: Amazon Linux 2 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3025,7 +3025,7 @@ jobs:
     secrets: inherit
 
   amazonlinux-2-arm64-package-download-tests:
-    name: Test Amazon Linux 2 Arm64 package Downloads
+    name: Amazon Linux 2 Arm64 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3047,7 +3047,7 @@ jobs:
     secrets: inherit
 
   centos-7-package-download-tests:
-    name: Test CentOS 7 package Downloads
+    name: CentOS 7 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3069,7 +3069,7 @@ jobs:
     secrets: inherit
 
   centos-7-arm64-package-download-tests:
-    name: Test CentOS 7 Arm64 package Downloads
+    name: CentOS 7 Arm64 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3091,7 +3091,7 @@ jobs:
     secrets: inherit
 
   centosstream-8-package-download-tests:
-    name: Test CentOS Stream 8 package Downloads
+    name: CentOS Stream 8 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3113,7 +3113,7 @@ jobs:
     secrets: inherit
 
   centosstream-8-arm64-package-download-tests:
-    name: Test CentOS Stream 8 Arm64 package Downloads
+    name: CentOS Stream 8 Arm64 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3135,7 +3135,7 @@ jobs:
     secrets: inherit
 
   centosstream-9-package-download-tests:
-    name: Test CentOS Stream 9 package Downloads
+    name: CentOS Stream 9 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3157,7 +3157,7 @@ jobs:
     secrets: inherit
 
   centosstream-9-arm64-package-download-tests:
-    name: Test CentOS Stream 9 Arm64 package Downloads
+    name: CentOS Stream 9 Arm64 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3179,7 +3179,7 @@ jobs:
     secrets: inherit
 
   debian-10-package-download-tests:
-    name: Test Debian 10 package Downloads
+    name: Debian 10 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3201,7 +3201,7 @@ jobs:
     secrets: inherit
 
   debian-11-package-download-tests:
-    name: Test Debian 11 package Downloads
+    name: Debian 11 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3223,7 +3223,7 @@ jobs:
     secrets: inherit
 
   debian-11-arm64-package-download-tests:
-    name: Test Debian 11 Arm64 package Downloads
+    name: Debian 11 Arm64 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3245,7 +3245,7 @@ jobs:
     secrets: inherit
 
   fedora-37-package-download-tests:
-    name: Test Fedora 37 package Downloads
+    name: Fedora 37 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3267,7 +3267,7 @@ jobs:
     secrets: inherit
 
   fedora-37-arm64-package-download-tests:
-    name: Test Fedora 37 Arm64 package Downloads
+    name: Fedora 37 Arm64 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3289,7 +3289,7 @@ jobs:
     secrets: inherit
 
   fedora-38-package-download-tests:
-    name: Test Fedora 38 package Downloads
+    name: Fedora 38 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3311,7 +3311,7 @@ jobs:
     secrets: inherit
 
   fedora-38-arm64-package-download-tests:
-    name: Test Fedora 38 Arm64 package Downloads
+    name: Fedora 38 Arm64 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3333,7 +3333,7 @@ jobs:
     secrets: inherit
 
   photonos-3-package-download-tests:
-    name: Test Photon OS 3 package Downloads
+    name: Photon OS 3 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3355,7 +3355,7 @@ jobs:
     secrets: inherit
 
   photonos-4-package-download-tests:
-    name: Test Photon OS 4 package Downloads
+    name: Photon OS 4 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3377,7 +3377,7 @@ jobs:
     secrets: inherit
 
   photonos-4-arm64-package-download-tests:
-    name: Test Photon OS 4 Arm64 package Downloads
+    name: Photon OS 4 Arm64 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3399,7 +3399,7 @@ jobs:
     secrets: inherit
 
   ubuntu-2004-package-download-tests:
-    name: Test Ubuntu 20.04 package Downloads
+    name: Ubuntu 20.04 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3421,7 +3421,7 @@ jobs:
     secrets: inherit
 
   ubuntu-2004-arm64-package-download-tests:
-    name: Test Ubuntu 20.04 Arm64 package Downloads
+    name: Ubuntu 20.04 Arm64 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3443,7 +3443,7 @@ jobs:
     secrets: inherit
 
   ubuntu-2204-package-download-tests:
-    name: Test Ubuntu 22.04 package Downloads
+    name: Ubuntu 22.04 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3465,7 +3465,7 @@ jobs:
     secrets: inherit
 
   ubuntu-2204-arm64-package-download-tests:
-    name: Test Ubuntu 22.04 Arm64 package Downloads
+    name: Ubuntu 22.04 Arm64 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3487,7 +3487,7 @@ jobs:
     secrets: inherit
 
   ubuntu-2204-onedir-download-tests:
-    name: Test Ubuntu 22.04 onedir Downloads
+    name: Ubuntu 22.04 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3509,7 +3509,7 @@ jobs:
     secrets: inherit
 
   ubuntu-2204-arm64-onedir-download-tests:
-    name: Test Ubuntu 22.04 Arm64 onedir Downloads
+    name: Ubuntu 22.04 Arm64 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3530,8 +3530,8 @@ jobs:
       pkg-type: onedir
     secrets: inherit
 
-  macos-12-Package-download-tests:
-    name: Test macOS 12 Package Downloads
+  macos-12-package-download-tests:
+    name: macOS 12 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3552,8 +3552,8 @@ jobs:
       pkg-type: package
     secrets: inherit
 
-  macos-12-Onedir-download-tests:
-    name: Test macOS 12 Onedir Downloads
+  macos-12-onedir-download-tests:
+    name: macOS 12 Package Download
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -3574,9 +3574,9 @@ jobs:
       pkg-type: onedir
     secrets: inherit
 
-  windows-2022-NSIS-amd64-download-tests:
+  windows-2022-nsis-amd64-download-tests:
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
-    name: Test Windows 2022 amd64 NSIS Package Downloads
+    name: Windows 2022 Package Download
     needs:
       - prepare-workflow
       - publish-repositories
@@ -3596,9 +3596,9 @@ jobs:
       latest-release: "${{ needs.prepare-workflow.outputs.latest-release }}"
     secrets: inherit
 
-  windows-2022-MSI-amd64-download-tests:
+  windows-2022-msi-amd64-download-tests:
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
-    name: Test Windows 2022 amd64 MSI Package Downloads
+    name: Windows 2022 Package Download
     needs:
       - prepare-workflow
       - publish-repositories
@@ -3618,9 +3618,9 @@ jobs:
       latest-release: "${{ needs.prepare-workflow.outputs.latest-release }}"
     secrets: inherit
 
-  windows-2022-Onedir-amd64-download-tests:
+  windows-2022-onedir-amd64-download-tests:
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
-    name: Test Windows 2022 amd64 Onedir Package Downloads
+    name: Windows 2022 Package Download
     needs:
       - prepare-workflow
       - publish-repositories
@@ -3751,11 +3751,11 @@ jobs:
       - ubuntu-2204-arm64-package-download-tests
       - ubuntu-2204-onedir-download-tests
       - ubuntu-2204-arm64-onedir-download-tests
-      - macos-12-Package-download-tests
-      - macos-12-Onedir-download-tests
-      - windows-2022-NSIS-amd64-download-tests
-      - windows-2022-MSI-amd64-download-tests
-      - windows-2022-Onedir-amd64-download-tests
+      - macos-12-package-download-tests
+      - macos-12-onedir-download-tests
+      - windows-2022-nsis-amd64-download-tests
+      - windows-2022-msi-amd64-download-tests
+      - windows-2022-onedir-amd64-download-tests
     environment: staging
     runs-on:
       - self-hosted
diff --git a/.github/workflows/templates/release.yml.jinja b/.github/workflows/templates/release.yml.jinja
index 14f7698cb1c..4e109f90463 100644
--- a/.github/workflows/templates/release.yml.jinja
+++ b/.github/workflows/templates/release.yml.jinja
@@ -259,7 +259,7 @@ permissions:
           tools pkg repo publish <{ gh_environment }> ${{ needs.prepare-workflow.outputs.salt-version }}
 
   <%- if includes.get("test-pkg-downloads", True) %>
-  <%- include "test-pkg-repo-downloads.yml.jinja" %>
+  <%- include "test-salt-pkg-repo-downloads.yml.jinja" %>
   <%- endif %>
 
   release:
diff --git a/.github/workflows/templates/staging.yml.jinja b/.github/workflows/templates/staging.yml.jinja
index e11a763b0a0..8e3a0c98d9f 100644
--- a/.github/workflows/templates/staging.yml.jinja
+++ b/.github/workflows/templates/staging.yml.jinja
@@ -158,7 +158,7 @@ concurrency:
           if-no-files-found: error
 
   <%- if includes.get("test-pkg-downloads", True) %>
-  <%- include "test-pkg-repo-downloads.yml.jinja" %>
+  <%- include "test-salt-pkg-repo-downloads.yml.jinja" %>
   <%- endif %>
 
   publish-pypi:
diff --git a/.github/workflows/templates/test-pkg-repo-downloads.yml.jinja b/.github/workflows/templates/test-salt-pkg-repo-downloads.yml.jinja
similarity index 85%
rename from .github/workflows/templates/test-pkg-repo-downloads.yml.jinja
rename to .github/workflows/templates/test-salt-pkg-repo-downloads.yml.jinja
index 3fbc063d4eb..bb6da5a4a05 100644
--- a/.github/workflows/templates/test-pkg-repo-downloads.yml.jinja
+++ b/.github/workflows/templates/test-salt-pkg-repo-downloads.yml.jinja
@@ -1,42 +1,41 @@
-
   <%- set linux_pkg_tests = (
-                               ("almalinux-8", "Alma Linux 8", "x86_64", "package"),
-                               ("almalinux-8-arm64", "Alma Linux 8 Arm64", "aarch64", "package"),
-                               ("almalinux-9", "Alma Linux 9", "x86_64", "package"),
-                               ("almalinux-9-arm64", "Alma Linux 9 Arm64", "aarch64", "package"),
-                               ("amazonlinux-2", "Amazon Linux 2", "x86_64", "package"),
-                               ("amazonlinux-2-arm64", "Amazon Linux 2 Arm64", "aarch64", "package"),
-                               ("centos-7", "CentOS 7", "x86_64", "package"),
-                               ("centos-7-arm64", "CentOS 7 Arm64", "aarch64", "package"),
-                               ("centosstream-8", "CentOS Stream 8", "x86_64", "package"),
-                               ("centosstream-8-arm64", "CentOS Stream 8 Arm64", "aarch64", "package"),
-                               ("centosstream-9", "CentOS Stream 9", "x86_64", "package"),
-                               ("centosstream-9-arm64", "CentOS Stream 9 Arm64", "aarch64", "package"),
-                               ("debian-10", "Debian 10", "x86_64", "package"),
-                               ("debian-11", "Debian 11", "x86_64", "package"),
-                               ("debian-11-arm64", "Debian 11 Arm64", "aarch64", "package"),
-                               ("fedora-37", "Fedora 37", "x86_64", "package"),
-                               ("fedora-37-arm64", "Fedora 37 Arm64", "aarch64", "package"),
-                               ("fedora-38", "Fedora 38", "x86_64", "package"),
-                               ("fedora-38-arm64", "Fedora 38 Arm64", "aarch64", "package"),
-                               ("photonos-3", "Photon OS 3", "x86_64", "package"),
-                               ("photonos-4", "Photon OS 4", "x86_64", "package"),
-                               ("photonos-4-arm64", "Photon OS 4 Arm64", "aarch64", "package"),
-                               ("ubuntu-20.04", "Ubuntu 20.04", "x86_64", "package"),
-                               ("ubuntu-20.04-arm64", "Ubuntu 20.04 Arm64", "aarch64", "package"),
-                               ("ubuntu-22.04", "Ubuntu 22.04", "x86_64", "package"),
-                               ("ubuntu-22.04-arm64", "Ubuntu 22.04 Arm64", "aarch64", "package"),
-                               ("ubuntu-22.04", "Ubuntu 22.04", "x86_64", "onedir"),
-                               ("ubuntu-22.04-arm64", "Ubuntu 22.04 Arm64", "aarch64", "onedir")
+                               ("almalinux-8", "Alma Linux 8", "x86_64", "Package"),
+                               ("almalinux-8-arm64", "Alma Linux 8 Arm64", "aarch64", "Package"),
+                               ("almalinux-9", "Alma Linux 9", "x86_64", "Package"),
+                               ("almalinux-9-arm64", "Alma Linux 9 Arm64", "aarch64", "Package"),
+                               ("amazonlinux-2", "Amazon Linux 2", "x86_64", "Package"),
+                               ("amazonlinux-2-arm64", "Amazon Linux 2 Arm64", "aarch64", "Package"),
+                               ("centos-7", "CentOS 7", "x86_64", "Package"),
+                               ("centos-7-arm64", "CentOS 7 Arm64", "aarch64", "Package"),
+                               ("centosstream-8", "CentOS Stream 8", "x86_64", "Package"),
+                               ("centosstream-8-arm64", "CentOS Stream 8 Arm64", "aarch64", "Package"),
+                               ("centosstream-9", "CentOS Stream 9", "x86_64", "Package"),
+                               ("centosstream-9-arm64", "CentOS Stream 9 Arm64", "aarch64", "Package"),
+                               ("debian-10", "Debian 10", "x86_64", "Package"),
+                               ("debian-11", "Debian 11", "x86_64", "Package"),
+                               ("debian-11-arm64", "Debian 11 Arm64", "aarch64", "Package"),
+                               ("fedora-37", "Fedora 37", "x86_64", "Package"),
+                               ("fedora-37-arm64", "Fedora 37 Arm64", "aarch64", "Package"),
+                               ("fedora-38", "Fedora 38", "x86_64", "Package"),
+                               ("fedora-38-arm64", "Fedora 38 Arm64", "aarch64", "Package"),
+                               ("photonos-3", "Photon OS 3", "x86_64", "Package"),
+                               ("photonos-4", "Photon OS 4", "x86_64", "Package"),
+                               ("photonos-4-arm64", "Photon OS 4 Arm64", "aarch64", "Package"),
+                               ("ubuntu-20.04", "Ubuntu 20.04", "x86_64", "Package"),
+                               ("ubuntu-20.04-arm64", "Ubuntu 20.04 Arm64", "aarch64", "Package"),
+                               ("ubuntu-22.04", "Ubuntu 22.04", "x86_64", "Package"),
+                               ("ubuntu-22.04-arm64", "Ubuntu 22.04 Arm64", "aarch64", "Package"),
+                               ("ubuntu-22.04", "Ubuntu 22.04", "x86_64", "Onedir"),
+                               ("ubuntu-22.04-arm64", "Ubuntu 22.04 Arm64", "aarch64", "Onedir")
                             ) %>
 
 
   <%- for slug, display_name, arch, pkg_type in linux_pkg_tests %>
-    <%- set job_name = "{}-{}-download-tests".format(slug.replace(".", ""), pkg_type) %>
+    <%- set job_name = "{}-{}-download-tests".format(slug.replace(".", ""), pkg_type.lower()) %>
 
   <{ job_name }>:
     <%- do test_repo_needs.append(job_name) %>
-    name: Test <{ display_name }> <{ pkg_type }> Downloads
+    name: <{ display_name }> Package Download
     <%- if gh_environment == "staging" %>
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     <%- else %>
@@ -71,11 +70,11 @@
                                         ("macos-12", "macOS 12", "x86_64", "Package"),
                                         ("macos-12", "macOS 12", "x86_64", "Onedir"),
                                       ) %>
-    <%- set job_name = "{}-{}-download-tests".format(slug.replace(".", ""), pkg_type) %>
+    <%- set job_name = "{}-{}-download-tests".format(slug.replace(".", ""), pkg_type.lower()) %>
 
   <{ job_name }>:
     <%- do test_repo_needs.append(job_name) %>
-    name: Test <{ display_name }> <{ pkg_type }> Downloads
+    name: <{ display_name }> Package Download
     <%- if gh_environment == "staging" %>
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg-download'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     <%- else %>
@@ -109,7 +108,7 @@
                                         ("windows-2022", "Windows 2022", "amd64"),
                                       ) %>
     <%- for pkg_type in ("NSIS", "MSI", "Onedir") %>
-    <%- set job_name = "{}-{}-{}-download-tests".format(slug.replace(".", ""), pkg_type, arch.lower()) %>
+    <%- set job_name = "{}-{}-{}-download-tests".format(slug.replace(".", ""), pkg_type.lower(), arch.lower()) %>
 
   <{ job_name }>:
     <%- do test_repo_needs.append(job_name) %>
@@ -118,7 +117,7 @@
     <%- else %>
     if: ${{ inputs.skip-salt-pkg-download-test-suite == false }}
     <%- endif %>
-    name: Test <{ display_name }> <{ arch }> <{ pkg_type }> Package Downloads
+    name: <{ display_name }> Package Download
     needs:
       - prepare-workflow
       - publish-repositories
diff --git a/.github/workflows/templates/test-salt-pkg.yml.jinja b/.github/workflows/templates/test-salt-pkg.yml.jinja
index ee29c420b4f..d078bea80e2 100644
--- a/.github/workflows/templates/test-salt-pkg.yml.jinja
+++ b/.github/workflows/templates/test-salt-pkg.yml.jinja
@@ -1,4 +1,3 @@
-
   <%- set linux_pkg_tests = (
                                ("almalinux-8", "Alma Linux 8", "x86_64", "rpm"),
                                ("almalinux-9", "Alma Linux 9", "x86_64", "rpm"),
@@ -39,7 +38,7 @@
 
   <{ job_name }>:
     <%- do test_salt_pkg_needs.append(job_name) %>
-    name: <{ display_name }>
+    name: <{ display_name }> Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
@@ -69,7 +68,7 @@
 
   <{ job_name }>:
     <%- do test_salt_pkg_needs.append(job_name) %>
-    name: <{ display_name }>
+    name: <{ display_name }> Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
     needs:
       - prepare-workflow
@@ -101,7 +100,7 @@
 
   <{ job_name }>:
     <%- do test_salt_pkg_needs.append(job_name) %>
-    name: <{ display_name }>
+    name: <{ display_name }> <{ pkg_type }> Package
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
     needs:
       - prepare-workflow
diff --git a/.github/workflows/test-package-downloads-action-linux.yml b/.github/workflows/test-package-downloads-action-linux.yml
index a9086d6634d..a1bf24ece8a 100644
--- a/.github/workflows/test-package-downloads-action-linux.yml
+++ b/.github/workflows/test-package-downloads-action-linux.yml
@@ -70,13 +70,20 @@ env:
 jobs:
 
   test:
-    name: Test Pkg Download
+    name: Test
     runs-on:
       - self-hosted
       - linux
       - bastion
     environment: ${{ inputs.environment }}
     timeout-minutes: 120  # 2 Hours - More than this and something is wrong
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - ${{ inputs.arch }}
+        pkg-type:
+          - ${{ inputs.pkg-type }}
 
     steps:
 
diff --git a/.github/workflows/test-package-downloads-action-macos.yml b/.github/workflows/test-package-downloads-action-macos.yml
index 2934889ce5f..e6f4573a2b2 100644
--- a/.github/workflows/test-package-downloads-action-macos.yml
+++ b/.github/workflows/test-package-downloads-action-macos.yml
@@ -68,10 +68,17 @@ env:
 jobs:
 
   test:
-    name: Test Pkg Download
+    name: Test
     runs-on: ${{ inputs.distro-slug }}
     environment: ${{ inputs.environment }}
     timeout-minutes: 120  # 2 Hours - More than this and something is wrong
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - ${{ inputs.arch }}
+        pkg-type:
+          - ${{ inputs.pkg-type }}
 
     steps:
 
diff --git a/.github/workflows/test-package-downloads-action-windows.yml b/.github/workflows/test-package-downloads-action-windows.yml
index 4db10708173..60d8b1be9aa 100644
--- a/.github/workflows/test-package-downloads-action-windows.yml
+++ b/.github/workflows/test-package-downloads-action-windows.yml
@@ -75,13 +75,20 @@ env:
 jobs:
 
   test:
-    name: Test Pkg Download
+    name: Test
     runs-on:
       - self-hosted
       - linux
       - bastion
     environment: ${{ inputs.environment }}
     timeout-minutes: 120  # 2 Hours - More than this and something is wrong
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - ${{ inputs.arch }}
+        pkg-type:
+          - ${{ inputs.pkg-type }}
 
     steps:
       - name: Checkout Source Code
diff --git a/.github/workflows/test-packages-action-macos.yml b/.github/workflows/test-packages-action-macos.yml
index 7767b104a7f..a84edb76b8c 100644
--- a/.github/workflows/test-packages-action-macos.yml
+++ b/.github/workflows/test-packages-action-macos.yml
@@ -69,7 +69,7 @@ env:
 jobs:
 
   generate-matrix:
-    name: Test Pkg Matrix
+    name: Generate Matrix
     runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
     outputs:
       pkg-matrix-include: ${{ steps.generate-pkg-matrix.outputs.matrix }}
@@ -93,7 +93,7 @@ jobs:
 
 
   test:
-    name: Test Pkg
+    name: Test
     runs-on: ${{ inputs.distro-slug }}
     timeout-minutes: 120  # 2 Hours - More than this and something is wrong
     needs:
@@ -207,7 +207,7 @@ jobs:
             !artifacts/salt-*.tar.*
 
   report:
-    name: Test Pkg Reports
+    name: Report
     runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
     if: always() && (inputs.skip-code-coverage == false || inputs.skip-junit-reports == false) && needs.test.result != 'cancelled' && needs.test.result != 'skipped'
     needs:
diff --git a/.github/workflows/test-packages-action.yml b/.github/workflows/test-packages-action.yml
index f455bf7b0a7..b38efca107f 100644
--- a/.github/workflows/test-packages-action.yml
+++ b/.github/workflows/test-packages-action.yml
@@ -71,7 +71,7 @@ env:
 jobs:
 
   generate-matrix:
-    name: Test ${{ inputs.pkg-type }} Pkg Matrix
+    name: Generate Matrix
     runs-on:
       - self-hosted
       - linux
@@ -98,7 +98,7 @@ jobs:
 
 
   test:
-    name: Test Pkg
+    name: Test
     runs-on:
       - self-hosted
       - linux
@@ -218,7 +218,7 @@ jobs:
             !artifacts/salt-*.tar.*
 
   report:
-    name: Test Pkg Reports
+    name: Report
     runs-on:
       - self-hosted
       - linux
diff --git a/tools/ci.py b/tools/ci.py
index 066c9a13efa..cc6578be789 100644
--- a/tools/ci.py
+++ b/tools/ci.py
@@ -768,8 +768,6 @@ def pkg_matrix(
                     "version": version,
                 }
             )
-            if distro_slug.startswith("windows"):
-                _matrix[-1]["pkg-type"] = pkg_type.upper()
     ctx.info("Generated matrix:")
     ctx.print(_matrix, soft_wrap=True)
 

From 4d9f69279493f34a2490d24622afc64e4117e1aa Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Thu, 5 Oct 2023 15:41:52 +0100
Subject: [PATCH 18/29] Throttle Builds

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/test-action-macos.yml                     | 6 ++++++
 .github/workflows/test-action.yml                           | 6 ++++++
 .github/workflows/test-package-downloads-action-windows.yml | 6 ++++++
 .github/workflows/test-packages-action-macos.yml            | 6 ++++++
 .github/workflows/test-packages-action.yml                  | 6 ++++++
 5 files changed, 30 insertions(+)

diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index c332d4a5647..4af38494ff6 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -101,6 +101,12 @@ jobs:
       SALT_TRANSPORT: ${{ matrix.transport }}
 
     steps:
+
+      - name: "Throttle Builds"
+        shell: bash
+        run: |
+          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
+
       - name: Checkout Source Code
         uses: actions/checkout@v4
 
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index dccbd3134b6..8ef3ffb8686 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -110,6 +110,12 @@ jobs:
       TEST_GROUP: ${{ matrix.test-group || 1 }}
 
     steps:
+
+      - name: "Throttle Builds"
+        shell: bash
+        run: |
+          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
+
       - name: Checkout Source Code
         uses: actions/checkout@v4
 
diff --git a/.github/workflows/test-package-downloads-action-windows.yml b/.github/workflows/test-package-downloads-action-windows.yml
index 60d8b1be9aa..686c93af68f 100644
--- a/.github/workflows/test-package-downloads-action-windows.yml
+++ b/.github/workflows/test-package-downloads-action-windows.yml
@@ -91,6 +91,12 @@ jobs:
           - ${{ inputs.pkg-type }}
 
     steps:
+
+      - name: "Throttle Builds"
+        shell: bash
+        run: |
+          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
+
       - name: Checkout Source Code
         uses: actions/checkout@v4
 
diff --git a/.github/workflows/test-packages-action-macos.yml b/.github/workflows/test-packages-action-macos.yml
index a84edb76b8c..5a6ac846fb8 100644
--- a/.github/workflows/test-packages-action-macos.yml
+++ b/.github/workflows/test-packages-action-macos.yml
@@ -104,6 +104,12 @@ jobs:
         include: ${{ fromJSON(needs.generate-matrix.outputs.pkg-matrix-include) }}
 
     steps:
+
+      - name: "Throttle Builds"
+        shell: bash
+        run: |
+          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
+
       - name: Checkout Source Code
         uses: actions/checkout@v4
 
diff --git a/.github/workflows/test-packages-action.yml b/.github/workflows/test-packages-action.yml
index b38efca107f..1418bc93e30 100644
--- a/.github/workflows/test-packages-action.yml
+++ b/.github/workflows/test-packages-action.yml
@@ -112,6 +112,12 @@ jobs:
         include: ${{ fromJSON(needs.generate-matrix.outputs.pkg-matrix-include) }}
 
     steps:
+
+      - name: "Throttle Builds"
+        shell: bash
+        run: |
+          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
+
       - name: Checkout Source Code
         uses: actions/checkout@v4
 

From a0b24882931e654e64334c7a02784306f9876d72 Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Thu, 5 Oct 2023 15:49:22 +0100
Subject: [PATCH 19/29] Stricter timeouts

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/test-action-macos.yml | 4 +++-
 .github/workflows/test-action.yml       | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index 4af38494ff6..0457e0acebe 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -90,7 +90,9 @@ jobs:
   test:
     name: Test
     runs-on: ${{ inputs.distro-slug }}
-    timeout-minutes: 360  # 6 Hours
+    # Full test runs. Each chunk should never take more than 2 hours.
+    # Partial test runs(no chunk parallelization), 5 Hours
+    timeout-minutes: ${{ fromJSON(inputs.testrun)['type'] == 'full' && 120 || 300 }}
     needs:
       - generate-matrix
     strategy:
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 8ef3ffb8686..562b29e7c4c 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -98,7 +98,9 @@ jobs:
       - self-hosted
       - linux
       - bastion
-    timeout-minutes: 300  # 5 Hours - More than this and something is wrong
+    # Full test runs. Each chunk should never take more than 2 hours.
+    # Partial test runs(no chunk parallelization), 5 Hours
+    timeout-minutes: ${{ fromJSON(inputs.testrun)['type'] == 'full' && 120 || 300 }}
     needs:
       - generate-matrix
     strategy:

From 65ee4641a6e6ae60505694e579e30b11621828ab Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Thu, 5 Oct 2023 16:25:22 +0100
Subject: [PATCH 20/29] Always download the test run artifacts(namely logs)

These help debugging failed builds

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/test-action-macos.yml                |  8 ++++----
 .github/workflows/test-action.yml                      | 10 +++++-----
 .../workflows/test-package-downloads-action-linux.yml  |  5 +++++
 .../workflows/test-package-downloads-action-macos.yml  |  4 ++--
 .../test-package-downloads-action-windows.yml          |  5 +++++
 .github/workflows/test-packages-action-macos.yml       |  4 ++--
 6 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index 0457e0acebe..360e5eaded8 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -318,13 +318,13 @@ jobs:
           sudo chown -R "$(id -un)" .
 
