From 4594689aa0b628ac7458835c622dc5a70feb0142 Mon Sep 17 00:00:00 2001
From: Alex Fenlon <a.fenlon@f5.com>
Date: Mon, 23 Jun 2025 15:25:25 +0100
Subject: [PATCH 1/9] update release notes scripts

---
 .github/release-rn.yml                     |  20 +++
 .github/scripts/docs-shortcode-update.sh   |  35 ++++
 .github/scripts/exclude_ci_files.txt       |   5 +-
 .github/scripts/pull-release-notes.py      | 158 +++++++++++++++++
 .github/scripts/release-docs.sh            | 197 +++++++++++++++++++++
 .github/scripts/release-notes-update.sh    |  55 ------
 .github/scripts/release-notes.j2           |  37 ++++
 .github/workflows/release-pr.yml           |  10 +-
 .github/workflows/update-release-draft.yml |   2 +-
 hack/changelog-template.txt                |  29 ---
 10 files changed, 459 insertions(+), 89 deletions(-)
 create mode 100644 .github/release-rn.yml
 create mode 100755 .github/scripts/docs-shortcode-update.sh
 create mode 100755 .github/scripts/pull-release-notes.py
 create mode 100755 .github/scripts/release-docs.sh
 delete mode 100755 .github/scripts/release-notes-update.sh
 create mode 100644 .github/scripts/release-notes.j2
 delete mode 100644 hack/changelog-template.txt

diff --git a/.github/release-rn.yml b/.github/release-rn.yml
new file mode 100644
index 0000000000..51b4a8a1d9
--- /dev/null
+++ b/.github/release-rn.yml
@@ -0,0 +1,20 @@
+changelog:
+  exclude:
+    labels:
+      - skip changelog
+  categories:
+    - title: 💣 Breaking Changes
+      labels:
+        - change
+    - title: 🚀 Features
+      labels:
+        - enhancement
+    - title: 🐛 Bug Fixes
+      labels:
+        - bug
+    - title: 📦 Helm Chart
+      labels:
+        - helm_chart
+    - title: ⬆️ Dependencies
+      labels:
+        - dependencies
diff --git a/.github/scripts/docs-shortcode-update.sh b/.github/scripts/docs-shortcode-update.sh
new file mode 100755
index 0000000000..4834c4aaf4
--- /dev/null
+++ b/.github/scripts/docs-shortcode-update.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+set -o pipefail
+
+ usage() {
+    echo "Usage: $0 <docs_folder> <new_ic_version> <new_helm_chart_version> <new_operator_version>"
+    exit 1
+ }
+
+docs_folder=$1
+new_ic_version=$2
+new_helm_chart_version=$3
+new_operator_version=$4
+
+if [ -z "${docs_folder}" ]; then
+    usage
+fi
+
+if [ -z "${new_ic_version}" ]; then
+    usage
+fi
+
+if [ -z "${new_helm_chart_version}" ]; then
+    usage
+fi
+
+if [ -z "${new_operator_version}" ]; then
+    usage
+fi
+
+
+# update docs with new versions
+echo -n "${new_ic_version}" > ${docs_folder}/layouts/shortcodes/nic-version.html
+echo -n "${new_helm_chart_version}" > ${docs_folder}/layouts/shortcodes/nic-helm-version.html
+echo -n "${new_operator_version}" > ${docs_folder}/layouts/shortcodes/nic-operator-version.html
diff --git a/.github/scripts/exclude_ci_files.txt b/.github/scripts/exclude_ci_files.txt
index c82a068a93..80a4bae44f 100644
--- a/.github/scripts/exclude_ci_files.txt
+++ b/.github/scripts/exclude_ci_files.txt
@@ -10,7 +10,10 @@
 .github/ISSUE_TEMPLATE/*
 .github/scripts/create-release-tarballs.sh
 .github/scripts/docker-updater.sh
-.github/scripts/release-notes-update.sh
+.github/scripts/release-docs.sh
+.github/scripts/pull-release-notes.py
+.github/scripts/release-notes.j2
+.github/scripts/docs-shortcode-update.sh
 .github/scripts/release-version-update.sh
 .github/workflows/build-base-images.yml
 .github/workflows/build-ot-dependency.yml
diff --git a/.github/scripts/pull-release-notes.py b/.github/scripts/pull-release-notes.py
new file mode 100755
index 0000000000..ba36e1ccc9
--- /dev/null
+++ b/.github/scripts/pull-release-notes.py
@@ -0,0 +1,158 @@
+#!/usr/bin/env python
+
+import argparse
+import os
+import re
+import sys
+
+from github import Auth, Github
+from jinja2 import Environment, FileSystemLoader
+
+# parse args
+parser = argparse.ArgumentParser()
+parser.add_argument("nic_version", help="NGINX Ingress Controller version")
+parser.add_argument("helm_chart_version", help="NGINX Ingress Controller Helm chart version")
+parser.add_argument("k8s_versions", help="Kubernetes versions")
+parser.add_argument("release_date", help="Release date")
+args = parser.parse_args()
+NIC_VERSION = args.nic_version
+HELM_CHART_VERSION = args.helm_chart_version
+K8S_VERSIONS = args.k8s_versions
+RELEASE_DATE = args.release_date
+
+# Set up Jinja2 environment
+template_dir = os.path.dirname(os.path.abspath(__file__))
+env = Environment(loader=FileSystemLoader(template_dir))
+template = env.get_template("release-notes.j2")
+
+# Set github environment
+github_org = os.getenv("GITHUB_ORG", "nginx")
+github_repo = os.getenv("GITHUB_REPO", "kubernetes-ingress")
+token = os.environ.get("GITHUB_TOKEN")
+docker_pr_strings = ["Docker image update", "docker group", "docker-images group", "in /build"]
+golang_pr_strings = ["go group", "go_modules group"]
+
+
+def parse_sections(markdown: str):
+    sections = {}
+    section_name = None
+    for line in markdown.splitlines():
+        # Check if the line starts with a section header
+        # Section headers start with "### "
+        # We will use the section header as the key in the sections dictionary
+        # and the lines below it as the values (until the next section header)
+        line = line.strip()
+        if not line:
+            continue  # skip empty lines
+        if line.startswith("### "):
+            section_name = line[3:].strip()
+            sections[section_name] = []
+        # If the line starts with "* " and contains "made their first contribution",
+        # we will skip it as it is not a change but a contributor note
+        elif section_name and line.startswith("* ") and "made their first contribution" in line:
+            continue
+        # Check if the line starts with "* " or "- "
+        # If it does, we will add the line to the current section
+        # We will also strip the "* " or "- " from the beginning of the line
+        elif section_name and line.strip().startswith("* "):
+            sections[section_name].append(line.strip()[2:].strip())
+    return sections
+
+
+def format_pr_groups(prs, title):
+    # join the PR's into a comma, space separated string
+    comma_sep_prs = "".join([f"{dep['details']}, " for dep in prs])
+
+    # strip the last comma and space, and add the first PR title
+    trimmed_comma_sep_prs = f"{comma_sep_prs.rstrip(', ')} {title}"
+
+    # split the string by the last comma and join with an ampersand
+    split_result = trimmed_comma_sep_prs.rsplit(",", 1)
+    return " &".join(split_result)
+
+
+# Get release text
+def get_github_release(version, github_org, github_repo, token):
+    if token == "":
+        print("ERROR: GITHUB token variable cannot be empty")
+        return None
+    auth = Auth.Token(token)
+    g = Github(auth=auth)
+    repo = g.get_organization(github_org).get_repo(github_repo)
+    release = None
+    releases = repo.get_releases()
+    for rel in releases:
+        if rel.tag_name == f"v{version}":
+            release = rel
+            break
+    g.close()
+    if release is not None:
+        return release.body
+    print(f"ERROR: Release v{NIC_VERSION} not found in {github_org}/{github_repo}.")