       - name: Combine Coverage Reports
-        if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
+        if: always() && inputs.skip-code-coverage == false
         run: |
           nox -e combine-coverage
 
       - name: Prepare Test Run Artifacts
         id: download-artifacts-from-vm
-        if: always() && job.status != 'cancelled'
+        if: always()
         run: |
           # Delete the salt onedir, we won't need it anymore and it will prevent
           # from it showing in the tree command below
@@ -351,7 +351,7 @@ jobs:
             artifacts/coverage/
 
       - name: Upload JUnit XML Test Run Artifacts
-        if: always() && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
+        if: always() && steps.download-artifacts-from-vm.outcome == 'success'
         uses: actions/upload-artifact@v3
         with:
           name: testrun-junit-artifacts-${{ inputs.distro-slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}
@@ -359,7 +359,7 @@ jobs:
             artifacts/xml-unittests-output/
 
       - name: Upload Test Run Log Artifacts
-        if: always() && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
+        if: always() && steps.download-artifacts-from-vm.outcome == 'success'
         uses: actions/upload-artifact@v3
         with:
           name: testrun-log-artifacts-${{ inputs.distro-slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 562b29e7c4c..c84d717f949 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -261,13 +261,13 @@ jobs:
             --test-group-count=${{ matrix.test-group-count || 1 }} --test-group=${{ matrix.test-group || 1 }}
 
       - name: Combine Coverage Reports
-        if: always() && inputs.skip-code-coverage == false && steps.spin-up-vm.outcome == 'success' && job.status != 'cancelled'
+        if: always() && inputs.skip-code-coverage == false && steps.spin-up-vm.outcome == 'success'
         run: |
           tools --timestamps vm combine-coverage ${{ inputs.distro-slug }}
 
       - name: Download Test Run Artifacts
         id: download-artifacts-from-vm
-        if: always() && steps.spin-up-vm.outcome == 'success' && job.status != 'cancelled'
+        if: always() && steps.spin-up-vm.outcome == 'success'
         run: |
           tools --timestamps vm download-artifacts ${{ inputs.distro-slug }}
           # Delete the salt onedir, we won't need it anymore and it will prevent
@@ -300,7 +300,7 @@ jobs:
             artifacts/coverage/
 
       - name: Upload JUnit XML Test Run Artifacts
-        if: always() && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
+        if: always() && steps.download-artifacts-from-vm.outcome == 'success'
         uses: actions/upload-artifact@v3
         with:
           name: testrun-junit-artifacts-${{ inputs.distro-slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}
@@ -308,7 +308,7 @@ jobs:
             artifacts/xml-unittests-output/
 
       - name: Upload Test Run Log Artifacts
-        if: always() && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
+        if: always() && steps.download-artifacts-from-vm.outcome == 'success'
         uses: actions/upload-artifact@v3
         with:
           name: testrun-log-artifacts-${{ inputs.distro-slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}
@@ -318,7 +318,7 @@ jobs:
       - name: Publish Test Report
         uses: mikepenz/action-junit-report@v3
         # always run even if the previous steps fails
-        if: always() && inputs.skip-junit-reports == false
+        if: always() && inputs.skip-junit-reports == false && job.status != 'cancelled'
         with:
           check_name: Test Results(${{ inputs.distro-slug }}, transport=${{ matrix.transport }}, tests-chunk=${{ matrix.tests-chunk }}, group=${{ matrix.test-group || '1' }})
           report_paths: 'artifacts/xml-unittests-output/*.xml'
diff --git a/.github/workflows/test-package-downloads-action-linux.yml b/.github/workflows/test-package-downloads-action-linux.yml
index a1bf24ece8a..a828a631e8c 100644
--- a/.github/workflows/test-package-downloads-action-linux.yml
+++ b/.github/workflows/test-package-downloads-action-linux.yml
@@ -180,6 +180,11 @@ jobs:
           -E SALT_REPO_DOMAIN_RELEASE -E SALT_REPO_DOMAIN_STAGING  -E LATEST_SALT_RELEASE -E DOWNLOAD_TEST_PACKAGE_TYPE \
             --nox-session=${{ inputs.nox-session }}-pkgs --rerun-failures ${{ inputs.distro-slug }} -- download-pkgs
 
+      - name: Combine Coverage Reports
+        if: always() && inputs.skip-code-coverage == false && steps.spin-up-vm.outcome == 'success'
+        run: |
+          tools --timestamps vm combine-coverage ${{ inputs.distro-slug }}
+
       - name: Create XML Coverage Reports
         if: always() && inputs.skip-code-coverage == false && steps.spin-up-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
diff --git a/.github/workflows/test-package-downloads-action-macos.yml b/.github/workflows/test-package-downloads-action-macos.yml
index e6f4573a2b2..706b0284a01 100644
--- a/.github/workflows/test-package-downloads-action-macos.yml
+++ b/.github/workflows/test-package-downloads-action-macos.yml
@@ -180,7 +180,7 @@ jobs:
 
       - name: Prepare Test Run Artifacts
         id: download-artifacts-from-vm
-        if: always() && job.status != 'cancelled'
+        if: always()
         run: |
           # Delete the salt onedir, we won't need it anymore and it will prevent
           # from it showing in the tree command below
@@ -258,7 +258,7 @@ jobs:
           fi
 
       - name: Upload Test Run Artifacts
-        if: always() && job.status != 'cancelled'
+        if: always()
         uses: actions/upload-artifact@v3
         with:
           name: pkg-testrun-artifacts-${{ inputs.distro-slug }}-${{ inputs.arch }}
diff --git a/.github/workflows/test-package-downloads-action-windows.yml b/.github/workflows/test-package-downloads-action-windows.yml
index 686c93af68f..c3bf59a8add 100644
--- a/.github/workflows/test-package-downloads-action-windows.yml
+++ b/.github/workflows/test-package-downloads-action-windows.yml
@@ -185,6 +185,11 @@ jobs:
           -E SALT_REPO_DOMAIN_RELEASE -E SALT_REPO_DOMAIN_STAGING -E LATEST_SALT_RELEASE -E DOWNLOAD_TEST_PACKAGE_TYPE \
             --nox-session=${{ inputs.nox-session }}-pkgs --rerun-failures ${{ inputs.distro-slug }} -- download-pkgs
 
+      - name: Combine Coverage Reports
+        if: always() && inputs.skip-code-coverage == false && steps.spin-up-vm.outcome == 'success'
+        run: |
+          tools --timestamps vm combine-coverage ${{ inputs.distro-slug }}
+
       - name: Create XML Coverage Reports
         if: always() && inputs.skip-code-coverage == false && steps.spin-up-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
diff --git a/.github/workflows/test-packages-action-macos.yml b/.github/workflows/test-packages-action-macos.yml
index 5a6ac846fb8..41048bd4e34 100644
--- a/.github/workflows/test-packages-action-macos.yml
+++ b/.github/workflows/test-packages-action-macos.yml
@@ -195,7 +195,7 @@ jobs:
 
       - name: Prepare Test Run Artifacts
         id: download-artifacts-from-vm
-        if: always() && job.status != 'cancelled'
+        if: always()
         run: |
           # Delete the salt onedir, we won't need it anymore and it will prevent
           # from it showing in the tree command below
@@ -203,7 +203,7 @@ jobs:
           tree -a artifacts
 
       - name: Upload Test Run Artifacts
-        if: always() && job.status != 'cancelled'
+        if: always()
         uses: actions/upload-artifact@v3
         with:
           name: pkg-testrun-artifacts-${{ inputs.distro-slug }}-${{ matrix.test-chunk }}

From 834bb2d9e6674a5ba1fcb647f92b11a68b9793ee Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Thu, 5 Oct 2023 18:17:05 +0100
Subject: [PATCH 21/29] The `build-onedir-repo` job needs to depend on
 `build-salt-onedir-{linux,macos,windows}` jobs

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/nightly.yml                     | 3 +++
 .github/workflows/staging.yml                     | 3 +++
 .github/workflows/templates/build-repos.yml.jinja | 4 ++++
 3 files changed, 10 insertions(+)

diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index dc54c93db45..914804ef073 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -2838,6 +2838,9 @@ jobs:
       - repo-nightly
     needs:
       - prepare-workflow
+      - build-salt-onedir-linux
+      - build-salt-onedir-macos
+      - build-salt-onedir-windows
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml
index ef40f32310b..4f7e567e94d 100644
--- a/.github/workflows/staging.yml
+++ b/.github/workflows/staging.yml
@@ -2696,6 +2696,9 @@ jobs:
       - repo-staging
     needs:
       - prepare-workflow
+      - build-salt-onedir-linux
+      - build-salt-onedir-macos
+      - build-salt-onedir-windows
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/templates/build-repos.yml.jinja b/.github/workflows/templates/build-repos.yml.jinja
index 8aa147ce40b..da05231fdb5 100644
--- a/.github/workflows/templates/build-repos.yml.jinja
+++ b/.github/workflows/templates/build-repos.yml.jinja
@@ -23,6 +23,10 @@
       - build-<{ type }>-pkgs-onedir
       <%- elif platform %>
       - build-salt-onedir-<{ platform }>
+      <%- elif type == 'onedir' %>
+      - build-salt-onedir-linux
+      - build-salt-onedir-macos
+      - build-salt-onedir-windows
       <%- endif %>
     <%- include "build-{}-repo.yml.jinja".format(type) %>
 

From 72cb90835d92925654734cec95d51ee0ab58b46d Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Fri, 6 Oct 2023 08:17:24 +0100
Subject: [PATCH 22/29] Update to the latest golden images

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 cicd/golden-images.json | 164 ++++++++++++++++++++--------------------
 pkg/tests/conftest.py   |  12 ---
 2 files changed, 82 insertions(+), 94 deletions(-)

diff --git a/cicd/golden-images.json b/cicd/golden-images.json
index 9a3f06f705a..962af9809e6 100644
--- a/cicd/golden-images.json
+++ b/cicd/golden-images.json
@@ -1,8 +1,8 @@
 {
   "almalinux-8-arm64": {
-    "ami": "ami-0f08fc00f1689a8ec",
+    "ami": "ami-04c86a9990a3836b9",
     "ami_description": "CI Image of AlmaLinux 8 arm64",
-    "ami_name": "salt-project/ci/almalinux/8/arm64/20231003.2057",
+    "ami_name": "salt-project/ci/almalinux/8/arm64/20231005.1556",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -10,9 +10,9 @@
     "ssh_username": "ec2-user"
   },
   "almalinux-8": {
-    "ami": "ami-08f648e0e6fa619c2",
+    "ami": "ami-059ed5c00c02c564b",
     "ami_description": "CI Image of AlmaLinux 8 x86_64",
-    "ami_name": "salt-project/ci/almalinux/8/x86_64/20231003.2058",
+    "ami_name": "salt-project/ci/almalinux/8/x86_64/20231005.1557",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -20,9 +20,9 @@
     "ssh_username": "ec2-user"
   },
   "almalinux-9-arm64": {
-    "ami": "ami-0394b210e1e09b962",
+    "ami": "ami-0213f3e31656f7393",
     "ami_description": "CI Image of AlmaLinux 9 arm64",
-    "ami_name": "salt-project/ci/almalinux/9/arm64/20231003.2058",
+    "ami_name": "salt-project/ci/almalinux/9/arm64/20231005.1557",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -30,9 +30,9 @@
     "ssh_username": "ec2-user"
   },
   "almalinux-9": {
-    "ami": "ami-0a909a150cfebea5b",
+    "ami": "ami-0c4e36d63e728ee21",
     "ami_description": "CI Image of AlmaLinux 9 x86_64",
-    "ami_name": "salt-project/ci/almalinux/9/x86_64/20231003.2100",
+    "ami_name": "salt-project/ci/almalinux/9/x86_64/20231005.1557",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -40,9 +40,9 @@
     "ssh_username": "ec2-user"
   },
   "amazonlinux-2-arm64": {
-    "ami": "ami-038eac6a08feecdb2",
+    "ami": "ami-010d24ab23bfb0330",
     "ami_description": "CI Image of AmazonLinux 2 arm64",
-    "ami_name": "salt-project/ci/amazonlinux/2/arm64/20231003.2104",
+    "ami_name": "salt-project/ci/amazonlinux/2/arm64/20231005.1614",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -50,9 +50,9 @@
     "ssh_username": "ec2-user"
   },
   "amazonlinux-2": {
-    "ami": "ami-09682e96e7785642d",
+    "ami": "ami-0ad016fe17f923c6b",
     "ami_description": "CI Image of AmazonLinux 2 x86_64",
-    "ami_name": "salt-project/ci/amazonlinux/2/x86_64/20231003.2104",
+    "ami_name": "salt-project/ci/amazonlinux/2/x86_64/20231005.1614",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -60,9 +60,9 @@
     "ssh_username": "ec2-user"
   },
   "amazonlinux-2023.1-arm64": {
-    "ami": "ami-0e46c84fb43817334",
+    "ami": "ami-037b7d6177ec8259d",
     "ami_description": "CI Image of AmazonLinux 2023.1 arm64",
-    "ami_name": "salt-project/ci/amazonlinux/2023.1/arm64/20231003.2103",
+    "ami_name": "salt-project/ci/amazonlinux/2023.1/arm64/20231005.1555",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -70,9 +70,9 @@
     "ssh_username": "ec2-user"
   },
   "amazonlinux-2023.1": {
-    "ami": "ami-0ac591368ec230345",
+    "ami": "ami-08e04f6dd44c858fa",
     "ami_description": "CI Image of AmazonLinux 2023.1 x86_64",
-    "ami_name": "salt-project/ci/amazonlinux/2023.1/x86_64/20231003.2103",
+    "ami_name": "salt-project/ci/amazonlinux/2023.1/x86_64/20231005.1555",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -80,9 +80,9 @@
     "ssh_username": "ec2-user"
   },
   "archlinux-lts": {
-    "ami": "ami-017de6f1e636021a0",
+    "ami": "ami-0b88ddfb321aff9ba",
     "ami_description": "CI Image of ArchLinux lts x86_64",
-    "ami_name": "salt-project/ci/archlinux/lts/x86_64/20231003.2108",
+    "ami_name": "salt-project/ci/archlinux/lts/x86_64/20231005.1555",
     "arch": "x86_64",
     "cloudwatch-agent-available": "false",
     "instance_type": "t3a.large",
@@ -90,9 +90,9 @@
     "ssh_username": "arch"
   },
   "centos-7-arm64": {
-    "ami": "ami-088cb5f3066efa748",
+    "ami": "ami-01d5ee66081a02154",
     "ami_description": "CI Image of CentOS 7 arm64",
-    "ami_name": "salt-project/ci/centos/7/arm64/20231003.2108",
+    "ami_name": "salt-project/ci/centos/7/arm64/20231005.1617",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -100,9 +100,9 @@
     "ssh_username": "centos"
   },
   "centos-7": {
-    "ami": "ami-05c4056c36cecc136",
+    "ami": "ami-020fcff1da1f72f27",
     "ami_description": "CI Image of CentOS 7 x86_64",
-    "ami_name": "salt-project/ci/centos/7/x86_64/20231003.2107",
+    "ami_name": "salt-project/ci/centos/7/x86_64/20231005.1616",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -110,9 +110,9 @@
     "ssh_username": "centos"
   },
   "centosstream-8-arm64": {
-    "ami": "ami-0e2a761782490f7c2",
+    "ami": "ami-0ac6238b6506f7b8f",
     "ami_description": "CI Image of CentOSStream 8 arm64",
-    "ami_name": "salt-project/ci/centosstream/8/arm64/20231003.2109",
+    "ami_name": "salt-project/ci/centosstream/8/arm64/20231005.1614",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -120,9 +120,9 @@
     "ssh_username": "centos"
   },
   "centosstream-8": {
-    "ami": "ami-06178cd094ea71c34",
+    "ami": "ami-0bfceb03d43d0ba0e",
     "ami_description": "CI Image of CentOSStream 8 x86_64",
-    "ami_name": "salt-project/ci/centosstream/8/x86_64/20231003.2108",
+    "ami_name": "salt-project/ci/centosstream/8/x86_64/20231005.1615",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -130,9 +130,9 @@
     "ssh_username": "centos"
   },
   "centosstream-9-arm64": {
-    "ami": "ami-0ea1025028e6fe700",
+    "ami": "ami-04db23ba9082a01bf",
     "ami_description": "CI Image of CentOSStream 9 arm64",
-    "ami_name": "salt-project/ci/centosstream/9/arm64/20231003.2109",
+    "ami_name": "salt-project/ci/centosstream/9/arm64/20231005.1615",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -140,9 +140,9 @@
     "ssh_username": "ec2-user"
   },
   "centosstream-9": {
-    "ami": "ami-0f474b360fca72512",
+    "ami": "ami-0a47f4f785cb7a81c",
     "ami_description": "CI Image of CentOSStream 9 x86_64",
-    "ami_name": "salt-project/ci/centosstream/9/x86_64/20231003.2109",
+    "ami_name": "salt-project/ci/centosstream/9/x86_64/20231005.1615",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -150,9 +150,9 @@
     "ssh_username": "ec2-user"
   },
   "debian-10-arm64": {
-    "ami": "ami-0b9cbee875ae2e145",
+    "ami": "ami-015d30e48fa213528",
     "ami_description": "CI Image of Debian 10 arm64",
-    "ami_name": "salt-project/ci/debian/10/arm64/20231003.2114",
+    "ami_name": "salt-project/ci/debian/10/arm64/20231005.1601",
     "arch": "arm64",
     "cloudwatch-agent-available": "false",
     "instance_type": "m6g.large",
@@ -160,9 +160,9 @@
     "ssh_username": "admin"
   },
   "debian-10": {
-    "ami": "ami-03b713e88ac915c18",
+    "ami": "ami-0397043698fedfa4c",
     "ami_description": "CI Image of Debian 10 x86_64",
-    "ami_name": "salt-project/ci/debian/10/x86_64/20231003.2112",
+    "ami_name": "salt-project/ci/debian/10/x86_64/20231005.1606",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -170,9 +170,9 @@
     "ssh_username": "admin"
   },
   "debian-11-arm64": {
-    "ami": "ami-0e48f24d9def8d84c",
+    "ami": "ami-008dbab5525972174",
     "ami_description": "CI Image of Debian 11 arm64",
-    "ami_name": "salt-project/ci/debian/11/arm64/20231003.2114",
+    "ami_name": "salt-project/ci/debian/11/arm64/20231005.1607",
     "arch": "arm64",
     "cloudwatch-agent-available": "false",
     "instance_type": "m6g.large",
@@ -180,9 +180,9 @@
     "ssh_username": "admin"
   },
   "debian-11": {
-    "ami": "ami-07a2fb75d29d0d6f7",
+    "ami": "ami-04fc56501daaf3c94",
     "ami_description": "CI Image of Debian 11 x86_64",
-    "ami_name": "salt-project/ci/debian/11/x86_64/20231003.2116",
+    "ami_name": "salt-project/ci/debian/11/x86_64/20231005.1607",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -190,9 +190,9 @@
     "ssh_username": "admin"
   },
   "debian-12-arm64": {
-    "ami": "ami-027199ded9ce9f659",
+    "ami": "ami-0956b73228a7368c3",
     "ami_description": "CI Image of Debian 12 arm64",
-    "ami_name": "salt-project/ci/debian/12/arm64/20231003.2117",
+    "ami_name": "salt-project/ci/debian/12/arm64/20231005.1610",
     "arch": "arm64",
     "cloudwatch-agent-available": "false",
     "instance_type": "m6g.large",
@@ -200,9 +200,9 @@
     "ssh_username": "admin"
   },
   "debian-12": {
-    "ami": "ami-02156ad853a403599",
+    "ami": "ami-0d0aa04bb5c49e54f",
     "ami_description": "CI Image of Debian 12 x86_64",
-    "ami_name": "salt-project/ci/debian/12/x86_64/20231003.2119",
+    "ami_name": "salt-project/ci/debian/12/x86_64/20231005.1613",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -210,9 +210,9 @@
     "ssh_username": "admin"
   },
   "fedora-37-arm64": {
-    "ami": "ami-0dfb1b2e3b6cd8847",
+    "ami": "ami-0201f64fda9f1ca6d",
     "ami_description": "CI Image of Fedora 37 arm64",
-    "ami_name": "salt-project/ci/fedora/37/arm64/20231003.2119",
+    "ami_name": "salt-project/ci/fedora/37/arm64/20231005.1617",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -220,9 +220,9 @@
     "ssh_username": "fedora"
   },
   "fedora-37": {
-    "ami": "ami-0d27e014bf07af18b",
+    "ami": "ami-02dfc80c8b14fd5bc",
     "ami_description": "CI Image of Fedora 37 x86_64",
-    "ami_name": "salt-project/ci/fedora/37/x86_64/20231003.2120",
+    "ami_name": "salt-project/ci/fedora/37/x86_64/20231005.1618",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -230,9 +230,9 @@
     "ssh_username": "fedora"
   },
   "fedora-38-arm64": {
-    "ami": "ami-04f5a34bae3040974",
+    "ami": "ami-0b03c270c7f50165d",
     "ami_description": "CI Image of Fedora 38 arm64",
-    "ami_name": "salt-project/ci/fedora/38/arm64/20231003.2120",
+    "ami_name": "salt-project/ci/fedora/38/arm64/20231005.1618",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -240,9 +240,9 @@
     "ssh_username": "fedora"
   },
   "fedora-38": {
-    "ami": "ami-0e69802061ed79891",
+    "ami": "ami-0927a80620f670c23",
     "ami_description": "CI Image of Fedora 38 x86_64",
-    "ami_name": "salt-project/ci/fedora/38/x86_64/20231003.2123",
+    "ami_name": "salt-project/ci/fedora/38/x86_64/20231005.1626",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -250,9 +250,9 @@
     "ssh_username": "fedora"
   },
   "opensuse-15": {
-    "ami": "ami-0ebb684e16914ad0a",
+    "ami": "ami-0b51e3479fabb4078",
     "ami_description": "CI Image of Opensuse 15 x86_64",
-    "ami_name": "salt-project/ci/opensuse/15/x86_64/20231003.2110",
+    "ami_name": "salt-project/ci/opensuse/15/x86_64/20231005.1614",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -260,9 +260,9 @@
     "ssh_username": "ec2-user"
   },
   "photonos-3-arm64": {
-    "ami": "ami-054765b3beb6dd97c",
+    "ami": "ami-0a33037524874686c",
     "ami_description": "CI Image of PhotonOS 3 arm64",
-    "ami_name": "salt-project/ci/photonos/3/arm64/20231003.2129",
+    "ami_name": "salt-project/ci/photonos/3/arm64/20231005.1558",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -270,9 +270,9 @@
     "ssh_username": "root"
   },
   "photonos-3": {
-    "ami": "ami-0224e8a4471113ebb",
+    "ami": "ami-068c5c07aa91d84d1",
     "ami_description": "CI Image of PhotonOS 3 x86_64",
-    "ami_name": "salt-project/ci/photonos/3/x86_64/20231003.2128",
+    "ami_name": "salt-project/ci/photonos/3/x86_64/20231005.1558",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -280,9 +280,9 @@
     "ssh_username": "root"
   },
   "photonos-4-arm64": {
-    "ami": "ami-091f6d77aa3921394",
+    "ami": "ami-0f8c72854c5b5679c",
     "ami_description": "CI Image of PhotonOS 4 arm64",
-    "ami_name": "salt-project/ci/photonos/4/arm64/20231003.2124",
+    "ami_name": "salt-project/ci/photonos/4/arm64/20231005.1558",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -290,9 +290,9 @@
     "ssh_username": "root"
   },
   "photonos-4": {
-    "ami": "ami-0714704e9471a8e0c",
+    "ami": "ami-04b8974b830b5adb0",
     "ami_description": "CI Image of PhotonOS 4 x86_64",
-    "ami_name": "salt-project/ci/photonos/4/x86_64/20231003.2130",
+    "ami_name": "salt-project/ci/photonos/4/x86_64/20231005.1559",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -300,9 +300,9 @@
     "ssh_username": "root"
   },
   "photonos-5-arm64": {
-    "ami": "ami-05ebc5bddb487c20b",
+    "ami": "ami-0f466b198cbcaf380",
     "ami_description": "CI Image of PhotonOS 5 arm64",
-    "ami_name": "salt-project/ci/photonos/5/arm64/20231003.2130",
+    "ami_name": "salt-project/ci/photonos/5/arm64/20231005.1559",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -310,9 +310,9 @@
     "ssh_username": "root"
   },
   "photonos-5": {
-    "ami": "ami-0b7e17bc1990da3af",
+    "ami": "ami-01bb09f84464b243e",
     "ami_description": "CI Image of PhotonOS 5 x86_64",
-    "ami_name": "salt-project/ci/photonos/5/x86_64/20231003.2131",
+    "ami_name": "salt-project/ci/photonos/5/x86_64/20231005.1601",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -320,9 +320,9 @@
     "ssh_username": "root"
   },
   "ubuntu-20.04-arm64": {
-    "ami": "ami-09210544c9163df86",
+    "ami": "ami-06d9a9e3b5ae369c7",
     "ami_description": "CI Image of Ubuntu 20.04 arm64",
-    "ami_name": "salt-project/ci/ubuntu/20.04/arm64/20231003.2110",
+    "ami_name": "salt-project/ci/ubuntu/20.04/arm64/20231005.1555",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -330,9 +330,9 @@
     "ssh_username": "ubuntu"
   },
   "ubuntu-20.04": {
-    "ami": "ami-05894335447f4c052",
+    "ami": "ami-080a55fb6cb08134d",
     "ami_description": "CI Image of Ubuntu 20.04 x86_64",
-    "ami_name": "salt-project/ci/ubuntu/20.04/x86_64/20231003.2110",
+    "ami_name": "salt-project/ci/ubuntu/20.04/x86_64/20231005.1555",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -340,9 +340,9 @@
     "ssh_username": "ubuntu"
   },
   "ubuntu-22.04-arm64": {
-    "ami": "ami-090423dbe605f6d3e",
+    "ami": "ami-0c87b8f0b8794f32e",
     "ami_description": "CI Image of Ubuntu 22.04 arm64",
-    "ami_name": "salt-project/ci/ubuntu/22.04/arm64/20231003.2111",
+    "ami_name": "salt-project/ci/ubuntu/22.04/arm64/20231005.1555",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -350,9 +350,9 @@
     "ssh_username": "ubuntu"
   },
   "ubuntu-22.04": {
-    "ami": "ami-0a465357b34ea7fdc",
+    "ami": "ami-0ce98043f227c9ac0",
     "ami_description": "CI Image of Ubuntu 22.04 x86_64",
-    "ami_name": "salt-project/ci/ubuntu/22.04/x86_64/20231003.2111",
+    "ami_name": "salt-project/ci/ubuntu/22.04/x86_64/20231005.1555",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -360,9 +360,9 @@
     "ssh_username": "ubuntu"
   },
   "ubuntu-23.04-arm64": {
-    "ami": "ami-0ed81524d646f95ee",
+    "ami": "ami-0519c583e36309fef",
     "ami_description": "CI Image of Ubuntu 23.04 arm64",
-    "ami_name": "salt-project/ci/ubuntu/23.04/arm64/20231003.2111",
+    "ami_name": "salt-project/ci/ubuntu/23.04/arm64/20231005.1555",
     "arch": "arm64",
     "cloudwatch-agent-available": "true",
     "instance_type": "m6g.large",
@@ -370,9 +370,9 @@
     "ssh_username": "ubuntu"
   },
   "ubuntu-23.04": {
-    "ami": "ami-02c7edd6357be51b6",
+    "ami": "ami-063ad5dfb49f09182",
     "ami_description": "CI Image of Ubuntu 23.04 x86_64",
-    "ami_name": "salt-project/ci/ubuntu/23.04/x86_64/20231003.2112",
+    "ami_name": "salt-project/ci/ubuntu/23.04/x86_64/20231005.1555",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.large",
@@ -380,9 +380,9 @@
     "ssh_username": "ubuntu"
   },
   "windows-2016": {
-    "ami": "ami-04f113ff291a8953f",
+    "ami": "ami-0f1ac34593b8b044f",
     "ami_description": "CI Image of Windows 2016 x86_64",
-    "ami_name": "salt-project/ci/windows/2016/x86_64/20231003.2104",
+    "ami_name": "salt-project/ci/windows/2016/x86_64/20231005.1615",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.xlarge",
@@ -390,9 +390,9 @@
     "ssh_username": "Administrator"
   },
   "windows-2019": {
-    "ami": "ami-06475f495e0151fc9",
+    "ami": "ami-09100ff6a103a28ab",
     "ami_description": "CI Image of Windows 2019 x86_64",
-    "ami_name": "salt-project/ci/windows/2019/x86_64/20231003.2106",
+    "ami_name": "salt-project/ci/windows/2019/x86_64/20231005.1615",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.xlarge",
@@ -400,9 +400,9 @@
     "ssh_username": "Administrator"
   },
   "windows-2022": {
-    "ami": "ami-0558da89560480f32",
+    "ami": "ami-0266dc6a12bc9fca6",
     "ami_description": "CI Image of Windows 2022 x86_64",
-    "ami_name": "salt-project/ci/windows/2022/x86_64/20231003.2106",
+    "ami_name": "salt-project/ci/windows/2022/x86_64/20231005.1616",
     "arch": "x86_64",
     "cloudwatch-agent-available": "true",
     "instance_type": "t3a.xlarge",
diff --git a/pkg/tests/conftest.py b/pkg/tests/conftest.py
index c618b7ed4bb..36c60b0e57b 100644
--- a/pkg/tests/conftest.py
+++ b/pkg/tests/conftest.py
@@ -49,18 +49,6 @@ def _system_up_to_date(
     grains,
     shell,
 ):
-    if grains["os"] == "Ubuntu" and grains["osarch"] == "amd64":
-        # The grub-efi-amd64-signed package seems to be a problem
-        # right now when updating the system
-        env = os.environ.copy()
-        env["DEBIAN_FRONTEND"] = "noninteractive"
-        ret = shell.run(
-            "apt-mark",
-            "hold",
-            "grub-efi-amd64-signed",
-            env=env,
-        )
-        assert ret.returncode == 0
     if grains["os_family"] == "Debian":
         ret = shell.run("apt", "update")
         assert ret.returncode == 0

From efe18b6f1239b314090fef14c76a18cdc506d31c Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Fri, 6 Oct 2023 15:02:48 +0100
Subject: [PATCH 23/29] The XML coverage reports need to be created for Salt
 and Tests

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/test-action-macos.yml             |  8 ++++++++
 .github/workflows/test-action.yml                   |  8 ++++++++
 .../test-package-downloads-action-linux.yml         |  8 ++++++++
 .../test-package-downloads-action-macos.yml         |  8 ++++++++
 .../test-package-downloads-action-windows.yml       |  8 ++++++++
 noxfile.py                                          | 13 +++++++++++--
 6 files changed, 51 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index 360e5eaded8..a9fa7c783ff 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -430,6 +430,10 @@ jobs:
       - name: Upload Source Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
         run: |
+          if [ ! -s artifacts/coverage/salt.xml ]; then
+            echo "The artifacts/coverage/salt.xml file does not exist"
+            exit 1
+          fi
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
@@ -458,6 +462,10 @@ jobs:
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
         run: |
+          if [ ! -s artifacts/coverage/tests.xml ]; then
+            echo "The artifacts/coverage/tests.xml file does not exist"
+            exit 1
+          fi
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index c84d717f949..351ba55e5b9 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -377,6 +377,10 @@ jobs:
       - name: Upload Source Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
         run: |
+          if [ ! -s artifacts/coverage/salt.xml ]; then
+            echo "The artifacts/coverage/salt.xml file does not exist"
+            exit 1
+          fi
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
@@ -405,6 +409,10 @@ jobs:
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
         run: |
+          if [ ! -s artifacts/coverage/tests.xml ]; then
+            echo "The artifacts/coverage/tests.xml file does not exist"
+            exit 1
+          fi
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
diff --git a/.github/workflows/test-package-downloads-action-linux.yml b/.github/workflows/test-package-downloads-action-linux.yml
index a828a631e8c..06faeffa002 100644
--- a/.github/workflows/test-package-downloads-action-linux.yml
+++ b/.github/workflows/test-package-downloads-action-linux.yml
@@ -226,6 +226,10 @@ jobs:
       - name: Upload Source Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
+          if [ ! -s artifacts/coverage/salt.xml ]; then
+            echo "The artifacts/coverage/salt.xml file does not exist"
+            exit 1
+          fi
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
@@ -254,6 +258,10 @@ jobs:
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
+          if [ ! -s artifacts/coverage/tests.xml ]; then
+            echo "The artifacts/coverage/tests.xml file does not exist"
+            exit 1
+          fi
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
diff --git a/.github/workflows/test-package-downloads-action-macos.yml b/.github/workflows/test-package-downloads-action-macos.yml
index 706b0284a01..f5e8c2d05c6 100644
--- a/.github/workflows/test-package-downloads-action-macos.yml
+++ b/.github/workflows/test-package-downloads-action-macos.yml
@@ -204,6 +204,10 @@ jobs:
       - name: Upload Source Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
         run: |
+          if [ ! -s artifacts/coverage/salt.xml ]; then
+            echo "The artifacts/coverage/salt.xml file does not exist"
+            exit 1
+          fi
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
@@ -232,6 +236,10 @@ jobs:
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && job.status != 'cancelled'
         run: |
+          if [ ! -s artifacts/coverage/tests.xml ]; then
+            echo "The artifacts/coverage/tests.xml file does not exist"
+            exit 1
+          fi
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
diff --git a/.github/workflows/test-package-downloads-action-windows.yml b/.github/workflows/test-package-downloads-action-windows.yml
index c3bf59a8add..704aa962829 100644
--- a/.github/workflows/test-package-downloads-action-windows.yml
+++ b/.github/workflows/test-package-downloads-action-windows.yml
@@ -231,6 +231,10 @@ jobs:
       - name: Upload Source Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
+          if [ ! -s artifacts/coverage/salt.xml ]; then
+            echo "The artifacts/coverage/salt.xml file does not exist"
+            exit 1
+          fi
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
@@ -259,6 +263,10 @@ jobs:
       - name: Upload Tests Code Coverage To Codecov
         if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
         run: |
+          if [ ! -s artifacts/coverage/tests.xml ]; then
+            echo "The artifacts/coverage/tests.xml file does not exist"
+            exit 1
+          fi
           # We can't yet use tokenless uploads with the codecov CLI
           #codecovcli --auto-load-params-from GithubActions --verbose --token ${{ secrets.CODECOV_TOKEN }} \
           #  do-upload --git-service github --sha ${{ github.sha }} \
diff --git a/noxfile.py b/noxfile.py
index 83dc559a9d5..e6ad8832590 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -1357,9 +1357,18 @@ def create_html_coverage_report(session):
     _report_coverage(session, combine=True, cli_report=False, html_report=True)
 
 
+def _create_xml_coverage_reports(session):
+    if session.posargs:
+        session.error("No arguments are acceptable to this nox session.")
+    session.posargs.append("salt")
+    _report_coverage(session, combine=True, cli_report=False, xml_report=True)
+    session.posargs.append("tests")
+    _report_coverage(session, combine=True, cli_report=False, xml_report=True)
+
+
 @nox.session(python="3", name="create-xml-coverage-reports")
 def create_xml_coverage_reports(session):
-    _report_coverage(session, combine=True, cli_report=False, xml_report=True)
+    _create_xml_coverage_reports(session)
 
 
 @nox.session(
@@ -1368,7 +1377,7 @@ def create_xml_coverage_reports(session):
     venv_params=["--system-site-packages"],
 )
 def create_xml_coverage_reports_onedir(session):
-    _report_coverage(session, combine=True, cli_report=False, xml_report=True)
+    _create_xml_coverage_reports(session)
 
 
 @nox.session(python="3", name="create-json-coverage-reports")

From efadd88601af564c2bb862bbbea255f74e66de2e Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Fri, 6 Oct 2023 10:06:47 +0100
Subject: [PATCH 24/29] Create workflow for each of the supported repositories

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 ...-deb-repo.yml.jinja => build-deb-repo.yml} |  94 ++-
 ...os-repo.yml.jinja => build-macos-repo.yml} |  56 +-
 ...r-repo.yml.jinja => build-onedir-repo.yml} |  67 +-
 ...-rpm-repo.yml.jinja => build-rpm-repo.yml} |  99 ++-
 ...-src-repo.yml.jinja => build-src-repo.yml} |  61 +-
 ...-repo.yml.jinja => build-windows-repo.yml} |  61 +-
 .github/workflows/nightly.yml                 | 642 ++---------------
 .github/workflows/staging.yml                 | 644 ++----------------
 .../workflows/templates/build-repos.yml.jinja |  36 +-
 tools/ci.py                                   |  63 ++
 10 files changed, 525 insertions(+), 1298 deletions(-)
 rename .github/workflows/{templates/build-deb-repo.yml.jinja => build-deb-repo.yml} (55%)
 rename .github/workflows/{templates/build-macos-repo.yml.jinja => build-macos-repo.yml} (62%)
 rename .github/workflows/{templates/build-onedir-repo.yml.jinja => build-onedir-repo.yml} (63%)
 rename .github/workflows/{templates/build-rpm-repo.yml.jinja => build-rpm-repo.yml} (60%)
 rename .github/workflows/{templates/build-src-repo.yml.jinja => build-src-repo.yml} (63%)
 rename .github/workflows/{templates/build-windows-repo.yml.jinja => build-windows-repo.yml} (63%)

diff --git a/.github/workflows/templates/build-deb-repo.yml.jinja b/.github/workflows/build-deb-repo.yml
similarity index 55%
rename from .github/workflows/templates/build-deb-repo.yml.jinja
rename to .github/workflows/build-deb-repo.yml
index a4e3dd8a2aa..1b8233017f1 100644
--- a/.github/workflows/templates/build-deb-repo.yml.jinja
+++ b/.github/workflows/build-deb-repo.yml
@@ -1,24 +1,78 @@
+---
+name: Build DEB Repository
 
+on:
+  workflow_call:
+    inputs:
+      environment:
+        type: string
+        required: true
+        description: The environment to run against
+      gpg_key_id:
+        type: string
+        required: true
+        description: The GPG key ID to use
+      salt-version:
+        type: string
+        required: true
+        description: The Salt version of the packages to install and test
+
+env:
+  RELENV_DATA: "${{ github.workspace }}/.relenv"
+  COLUMNS: 190
+  AWS_MAX_ATTEMPTS: "10"
+  AWS_RETRY_MODE: "adaptive"
+  PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
+  PIP_EXTRA_INDEX_URL: https://pypi.org/simple
+
+jobs:
+
+  generate-matrix:
+    name: DEB (matrix)
+    runs-on:
+      - self-hosted
+      - linux
+      - x86_64
+    outputs:
+      repo-matrix-include: ${{ steps.generate-pkg-repo-matrix.outputs.matrix }}
+    steps:
+
+      - name: "Throttle Builds"
+        shell: bash
+        run: |
+          t=$(shuf -i 1-30 -n 1); echo "Sleeping $t seconds"; sleep "$t"
+
+      - name: Checkout Source Code
+        uses: actions/checkout@v4
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Generate Package Repo Matrix
+        id: generate-pkg-repo-matrix
+        run: |
+          tools ci pkg-repo-matrix deb
+
+  build-deb-repo:
+    name: DEB
+    environment: ${{ inputs.environment }}
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-${{ inputs.environment }}
+    needs:
+      - generate-matrix
     strategy:
       fail-fast: false
       matrix:
-        include:
-        <%- for distro, version, arch in (
-                                            ("debian", "10", "x86_64"),
-                                            ("debian", "10", "aarch64"),
-                                            ("debian", "11", "x86_64"),
-                                            ("debian", "11", "aarch64"),
-                                            ("ubuntu", "20.04", "x86_64"),
-                                            ("ubuntu", "20.04", "aarch64"),
-                                            ("ubuntu", "22.04", "x86_64"),
-                                            ("ubuntu", "22.04", "aarch64"),
-                                        ) %>
-          - distro: <{ distro }>
-            version: "<{ version }>"
-            arch: <{ arch }>
-        <%- endfor %>
-
+        include: ${{ fromJSON(needs.generate-matrix.outputs.repo-matrix-include) }}
     steps:
+
+      - name: "Throttle Builds"
+        shell: bash
+        run: |
+          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
+
       - uses: actions/checkout@v4
 
       - name: Download System Dependencies
@@ -38,7 +92,7 @@
       - name: Download DEB Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-deb
+          name: salt-${{ inputs.salt-version }}-${{ matrix.arch }}-deb
           path: artifacts/pkgs/incoming
 
       - name: Setup GnuPG
@@ -76,15 +130,15 @@
 
       - name: Create Repository
         run: |
-          tools pkg repo create deb --key-id=<{ gpg_key_id }> --distro-arch=${{ matrix.arch }} <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+          tools pkg repo create deb --key-id=${{ inputs.gpg_key_id }} --distro-arch=${{ matrix.arch }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
+            --salt-version=${{ inputs.salt-version }} \
             --distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
             --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
 
       - name: Upload Repository As An Artifact
         uses: ./.github/actions/upload-artifact
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
+          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
           path: artifacts/pkgs/repo/*
           retention-days: 7
           if-no-files-found: error
diff --git a/.github/workflows/templates/build-macos-repo.yml.jinja b/.github/workflows/build-macos-repo.yml
similarity index 62%
rename from .github/workflows/templates/build-macos-repo.yml.jinja
rename to .github/workflows/build-macos-repo.yml
index b24e0a9c4a4..26101419913 100644
--- a/.github/workflows/templates/build-macos-repo.yml.jinja
+++ b/.github/workflows/build-macos-repo.yml
@@ -1,5 +1,52 @@
+---
+name: Build DEB Repository
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        type: string
+        required: true
+        description: The environment to run against
+      gpg_key_id:
+        type: string
+        required: true
+        description: The GPG key ID to use
+      salt-version:
+        type: string
+        required: true
+        description: The Salt version of the packages to install and test
+
+env:
+  RELENV_DATA: "${{ github.workspace }}/.relenv"
+  COLUMNS: 190
+  AWS_MAX_ATTEMPTS: "10"
+  AWS_RETRY_MODE: "adaptive"
+  PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
+  PIP_EXTRA_INDEX_URL: https://pypi.org/simple
+
+jobs:
+
+  build-repo:
+    name: MacOS
+    environment: ${{ inputs.environment }}
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-${{ inputs.environment }}
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - macos
 
     steps:
+
+      - name: "Throttle Builds"
+        shell: bash
+        run: |
+          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
+
       - uses: actions/checkout@v4
 
       - name: Setup Python Tools Scripts
@@ -14,7 +61,7 @@
       - name: Download macOS x86_64 Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86_64-macos
+          name: salt-${{ inputs.salt-version }}-x86_64-macos
           path: artifacts/pkgs/incoming
 
       - name: Setup GnuPG
@@ -52,15 +99,14 @@
 
       - name: Create Repository
         run: |
-          tools pkg repo create macos --key-id=<{ gpg_key_id }> <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+          tools pkg repo create macos --key-id=${{ inputs.gpg_key_id }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
+            --salt-version=${{ inputs.salt-version }} \
             --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
 
       - name: Upload Repository As An Artifact
         uses: ./.github/actions/upload-artifact
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
+          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
           path: artifacts/pkgs/repo/*
           retention-days: 7
           if-no-files-found: error
-          archive-name: macos-repo
diff --git a/.github/workflows/templates/build-onedir-repo.yml.jinja b/.github/workflows/build-onedir-repo.yml
similarity index 63%
rename from .github/workflows/templates/build-onedir-repo.yml.jinja
rename to .github/workflows/build-onedir-repo.yml
index 581503ab1eb..a30e4297c3e 100644
--- a/.github/workflows/templates/build-onedir-repo.yml.jinja
+++ b/.github/workflows/build-onedir-repo.yml
@@ -1,5 +1,52 @@
+---
+name: Build Onedir Repository
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        type: string
+        required: true
+        description: The environment to run against
+      gpg_key_id:
+        type: string
+        required: true
+        description: The GPG key ID to use
+      salt-version:
+        type: string
+        required: true
+        description: The Salt version of the packages to install and test
+
+env:
+  RELENV_DATA: "${{ github.workspace }}/.relenv"
+  COLUMNS: 190
+  AWS_MAX_ATTEMPTS: "10"
+  AWS_RETRY_MODE: "adaptive"
+  PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
+  PIP_EXTRA_INDEX_URL: https://pypi.org/simple
+
+jobs:
+
+  build-repo:
+    name: Onedir
+    environment: ${{ inputs.environment }}
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-${{ inputs.environment }}
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - onedir
 
     steps:
+
+      - name: "Throttle Builds"
+        shell: bash
+        run: |
+          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
+
       - uses: actions/checkout@v4
 
       - name: Setup Python Tools Scripts
@@ -14,43 +61,43 @@
       - name: Download Linux x86_64 Onedir Archive
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-x86_64.tar.xz
+          name: salt-${{ inputs.salt-version }}-onedir-linux-x86_64.tar.xz
           path: artifacts/pkgs/incoming
 
       - name: Download Linux aarch64 Onedir Archive
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-aarch64.tar.xz
+          name: salt-${{ inputs.salt-version }}-onedir-linux-aarch64.tar.xz
           path: artifacts/pkgs/incoming
 