+    return None
+
+
+## Main section of script
+
+release_body = get_github_release(NIC_VERSION, github_org, github_repo, token)
+if release_body is None:
+    print("ERROR: Cannot get release from Github.  Exiting...")
+    sys.exit(1)
+
+# Parse the release body to extract sections
+sections = parse_sections(release_body or "")
+
+# Prepare the data for rendering
+# We will create a dictionary with the categories and their changes
+# Also, we will handle dependencies separately for Go and Docker images
+# and format them accordingly
+catagories = {}
+dependencies_title = ""
+for title, changes in sections.items():
+    if any(x in title for x in ["Other Changes", "Documentation", "Maintenance", "Tests"]):
+        # These sections do not show up in the docs release notes
+        continue
+    parsed_changes = []
+    go_dependencies = []
+    docker_dependencies = []
+    for line in changes:
+        change = re.search("^(.*) by @.* in (.*)$", line)
+        change_title = change.group(1)
+        pr_link = change.group(2)
+        pr_number = re.search(r"^.*pull/(\d+)$", pr_link).group(1)
+        pr = {"details": f"[{pr_number}]({pr_link})", "title": change_title.capitalize()}
+        if "Dependencies" in title:
+            # save section title for later use as lookup key to categories dict
+            dependencies_title = title
+
+            # Append Golang changes in to the go_dependencies list for later processing
+            if any(str in change_title for str in golang_pr_strings):
+                go_dependencies.append(pr)
+            # Append Docker changes in to the docker_dependencies list for later processing
+            elif any(str in change_title for str in docker_pr_strings):
+                docker_dependencies.append(pr)
+            # Treat this change like any other ungrouped change
+            else:
+                parsed_changes.append(f"{pr['details']} {pr['title']}")
+        else:
+            parsed_changes.append(f"{pr['details']} {pr['title']}")
+
+    catagories[title] = parsed_changes
+
+# Add grouped dependencies to the Dependencies category
+catagories[dependencies_title].append(format_pr_groups(docker_dependencies, "Bump Docker dependencies"))
+catagories[dependencies_title].append(format_pr_groups(go_dependencies, "Bump Go dependencies"))
+catagories[dependencies_title].reverse()
+
+# Populates the data needed for rendering the template
+# The data will be passed to the Jinja2 template for rendering
+data = {
+    "version": NIC_VERSION,
+    "release_date": RELEASE_DATE,
+    "sections": catagories,
+    "HELM_CHART_VERSION": HELM_CHART_VERSION,
+    "K8S_VERSIONS": K8S_VERSIONS,
+}
+
+# Render with Jinja2
+print(template.render(**data))
diff --git a/.github/scripts/release-docs.sh b/.github/scripts/release-docs.sh
new file mode 100755
index 0000000000..b6f1ffe60f
--- /dev/null
+++ b/.github/scripts/release-docs.sh
@@ -0,0 +1,197 @@
+#!/usr/bin/env bash
+
+set -o pipefail
+
+ROOTDIR=$(git rev-parse --show-toplevel || echo ".")