       - name: Download macOS x86_64 Onedir Archive
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-darwin-x86_64.tar.xz
+          name: salt-${{ inputs.salt-version }}-onedir-darwin-x86_64.tar.xz
           path: artifacts/pkgs/incoming
 
       - name: Download Windows amd64 Onedir Archive
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.tar.xz
+          name: salt-${{ inputs.salt-version }}-onedir-windows-amd64.tar.xz
           path: artifacts/pkgs/incoming
 
       - name: Download Windows amd64 Onedir Archive(zip)
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.zip
+          name: salt-${{ inputs.salt-version }}-onedir-windows-amd64.zip
           path: artifacts/pkgs/incoming
 
       - name: Download Windows x86 Onedir Archive
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.tar.xz
+          name: salt-${{ inputs.salt-version }}-onedir-windows-x86.tar.xz
           path: artifacts/pkgs/incoming
 
       - name: Download Windows amd64 Onedir Archive(zip)
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.zip
+          name: salt-${{ inputs.salt-version }}-onedir-windows-x86.zip
           path: artifacts/pkgs/incoming
 
       - name: Setup GnuPG
@@ -88,14 +135,14 @@
 
       - name: Create Repository
         run: |
-          tools pkg repo create onedir --key-id=<{ gpg_key_id }> <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+          tools pkg repo create onedir --key-id=${{ inputs.gpg_key_id }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
+            --salt-version=${{ inputs.salt-version }} \
             --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
 
       - name: Upload Repository As An Artifact
         uses: ./.github/actions/upload-artifact
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
+          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
           path: artifacts/pkgs/repo/*
           retention-days: 7
           if-no-files-found: error
diff --git a/.github/workflows/templates/build-rpm-repo.yml.jinja b/.github/workflows/build-rpm-repo.yml
similarity index 60%
rename from .github/workflows/templates/build-rpm-repo.yml.jinja
rename to .github/workflows/build-rpm-repo.yml
index ba0702ffc03..83f957de461 100644
--- a/.github/workflows/templates/build-rpm-repo.yml.jinja
+++ b/.github/workflows/build-rpm-repo.yml
@@ -1,32 +1,71 @@
+---
+name: Build RPM Repository
 
+on:
+  workflow_call:
+    inputs:
+      environment:
+        type: string
+        required: true
+        description: The environment to run against
+      gpg_key_id:
+        type: string
+        required: true
+        description: The GPG key ID to use
+      salt-version:
+        type: string
+        required: true
+        description: The Salt version of the packages to install and test
+
+env:
+  RELENV_DATA: "${{ github.workspace }}/.relenv"
+  COLUMNS: 190
+  AWS_MAX_ATTEMPTS: "10"
+  AWS_RETRY_MODE: "adaptive"
+  PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
+  PIP_EXTRA_INDEX_URL: https://pypi.org/simple
+
+jobs:
+
+  generate-matrix:
+    name: RPM (matrix)
+    runs-on:
+      - self-hosted
+      - linux
+      - x86_64
+    outputs:
+      repo-matrix-include: ${{ steps.generate-pkg-repo-matrix.outputs.matrix }}
+    steps:
+
+      - name: "Throttle Builds"
+        shell: bash
+        run: |
+          t=$(shuf -i 1-30 -n 1); echo "Sleeping $t seconds"; sleep "$t"
+
+      - name: Checkout Source Code
+        uses: actions/checkout@v4
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Generate Package Repo Matrix
+        id: generate-pkg-repo-matrix
+        run: |
+          tools ci pkg-repo-matrix rpm
+
+  build-repo:
+    name: RPM
+    environment: ${{ inputs.environment }}
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-${{ inputs.environment }}
+    needs:
+      - generate-matrix
     strategy:
       fail-fast: false
       matrix:
-        include:
-        <%- for distro, version, arch in (
-                                            ("amazon", "2", "x86_64"),
-                                            ("amazon", "2", "aarch64"),
-                                            ("redhat", "7", "x86_64"),
-                                            ("redhat", "7", "aarch64"),
-                                            ("redhat", "8", "x86_64"),
-                                            ("redhat", "8", "aarch64"),
-                                            ("redhat", "9", "x86_64"),
-                                            ("redhat", "9", "aarch64"),
-                                            ("fedora", "36", "x86_64"),
-                                            ("fedora", "36", "aarch64"),
-                                            ("fedora", "37", "x86_64"),
-                                            ("fedora", "37", "aarch64"),
-                                            ("fedora", "38", "x86_64"),
-                                            ("fedora", "38", "aarch64"),
-                                            ("photon", "3", "x86_64"),
-                                            ("photon", "3", "aarch64"),
-                                            ("photon", "4", "x86_64"),
-                                            ("photon", "4", "aarch64"),
-                                        ) %>
-          - distro: <{ distro }>
-            version: "<{ version }>"
-            arch: <{ arch }>
-        <%- endfor %>
+        include: ${{ fromJSON(needs.generate-matrix.outputs.repo-matrix-include) }}
 
     steps:
       - uses: actions/checkout@v4
@@ -48,7 +87,7 @@
       - name: Download RPM Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-rpm
+          name: salt-${{ inputs.salt-version }}-${{ matrix.arch }}-rpm
           path: artifacts/pkgs/incoming
 
       - name: Setup GnuPG
@@ -86,22 +125,20 @@
 
       - name: Create Repository
         env:
-          <%- if gh_environment == 'staging' %>
           SALT_REPO_USER: ${{ secrets.SALT_REPO_USER }}
           SALT_REPO_PASS: ${{ secrets.SALT_REPO_PASS }}
-          <%- endif %>
           SALT_REPO_DOMAIN_RELEASE: ${{ vars.SALT_REPO_DOMAIN_RELEASE || 'repo.saltproject.io' }}
           SALT_REPO_DOMAIN_STAGING: ${{ vars.SALT_REPO_DOMAIN_STAGING || 'staging.repo.saltproject.io' }}
         run: |
-          tools pkg repo create rpm --key-id=<{ gpg_key_id }> --distro-arch=${{ matrix.arch }} <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+          tools pkg repo create rpm --key-id=${{ inputs.gpg_key_id }} --distro-arch=${{ matrix.arch }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
+            --salt-version=${{ inputs.salt-version }} \
             --distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
             --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
 
       - name: Upload Repository As An Artifact
         uses: ./.github/actions/upload-artifact
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
+          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
           path: artifacts/pkgs/repo/*
           retention-days: 7
           if-no-files-found: error
diff --git a/.github/workflows/templates/build-src-repo.yml.jinja b/.github/workflows/build-src-repo.yml
similarity index 63%
rename from .github/workflows/templates/build-src-repo.yml.jinja
rename to .github/workflows/build-src-repo.yml
index 728ed00f093..8e0e37c3d52 100644
--- a/.github/workflows/templates/build-src-repo.yml.jinja
+++ b/.github/workflows/build-src-repo.yml
@@ -1,5 +1,52 @@
+---
+name: Build Source Repository
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        type: string
+        required: true
+        description: The environment to run against
+      gpg_key_id:
+        type: string
+        required: true
+        description: The GPG key ID to use
+      salt-version:
+        type: string
+        required: true
+        description: The Salt version of the packages to install and test
+
+env:
+  RELENV_DATA: "${{ github.workspace }}/.relenv"
+  COLUMNS: 190
+  AWS_MAX_ATTEMPTS: "10"
+  AWS_RETRY_MODE: "adaptive"
+  PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
+  PIP_EXTRA_INDEX_URL: https://pypi.org/simple
+
+jobs:
+
+  build-repo:
+    name: Source
+    environment: ${{ inputs.environment }}
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-${{ inputs.environment }}
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - onedir
 
     steps:
+
+      - name: "Throttle Builds"
+        shell: bash
+        run: |
+          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
+
       - uses: actions/checkout@v4
 
       - name: Setup Python Tools Scripts
@@ -14,7 +61,7 @@
       - name: Download Source Tarball
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
+          name: salt-${{ inputs.salt-version }}.tar.gz
           path: artifacts/pkgs/incoming
 
       - name: Setup GnuPG
@@ -52,8 +99,8 @@
 
       - name: Create Repository
         run: |
-          tools pkg repo create src --key-id=<{ gpg_key_id }> <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+          tools pkg repo create src --key-id=${{ inputs.gpg_key_id }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
+            --salt-version=${{ inputs.salt-version }} \
             --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
 
       - name: Copy Files For Source Only Artifact Uploads
@@ -64,10 +111,10 @@
       - name: Upload Standalone Repository As An Artifact
         uses: actions/upload-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-src-repo
+          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-src-repo
           path: |
-            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
-            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz.*
+            artifacts/src/salt-${{ inputs.salt-version }}.tar.gz
+            artifacts/src/salt-${{ inputs.salt-version }}.tar.gz.*
             artifacts/src/*-GPG-*
           retention-days: 7
           if-no-files-found: error
@@ -75,7 +122,7 @@
       - name: Upload Repository As An Artifact
         uses: ./.github/actions/upload-artifact
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
+          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
           path: artifacts/pkgs/repo/*
           retention-days: 7
           if-no-files-found: error
diff --git a/.github/workflows/templates/build-windows-repo.yml.jinja b/.github/workflows/build-windows-repo.yml
similarity index 63%
rename from .github/workflows/templates/build-windows-repo.yml.jinja
rename to .github/workflows/build-windows-repo.yml
index d806fd00bb3..f5a0b32ccd2 100644
--- a/.github/workflows/templates/build-windows-repo.yml.jinja
+++ b/.github/workflows/build-windows-repo.yml
@@ -1,5 +1,52 @@
+---
+name: Build Windows Repository
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        type: string
+        required: true
+        description: The environment to run against
+      gpg_key_id:
+        type: string
+        required: true
+        description: The GPG key ID to use
+      salt-version:
+        type: string
+        required: true
+        description: The Salt version of the packages to install and test
+
+env:
+  RELENV_DATA: "${{ github.workspace }}/.relenv"
+  COLUMNS: 190
+  AWS_MAX_ATTEMPTS: "10"
+  AWS_RETRY_MODE: "adaptive"
+  PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
+  PIP_EXTRA_INDEX_URL: https://pypi.org/simple
+
+jobs:
+
+  build-repo:
+    name: Windows
+    environment: ${{ inputs.environment }}
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-${{ inputs.environment }}
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - windows
 
     steps:
+
+      - name: "Throttle Builds"
+        shell: bash
+        run: |
+          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
+
       - uses: actions/checkout@v4
 
       - name: Setup Python Tools Scripts
@@ -14,25 +61,25 @@
       - name: Download Windows NSIS x86 Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-NSIS
+          name: salt-${{ inputs.salt-version }}-x86-NSIS
           path: artifacts/pkgs/incoming
 
       - name: Download Windows MSI x86 Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-MSI
+          name: salt-${{ inputs.salt-version }}-x86-MSI
           path: artifacts/pkgs/incoming
 
       - name: Download Windows NSIS amd64 Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-NSIS
+          name: salt-${{ inputs.salt-version }}-amd64-NSIS
           path: artifacts/pkgs/incoming
 
       - name: Download Windows MSI amd64 Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-MSI
+          name: salt-${{ inputs.salt-version }}-amd64-MSI
           path: artifacts/pkgs/incoming
 
       - name: Setup GnuPG
@@ -70,14 +117,14 @@
 
       - name: Create Repository
         run: |
-          tools pkg repo create windows --key-id=<{ gpg_key_id }> <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+          tools pkg repo create windows --key-id=${{ inputs.gpg_key_id }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
+            --salt-version=${{ inputs.salt-version }} \
             --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
 
       - name: Upload Repository As An Artifact
         uses: ./.github/actions/upload-artifact
         with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
+          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
           path: artifacts/pkgs/repo/*
           retention-days: 7
           if-no-files-found: error
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 914804ef073..064a7b30b7f 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -2314,634 +2314,78 @@ jobs:
           if-no-files-found: error
 
   build-src-repo:
-    name: Build Source Repository
-    environment: nightly
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-nightly
+    name: Build Repository
     needs:
       - prepare-workflow
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Download Source Tarball
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
-          path: artifacts/pkgs/incoming
-
-      - name: Setup GnuPG
-        run: |
-          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
-          GNUPGHOME="$(mktemp -d -p /run/gpg)"
-          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
-          cat <<EOF > "${GNUPGHOME}/gpg.conf"
-          batch
-          no-tty
-          pinentry-mode loopback
-          EOF
-
-      - name: Get Secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text | jq .default_key -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
-            | gpg --import -
-          sync
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
-          sync
-          rm "$SECRETS_KEY_FILE"
-          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
-
-      - name: Create Repository Path
-        run: |
-          mkdir -p artifacts/pkgs/repo
-
-      - name: Create Repository
-        run: |
-          tools pkg repo create src --key-id=64CBBC8173D76B3F --nightly-build-from=${{ github.ref_name }} \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
-            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
-
-      - name: Copy Files For Source Only Artifact Uploads
-        run: |
-          mkdir artifacts/src
-          find artifacts/pkgs/repo -type f -print -exec cp {} artifacts/src \;
-
-      - name: Upload Standalone Repository As An Artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-src-repo
-          path: |
-            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
-            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz.*
-            artifacts/src/*-GPG-*
-          retention-days: 7
-          if-no-files-found: error
-
-      - name: Upload Repository As An Artifact
-        uses: ./.github/actions/upload-artifact
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
-          path: artifacts/pkgs/repo/*
-          retention-days: 7
-          if-no-files-found: error
-          archive-name: src-repo
+      - build-source-tarball
+    uses: ./.github/workflows/build-src-repo.yml
+    with:
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      environment: nightly
+      gpg_key_id: 64CBBC8173D76B3F
+    secrets: inherit
 
   build-deb-repo:
-    name: Build DEB Repository
-    environment: nightly
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-nightly
+    name: Build Repository
     needs:
       - prepare-workflow
       - build-deb-pkgs-onedir
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - distro: debian
-            version: "10"
-            arch: x86_64
-          - distro: debian
-            version: "10"
-            arch: aarch64
-          - distro: debian
-            version: "11"
-            arch: x86_64
-          - distro: debian
-            version: "11"
-            arch: aarch64
-          - distro: ubuntu
-            version: "20.04"
-            arch: x86_64
-          - distro: ubuntu
-            version: "20.04"
-            arch: aarch64
-          - distro: ubuntu
-            version: "22.04"
-            arch: x86_64
-          - distro: ubuntu
-            version: "22.04"
-            arch: aarch64
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Download System Dependencies
-        run: |
-          sudo apt update
-          sudo apt install -y devscripts apt-utils
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Download DEB Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-deb
-          path: artifacts/pkgs/incoming
-
-      - name: Setup GnuPG
-        run: |
-          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
-          GNUPGHOME="$(mktemp -d -p /run/gpg)"
-          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
-          cat <<EOF > "${GNUPGHOME}/gpg.conf"
-          batch
-          no-tty
-          pinentry-mode loopback
-          EOF
-
-      - name: Get Secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text | jq .default_key -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
-            | gpg --import -
-          sync
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
-          sync
-          rm "$SECRETS_KEY_FILE"
-          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
-
-      - name: Create Repository Path
-        run: |
-          mkdir -p artifacts/pkgs/repo
-
-      - name: Create Repository
-        run: |
-          tools pkg repo create deb --key-id=64CBBC8173D76B3F --distro-arch=${{ matrix.arch }} --nightly-build-from=${{ github.ref_name }} \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
-            --distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
-            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
-
-      - name: Upload Repository As An Artifact
-        uses: ./.github/actions/upload-artifact
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
-          path: artifacts/pkgs/repo/*
-          retention-days: 7
-          if-no-files-found: error
-          archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
+    uses: ./.github/workflows/build-deb-repo.yml
+    with:
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      environment: nightly
+      gpg_key_id: 64CBBC8173D76B3F
+    secrets: inherit
 
   build-rpm-repo:
-    name: Build RPM Repository
-    environment: nightly
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-nightly
+    name: Build Repository
     needs:
       - prepare-workflow
       - build-rpm-pkgs-onedir
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - distro: amazon
-            version: "2"
-            arch: x86_64
-          - distro: amazon
-            version: "2"
-            arch: aarch64
-          - distro: redhat
-            version: "7"
-            arch: x86_64
-          - distro: redhat
-            version: "7"
-            arch: aarch64
-          - distro: redhat
-            version: "8"
-            arch: x86_64
-          - distro: redhat
-            version: "8"
-            arch: aarch64
-          - distro: redhat
-            version: "9"
-            arch: x86_64
-          - distro: redhat
-            version: "9"
-            arch: aarch64
-          - distro: fedora
-            version: "36"
-            arch: x86_64
-          - distro: fedora
-            version: "36"
-            arch: aarch64
-          - distro: fedora
-            version: "37"
-            arch: x86_64
-          - distro: fedora
-            version: "37"
-            arch: aarch64
-          - distro: fedora
-            version: "38"
-            arch: x86_64
-          - distro: fedora
-            version: "38"
-            arch: aarch64
-          - distro: photon
-            version: "3"
-            arch: x86_64
-          - distro: photon
-            version: "3"
-            arch: aarch64
-          - distro: photon
-            version: "4"
-            arch: x86_64
-          - distro: photon
-            version: "4"
-            arch: aarch64
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Download System Dependencies
-        run: |
-          sudo apt update
-          sudo apt install -y rpm
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Download RPM Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-rpm
-          path: artifacts/pkgs/incoming
-
-      - name: Setup GnuPG
-        run: |
-          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
-          GNUPGHOME="$(mktemp -d -p /run/gpg)"
-          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
-          cat <<EOF > "${GNUPGHOME}/gpg.conf"
-          batch
-          no-tty
-          pinentry-mode loopback
-          EOF
-
-      - name: Get Secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text | jq .default_key -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
-            | gpg --import -
-          sync
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
-          sync
-          rm "$SECRETS_KEY_FILE"
-          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
-
-      - name: Create Repository Path
-        run: |
-          mkdir -p artifacts/pkgs/repo
-
-      - name: Create Repository
-        env:
-          SALT_REPO_DOMAIN_RELEASE: ${{ vars.SALT_REPO_DOMAIN_RELEASE || 'repo.saltproject.io' }}
-          SALT_REPO_DOMAIN_STAGING: ${{ vars.SALT_REPO_DOMAIN_STAGING || 'staging.repo.saltproject.io' }}
-        run: |
-          tools pkg repo create rpm --key-id=64CBBC8173D76B3F --distro-arch=${{ matrix.arch }} --nightly-build-from=${{ github.ref_name }} \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
-            --distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
-            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
-
-      - name: Upload Repository As An Artifact
-        uses: ./.github/actions/upload-artifact
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
-          path: artifacts/pkgs/repo/*
-          retention-days: 7
-          if-no-files-found: error
-          archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
+    uses: ./.github/workflows/build-rpm-repo.yml
+    with:
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      environment: nightly
+      gpg_key_id: 64CBBC8173D76B3F
+    secrets: inherit
 
   build-windows-repo:
-    name: Build Windows Repository
-    environment: nightly
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-nightly
+    name: Build Repository
     needs:
       - prepare-workflow
       - build-windows-pkgs-onedir
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Download Windows NSIS x86 Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-NSIS
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows MSI x86 Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-MSI
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows NSIS amd64 Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-NSIS
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows MSI amd64 Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-MSI
-          path: artifacts/pkgs/incoming
-
-      - name: Setup GnuPG
-        run: |
-          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
-          GNUPGHOME="$(mktemp -d -p /run/gpg)"
-          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
-          cat <<EOF > "${GNUPGHOME}/gpg.conf"
-          batch
-          no-tty
-          pinentry-mode loopback
-          EOF
-
-      - name: Get Secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text | jq .default_key -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
-            | gpg --import -
-          sync
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
-          sync
-          rm "$SECRETS_KEY_FILE"
-          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
-
-      - name: Create Repository Path
-        run: |
-          mkdir -p artifacts/pkgs/repo
-
-      - name: Create Repository
-        run: |
-          tools pkg repo create windows --key-id=64CBBC8173D76B3F --nightly-build-from=${{ github.ref_name }} \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
-            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
-
-      - name: Upload Repository As An Artifact
-        uses: ./.github/actions/upload-artifact
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
-          path: artifacts/pkgs/repo/*
-          retention-days: 7
-          if-no-files-found: error
-          archive-name: windows-repo
+    uses: ./.github/workflows/build-windows-repo.yml
+    with:
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      environment: nightly
+      gpg_key_id: 64CBBC8173D76B3F
+    secrets: inherit
 
   build-macos-repo:
-    name: Build macOS Repository
-    environment: nightly
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-nightly
+    name: Build Repository
     needs:
       - prepare-workflow
       - build-macos-pkgs-onedir
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Download macOS x86_64 Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86_64-macos
-          path: artifacts/pkgs/incoming
-
-      - name: Setup GnuPG
-        run: |
-          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
-          GNUPGHOME="$(mktemp -d -p /run/gpg)"
-          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
-          cat <<EOF > "${GNUPGHOME}/gpg.conf"
-          batch
-          no-tty
-          pinentry-mode loopback
-          EOF
-
-      - name: Get Secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text | jq .default_key -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
-            | gpg --import -
-          sync
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
-          sync
-          rm "$SECRETS_KEY_FILE"
-          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
-
-      - name: Create Repository Path
-        run: |
-          mkdir -p artifacts/pkgs/repo
-
-      - name: Create Repository
-        run: |
-          tools pkg repo create macos --key-id=64CBBC8173D76B3F --nightly-build-from=${{ github.ref_name }} \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
-            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
-
-      - name: Upload Repository As An Artifact
-        uses: ./.github/actions/upload-artifact
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
-          path: artifacts/pkgs/repo/*
-          retention-days: 7
-          if-no-files-found: error
-          archive-name: macos-repo
+    uses: ./.github/workflows/build-macos-repo.yml
+    with:
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      environment: nightly
+      gpg_key_id: 64CBBC8173D76B3F
+    secrets: inherit
 
   build-onedir-repo:
-    name: Build Onedir Repository
-    environment: nightly
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-nightly
+    name: Build Repository
     needs:
       - prepare-workflow
       - build-salt-onedir-linux
       - build-salt-onedir-macos
       - build-salt-onedir-windows
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Download Linux x86_64 Onedir Archive
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-x86_64.tar.xz
-          path: artifacts/pkgs/incoming
-
-      - name: Download Linux aarch64 Onedir Archive
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-aarch64.tar.xz
-          path: artifacts/pkgs/incoming
-
-      - name: Download macOS x86_64 Onedir Archive
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-darwin-x86_64.tar.xz
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows amd64 Onedir Archive
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.tar.xz
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows amd64 Onedir Archive(zip)
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.zip
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows x86 Onedir Archive
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.tar.xz
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows amd64 Onedir Archive(zip)
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.zip
-          path: artifacts/pkgs/incoming
-
-      - name: Setup GnuPG
-        run: |
-          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
-          GNUPGHOME="$(mktemp -d -p /run/gpg)"
-          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
-          cat <<EOF > "${GNUPGHOME}/gpg.conf"
-          batch
-          no-tty
-          pinentry-mode loopback
-          EOF
-
-      - name: Get Secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text | jq .default_key -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
-            | gpg --import -
-          sync
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
-          sync
-          rm "$SECRETS_KEY_FILE"
-          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
-
-      - name: Create Repository Path
-        run: |
-          mkdir -p artifacts/pkgs/repo
-
-      - name: Create Repository
-        run: |
-          tools pkg repo create onedir --key-id=64CBBC8173D76B3F --nightly-build-from=${{ github.ref_name }} \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
-            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
-
-      - name: Upload Repository As An Artifact
-        uses: ./.github/actions/upload-artifact
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
-          path: artifacts/pkgs/repo/*
-          retention-days: 7
-          if-no-files-found: error
-          archive-name: onedir-repo
+    uses: ./.github/workflows/build-onedir-repo.yml
+    with:
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      environment: nightly
+      gpg_key_id: 64CBBC8173D76B3F
+    secrets: inherit
 
   publish-repositories:
     name: Publish Repositories
diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml
index 4f7e567e94d..e1a3c7a087c 100644
--- a/.github/workflows/staging.yml
+++ b/.github/workflows/staging.yml
@@ -2170,636 +2170,78 @@ jobs:
       skip-junit-reports: true
 
   build-src-repo:
-    name: Build Source Repository
-    environment: staging
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-staging
+    name: Build Repository
     needs:
       - prepare-workflow
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Download Source Tarball
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
-          path: artifacts/pkgs/incoming
-
-      - name: Setup GnuPG
-        run: |
-          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
-          GNUPGHOME="$(mktemp -d -p /run/gpg)"
-          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
-          cat <<EOF > "${GNUPGHOME}/gpg.conf"
-          batch
-          no-tty
-          pinentry-mode loopback
-          EOF
-
-      - name: Get Secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text | jq .default_key -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
-            | gpg --import -
-          sync
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
-          sync
-          rm "$SECRETS_KEY_FILE"
-          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
-
-      - name: Create Repository Path
-        run: |
-          mkdir -p artifacts/pkgs/repo
-
-      - name: Create Repository
-        run: |
-          tools pkg repo create src --key-id=64CBBC8173D76B3F  \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
-            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
-
-      - name: Copy Files For Source Only Artifact Uploads
-        run: |
-          mkdir artifacts/src
-          find artifacts/pkgs/repo -type f -print -exec cp {} artifacts/src \;
-
-      - name: Upload Standalone Repository As An Artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-src-repo
-          path: |
-            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
-            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz.*
-            artifacts/src/*-GPG-*
-          retention-days: 7
-          if-no-files-found: error
-
-      - name: Upload Repository As An Artifact
-        uses: ./.github/actions/upload-artifact
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
-          path: artifacts/pkgs/repo/*
-          retention-days: 7
-          if-no-files-found: error
-          archive-name: src-repo
+      - build-source-tarball
+    uses: ./.github/workflows/build-src-repo.yml
+    with:
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      environment: staging
+      gpg_key_id: 64CBBC8173D76B3F
+    secrets: inherit
 
   build-deb-repo:
-    name: Build DEB Repository
-    environment: staging
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-staging
+    name: Build Repository
     needs:
       - prepare-workflow
       - build-deb-pkgs-onedir
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - distro: debian
-            version: "10"
-            arch: x86_64
-          - distro: debian
-            version: "10"
-            arch: aarch64
-          - distro: debian
-            version: "11"
-            arch: x86_64
-          - distro: debian
-            version: "11"
-            arch: aarch64
-          - distro: ubuntu
-            version: "20.04"
-            arch: x86_64
-          - distro: ubuntu
-            version: "20.04"
-            arch: aarch64
-          - distro: ubuntu
-            version: "22.04"
-            arch: x86_64
-          - distro: ubuntu
-            version: "22.04"
-            arch: aarch64
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Download System Dependencies
-        run: |
-          sudo apt update
-          sudo apt install -y devscripts apt-utils
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Download DEB Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-deb
-          path: artifacts/pkgs/incoming
-
-      - name: Setup GnuPG
-        run: |
-          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
-          GNUPGHOME="$(mktemp -d -p /run/gpg)"
-          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
-          cat <<EOF > "${GNUPGHOME}/gpg.conf"
-          batch
-          no-tty
-          pinentry-mode loopback
-          EOF
-
-      - name: Get Secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text | jq .default_key -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
-            | gpg --import -
-          sync
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
-          sync
-          rm "$SECRETS_KEY_FILE"
-          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
-
-      - name: Create Repository Path
-        run: |
-          mkdir -p artifacts/pkgs/repo
-
-      - name: Create Repository
-        run: |
-          tools pkg repo create deb --key-id=64CBBC8173D76B3F --distro-arch=${{ matrix.arch }}  \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
-            --distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
-            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
-
-      - name: Upload Repository As An Artifact
-        uses: ./.github/actions/upload-artifact
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
-          path: artifacts/pkgs/repo/*
-          retention-days: 7
-          if-no-files-found: error
-          archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
+    uses: ./.github/workflows/build-deb-repo.yml
+    with:
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      environment: staging
+      gpg_key_id: 64CBBC8173D76B3F
+    secrets: inherit
 
   build-rpm-repo:
-    name: Build RPM Repository
-    environment: staging
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-staging
+    name: Build Repository
     needs:
       - prepare-workflow
       - build-rpm-pkgs-onedir
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - distro: amazon
-            version: "2"
-            arch: x86_64
-          - distro: amazon
-            version: "2"
-            arch: aarch64
-          - distro: redhat
-            version: "7"
-            arch: x86_64
-          - distro: redhat
-            version: "7"
-            arch: aarch64
-          - distro: redhat
-            version: "8"
-            arch: x86_64
-          - distro: redhat
-            version: "8"
-            arch: aarch64
-          - distro: redhat
-            version: "9"
-            arch: x86_64
-          - distro: redhat
-            version: "9"
-            arch: aarch64
-          - distro: fedora
-            version: "36"
-            arch: x86_64
-          - distro: fedora
-            version: "36"
-            arch: aarch64
-          - distro: fedora
-            version: "37"
-            arch: x86_64
-          - distro: fedora
-            version: "37"
-            arch: aarch64
-          - distro: fedora
-            version: "38"
-            arch: x86_64
-          - distro: fedora
-            version: "38"
-            arch: aarch64
-          - distro: photon
-            version: "3"
-            arch: x86_64
-          - distro: photon
-            version: "3"
-            arch: aarch64
-          - distro: photon
-            version: "4"
-            arch: x86_64
-          - distro: photon
-            version: "4"
-            arch: aarch64
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Download System Dependencies
-        run: |
-          sudo apt update
-          sudo apt install -y rpm
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Download RPM Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-rpm
-          path: artifacts/pkgs/incoming
-
-      - name: Setup GnuPG
-        run: |
-          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
-          GNUPGHOME="$(mktemp -d -p /run/gpg)"
-          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
-          cat <<EOF > "${GNUPGHOME}/gpg.conf"
-          batch
-          no-tty
-          pinentry-mode loopback
-          EOF
-
-      - name: Get Secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text | jq .default_key -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
-            | gpg --import -
-          sync
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
-          sync
-          rm "$SECRETS_KEY_FILE"
-          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
-
-      - name: Create Repository Path
-        run: |
-          mkdir -p artifacts/pkgs/repo
-
-      - name: Create Repository
-        env:
-          SALT_REPO_USER: ${{ secrets.SALT_REPO_USER }}
-          SALT_REPO_PASS: ${{ secrets.SALT_REPO_PASS }}
-          SALT_REPO_DOMAIN_RELEASE: ${{ vars.SALT_REPO_DOMAIN_RELEASE || 'repo.saltproject.io' }}
-          SALT_REPO_DOMAIN_STAGING: ${{ vars.SALT_REPO_DOMAIN_STAGING || 'staging.repo.saltproject.io' }}
-        run: |
-          tools pkg repo create rpm --key-id=64CBBC8173D76B3F --distro-arch=${{ matrix.arch }}  \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
-            --distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
-            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
-
-      - name: Upload Repository As An Artifact
-        uses: ./.github/actions/upload-artifact
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
-          path: artifacts/pkgs/repo/*
-          retention-days: 7
-          if-no-files-found: error
-          archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
+    uses: ./.github/workflows/build-rpm-repo.yml
+    with:
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      environment: staging
+      gpg_key_id: 64CBBC8173D76B3F
+    secrets: inherit
 
   build-windows-repo:
-    name: Build Windows Repository
-    environment: staging
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-staging
+    name: Build Repository
     needs:
       - prepare-workflow
       - build-windows-pkgs-onedir
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Download Windows NSIS x86 Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-NSIS
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows MSI x86 Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-MSI
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows NSIS amd64 Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-NSIS
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows MSI amd64 Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-MSI
-          path: artifacts/pkgs/incoming
-
-      - name: Setup GnuPG
-        run: |
-          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
-          GNUPGHOME="$(mktemp -d -p /run/gpg)"
-          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
-          cat <<EOF > "${GNUPGHOME}/gpg.conf"
-          batch
-          no-tty
-          pinentry-mode loopback
-          EOF
-
-      - name: Get Secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text | jq .default_key -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
-            | gpg --import -
-          sync
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
-          sync
-          rm "$SECRETS_KEY_FILE"
-          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
-
-      - name: Create Repository Path
-        run: |
-          mkdir -p artifacts/pkgs/repo
-
-      - name: Create Repository
-        run: |
-          tools pkg repo create windows --key-id=64CBBC8173D76B3F  \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
-            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
-
-      - name: Upload Repository As An Artifact
-        uses: ./.github/actions/upload-artifact
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
-          path: artifacts/pkgs/repo/*
-          retention-days: 7
-          if-no-files-found: error
-          archive-name: windows-repo
+    uses: ./.github/workflows/build-windows-repo.yml
+    with:
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      environment: staging
+      gpg_key_id: 64CBBC8173D76B3F
+    secrets: inherit
 
   build-macos-repo:
-    name: Build macOS Repository
-    environment: staging
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-staging
+    name: Build Repository
     needs:
       - prepare-workflow
       - build-macos-pkgs-onedir
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Download macOS x86_64 Packages
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86_64-macos
-          path: artifacts/pkgs/incoming
-
-      - name: Setup GnuPG
-        run: |
-          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
-          GNUPGHOME="$(mktemp -d -p /run/gpg)"
-          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
-          cat <<EOF > "${GNUPGHOME}/gpg.conf"
-          batch
-          no-tty
-          pinentry-mode loopback
-          EOF
-
-      - name: Get Secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text | jq .default_key -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
-            | gpg --import -
-          sync
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
-          sync
-          rm "$SECRETS_KEY_FILE"
-          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
-
-      - name: Create Repository Path
-        run: |
-          mkdir -p artifacts/pkgs/repo
-
-      - name: Create Repository
-        run: |
-          tools pkg repo create macos --key-id=64CBBC8173D76B3F  \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
-            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
-
-      - name: Upload Repository As An Artifact
-        uses: ./.github/actions/upload-artifact
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
-          path: artifacts/pkgs/repo/*
-          retention-days: 7
-          if-no-files-found: error
-          archive-name: macos-repo
+    uses: ./.github/workflows/build-macos-repo.yml
+    with:
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      environment: staging
+      gpg_key_id: 64CBBC8173D76B3F
+    secrets: inherit
 
   build-onedir-repo:
-    name: Build Onedir Repository
-    environment: staging
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-staging
+    name: Build Repository
     needs:
       - prepare-workflow
       - build-salt-onedir-linux
       - build-salt-onedir-macos
       - build-salt-onedir-windows
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Download Linux x86_64 Onedir Archive
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-x86_64.tar.xz
-          path: artifacts/pkgs/incoming
-
-      - name: Download Linux aarch64 Onedir Archive
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-aarch64.tar.xz
-          path: artifacts/pkgs/incoming
-
-      - name: Download macOS x86_64 Onedir Archive
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-darwin-x86_64.tar.xz
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows amd64 Onedir Archive
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.tar.xz
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows amd64 Onedir Archive(zip)
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.zip
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows x86 Onedir Archive
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.tar.xz
-          path: artifacts/pkgs/incoming
-
-      - name: Download Windows amd64 Onedir Archive(zip)
-        uses: actions/download-artifact@v3
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.zip
-          path: artifacts/pkgs/incoming
-
-      - name: Setup GnuPG
-        run: |
-          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
-          GNUPGHOME="$(mktemp -d -p /run/gpg)"
-          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
-          cat <<EOF > "${GNUPGHOME}/gpg.conf"
-          batch
-          no-tty
-          pinentry-mode loopback
-          EOF
-
-      - name: Get Secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text | jq .default_key -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
-            | gpg --import -
-          sync
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
-          sync
-          rm "$SECRETS_KEY_FILE"
-          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
-
-      - name: Create Repository Path
-        run: |
-          mkdir -p artifacts/pkgs/repo
-
-      - name: Create Repository
-        run: |
-          tools pkg repo create onedir --key-id=64CBBC8173D76B3F  \
-            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
-            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
-
-      - name: Upload Repository As An Artifact
-        uses: ./.github/actions/upload-artifact
-        with:
-          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
-          path: artifacts/pkgs/repo/*
-          retention-days: 7
-          if-no-files-found: error
-          archive-name: onedir-repo
+    uses: ./.github/workflows/build-onedir-repo.yml
+    with:
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      environment: staging
+      gpg_key_id: 64CBBC8173D76B3F
+    secrets: inherit
 
   publish-repositories:
     name: Publish Repositories
diff --git a/.github/workflows/templates/build-repos.yml.jinja b/.github/workflows/templates/build-repos.yml.jinja
index da05231fdb5..313a178a093 100644
--- a/.github/workflows/templates/build-repos.yml.jinja
+++ b/.github/workflows/templates/build-repos.yml.jinja
@@ -1,33 +1,33 @@
-<%- for platform, type, display_name, needs_pkg in (
-                                                    (None, "src", "Source", False),
-                                                    ("linux", "deb", "DEB", True),
-                                                    ("linux", "rpm", "RPM", True),
-                                                    ("windows", "windows", "Windows", True),
-                                                    ("macos", "macos", "macOS", True),
-                                                    (None, "onedir", "Onedir", False),
-                                                  ) %>
+<%- for type, display_name in (
+                                ("src", "Source"),
+                                ("deb", "DEB"),
+                                ("rpm", "RPM"),
+                                ("windows", "Windows"),
+                                ("macos", "macOS"),
+                                ("onedir", "Onedir"),
+                              ) %>
 
   <%- set job_name = "build-{}-repo".format(type) %>
     <%- do build_repo_needs.append(job_name) %>
 
   <{ job_name }>:
-    name: Build <{ display_name }> Repository
-    environment: <{ gh_environment }>
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-<{ gh_environment }>
+    name: Build Repository
     needs:
       - prepare-workflow
-      <%- if needs_pkg %>
+      <%- if type not in ("src", "onedir") %>
       - build-<{ type }>-pkgs-onedir
-      <%- elif platform %>
-      - build-salt-onedir-<{ platform }>
       <%- elif type == 'onedir' %>
       - build-salt-onedir-linux
       - build-salt-onedir-macos
       - build-salt-onedir-windows
+      <%- elif type == 'src' %>
+      - build-source-tarball
       <%- endif %>
-    <%- include "build-{}-repo.yml.jinja".format(type) %>
+    uses: ./.github/workflows/build-<{ type }>-repo.yml
+    with:
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      environment: <{ gh_environment }>
+      gpg_key_id: <{ gpg_key_id }>
+    secrets: inherit
 
 <%- endfor %>
diff --git a/tools/ci.py b/tools/ci.py
index cc6578be789..e9afa16c98c 100644
--- a/tools/ci.py
+++ b/tools/ci.py
@@ -777,6 +777,69 @@ def pkg_matrix(
     ctx.exit(0)
 
 
+@ci.command(
+    name="pkg-repo-matrix",
+    arguments={
+        "pkg_type": {
+            "help": "The package type",
+        },
+    },
+)
+def pkg_repo_matrix(ctx: Context, pkg_type: str):
+    """
+    Generate the matrix for the package repository builds
+    """
+    _matrix = []
+    if pkg_type == "deb":
+        for distro in ("debian", "ubuntu"):
+            if distro == "debian":
+                versions = ["10", "11"]
+            else:
+                versions = ["20.04", "22.04"]
+            for arch in ("x86_64", "aarch64"):
+                for version in versions:
+                    _matrix.append(
+                        {
+                            "distro": distro,
+                            "version": version,
+                            "arch": arch,
+                        }
+                    )
+    elif pkg_type == "rpm":
+        for distro in ("amazon", "redhat", "fedora", "photon"):
+            if distro == "amazon":
+                versions = ["2"]
+            elif distro == "redhat":
+                versions = ["7", "8", "9"]
+            elif distro == "fedora":
+                versions = ["36", "37", "38"]
+            elif distro == "photon":
+                versions = ["3", "4"]
+            else:
+                ctx.error(f"Don't know how to handle distro {distro}")
+                ctx.exit(1)
+            for arch in ("x86_64", "aarch64"):
+                for version in versions:
+                    _matrix.append(
+                        {
+                            "distro": distro,
+                            "version": version,
+                            "arch": arch,
+                        }
+                    )
+    else:
+        _matrix.append({"pkg_type": pkg_type})
+
+    ctx.info("Generated matrix:")
+    ctx.print(_matrix, soft_wrap=True)
+
+    github_output = os.environ.get("GITHUB_OUTPUT")
+    if github_output is not None:
+        with open(github_output, "a", encoding="utf-8") as wfh:
+            wfh.write(f"matrix={json.dumps(_matrix)}\n")
+    ctx.exit(0)
+
+
 @ci.command(
     name="get-releases",
     arguments={

From 13b6b00171e30b36daef5c2faa54c6bf249680bf Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Fri, 6 Oct 2023 10:15:34 +0100
Subject: [PATCH 25/29] Revert "Create workflow for each of the supported
 repositories"

This reverts commit 19eb5a8c446e67969e84630c2eb172527348456d.

BAH!

```
too many workflows are referenced, total: 21, limit: 20
```

https://docs.github.com/en/enterprise-cloud@latest/actions/using-workflows/reusing-workflows#limitations
---
 .github/workflows/nightly.yml                 | 642 +++++++++++++++--
 .github/workflows/staging.yml                 | 644 ++++++++++++++++--
 .../build-deb-repo.yml.jinja}                 |  94 +--
 .../build-macos-repo.yml.jinja}               |  56 +-
 .../build-onedir-repo.yml.jinja}              |  67 +-
 .../workflows/templates/build-repos.yml.jinja |  36 +-
 .../build-rpm-repo.yml.jinja}                 |  99 +--
 .../build-src-repo.yml.jinja}                 |  61 +-
 .../build-windows-repo.yml.jinja}             |  61 +-
 tools/ci.py                                   |  63 --
 10 files changed, 1298 insertions(+), 525 deletions(-)
 rename .github/workflows/{build-deb-repo.yml => templates/build-deb-repo.yml.jinja} (55%)
 rename .github/workflows/{build-macos-repo.yml => templates/build-macos-repo.yml.jinja} (62%)
 rename .github/workflows/{build-onedir-repo.yml => templates/build-onedir-repo.yml.jinja} (63%)
 rename .github/workflows/{build-rpm-repo.yml => templates/build-rpm-repo.yml.jinja} (60%)
 rename .github/workflows/{build-src-repo.yml => templates/build-src-repo.yml.jinja} (63%)
 rename .github/workflows/{build-windows-repo.yml => templates/build-windows-repo.yml.jinja} (63%)

diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 064a7b30b7f..914804ef073 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -2314,78 +2314,634 @@ jobs:
           if-no-files-found: error
 
   build-src-repo:
-    name: Build Repository
+    name: Build Source Repository
+    environment: nightly
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-nightly
     needs:
       - prepare-workflow
-      - build-source-tarball
-    uses: ./.github/workflows/build-src-repo.yml
-    with:
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      environment: nightly
-      gpg_key_id: 64CBBC8173D76B3F
-    secrets: inherit
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Get Salt Project GitHub Actions Bot Environment
+        run: |
+          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
+          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
+          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
+
+      - name: Download Source Tarball
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
+          path: artifacts/pkgs/incoming
+
+      - name: Setup GnuPG
+        run: |
+          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
+          GNUPGHOME="$(mktemp -d -p /run/gpg)"
+          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
+          cat <<EOF > "${GNUPGHOME}/gpg.conf"
+          batch
+          no-tty
+          pinentry-mode loopback
+          EOF
+
+      - name: Get Secrets
+        env:
+          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
+        run: |
+          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
+          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text | jq .default_key -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
+            | gpg --import -
+          sync
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
+          sync
+          rm "$SECRETS_KEY_FILE"
+          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
+
+      - name: Create Repository Path
+        run: |
+          mkdir -p artifacts/pkgs/repo
+
+      - name: Create Repository
+        run: |
+          tools pkg repo create src --key-id=64CBBC8173D76B3F --nightly-build-from=${{ github.ref_name }} \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
+
+      - name: Copy Files For Source Only Artifact Uploads
+        run: |
+          mkdir artifacts/src
+          find artifacts/pkgs/repo -type f -print -exec cp {} artifacts/src \;
+
+      - name: Upload Standalone Repository As An Artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-src-repo
+          path: |
+            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
+            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz.*
+            artifacts/src/*-GPG-*
+          retention-days: 7
+          if-no-files-found: error
+
+      - name: Upload Repository As An Artifact
+        uses: ./.github/actions/upload-artifact
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
+          path: artifacts/pkgs/repo/*
+          retention-days: 7
+          if-no-files-found: error
+          archive-name: src-repo
 
   build-deb-repo:
-    name: Build Repository
+    name: Build DEB Repository
+    environment: nightly
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-nightly
     needs:
       - prepare-workflow
       - build-deb-pkgs-onedir
-    uses: ./.github/workflows/build-deb-repo.yml
-    with:
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      environment: nightly
-      gpg_key_id: 64CBBC8173D76B3F
-    secrets: inherit
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - distro: debian
+            version: "10"
+            arch: x86_64
+          - distro: debian
+            version: "10"
+            arch: aarch64
+          - distro: debian
+            version: "11"
+            arch: x86_64
+          - distro: debian
+            version: "11"
+            arch: aarch64
+          - distro: ubuntu
+            version: "20.04"
+            arch: x86_64
+          - distro: ubuntu
+            version: "20.04"
+            arch: aarch64
+          - distro: ubuntu
+            version: "22.04"
+            arch: x86_64
+          - distro: ubuntu
+            version: "22.04"
+            arch: aarch64
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download System Dependencies
+        run: |
+          sudo apt update
+          sudo apt install -y devscripts apt-utils
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Get Salt Project GitHub Actions Bot Environment
+        run: |
+          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
+          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
+          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
+
+      - name: Download DEB Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-deb
+          path: artifacts/pkgs/incoming
+
+      - name: Setup GnuPG
+        run: |
+          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
+          GNUPGHOME="$(mktemp -d -p /run/gpg)"
+          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
+          cat <<EOF > "${GNUPGHOME}/gpg.conf"
+          batch
+          no-tty
+          pinentry-mode loopback
+          EOF
+
+      - name: Get Secrets
+        env:
+          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
+        run: |
+          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
+          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text | jq .default_key -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
+            | gpg --import -
+          sync
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
+          sync
+          rm "$SECRETS_KEY_FILE"
+          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
+
+      - name: Create Repository Path
+        run: |
+          mkdir -p artifacts/pkgs/repo
+
+      - name: Create Repository
+        run: |
+          tools pkg repo create deb --key-id=64CBBC8173D76B3F --distro-arch=${{ matrix.arch }} --nightly-build-from=${{ github.ref_name }} \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+            --distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
+            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
+
+      - name: Upload Repository As An Artifact
+        uses: ./.github/actions/upload-artifact
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
+          path: artifacts/pkgs/repo/*
+          retention-days: 7
+          if-no-files-found: error
+          archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
 
   build-rpm-repo:
-    name: Build Repository
+    name: Build RPM Repository
+    environment: nightly
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-nightly
     needs:
       - prepare-workflow
       - build-rpm-pkgs-onedir
-    uses: ./.github/workflows/build-rpm-repo.yml
-    with:
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      environment: nightly
-      gpg_key_id: 64CBBC8173D76B3F
-    secrets: inherit
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - distro: amazon
+            version: "2"
+            arch: x86_64
+          - distro: amazon
+            version: "2"
+            arch: aarch64
+          - distro: redhat
+            version: "7"
+            arch: x86_64
+          - distro: redhat
+            version: "7"
+            arch: aarch64
+          - distro: redhat
+            version: "8"
+            arch: x86_64
+          - distro: redhat
+            version: "8"
+            arch: aarch64
+          - distro: redhat
+            version: "9"
+            arch: x86_64
+          - distro: redhat
+            version: "9"
+            arch: aarch64
+          - distro: fedora
+            version: "36"
+            arch: x86_64
+          - distro: fedora
+            version: "36"
+            arch: aarch64
+          - distro: fedora
+            version: "37"
+            arch: x86_64
+          - distro: fedora
+            version: "37"
+            arch: aarch64
+          - distro: fedora
+            version: "38"
+            arch: x86_64
+          - distro: fedora
+            version: "38"
+            arch: aarch64
+          - distro: photon
+            version: "3"
+            arch: x86_64
+          - distro: photon
+            version: "3"
+            arch: aarch64
+          - distro: photon
+            version: "4"
+            arch: x86_64
+          - distro: photon
+            version: "4"
+            arch: aarch64
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download System Dependencies
+        run: |
+          sudo apt update
+          sudo apt install -y rpm
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Get Salt Project GitHub Actions Bot Environment
+        run: |
+          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
+          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
+          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
+
+      - name: Download RPM Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-rpm
+          path: artifacts/pkgs/incoming
+
+      - name: Setup GnuPG
+        run: |
+          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
+          GNUPGHOME="$(mktemp -d -p /run/gpg)"
+          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
+          cat <<EOF > "${GNUPGHOME}/gpg.conf"
+          batch
+          no-tty
+          pinentry-mode loopback
+          EOF
+
+      - name: Get Secrets
+        env:
+          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
+        run: |
+          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
+          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text | jq .default_key -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
+            | gpg --import -
+          sync
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
+          sync
+          rm "$SECRETS_KEY_FILE"
+          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
+
+      - name: Create Repository Path
+        run: |
+          mkdir -p artifacts/pkgs/repo
+
+      - name: Create Repository
+        env:
+          SALT_REPO_DOMAIN_RELEASE: ${{ vars.SALT_REPO_DOMAIN_RELEASE || 'repo.saltproject.io' }}
+          SALT_REPO_DOMAIN_STAGING: ${{ vars.SALT_REPO_DOMAIN_STAGING || 'staging.repo.saltproject.io' }}
+        run: |
+          tools pkg repo create rpm --key-id=64CBBC8173D76B3F --distro-arch=${{ matrix.arch }} --nightly-build-from=${{ github.ref_name }} \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+            --distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
+            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
+
+      - name: Upload Repository As An Artifact
+        uses: ./.github/actions/upload-artifact
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
+          path: artifacts/pkgs/repo/*
+          retention-days: 7
+          if-no-files-found: error
+          archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
 