+TMPDIR=/tmp
+DEBUG=${DEBUG:-"false"}
+DRY_RUN=${DRY_RUN:-"false"}
+TIDY=${TIDY:-"true"}
+DOCS_REPO=${DOCS_REPO:-"nginx/documentation"}
+GITHUB_USERNAME=${GITHUB_USERNAME:-""}
+GITHUB_EMAIL=${GITHUB_EMAIL:-""}
+RELEASE_BRANCH_PREFIX=${RELEASE_BRANCH_PREFIX:-"nic-release-"}
+export GH_TOKEN=${GITHUB_TOKEN:-""}
+
+ usage() {
+    echo "Usage: $0 <ic_version> <helm_chart_version> <operator_version> <k8s_versions> <release_date>"
+    exit 1
+ }
+
+ # clone local doc repo
+ # if branch for the release doesnt exist, create it, otherwise checkout
+
+DOCS_FOLDER=${TMPDIR}/documentation
+ic_version=$1
+helm_chart_version=$2
+operator_version=$3
+k8s_versions=$4
+release_date=$5
+
+if [ -z "${ic_version}" ]; then
+    usage
+fi
+
+if [ -z "${helm_chart_version}" ]; then
+    usage
+fi
+
+if [ -z "${k8s_versions}" ]; then
+    usage
+fi
+
+if [ -z "${release_date}" ]; then
+    usage
+fi
+
+if [ -z "${GH_TOKEN}" ]; then
+    echo "ERROR: GITHUB_TOKEN is not set"
+    exit 2
+fi
+
+echo "INFO: Setting git credentials"
+if [ -n "${GITHUB_USERNAME}" ]; then
+    git config --global user.name "${GITHUB_USERNAME}"
+fi
+
+if [ -n "${GITHUB_EMAIL}" ]; then
+    git config --global user.email "${GITHUB_EMAIL}"
+fi
+
+if [ "${DEBUG}" != "false" ]; then
+    echo "DEBUG: DRY_RUN: ${DRY_RUN}"
+    echo "DEBUG: TIDY: ${TIDY}"
+    echo "DEBUG: DOCS_REPO: ${DOCS_REPO}"
+    echo "DEBUG: GITHUB_USERNAME: ${GITHUB_USERNAME}"
+    echo "DEBUG: GITHUB_EMAIL: ${GITHUB_EMAIL}"
+    echo "DEBUG: RELEASE_BRANCH_PREFIX: ${RELEASE_BRANCH_PREFIX}"
+    echo "DEBUG: GH_TOKEN: ****$(echo -n $GH_TOKEN | tail -c 4)"
+    echo "DEBUG: DOCS_FOLDER: ${DOCS_FOLDER}"
+    echo "DEBUG: ic_version: ${ic_version}"
+    echo "DEBUG: helm_chart_version: ${helm_chart_version}"
+    echo "DEBUG: operator_version: ${operator_version}"
+    echo "DEBUG: k8s_versions: ${k8s_versions}"
+    echo "DEBUG: release_date: ${release_date}"
+fi
+
+echo "INFO: Generating release notes from github draft release"
+release_notes_content=$(${ROOTDIR}/.github/scripts/pull-release-notes.py ${ic_version} ${helm_chart_version} ${k8s_versions} "${release_date}")
+if [ $? -ne 0 ]; then
+    echo "ERROR: failed processing release notes"
+    exit 2
+fi
+
+if [ -z "${release_notes_content}" ]; then
+    echo "ERROR: no release notes content"
+    exit 2
+fi
+
+if [ "${DEBUG}" != "false" ]; then
+    echo "DEBUG: Release notes content:"
+    echo "${release_notes_content}"
+fi
+
+echo "INFO: Cloning ${DOCS_REPO}"
+gh_bin=$(which gh)
+if [ -z "${gh_bin}" ]; then
+    echo "ERROR: gh is not installed"
+    exit 2
+fi
+
+if [ -d "${DOCS_FOLDER}" ]; then
+    rm -rf "${DOCS_FOLDER}"
+fi
+
+$gh_bin repo clone "${DOCS_REPO}" "${DOCS_FOLDER}" > /dev/null 2>&1
+if [ $? -ne 0 ]; then
+    echo "ERROR: failed cloning ${DOCS_REPO}"
+    exit 2
+fi
+
+cd ${DOCS_FOLDER}
+if [ "${DEBUG}" != "false" ]; then
+    echo "DEBUG: Cloned doc repo to ${DOCS_FOLDER} and changed directory"
+fi
+
+# generate branch name
+branch=${RELEASE_BRANCH_PREFIX}${ic_version%.*}
+if [ "${DEBUG}" != "false" ]; then
+    echo "DEBUG: Generating branch ${branch}"