   build-windows-repo:
-    name: Build Repository
+    name: Build Windows Repository
+    environment: nightly
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-nightly
     needs:
       - prepare-workflow
       - build-windows-pkgs-onedir
-    uses: ./.github/workflows/build-windows-repo.yml
-    with:
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      environment: nightly
-      gpg_key_id: 64CBBC8173D76B3F
-    secrets: inherit
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Get Salt Project GitHub Actions Bot Environment
+        run: |
+          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
+          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
+          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
+
+      - name: Download Windows NSIS x86 Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-NSIS
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows MSI x86 Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-MSI
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows NSIS amd64 Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-NSIS
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows MSI amd64 Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-MSI
+          path: artifacts/pkgs/incoming
+
+      - name: Setup GnuPG
+        run: |
+          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
+          GNUPGHOME="$(mktemp -d -p /run/gpg)"
+          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
+          cat <<EOF > "${GNUPGHOME}/gpg.conf"
+          batch
+          no-tty
+          pinentry-mode loopback
+          EOF
+
+      - name: Get Secrets
+        env:
+          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
+        run: |
+          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
+          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text | jq .default_key -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
+            | gpg --import -
+          sync
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
+          sync
+          rm "$SECRETS_KEY_FILE"
+          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
+
+      - name: Create Repository Path
+        run: |
+          mkdir -p artifacts/pkgs/repo
+
+      - name: Create Repository
+        run: |
+          tools pkg repo create windows --key-id=64CBBC8173D76B3F --nightly-build-from=${{ github.ref_name }} \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
+
+      - name: Upload Repository As An Artifact
+        uses: ./.github/actions/upload-artifact
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
+          path: artifacts/pkgs/repo/*
+          retention-days: 7
+          if-no-files-found: error
+          archive-name: windows-repo
 
   build-macos-repo:
-    name: Build Repository
+    name: Build macOS Repository
+    environment: nightly
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-nightly
     needs:
       - prepare-workflow
       - build-macos-pkgs-onedir
-    uses: ./.github/workflows/build-macos-repo.yml
-    with:
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      environment: nightly
-      gpg_key_id: 64CBBC8173D76B3F
-    secrets: inherit
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Get Salt Project GitHub Actions Bot Environment
+        run: |
+          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
+          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
+          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
+
+      - name: Download macOS x86_64 Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86_64-macos
+          path: artifacts/pkgs/incoming
+
+      - name: Setup GnuPG
+        run: |
+          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
+          GNUPGHOME="$(mktemp -d -p /run/gpg)"
+          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
+          cat <<EOF > "${GNUPGHOME}/gpg.conf"
+          batch
+          no-tty
+          pinentry-mode loopback
+          EOF
+
+      - name: Get Secrets
+        env:
+          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
+        run: |
+          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
+          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text | jq .default_key -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
+            | gpg --import -
+          sync
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
+          sync
+          rm "$SECRETS_KEY_FILE"
+          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
+
+      - name: Create Repository Path
+        run: |
+          mkdir -p artifacts/pkgs/repo
+
+      - name: Create Repository
+        run: |
+          tools pkg repo create macos --key-id=64CBBC8173D76B3F --nightly-build-from=${{ github.ref_name }} \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
+
+      - name: Upload Repository As An Artifact
+        uses: ./.github/actions/upload-artifact
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
+          path: artifacts/pkgs/repo/*
+          retention-days: 7
+          if-no-files-found: error
+          archive-name: macos-repo
 
   build-onedir-repo:
-    name: Build Repository
+    name: Build Onedir Repository
+    environment: nightly
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-nightly
     needs:
       - prepare-workflow
       - build-salt-onedir-linux
       - build-salt-onedir-macos
       - build-salt-onedir-windows
-    uses: ./.github/workflows/build-onedir-repo.yml
-    with:
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      environment: nightly
-      gpg_key_id: 64CBBC8173D76B3F
-    secrets: inherit
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Get Salt Project GitHub Actions Bot Environment
+        run: |
+          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
+          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
+          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
+
+      - name: Download Linux x86_64 Onedir Archive
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-x86_64.tar.xz
+          path: artifacts/pkgs/incoming
+
+      - name: Download Linux aarch64 Onedir Archive
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-aarch64.tar.xz
+          path: artifacts/pkgs/incoming
+
+      - name: Download macOS x86_64 Onedir Archive
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-darwin-x86_64.tar.xz
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows amd64 Onedir Archive
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.tar.xz
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows amd64 Onedir Archive(zip)
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.zip
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows x86 Onedir Archive
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.tar.xz
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows amd64 Onedir Archive(zip)
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.zip
+          path: artifacts/pkgs/incoming
+
+      - name: Setup GnuPG
+        run: |
+          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
+          GNUPGHOME="$(mktemp -d -p /run/gpg)"
+          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
+          cat <<EOF > "${GNUPGHOME}/gpg.conf"
+          batch
+          no-tty
+          pinentry-mode loopback
+          EOF
+
+      - name: Get Secrets
+        env:
+          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
+        run: |
+          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
+          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text | jq .default_key -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
+            | gpg --import -
+          sync
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
+          sync
+          rm "$SECRETS_KEY_FILE"
+          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
+
+      - name: Create Repository Path
+        run: |
+          mkdir -p artifacts/pkgs/repo
+
+      - name: Create Repository
+        run: |
+          tools pkg repo create onedir --key-id=64CBBC8173D76B3F --nightly-build-from=${{ github.ref_name }} \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
+
+      - name: Upload Repository As An Artifact
+        uses: ./.github/actions/upload-artifact
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-nightly-repo
+          path: artifacts/pkgs/repo/*
+          retention-days: 7
+          if-no-files-found: error
+          archive-name: onedir-repo
 
   publish-repositories:
     name: Publish Repositories
diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml
index e1a3c7a087c..4f7e567e94d 100644
--- a/.github/workflows/staging.yml
+++ b/.github/workflows/staging.yml
@@ -2170,78 +2170,636 @@ jobs:
       skip-junit-reports: true
 
   build-src-repo:
-    name: Build Repository
+    name: Build Source Repository
+    environment: staging
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-staging
     needs:
       - prepare-workflow
-      - build-source-tarball
-    uses: ./.github/workflows/build-src-repo.yml
-    with:
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      environment: staging
-      gpg_key_id: 64CBBC8173D76B3F
-    secrets: inherit
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Get Salt Project GitHub Actions Bot Environment
+        run: |
+          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
+          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
+          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
+
+      - name: Download Source Tarball
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
+          path: artifacts/pkgs/incoming
+
+      - name: Setup GnuPG
+        run: |
+          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
+          GNUPGHOME="$(mktemp -d -p /run/gpg)"
+          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
+          cat <<EOF > "${GNUPGHOME}/gpg.conf"
+          batch
+          no-tty
+          pinentry-mode loopback
+          EOF
+
+      - name: Get Secrets
+        env:
+          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
+        run: |
+          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
+          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text | jq .default_key -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
+            | gpg --import -
+          sync
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
+          sync
+          rm "$SECRETS_KEY_FILE"
+          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
+
+      - name: Create Repository Path
+        run: |
+          mkdir -p artifacts/pkgs/repo
+
+      - name: Create Repository
+        run: |
+          tools pkg repo create src --key-id=64CBBC8173D76B3F  \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
+
+      - name: Copy Files For Source Only Artifact Uploads
+        run: |
+          mkdir artifacts/src
+          find artifacts/pkgs/repo -type f -print -exec cp {} artifacts/src \;
+
+      - name: Upload Standalone Repository As An Artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-src-repo
+          path: |
+            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
+            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz.*
+            artifacts/src/*-GPG-*
+          retention-days: 7
+          if-no-files-found: error
+
+      - name: Upload Repository As An Artifact
+        uses: ./.github/actions/upload-artifact
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
+          path: artifacts/pkgs/repo/*
+          retention-days: 7
+          if-no-files-found: error
+          archive-name: src-repo
 
   build-deb-repo:
-    name: Build Repository
+    name: Build DEB Repository
+    environment: staging
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-staging
     needs:
       - prepare-workflow
       - build-deb-pkgs-onedir
-    uses: ./.github/workflows/build-deb-repo.yml
-    with:
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      environment: staging
-      gpg_key_id: 64CBBC8173D76B3F
-    secrets: inherit
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - distro: debian
+            version: "10"
+            arch: x86_64
+          - distro: debian
+            version: "10"
+            arch: aarch64
+          - distro: debian
+            version: "11"
+            arch: x86_64
+          - distro: debian
+            version: "11"
+            arch: aarch64
+          - distro: ubuntu
+            version: "20.04"
+            arch: x86_64
+          - distro: ubuntu
+            version: "20.04"
+            arch: aarch64
+          - distro: ubuntu
+            version: "22.04"
+            arch: x86_64
+          - distro: ubuntu
+            version: "22.04"
+            arch: aarch64
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download System Dependencies
+        run: |
+          sudo apt update
+          sudo apt install -y devscripts apt-utils
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Get Salt Project GitHub Actions Bot Environment
+        run: |
+          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
+          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
+          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
+
+      - name: Download DEB Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-deb
+          path: artifacts/pkgs/incoming
+
+      - name: Setup GnuPG
+        run: |
+          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
+          GNUPGHOME="$(mktemp -d -p /run/gpg)"
+          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
+          cat <<EOF > "${GNUPGHOME}/gpg.conf"
+          batch
+          no-tty
+          pinentry-mode loopback
+          EOF
+
+      - name: Get Secrets
+        env:
+          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
+        run: |
+          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
+          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text | jq .default_key -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
+            | gpg --import -
+          sync
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
+          sync
+          rm "$SECRETS_KEY_FILE"
+          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
+
+      - name: Create Repository Path
+        run: |
+          mkdir -p artifacts/pkgs/repo
+
+      - name: Create Repository
+        run: |
+          tools pkg repo create deb --key-id=64CBBC8173D76B3F --distro-arch=${{ matrix.arch }}  \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+            --distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
+            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
+
+      - name: Upload Repository As An Artifact
+        uses: ./.github/actions/upload-artifact
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
+          path: artifacts/pkgs/repo/*
+          retention-days: 7
+          if-no-files-found: error
+          archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
 
   build-rpm-repo:
-    name: Build Repository
+    name: Build RPM Repository
+    environment: staging
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-staging
     needs:
       - prepare-workflow
       - build-rpm-pkgs-onedir
-    uses: ./.github/workflows/build-rpm-repo.yml
-    with:
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      environment: staging
-      gpg_key_id: 64CBBC8173D76B3F
-    secrets: inherit
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - distro: amazon
+            version: "2"
+            arch: x86_64
+          - distro: amazon
+            version: "2"
+            arch: aarch64
+          - distro: redhat
+            version: "7"
+            arch: x86_64
+          - distro: redhat
+            version: "7"
+            arch: aarch64
+          - distro: redhat
+            version: "8"
+            arch: x86_64
+          - distro: redhat
+            version: "8"
+            arch: aarch64
+          - distro: redhat
+            version: "9"
+            arch: x86_64
+          - distro: redhat
+            version: "9"
+            arch: aarch64
+          - distro: fedora
+            version: "36"
+            arch: x86_64
+          - distro: fedora
+            version: "36"
+            arch: aarch64
+          - distro: fedora
+            version: "37"
+            arch: x86_64
+          - distro: fedora
+            version: "37"
+            arch: aarch64
+          - distro: fedora
+            version: "38"
+            arch: x86_64
+          - distro: fedora
+            version: "38"
+            arch: aarch64
+          - distro: photon
+            version: "3"
+            arch: x86_64
+          - distro: photon
+            version: "3"
+            arch: aarch64
+          - distro: photon
+            version: "4"
+            arch: x86_64
+          - distro: photon
+            version: "4"
+            arch: aarch64
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download System Dependencies
+        run: |
+          sudo apt update
+          sudo apt install -y rpm
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Get Salt Project GitHub Actions Bot Environment
+        run: |
+          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
+          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
+          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
+
+      - name: Download RPM Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-rpm
+          path: artifacts/pkgs/incoming
+
+      - name: Setup GnuPG
+        run: |
+          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
+          GNUPGHOME="$(mktemp -d -p /run/gpg)"
+          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
+          cat <<EOF > "${GNUPGHOME}/gpg.conf"
+          batch
+          no-tty
+          pinentry-mode loopback
+          EOF
+
+      - name: Get Secrets
+        env:
+          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
+        run: |
+          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
+          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text | jq .default_key -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
+            | gpg --import -
+          sync
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
+          sync
+          rm "$SECRETS_KEY_FILE"
+          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
+
+      - name: Create Repository Path
+        run: |
+          mkdir -p artifacts/pkgs/repo
+
+      - name: Create Repository
+        env:
+          SALT_REPO_USER: ${{ secrets.SALT_REPO_USER }}
+          SALT_REPO_PASS: ${{ secrets.SALT_REPO_PASS }}
+          SALT_REPO_DOMAIN_RELEASE: ${{ vars.SALT_REPO_DOMAIN_RELEASE || 'repo.saltproject.io' }}
+          SALT_REPO_DOMAIN_STAGING: ${{ vars.SALT_REPO_DOMAIN_STAGING || 'staging.repo.saltproject.io' }}
+        run: |
+          tools pkg repo create rpm --key-id=64CBBC8173D76B3F --distro-arch=${{ matrix.arch }}  \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+            --distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
+            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
+
+      - name: Upload Repository As An Artifact
+        uses: ./.github/actions/upload-artifact
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
+          path: artifacts/pkgs/repo/*
+          retention-days: 7
+          if-no-files-found: error
+          archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
 
   build-windows-repo:
-    name: Build Repository
+    name: Build Windows Repository
+    environment: staging
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-staging
     needs:
       - prepare-workflow
       - build-windows-pkgs-onedir
-    uses: ./.github/workflows/build-windows-repo.yml
-    with:
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      environment: staging
-      gpg_key_id: 64CBBC8173D76B3F
-    secrets: inherit
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Get Salt Project GitHub Actions Bot Environment
+        run: |
+          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
+          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
+          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
+
+      - name: Download Windows NSIS x86 Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-NSIS
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows MSI x86 Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-MSI
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows NSIS amd64 Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-NSIS
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows MSI amd64 Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-MSI
+          path: artifacts/pkgs/incoming
+
+      - name: Setup GnuPG
+        run: |
+          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
+          GNUPGHOME="$(mktemp -d -p /run/gpg)"
+          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
+          cat <<EOF > "${GNUPGHOME}/gpg.conf"
+          batch
+          no-tty
+          pinentry-mode loopback
+          EOF
+
+      - name: Get Secrets
+        env:
+          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
+        run: |
+          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
+          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text | jq .default_key -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
+            | gpg --import -
+          sync
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
+          sync
+          rm "$SECRETS_KEY_FILE"
+          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
+
+      - name: Create Repository Path
+        run: |
+          mkdir -p artifacts/pkgs/repo
+
+      - name: Create Repository
+        run: |
+          tools pkg repo create windows --key-id=64CBBC8173D76B3F  \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
+
+      - name: Upload Repository As An Artifact
+        uses: ./.github/actions/upload-artifact
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
+          path: artifacts/pkgs/repo/*
+          retention-days: 7
+          if-no-files-found: error
+          archive-name: windows-repo
 
   build-macos-repo:
-    name: Build Repository
+    name: Build macOS Repository
+    environment: staging
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-staging
     needs:
       - prepare-workflow
       - build-macos-pkgs-onedir
-    uses: ./.github/workflows/build-macos-repo.yml
-    with:
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      environment: staging
-      gpg_key_id: 64CBBC8173D76B3F
-    secrets: inherit
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Get Salt Project GitHub Actions Bot Environment
+        run: |
+          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
+          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
+          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
+
+      - name: Download macOS x86_64 Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86_64-macos
+          path: artifacts/pkgs/incoming
+
+      - name: Setup GnuPG
+        run: |
+          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
+          GNUPGHOME="$(mktemp -d -p /run/gpg)"
+          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
+          cat <<EOF > "${GNUPGHOME}/gpg.conf"
+          batch
+          no-tty
+          pinentry-mode loopback
+          EOF
+
+      - name: Get Secrets
+        env:
+          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
+        run: |
+          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
+          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text | jq .default_key -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
+            | gpg --import -
+          sync
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
+          sync
+          rm "$SECRETS_KEY_FILE"
+          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
+
+      - name: Create Repository Path
+        run: |
+          mkdir -p artifacts/pkgs/repo
+
+      - name: Create Repository
+        run: |
+          tools pkg repo create macos --key-id=64CBBC8173D76B3F  \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
+
+      - name: Upload Repository As An Artifact
+        uses: ./.github/actions/upload-artifact
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
+          path: artifacts/pkgs/repo/*
+          retention-days: 7
+          if-no-files-found: error
+          archive-name: macos-repo
 
   build-onedir-repo:
-    name: Build Repository
+    name: Build Onedir Repository
+    environment: staging
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-staging
     needs:
       - prepare-workflow
       - build-salt-onedir-linux
       - build-salt-onedir-macos
       - build-salt-onedir-windows
-    uses: ./.github/workflows/build-onedir-repo.yml
-    with:
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      environment: staging
-      gpg_key_id: 64CBBC8173D76B3F
-    secrets: inherit
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python Tools Scripts
+        uses: ./.github/actions/setup-python-tools-scripts
+
+      - name: Get Salt Project GitHub Actions Bot Environment
+        run: |
+          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
+          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
+          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
+
+      - name: Download Linux x86_64 Onedir Archive
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-x86_64.tar.xz
+          path: artifacts/pkgs/incoming
+
+      - name: Download Linux aarch64 Onedir Archive
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-aarch64.tar.xz
+          path: artifacts/pkgs/incoming
+
+      - name: Download macOS x86_64 Onedir Archive
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-darwin-x86_64.tar.xz
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows amd64 Onedir Archive
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.tar.xz
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows amd64 Onedir Archive(zip)
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.zip
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows x86 Onedir Archive
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.tar.xz
+          path: artifacts/pkgs/incoming
+
+      - name: Download Windows amd64 Onedir Archive(zip)
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.zip
+          path: artifacts/pkgs/incoming
+
+      - name: Setup GnuPG
+        run: |
+          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
+          GNUPGHOME="$(mktemp -d -p /run/gpg)"
+          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
+          cat <<EOF > "${GNUPGHOME}/gpg.conf"
+          batch
+          no-tty
+          pinentry-mode loopback
+          EOF
+
+      - name: Get Secrets
+        env:
+          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
+        run: |
+          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
+          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text | jq .default_key -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
+            | gpg --import -
+          sync
+          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
+            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
+            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
+          sync
+          rm "$SECRETS_KEY_FILE"
+          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
+
+      - name: Create Repository Path
+        run: |
+          mkdir -p artifacts/pkgs/repo
+
+      - name: Create Repository
+        run: |
+          tools pkg repo create onedir --key-id=64CBBC8173D76B3F  \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
+            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
+
+      - name: Upload Repository As An Artifact
+        uses: ./.github/actions/upload-artifact
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-staging-repo
+          path: artifacts/pkgs/repo/*
+          retention-days: 7
+          if-no-files-found: error
+          archive-name: onedir-repo
 
   publish-repositories:
     name: Publish Repositories
diff --git a/.github/workflows/build-deb-repo.yml b/.github/workflows/templates/build-deb-repo.yml.jinja
similarity index 55%
rename from .github/workflows/build-deb-repo.yml
rename to .github/workflows/templates/build-deb-repo.yml.jinja
index 1b8233017f1..a4e3dd8a2aa 100644
--- a/.github/workflows/build-deb-repo.yml
+++ b/.github/workflows/templates/build-deb-repo.yml.jinja
@@ -1,78 +1,24 @@
----
-name: Build DEB Repository
 
-on:
-  workflow_call:
-    inputs:
-      environment:
-        type: string
-        required: true
-        description: The environment to run against
-      gpg_key_id:
-        type: string
-        required: true
-        description: The GPG key ID to use
-      salt-version:
-        type: string
-        required: true
-        description: The Salt version of the packages to install and test
-
-env:
-  RELENV_DATA: "${{ github.workspace }}/.relenv"
-  COLUMNS: 190
-  AWS_MAX_ATTEMPTS: "10"
-  AWS_RETRY_MODE: "adaptive"
-  PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
-  PIP_EXTRA_INDEX_URL: https://pypi.org/simple
-
-jobs:
-
-  generate-matrix:
-    name: DEB (matrix)
-    runs-on:
-      - self-hosted
-      - linux
-      - x86_64
-    outputs:
-      repo-matrix-include: ${{ steps.generate-pkg-repo-matrix.outputs.matrix }}
-    steps:
-
-      - name: "Throttle Builds"
-        shell: bash
-        run: |
-          t=$(shuf -i 1-30 -n 1); echo "Sleeping $t seconds"; sleep "$t"
-
-      - name: Checkout Source Code
-        uses: actions/checkout@v4
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Generate Package Repo Matrix
-        id: generate-pkg-repo-matrix
-        run: |
-          tools ci pkg-repo-matrix deb
-
-  build-deb-repo:
-    name: DEB
-    environment: ${{ inputs.environment }}
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-${{ inputs.environment }}
-    needs:
-      - generate-matrix
     strategy:
       fail-fast: false
       matrix:
-        include: ${{ fromJSON(needs.generate-matrix.outputs.repo-matrix-include) }}
+        include:
+        <%- for distro, version, arch in (
+                                            ("debian", "10", "x86_64"),
+                                            ("debian", "10", "aarch64"),
+                                            ("debian", "11", "x86_64"),
+                                            ("debian", "11", "aarch64"),
+                                            ("ubuntu", "20.04", "x86_64"),
+                                            ("ubuntu", "20.04", "aarch64"),
+                                            ("ubuntu", "22.04", "x86_64"),
+                                            ("ubuntu", "22.04", "aarch64"),
+                                        ) %>
+          - distro: <{ distro }>
+            version: "<{ version }>"
+            arch: <{ arch }>
+        <%- endfor %>
+
     steps:
-
-      - name: "Throttle Builds"
-        shell: bash
-        run: |
-          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
-
       - uses: actions/checkout@v4
 
       - name: Download System Dependencies
@@ -92,7 +38,7 @@ jobs:
       - name: Download DEB Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-${{ matrix.arch }}-deb
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-deb
           path: artifacts/pkgs/incoming
 
       - name: Setup GnuPG
@@ -130,15 +76,15 @@ jobs:
 
       - name: Create Repository
         run: |
-          tools pkg repo create deb --key-id=${{ inputs.gpg_key_id }} --distro-arch=${{ matrix.arch }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
-            --salt-version=${{ inputs.salt-version }} \
+          tools pkg repo create deb --key-id=<{ gpg_key_id }> --distro-arch=${{ matrix.arch }} <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
             --distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
             --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
 
       - name: Upload Repository As An Artifact
         uses: ./.github/actions/upload-artifact
         with:
-          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
           path: artifacts/pkgs/repo/*
           retention-days: 7
           if-no-files-found: error
diff --git a/.github/workflows/build-macos-repo.yml b/.github/workflows/templates/build-macos-repo.yml.jinja
similarity index 62%
rename from .github/workflows/build-macos-repo.yml
rename to .github/workflows/templates/build-macos-repo.yml.jinja
index 26101419913..b24e0a9c4a4 100644
--- a/.github/workflows/build-macos-repo.yml
+++ b/.github/workflows/templates/build-macos-repo.yml.jinja
@@ -1,52 +1,5 @@
----
-name: Build DEB Repository
-
-on:
-  workflow_call:
-    inputs:
-      environment:
-        type: string
-        required: true
-        description: The environment to run against
-      gpg_key_id:
-        type: string
-        required: true
-        description: The GPG key ID to use
-      salt-version:
-        type: string
-        required: true
-        description: The Salt version of the packages to install and test
-
-env:
-  RELENV_DATA: "${{ github.workspace }}/.relenv"
-  COLUMNS: 190
-  AWS_MAX_ATTEMPTS: "10"
-  AWS_RETRY_MODE: "adaptive"
-  PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
-  PIP_EXTRA_INDEX_URL: https://pypi.org/simple
-
-jobs:
-
-  build-repo:
-    name: MacOS
-    environment: ${{ inputs.environment }}
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-${{ inputs.environment }}
-    strategy:
-      fail-fast: false
-      matrix:
-        pkg-type:
-          - macos
 
     steps:
-
-      - name: "Throttle Builds"
-        shell: bash
-        run: |
-          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
-
       - uses: actions/checkout@v4
 
       - name: Setup Python Tools Scripts
@@ -61,7 +14,7 @@ jobs:
       - name: Download macOS x86_64 Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-x86_64-macos
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86_64-macos
           path: artifacts/pkgs/incoming
 
       - name: Setup GnuPG
@@ -99,14 +52,15 @@ jobs:
 
       - name: Create Repository
         run: |
-          tools pkg repo create macos --key-id=${{ inputs.gpg_key_id }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
-            --salt-version=${{ inputs.salt-version }} \
+          tools pkg repo create macos --key-id=<{ gpg_key_id }> <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
             --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
 
       - name: Upload Repository As An Artifact
         uses: ./.github/actions/upload-artifact
         with:
-          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
           path: artifacts/pkgs/repo/*
           retention-days: 7
           if-no-files-found: error
+          archive-name: macos-repo
diff --git a/.github/workflows/build-onedir-repo.yml b/.github/workflows/templates/build-onedir-repo.yml.jinja
similarity index 63%
rename from .github/workflows/build-onedir-repo.yml
rename to .github/workflows/templates/build-onedir-repo.yml.jinja
index a30e4297c3e..581503ab1eb 100644
--- a/.github/workflows/build-onedir-repo.yml
+++ b/.github/workflows/templates/build-onedir-repo.yml.jinja
@@ -1,52 +1,5 @@
----
-name: Build Onedir Repository
-
-on:
-  workflow_call:
-    inputs:
-      environment:
-        type: string
-        required: true
-        description: The environment to run against
-      gpg_key_id:
-        type: string
-        required: true
-        description: The GPG key ID to use
-      salt-version:
-        type: string
-        required: true
-        description: The Salt version of the packages to install and test
-
-env:
-  RELENV_DATA: "${{ github.workspace }}/.relenv"
-  COLUMNS: 190
-  AWS_MAX_ATTEMPTS: "10"
-  AWS_RETRY_MODE: "adaptive"
-  PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
-  PIP_EXTRA_INDEX_URL: https://pypi.org/simple
-
-jobs:
-
-  build-repo:
-    name: Onedir
-    environment: ${{ inputs.environment }}
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-${{ inputs.environment }}
-    strategy:
-      fail-fast: false
-      matrix:
-        pkg-type:
-          - onedir
 
     steps:
-
-      - name: "Throttle Builds"
-        shell: bash
-        run: |
-          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
-
       - uses: actions/checkout@v4
 
       - name: Setup Python Tools Scripts
@@ -61,43 +14,43 @@ jobs:
       - name: Download Linux x86_64 Onedir Archive
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-onedir-linux-x86_64.tar.xz
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-x86_64.tar.xz
           path: artifacts/pkgs/incoming
 
       - name: Download Linux aarch64 Onedir Archive
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-onedir-linux-aarch64.tar.xz
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-linux-aarch64.tar.xz
           path: artifacts/pkgs/incoming
 
       - name: Download macOS x86_64 Onedir Archive
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-onedir-darwin-x86_64.tar.xz
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-darwin-x86_64.tar.xz
           path: artifacts/pkgs/incoming
 
       - name: Download Windows amd64 Onedir Archive
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-onedir-windows-amd64.tar.xz
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.tar.xz
           path: artifacts/pkgs/incoming
 
       - name: Download Windows amd64 Onedir Archive(zip)
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-onedir-windows-amd64.zip
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-amd64.zip
           path: artifacts/pkgs/incoming
 
       - name: Download Windows x86 Onedir Archive
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-onedir-windows-x86.tar.xz
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.tar.xz
           path: artifacts/pkgs/incoming
 
       - name: Download Windows amd64 Onedir Archive(zip)
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-onedir-windows-x86.zip
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-onedir-windows-x86.zip
           path: artifacts/pkgs/incoming
 
       - name: Setup GnuPG
@@ -135,14 +88,14 @@ jobs:
 
       - name: Create Repository
         run: |
-          tools pkg repo create onedir --key-id=${{ inputs.gpg_key_id }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
-            --salt-version=${{ inputs.salt-version }} \
+          tools pkg repo create onedir --key-id=<{ gpg_key_id }> <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
             --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
 
       - name: Upload Repository As An Artifact
         uses: ./.github/actions/upload-artifact
         with:
-          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
           path: artifacts/pkgs/repo/*
           retention-days: 7
           if-no-files-found: error
diff --git a/.github/workflows/templates/build-repos.yml.jinja b/.github/workflows/templates/build-repos.yml.jinja
index 313a178a093..da05231fdb5 100644
--- a/.github/workflows/templates/build-repos.yml.jinja
+++ b/.github/workflows/templates/build-repos.yml.jinja
@@ -1,33 +1,33 @@
-<%- for type, display_name in (
-                                ("src", "Source"),
-                                ("deb", "DEB"),
-                                ("rpm", "RPM"),
-                                ("windows", "Windows"),
-                                ("macos", "macOS"),
-                                ("onedir", "Onedir"),
-                              ) %>
+<%- for platform, type, display_name, needs_pkg in (
+                                                    (None, "src", "Source", False),
+                                                    ("linux", "deb", "DEB", True),
+                                                    ("linux", "rpm", "RPM", True),
+                                                    ("windows", "windows", "Windows", True),
+                                                    ("macos", "macos", "macOS", True),
+                                                    (None, "onedir", "Onedir", False),
+                                                  ) %>
 
   <%- set job_name = "build-{}-repo".format(type) %>
     <%- do build_repo_needs.append(job_name) %>
 
   <{ job_name }>:
-    name: Build Repository
+    name: Build <{ display_name }> Repository
+    environment: <{ gh_environment }>
+    runs-on:
+      - self-hosted
+      - linux
+      - repo-<{ gh_environment }>
     needs:
       - prepare-workflow
-      <%- if type not in ("src", "onedir") %>
+      <%- if needs_pkg %>
       - build-<{ type }>-pkgs-onedir
+      <%- elif platform %>
+      - build-salt-onedir-<{ platform }>
       <%- elif type == 'onedir' %>
       - build-salt-onedir-linux
       - build-salt-onedir-macos
       - build-salt-onedir-windows
-      <%- elif type == 'src' %>
-      - build-source-tarball
       <%- endif %>
-    uses: ./.github/workflows/build-<{ type }>-repo.yml
-    with:
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      environment: <{ gh_environment }>
-      gpg_key_id: <{ gpg_key_id }>
-    secrets: inherit
+    <%- include "build-{}-repo.yml.jinja".format(type) %>
 
 <%- endfor %>
diff --git a/.github/workflows/build-rpm-repo.yml b/.github/workflows/templates/build-rpm-repo.yml.jinja
similarity index 60%
rename from .github/workflows/build-rpm-repo.yml
rename to .github/workflows/templates/build-rpm-repo.yml.jinja
index 83f957de461..ba0702ffc03 100644
--- a/.github/workflows/build-rpm-repo.yml
+++ b/.github/workflows/templates/build-rpm-repo.yml.jinja
@@ -1,71 +1,32 @@
----
-name: Build RPM Repository
 
-on:
-  workflow_call:
-    inputs:
-      environment:
-        type: string
-        required: true
-        description: The environment to run against
-      gpg_key_id:
-        type: string
-        required: true
-        description: The GPG key ID to use
-      salt-version:
-        type: string
-        required: true
-        description: The Salt version of the packages to install and test
-
-env:
-  RELENV_DATA: "${{ github.workspace }}/.relenv"
-  COLUMNS: 190
-  AWS_MAX_ATTEMPTS: "10"
-  AWS_RETRY_MODE: "adaptive"
-  PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
-  PIP_EXTRA_INDEX_URL: https://pypi.org/simple
-
-jobs:
-
-  generate-matrix:
-    name: RPM (matrix)
-    runs-on:
-      - self-hosted
-      - linux
-      - x86_64
-    outputs:
-      repo-matrix-include: ${{ steps.generate-pkg-repo-matrix.outputs.matrix }}
-    steps:
-
-      - name: "Throttle Builds"
-        shell: bash
-        run: |
-          t=$(shuf -i 1-30 -n 1); echo "Sleeping $t seconds"; sleep "$t"
-
-      - name: Checkout Source Code
-        uses: actions/checkout@v4
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-
-      - name: Generate Package Repo Matrix
-        id: generate-pkg-repo-matrix
-        run: |
-          tools ci pkg-repo-matrix rpm
-
-  build-repo:
-    name: RPM
-    environment: ${{ inputs.environment }}
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-${{ inputs.environment }}
-    needs:
-      - generate-matrix
     strategy:
       fail-fast: false
       matrix:
-        include: ${{ fromJSON(needs.generate-matrix.outputs.repo-matrix-include) }}
+        include:
+        <%- for distro, version, arch in (
+                                            ("amazon", "2", "x86_64"),
+                                            ("amazon", "2", "aarch64"),
+                                            ("redhat", "7", "x86_64"),
+                                            ("redhat", "7", "aarch64"),
+                                            ("redhat", "8", "x86_64"),
+                                            ("redhat", "8", "aarch64"),
+                                            ("redhat", "9", "x86_64"),
+                                            ("redhat", "9", "aarch64"),
+                                            ("fedora", "36", "x86_64"),
+                                            ("fedora", "36", "aarch64"),
+                                            ("fedora", "37", "x86_64"),
+                                            ("fedora", "37", "aarch64"),
+                                            ("fedora", "38", "x86_64"),
+                                            ("fedora", "38", "aarch64"),
+                                            ("photon", "3", "x86_64"),
+                                            ("photon", "3", "aarch64"),
+                                            ("photon", "4", "x86_64"),
+                                            ("photon", "4", "aarch64"),
+                                        ) %>
+          - distro: <{ distro }>
+            version: "<{ version }>"
+            arch: <{ arch }>
+        <%- endfor %>
 
     steps:
       - uses: actions/checkout@v4
@@ -87,7 +48,7 @@ jobs:
       - name: Download RPM Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-${{ matrix.arch }}-rpm
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-${{ matrix.arch }}-rpm
           path: artifacts/pkgs/incoming
 
       - name: Setup GnuPG
@@ -125,20 +86,22 @@ jobs:
 
       - name: Create Repository
         env:
+          <%- if gh_environment == 'staging' %>
           SALT_REPO_USER: ${{ secrets.SALT_REPO_USER }}
           SALT_REPO_PASS: ${{ secrets.SALT_REPO_PASS }}
+          <%- endif %>
           SALT_REPO_DOMAIN_RELEASE: ${{ vars.SALT_REPO_DOMAIN_RELEASE || 'repo.saltproject.io' }}
           SALT_REPO_DOMAIN_STAGING: ${{ vars.SALT_REPO_DOMAIN_STAGING || 'staging.repo.saltproject.io' }}
         run: |
-          tools pkg repo create rpm --key-id=${{ inputs.gpg_key_id }} --distro-arch=${{ matrix.arch }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
-            --salt-version=${{ inputs.salt-version }} \
+          tools pkg repo create rpm --key-id=<{ gpg_key_id }> --distro-arch=${{ matrix.arch }} <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
             --distro=${{ matrix.distro }} --distro-version=${{ matrix.version }} \
             --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
 
       - name: Upload Repository As An Artifact
         uses: ./.github/actions/upload-artifact
         with:
-          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
           path: artifacts/pkgs/repo/*
           retention-days: 7
           if-no-files-found: error
diff --git a/.github/workflows/build-src-repo.yml b/.github/workflows/templates/build-src-repo.yml.jinja
similarity index 63%
rename from .github/workflows/build-src-repo.yml
rename to .github/workflows/templates/build-src-repo.yml.jinja
index 8e0e37c3d52..728ed00f093 100644
--- a/.github/workflows/build-src-repo.yml
+++ b/.github/workflows/templates/build-src-repo.yml.jinja
@@ -1,52 +1,5 @@
----
-name: Build Source Repository
-
-on:
-  workflow_call:
-    inputs:
-      environment:
-        type: string
-        required: true
-        description: The environment to run against
-      gpg_key_id:
-        type: string
-        required: true
-        description: The GPG key ID to use
-      salt-version:
-        type: string
-        required: true
-        description: The Salt version of the packages to install and test
-
-env:
-  RELENV_DATA: "${{ github.workspace }}/.relenv"
-  COLUMNS: 190
-  AWS_MAX_ATTEMPTS: "10"
-  AWS_RETRY_MODE: "adaptive"
-  PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
-  PIP_EXTRA_INDEX_URL: https://pypi.org/simple
-
-jobs:
-
-  build-repo:
-    name: Source
-    environment: ${{ inputs.environment }}
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-${{ inputs.environment }}
-    strategy:
-      fail-fast: false
-      matrix:
-        pkg-type:
-          - onedir
 
     steps:
-
-      - name: "Throttle Builds"
-        shell: bash
-        run: |
-          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
-
       - uses: actions/checkout@v4
 
       - name: Setup Python Tools Scripts
@@ -61,7 +14,7 @@ jobs:
       - name: Download Source Tarball
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}.tar.gz
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
           path: artifacts/pkgs/incoming
 
       - name: Setup GnuPG
@@ -99,8 +52,8 @@ jobs:
 
       - name: Create Repository
         run: |
-          tools pkg repo create src --key-id=${{ inputs.gpg_key_id }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
-            --salt-version=${{ inputs.salt-version }} \
+          tools pkg repo create src --key-id=<{ gpg_key_id }> <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
             --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
 
       - name: Copy Files For Source Only Artifact Uploads
@@ -111,10 +64,10 @@ jobs:
       - name: Upload Standalone Repository As An Artifact
         uses: actions/upload-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-src-repo
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-src-repo
           path: |
-            artifacts/src/salt-${{ inputs.salt-version }}.tar.gz
-            artifacts/src/salt-${{ inputs.salt-version }}.tar.gz.*
+            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
+            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz.*
             artifacts/src/*-GPG-*
           retention-days: 7
           if-no-files-found: error
@@ -122,7 +75,7 @@ jobs:
       - name: Upload Repository As An Artifact
         uses: ./.github/actions/upload-artifact
         with:
-          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
           path: artifacts/pkgs/repo/*
           retention-days: 7
           if-no-files-found: error
diff --git a/.github/workflows/build-windows-repo.yml b/.github/workflows/templates/build-windows-repo.yml.jinja
similarity index 63%
rename from .github/workflows/build-windows-repo.yml
rename to .github/workflows/templates/build-windows-repo.yml.jinja
index f5a0b32ccd2..d806fd00bb3 100644
--- a/.github/workflows/build-windows-repo.yml
+++ b/.github/workflows/templates/build-windows-repo.yml.jinja
@@ -1,52 +1,5 @@
----
-name: Build Windows Repository
-
-on:
-  workflow_call:
-    inputs:
-      environment:
-        type: string
-        required: true
-        description: The environment to run against
-      gpg_key_id:
-        type: string
-        required: true
-        description: The GPG key ID to use
-      salt-version:
-        type: string
-        required: true
-        description: The Salt version of the packages to install and test
-
-env:
-  RELENV_DATA: "${{ github.workspace }}/.relenv"
-  COLUMNS: 190
-  AWS_MAX_ATTEMPTS: "10"
-  AWS_RETRY_MODE: "adaptive"
-  PIP_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
-  PIP_EXTRA_INDEX_URL: https://pypi.org/simple
-
-jobs:
-
-  build-repo:
-    name: Windows
-    environment: ${{ inputs.environment }}
-    runs-on:
-      - self-hosted
-      - linux
-      - repo-${{ inputs.environment }}
-    strategy:
-      fail-fast: false
-      matrix:
-        pkg-type:
-          - windows
 
     steps:
-
-      - name: "Throttle Builds"
-        shell: bash
-        run: |
-          t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
-
       - uses: actions/checkout@v4
 
       - name: Setup Python Tools Scripts
@@ -61,25 +14,25 @@ jobs:
       - name: Download Windows NSIS x86 Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-x86-NSIS
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-NSIS
           path: artifacts/pkgs/incoming
 
       - name: Download Windows MSI x86 Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-x86-MSI
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86-MSI
           path: artifacts/pkgs/incoming
 
       - name: Download Windows NSIS amd64 Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-amd64-NSIS
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-NSIS
           path: artifacts/pkgs/incoming
 
       - name: Download Windows MSI amd64 Packages
         uses: actions/download-artifact@v3
         with:
-          name: salt-${{ inputs.salt-version }}-amd64-MSI
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-amd64-MSI
           path: artifacts/pkgs/incoming
 
       - name: Setup GnuPG
@@ -117,14 +70,14 @@ jobs:
 
       - name: Create Repository
         run: |
-          tools pkg repo create windows --key-id=${{ inputs.gpg_key_id }} ${{ inputs.environment == 'nightly' && format('--nightly-build-from={0}', github.ref_name) || '' }} \
-            --salt-version=${{ inputs.salt-version }} \
+          tools pkg repo create windows --key-id=<{ gpg_key_id }> <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
+            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
             --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo
 
       - name: Upload Repository As An Artifact
         uses: ./.github/actions/upload-artifact
         with:
-          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo
           path: artifacts/pkgs/repo/*
           retention-days: 7
           if-no-files-found: error
diff --git a/tools/ci.py b/tools/ci.py
index e9afa16c98c..cc6578be789 100644
--- a/tools/ci.py
+++ b/tools/ci.py
@@ -777,69 +777,6 @@ def pkg_matrix(
     ctx.exit(0)
 
 
-@ci.command(
-    name="pkg-repo-matrix",
-    arguments={
-        "pkg_type": {
-            "help": "The package type",
-        },
-    },
-)
-def pkg_repo_matrix(ctx: Context, pkg_type: str):
-    """
-    Generate the matrix for the package repository builds
-    """
-    _matrix = []
-    if pkg_type == "deb":
-        for distro in ("debian", "ubuntu"):
-            if distro == "debian":
-                versions = ["10", "11"]
-            else:
-                versions = ["20.04", "22.04"]
-            for arch in ("x86_64", "aarch64"):
-                for version in versions:
-                    _matrix.append(
-                        {
-                            "distro": distro,
-                            "version": version,
-                            "arch": arch,
-                        }
-                    )
-    elif pkg_type == "rpm":
-        for distro in ("amazon", "redhat", "fedora", "photon"):
-            if distro == "amazon":
-                versions = ["2"]
-            elif distro == "redhat":
-                versions = ["7", "8", "9"]
-            elif distro == "fedora":
-                versions = ["36", "37", "38"]
-            elif distro == "photon":
-                versions = ["3", "4"]
-            else:
-                ctx.error(f"Don't know how to handle distro {distro}")
-                ctx.exit(1)
-            for arch in ("x86_64", "aarch64"):
-                for version in versions:
-                    _matrix.append(
-                        {
-                            "distro": distro,
-                            "version": version,
-                            "arch": arch,
-                        }
-                    )
-    else:
-        _matrix.append({"pkg_type": pkg_type})
-
-    ctx.info("Generated matrix:")
-    ctx.print(_matrix, soft_wrap=True)
-
-    github_output = os.environ.get("GITHUB_OUTPUT")
-    if github_output is not None:
-        with open(github_output, "a", encoding="utf-8") as wfh:
-            wfh.write(f"matrix={json.dumps(_matrix)}\n")
-    ctx.exit(0)
-
-
 @ci.command(
     name="get-releases",
     arguments={

From a2f06e2153bf07839614d58deb490ef5935cd74c Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Fri, 6 Oct 2023 10:31:29 +0100
Subject: [PATCH 26/29] In that case, group under the `Build Repository`
 display name

BAH!

```
too many workflows are referenced, total: 21, limit: 20
```

https://docs.github.com/en/enterprise-cloud@latest/actions/using-workflows/reusing-workflows#limitations

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/nightly.yml                 | 115 +++++++++++++-----
 .github/workflows/staging.yml                 | 115 +++++++++++++-----
 .../templates/build-deb-repo.yml.jinja        |   3 +-
 .../templates/build-macos-repo.yml.jinja      |   6 +
 .../templates/build-onedir-repo.yml.jinja     |   6 +
 .../workflows/templates/build-repos.yml.jinja |  25 ++--
 .../templates/build-rpm-repo.yml.jinja        |   3 +-
 .../templates/build-src-repo.yml.jinja        |   6 +
 .../templates/build-windows-repo.yml.jinja    |   6 +
 9 files changed, 207 insertions(+), 78 deletions(-)

diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 914804ef073..6f570114738 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -2314,7 +2314,7 @@ jobs:
           if-no-files-found: error
 
   build-src-repo:
-    name: Build Source Repository
+    name: Build Repository
     environment: nightly
     runs-on:
       - self-hosted
@@ -2322,6 +2322,13 @@ jobs:
       - repo-nightly
     needs:
       - prepare-workflow
+      - build-source-tarball
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - src
+
     steps:
       - uses: actions/checkout@v4
 
@@ -2405,7 +2412,7 @@ jobs:
           archive-name: src-repo
 
   build-deb-repo:
-    name: Build DEB Repository
+    name: Build Repository
     environment: nightly
     runs-on:
       - self-hosted
@@ -2418,28 +2425,36 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - distro: debian
+          - pkg-type: deb
+            distro: debian
             version: "10"
             arch: x86_64
-          - distro: debian
+          - pkg-type: deb
+            distro: debian
             version: "10"
             arch: aarch64
-          - distro: debian
+          - pkg-type: deb
+            distro: debian
             version: "11"
             arch: x86_64
-          - distro: debian
+          - pkg-type: deb
+            distro: debian
             version: "11"
             arch: aarch64
-          - distro: ubuntu
+          - pkg-type: deb
+            distro: ubuntu
             version: "20.04"
             arch: x86_64
-          - distro: ubuntu
+          - pkg-type: deb
+            distro: ubuntu
             version: "20.04"
             arch: aarch64
-          - distro: ubuntu
+          - pkg-type: deb
+            distro: ubuntu
             version: "22.04"
             arch: x86_64
-          - distro: ubuntu
+          - pkg-type: deb
+            distro: ubuntu
             version: "22.04"
             arch: aarch64
 
@@ -2516,7 +2531,7 @@ jobs:
           archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
 
   build-rpm-repo:
-    name: Build RPM Repository
+    name: Build Repository
     environment: nightly
     runs-on:
       - self-hosted
@@ -2529,58 +2544,76 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - distro: amazon
+          - pkg-type: rpm
+            distro: amazon
             version: "2"
             arch: x86_64
-          - distro: amazon
+          - pkg-type: rpm
+            distro: amazon
             version: "2"
             arch: aarch64
-          - distro: redhat
+          - pkg-type: rpm
+            distro: redhat
             version: "7"
             arch: x86_64
-          - distro: redhat
+          - pkg-type: rpm
+            distro: redhat
             version: "7"
             arch: aarch64
-          - distro: redhat
+          - pkg-type: rpm
+            distro: redhat
             version: "8"
             arch: x86_64
-          - distro: redhat
+          - pkg-type: rpm
+            distro: redhat
             version: "8"
             arch: aarch64
-          - distro: redhat
+          - pkg-type: rpm
+            distro: redhat
             version: "9"
             arch: x86_64
-          - distro: redhat
+          - pkg-type: rpm
+            distro: redhat
             version: "9"
             arch: aarch64
-          - distro: fedora
+          - pkg-type: rpm
+            distro: fedora
             version: "36"
             arch: x86_64
-          - distro: fedora
+          - pkg-type: rpm
+            distro: fedora
             version: "36"
             arch: aarch64
-          - distro: fedora
+          - pkg-type: rpm
+            distro: fedora
             version: "37"
             arch: x86_64
-          - distro: fedora
+          - pkg-type: rpm
+            distro: fedora
             version: "37"
             arch: aarch64
-          - distro: fedora
+          - pkg-type: rpm
+            distro: fedora
             version: "38"
             arch: x86_64
-          - distro: fedora
+          - pkg-type: rpm
+            distro: fedora
             version: "38"
             arch: aarch64
-          - distro: photon
+          - pkg-type: rpm
+            distro: photon
             version: "3"
             arch: x86_64
-          - distro: photon
+          - pkg-type: rpm
+            distro: photon
             version: "3"
             arch: aarch64
-          - distro: photon
+          - pkg-type: rpm
+            distro: photon
             version: "4"
             arch: x86_64
-          - distro: photon
+          - pkg-type: rpm
+            distro: photon
             version: "4"
             arch: aarch64
 
@@ -2660,7 +2693,7 @@ jobs:
           archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
 
   build-windows-repo:
-    name: Build Windows Repository
+    name: Build Repository
     environment: nightly
     runs-on:
       - self-hosted
@@ -2669,6 +2702,12 @@ jobs:
     needs:
       - prepare-workflow
       - build-windows-pkgs-onedir
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - windows
+
     steps:
       - uses: actions/checkout@v4
 
@@ -2754,7 +2793,7 @@ jobs:
           archive-name: windows-repo
 
   build-macos-repo:
-    name: Build macOS Repository
+    name: Build Repository
     environment: nightly
     runs-on:
       - self-hosted
@@ -2763,6 +2802,12 @@ jobs:
     needs:
       - prepare-workflow
       - build-macos-pkgs-onedir
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - macos
+
     steps:
       - uses: actions/checkout@v4
 
@@ -2830,7 +2875,7 @@ jobs:
           archive-name: macos-repo
 
   build-onedir-repo:
-    name: Build Onedir Repository
+    name: Build Repository
     environment: nightly
     runs-on:
       - self-hosted
@@ -2841,6 +2886,12 @@ jobs:
       - build-salt-onedir-linux
       - build-salt-onedir-macos
       - build-salt-onedir-windows
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - onedir
+
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml
index 4f7e567e94d..473d45eccce 100644
--- a/.github/workflows/staging.yml
+++ b/.github/workflows/staging.yml
@@ -2170,7 +2170,7 @@ jobs:
       skip-junit-reports: true
 
   build-src-repo:
-    name: Build Source Repository
+    name: Build Repository
     environment: staging
     runs-on:
       - self-hosted
@@ -2178,6 +2178,13 @@ jobs:
       - repo-staging
     needs:
       - prepare-workflow
+      - build-source-tarball
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - src
+
     steps:
       - uses: actions/checkout@v4
 
@@ -2261,7 +2268,7 @@ jobs:
           archive-name: src-repo
 
   build-deb-repo:
-    name: Build DEB Repository
+    name: Build Repository
     environment: staging
     runs-on:
       - self-hosted
@@ -2274,28 +2281,36 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - distro: debian
+          - pkg-type: deb
+            distro: debian
             version: "10"
             arch: x86_64
-          - distro: debian
+          - pkg-type: deb
+            distro: debian
             version: "10"
             arch: aarch64
-          - distro: debian
+          - pkg-type: deb
+            distro: debian
             version: "11"
             arch: x86_64
-          - distro: debian
+          - pkg-type: deb
+            distro: debian
             version: "11"
             arch: aarch64
-          - distro: ubuntu
+          - pkg-type: deb
+            distro: ubuntu
             version: "20.04"
             arch: x86_64
-          - distro: ubuntu
+          - pkg-type: deb
+            distro: ubuntu
             version: "20.04"
             arch: aarch64
-          - distro: ubuntu
+          - pkg-type: deb
+            distro: ubuntu
             version: "22.04"
             arch: x86_64
-          - distro: ubuntu
+          - pkg-type: deb
+            distro: ubuntu
             version: "22.04"
             arch: aarch64
 
@@ -2372,7 +2387,7 @@ jobs:
           archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
 
   build-rpm-repo:
-    name: Build RPM Repository
+    name: Build Repository
     environment: staging
     runs-on:
       - self-hosted
@@ -2385,58 +2400,76 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - distro: amazon
+          - pkg-type: rpm
+            distro: amazon
             version: "2"
             arch: x86_64
-          - distro: amazon
+          - pkg-type: rpm
+            distro: amazon
             version: "2"
             arch: aarch64
-          - distro: redhat
+          - pkg-type: rpm
+            distro: redhat
             version: "7"
             arch: x86_64
-          - distro: redhat
+          - pkg-type: rpm
+            distro: redhat
             version: "7"
             arch: aarch64
-          - distro: redhat
+          - pkg-type: rpm
+            distro: redhat
             version: "8"
             arch: x86_64
-          - distro: redhat
+          - pkg-type: rpm
+            distro: redhat
             version: "8"
             arch: aarch64
-          - distro: redhat
+          - pkg-type: rpm
+            distro: redhat
             version: "9"
             arch: x86_64
-          - distro: redhat
+          - pkg-type: rpm
+            distro: redhat
             version: "9"
             arch: aarch64
-          - distro: fedora
+          - pkg-type: rpm
+            distro: fedora
             version: "36"
             arch: x86_64
-          - distro: fedora
+          - pkg-type: rpm
+            distro: fedora
             version: "36"
             arch: aarch64
-          - distro: fedora
+          - pkg-type: rpm
+            distro: fedora
             version: "37"
             arch: x86_64
-          - distro: fedora
+          - pkg-type: rpm
+            distro: fedora
             version: "37"
             arch: aarch64
-          - distro: fedora
+          - pkg-type: rpm
+            distro: fedora
             version: "38"
             arch: x86_64
-          - distro: fedora
+          - pkg-type: rpm
+            distro: fedora
             version: "38"
             arch: aarch64
-          - distro: photon
+          - pkg-type: rpm
+            distro: photon
             version: "3"
             arch: x86_64
-          - distro: photon
+          - pkg-type: rpm
+            distro: photon
             version: "3"
             arch: aarch64
-          - distro: photon
+          - pkg-type: rpm
+            distro: photon
             version: "4"
             arch: x86_64
-          - distro: photon
+          - pkg-type: rpm
+            distro: photon
             version: "4"
             arch: aarch64
 
@@ -2518,7 +2551,7 @@ jobs:
           archive-name: ${{ matrix.distro }}-${{ matrix.version }}-${{ matrix.arch }}-repo
 
   build-windows-repo:
-    name: Build Windows Repository
+    name: Build Repository
     environment: staging
     runs-on:
       - self-hosted
@@ -2527,6 +2560,12 @@ jobs:
     needs:
       - prepare-workflow
       - build-windows-pkgs-onedir
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - windows
+
     steps:
       - uses: actions/checkout@v4
 
@@ -2612,7 +2651,7 @@ jobs:
           archive-name: windows-repo
 
   build-macos-repo:
-    name: Build macOS Repository
+    name: Build Repository
     environment: staging
     runs-on:
       - self-hosted
@@ -2621,6 +2660,12 @@ jobs:
     needs:
       - prepare-workflow
       - build-macos-pkgs-onedir
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - macos
+
     steps:
       - uses: actions/checkout@v4
 
@@ -2688,7 +2733,7 @@ jobs:
           archive-name: macos-repo
 
   build-onedir-repo:
-    name: Build Onedir Repository
+    name: Build Repository
     environment: staging
     runs-on:
       - self-hosted
@@ -2699,6 +2744,12 @@ jobs:
       - build-salt-onedir-linux
       - build-salt-onedir-macos
       - build-salt-onedir-windows
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - onedir
+
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/templates/build-deb-repo.yml.jinja b/.github/workflows/templates/build-deb-repo.yml.jinja
index a4e3dd8a2aa..c2f0c09d0f2 100644
--- a/.github/workflows/templates/build-deb-repo.yml.jinja
+++ b/.github/workflows/templates/build-deb-repo.yml.jinja
@@ -13,7 +13,8 @@
                                             ("ubuntu", "22.04", "x86_64"),
                                             ("ubuntu", "22.04", "aarch64"),
                                         ) %>
-          - distro: <{ distro }>
+          - pkg-type: deb
+            distro: <{ distro }>
             version: "<{ version }>"
             arch: <{ arch }>
         <%- endfor %>
diff --git a/.github/workflows/templates/build-macos-repo.yml.jinja b/.github/workflows/templates/build-macos-repo.yml.jinja
index b24e0a9c4a4..5f9b14a9904 100644
--- a/.github/workflows/templates/build-macos-repo.yml.jinja
+++ b/.github/workflows/templates/build-macos-repo.yml.jinja
@@ -1,4 +1,10 @@
 
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - macos
+
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/templates/build-onedir-repo.yml.jinja b/.github/workflows/templates/build-onedir-repo.yml.jinja
index 581503ab1eb..70deec70b7d 100644
--- a/.github/workflows/templates/build-onedir-repo.yml.jinja
+++ b/.github/workflows/templates/build-onedir-repo.yml.jinja
@@ -1,4 +1,10 @@
 
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - onedir
+
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/templates/build-repos.yml.jinja b/.github/workflows/templates/build-repos.yml.jinja
index da05231fdb5..58c413cf547 100644
--- a/.github/workflows/templates/build-repos.yml.jinja
+++ b/.github/workflows/templates/build-repos.yml.jinja
@@ -1,17 +1,17 @@
-<%- for platform, type, display_name, needs_pkg in (
-                                                    (None, "src", "Source", False),
-                                                    ("linux", "deb", "DEB", True),
-                                                    ("linux", "rpm", "RPM", True),
-                                                    ("windows", "windows", "Windows", True),
-                                                    ("macos", "macos", "macOS", True),
-                                                    (None, "onedir", "Onedir", False),
-                                                  ) %>
+<%- for type, display_name in (
+                                ("src", "Source"),
+                                ("deb", "DEB"),
+                                ("rpm", "RPM"),
+                                ("windows", "Windows"),
+                                ("macos", "macOS"),
+                                ("onedir", "Onedir"),
+                              ) %>
 
   <%- set job_name = "build-{}-repo".format(type) %>
     <%- do build_repo_needs.append(job_name) %>
 
   <{ job_name }>:
-    name: Build <{ display_name }> Repository
+    name: Build Repository
     environment: <{ gh_environment }>
     runs-on:
       - self-hosted
@@ -19,15 +19,16 @@
       - repo-<{ gh_environment }>
     needs:
       - prepare-workflow
-      <%- if needs_pkg %>
+      <%- if type not in ("src", "onedir") %>
       - build-<{ type }>-pkgs-onedir
-      <%- elif platform %>
-      - build-salt-onedir-<{ platform }>
       <%- elif type == 'onedir' %>
       - build-salt-onedir-linux
       - build-salt-onedir-macos
       - build-salt-onedir-windows
+      <%- elif type == 'src' %>
+      - build-source-tarball
       <%- endif %>
+
     <%- include "build-{}-repo.yml.jinja".format(type) %>
 
 <%- endfor %>
diff --git a/.github/workflows/templates/build-rpm-repo.yml.jinja b/.github/workflows/templates/build-rpm-repo.yml.jinja
index ba0702ffc03..238bb00d642 100644
--- a/.github/workflows/templates/build-rpm-repo.yml.jinja
+++ b/.github/workflows/templates/build-rpm-repo.yml.jinja
@@ -23,7 +23,8 @@
                                             ("photon", "4", "x86_64"),
                                             ("photon", "4", "aarch64"),
                                         ) %>
-          - distro: <{ distro }>
+          - pkg-type: rpm
+            distro: <{ distro }>
             version: "<{ version }>"
             arch: <{ arch }>
         <%- endfor %>
diff --git a/.github/workflows/templates/build-src-repo.yml.jinja b/.github/workflows/templates/build-src-repo.yml.jinja
index 728ed00f093..f0c1a82b7c3 100644
--- a/.github/workflows/templates/build-src-repo.yml.jinja
+++ b/.github/workflows/templates/build-src-repo.yml.jinja
@@ -1,4 +1,10 @@
 
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - src
+
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/templates/build-windows-repo.yml.jinja b/.github/workflows/templates/build-windows-repo.yml.jinja
index d806fd00bb3..dc96a8a2e31 100644
--- a/.github/workflows/templates/build-windows-repo.yml.jinja
+++ b/.github/workflows/templates/build-windows-repo.yml.jinja
@@ -1,4 +1,10 @@
 
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg-type:
+          - windows
+
     steps:
       - uses: actions/checkout@v4
 

From 1cc07d7bf865bca071fdc855eb083cb3891a70e5 Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Fri, 6 Oct 2023 17:07:14 +0100
Subject: [PATCH 27/29] Fix the codecov report names

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/test-action-macos.yml                   | 8 ++++----
 .github/workflows/test-action.yml                         | 8 ++++----
 .github/workflows/test-package-downloads-action-linux.yml | 8 ++++----
 .github/workflows/test-package-downloads-action-macos.yml | 8 ++++----
 .../workflows/test-package-downloads-action-windows.yml   | 8 ++++----
 5 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index a9fa7c783ff..5be895a57ca 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -439,14 +439,14 @@ jobs:
           #  do-upload --git-service github --sha ${{ github.sha }} \
           #  --file artifacts/coverage/salt.xml \
           #  --flag salt --flag ${{ inputs.distro-slug }} \
-          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}
+          #  --name salt.${{ inputs.distro-slug }}.${{ inputs.nox-session }}
           n=0
           until [ "$n" -ge 5 ]
           do
           if ./codecov --file artifacts/coverage/salt.xml \
             --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
             --flags salt,${{ inputs.distro-slug }} \
-            --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }} --nonZero; then
+            --name salt.${{ inputs.distro-slug }}.${{ inputs.nox-session }} --nonZero; then
               rc=$?
               break
           fi
@@ -471,14 +471,14 @@ jobs:
           #  do-upload --git-service github --sha ${{ github.sha }} \
           #  --file artifacts/coverage/tests.xml \
           #  --flag tests --flag ${{ inputs.distro-slug }} \
-          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}
+          #  --name tests.${{ inputs.distro-slug }}.${{ inputs.nox-session }}
           n=0
           until [ "$n" -ge 5 ]
           do
             if ./codecov --file artifacts/coverage/tests.xml \
               --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
               --flags tests,${{ inputs.distro-slug }} \
-              --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }} --nonZero; then
+              --name tests.${{ inputs.distro-slug }}.${{ inputs.nox-session }} --nonZero; then
               rc=$?
               break
           fi
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 351ba55e5b9..f6c5f9e8c57 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -386,14 +386,14 @@ jobs:
           #  do-upload --git-service github --sha ${{ github.sha }} \
           #  --file artifacts/coverage/salt.xml \
           #  --flag salt --flag ${{ inputs.distro-slug }} \
-          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}
+          #  --name salt.${{ inputs.distro-slug }}.${{ inputs.nox-session }}
           n=0
           until [ "$n" -ge 5 ]
           do
           if ./codecov --file artifacts/coverage/salt.xml \
               --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
               --flags salt,${{ inputs.distro-slug }} \
-              --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }} --nonZero; then
+              --name salt.${{ inputs.distro-slug }}.${{ inputs.nox-session }} --nonZero; then
               rc=$?
               break
           fi
@@ -418,14 +418,14 @@ jobs:
           #  do-upload --git-service github --sha ${{ github.sha }} \
           #  --file artifacts/coverage/tests.xml \
           #  --flag tests --flag ${{ inputs.distro-slug }} \
-          #  --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }}
+          #  --name tests.${{ inputs.distro-slug }}.${{ inputs.nox-session }}
           n=0
           until [ "$n" -ge 5 ]
           do
           if ./codecov --file artifacts/coverage/tests.xml \
               --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
               --flags tests,${{ inputs.distro-slug }} \
-              --name ${{ inputs.distro-slug }}.${{ env.NOX_SESSION }} --nonZero; then
+              --name tests.${{ inputs.distro-slug }}.${{ inputs.nox-session }} --nonZero; then
               rc=$?
               break
           fi
diff --git a/.github/workflows/test-package-downloads-action-linux.yml b/.github/workflows/test-package-downloads-action-linux.yml
index 06faeffa002..f94d094d3b7 100644
--- a/.github/workflows/test-package-downloads-action-linux.yml
+++ b/.github/workflows/test-package-downloads-action-linux.yml
@@ -235,14 +235,14 @@ jobs:
           #  do-upload --git-service github --sha ${{ github.sha }} \
           #  --file artifacts/coverage/salt.xml \
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
-          #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          #  --name salt.${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           n=0
           until [ "$n" -ge 5 ]
           do
           if ./codecov --file artifacts/coverage/salt.xml \
               --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
               --flags salt,${{ inputs.distro-slug }},pkg \
-              --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
+              --name salt.${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
               rc=$?
               break
           fi
@@ -267,14 +267,14 @@ jobs:
           #  do-upload --git-service github --sha ${{ github.sha }} \
           #  --file artifacts/coverage/tests.xml \
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
-          #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          #  --name tests.${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           n=0
           until [ "$n" -ge 5 ]
           do
           if ./codecov --file artifacts/coverage/tests.xml \
               --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
               --flags tests,${{ inputs.distro-slug }},pkg \
-              --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
+              --name tests.${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
               rc=$?
               break
           fi
diff --git a/.github/workflows/test-package-downloads-action-macos.yml b/.github/workflows/test-package-downloads-action-macos.yml
index f5e8c2d05c6..632a88a7d29 100644
--- a/.github/workflows/test-package-downloads-action-macos.yml
+++ b/.github/workflows/test-package-downloads-action-macos.yml
@@ -213,14 +213,14 @@ jobs:
           #  do-upload --git-service github --sha ${{ github.sha }} \
           #  --file artifacts/coverage/salt.xml \
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
-          #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          #  --name salt.${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           n=0
           until [ "$n" -ge 5 ]
           do
           if ./codecov --file artifacts/coverage/salt.xml \
               --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
               --flags salt,${{ inputs.distro-slug }},pkg \
-              --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
+              --name salt.${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
               rc=$?
               break
           fi
@@ -245,14 +245,14 @@ jobs:
           #  do-upload --git-service github --sha ${{ github.sha }} \
           #  --file artifacts/coverage/tests.xml \
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
-          #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          #  --name tests.${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           n=0
           until [ "$n" -ge 5 ]
           do
           if ./codecov --file artifacts/coverage/tests.xml \
               --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
               --flags tests,${{ inputs.distro-slug }},pkg \
-              --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
+              --name tests.${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
               rc=$?
               break
           fi
diff --git a/.github/workflows/test-package-downloads-action-windows.yml b/.github/workflows/test-package-downloads-action-windows.yml
index 704aa962829..beb15893494 100644
--- a/.github/workflows/test-package-downloads-action-windows.yml
+++ b/.github/workflows/test-package-downloads-action-windows.yml
@@ -240,14 +240,14 @@ jobs:
           #  do-upload --git-service github --sha ${{ github.sha }} \
           #  --file artifacts/coverage/salt.xml \
           #  --flag salt --flag ${{ inputs.distro-slug }} --flag pkg \
-          #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          #  --name salt.${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           n=0
           until [ "$n" -ge 5 ]
           do
           if ./codecov --file artifacts/coverage/salt.xml \
               --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
               --flags salt,${{ inputs.distro-slug }},pkg \
-              --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
+              --name salt.${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
               rc=$?
               break
           fi
@@ -272,14 +272,14 @@ jobs:
           #  do-upload --git-service github --sha ${{ github.sha }} \
           #  --file artifacts/coverage/tests.xml \
           #  --flag tests --flag ${{ inputs.distro-slug }} --flag pkg \
-          #  --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
+          #  --name tests.${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs
           n=0
           until [ "$n" -ge 5 ]
           do
           if ./codecov --file artifacts/coverage/tests.xml \
               --sha ${{ github.event.pull_request.head.sha || github.sha }} ${{ github.event_name == 'pull_request' && format('--parent {0}', github.event.pull_request.base.sha) }} \
               --flags tests,${{ inputs.distro-slug }},pkg \
-              --name ${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
+              --name tests.${{ inputs.distro-slug }}.${{ inputs.nox-session }}.download-pkgs --nonZero; then
               rc=$?
               break
           fi

From 87242a1fd1ea637c1f512d4316a4cdb224451622 Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Fri, 6 Oct 2023 20:20:38 +0100
Subject: [PATCH 28/29] Do not override code coverage databases when uploading

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/test-action-macos.yml | 20 +++++++++++++-------
 .github/workflows/test-action.yml       | 20 +++++++++++++-------
 2 files changed, 26 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index 5be895a57ca..2b44708b7f2 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -491,13 +491,6 @@ jobs:
             exit 1
           fi
 
-      - name: Upload Code Coverage DB
-        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
-        uses: actions/upload-artifact@v3
-        with:
-          name: code-coverage
-          path: artifacts/coverage
-
       - name: Report Salt Code Coverage
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
         continue-on-error: true
@@ -509,3 +502,16 @@ jobs:
         continue-on-error: true
         run: |
           nox --force-color -e report-coverage
+
+      - name: Rename Code Coverage DB
+        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
+        continue-on-error: true
+        run: |
+          mv artifacts/coverage/.coverage artifacts/coverage/.coverage.${{ inputs.distro-slug }}.${{ inputs.nox-session }}
+
+      - name: Upload Code Coverage DB
+        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
+        uses: actions/upload-artifact@v3
+        with:
+          name: code-coverage
+          path: artifacts/coverage
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index f6c5f9e8c57..04600f5fe27 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -438,13 +438,6 @@ jobs:
             exit 1
           fi
 
-      - name: Upload Code Coverage DB
-        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
-        uses: actions/upload-artifact@v3
-        with:
-          name: code-coverage
-          path: artifacts/coverage
-
       - name: Report Salt Code Coverage
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
         continue-on-error: true
@@ -456,3 +449,16 @@ jobs:
         continue-on-error: true
         run: |
           nox --force-color -e report-coverage
+
+      - name: Rename Code Coverage DB
+        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
+        continue-on-error: true
+        run: |
+          mv artifacts/coverage/.coverage artifacts/coverage/.coverage.${{ inputs.distro-slug }}.${{ inputs.nox-session }}
+
+      - name: Upload Code Coverage DB
+        if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
+        uses: actions/upload-artifact@v3
+        with:
+          name: code-coverage
+          path: artifacts/coverage

From 7fbc2d1e02edf725b49818383826d717ed73e1f7 Mon Sep 17 00:00:00 2001
From: Pedro Algarvio <palgarvio@vmware.com>
Date: Fri, 6 Oct 2023 21:56:19 +0100
Subject: [PATCH 29/29] No need to upload coverage DB's twice

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>
---
 .github/workflows/test-action-macos.yml | 10 +---------
 .github/workflows/test-action.yml       | 10 +---------
 2 files changed, 2 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/test-action-macos.yml b/.github/workflows/test-action-macos.yml
index 2b44708b7f2..033c3a25e37 100644
--- a/.github/workflows/test-action-macos.yml
+++ b/.github/workflows/test-action-macos.yml
@@ -342,14 +342,6 @@ jobs:
           path: |
             artifacts/coverage/
 
-      - name: Upload All Code Coverage Test Run Artifacts
-        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
-        uses: actions/upload-artifact@v3
-        with:
-          name: all-testrun-coverage-artifacts
-          path: |
-            artifacts/coverage/
-
       - name: Upload JUnit XML Test Run Artifacts
         if: always() && steps.download-artifacts-from-vm.outcome == 'success'
         uses: actions/upload-artifact@v3
@@ -513,5 +505,5 @@ jobs:
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
         uses: actions/upload-artifact@v3
         with:
-          name: code-coverage
+          name: all-testrun-coverage-artifacts
           path: artifacts/coverage
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 04600f5fe27..8268b937dda 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -291,14 +291,6 @@ jobs:
           path: |
             artifacts/coverage/
 
-      - name: Upload All Code Coverage Test Run Artifacts
-        if: always() && inputs.skip-code-coverage == false && steps.download-artifacts-from-vm.outcome == 'success' && job.status != 'cancelled'
-        uses: actions/upload-artifact@v3
-        with:
-          name: all-testrun-coverage-artifacts
-          path: |
-            artifacts/coverage/
-
       - name: Upload JUnit XML Test Run Artifacts
         if: always() && steps.download-artifacts-from-vm.outcome == 'success'
         uses: actions/upload-artifact@v3
@@ -460,5 +452,5 @@ jobs:
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'
         uses: actions/upload-artifact@v3
         with:
-          name: code-coverage
+          name: all-testrun-coverage-artifacts
           path: artifacts/coverage