+fi
+
+echo "INFO: Checking out branch ${branch} in the documentation repository"
+remote_branch=$(git ls-remote --heads origin ${branch} 2> /dev/null)
+
+if [ -n "${remote_branch}" ]; then
+    git checkout ${branch}
+    if [ "${DEBUG}" != "false" ]; then
+        echo "DEBUG: Checked out branch ${branch}"
+    fi
+else
+    git checkout -b ${branch}
+    if [ "${DEBUG}" != "false" ]; then
+        echo "DEBUG: Created branch ${branch}"
+    fi
+fi
+
+echo "INFO: Adding release notes content to release.md in the documentation repository"
+file_path=${DOCS_FOLDER}/content/nic/releases.md
+if [ "${DEBUG}" != "false" ]; then
+    echo "DEBUG: Processing ${file_path}"
+fi
+file_name=$(basename "${file_path}")
+mv "${file_path}" "${TMPDIR}/${file_name}"
+head -n 8 "${TMPDIR}/${file_name}" > "${TMPDIR}/header"
+tail -n +9 "${TMPDIR}/${file_name}" > "${TMPDIR}/body"
+echo "${release_notes_content}" > "${TMPDIR}/release_notes"
+cat "${TMPDIR}/header" "${TMPDIR}/release_notes" "${TMPDIR}/body" > "${file_path}"
+if [ $? -ne 0 ]; then
+    echo "ERROR: failed processing ${file_path}"
+    mv "${TMPDIR}/${file_name}" "${file_path}"
+    exit 2
+fi
+
+echo "INFO: Updating shortcodes in the documentation repository"
+${ROOTDIR}/.github/scripts/docs-shortcode-update.sh "${DOCS_FOLDER}" "${ic_version}" "${helm_chart_version}" "${operator_version}"
+if [ $? -ne 0 ]; then
+    echo "ERROR: failed updating shortcodes"
+    exit 2
+fi
+
+echo "INFO: Committing changes to the documentation repository"
+git add -A
+if [ $? -ne 0 ]; then
+    echo "ERROR: failed adding files to git"
+    exit 2
+fi
+
+git commit -m "Update release notes for ${ic_version}"
+if [ $? -ne 0 ]; then
+    echo "ERROR: failed committing changes to the docs repo"
+    exit 2
+fi
+
+if [ "${DRY_RUN}" == "false" ]; then
+    echo "INFO: Pushing changes to the documentation repository"
+    git push origin ${branch}
+    if [ $? -ne 0 ]; then
+        echo "ERROR: failed pushing changes to the docs repo"
+        exit 2
+    fi
+    echo "INFO: Creating pull request for the documentation repository"
+    gh pr create --title "Update release notes for ${ic_version}" --body "Update release notes for ${ic_version}" --head ${branch} --draft
+else
+    echo "INFO: DRY_RUN: Skipping push and pull request creation"
+fi
+
+if [ "${DEBUG}" != "false" ]; then
+    echo "DEBUG: Returning to NIC directory"
+fi
+cd - > /dev/null 2>&1
+
+if [ "${TIDY}" == "true" ]; then
+    echo "INFO: Clean up"
+    rm -rf "${TMPDIR}/header" "${TMPDIR}/body" "${TMPDIR}/release_notes" "${DOCS_FOLDER}"
+fi
+
+exit 0
diff --git a/.github/scripts/release-notes-update.sh b/.github/scripts/release-notes-update.sh
deleted file mode 100755
index 2ae80ebb00..0000000000
--- a/.github/scripts/release-notes-update.sh
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-
-set -o pipefail
-
-ROOTDIR=$(git rev-parse --show-toplevel || echo ".")
-TMPDIR=/tmp
-DEBUG=${DEBUG:-"false"}
-
-DOCS_TO_UPDATE_FOLDER=${ROOTDIR}/site/content
-
- usage() {
-    echo "Usage: $0 <ic_version> <helm_chart_version> <k8s_versions> <release_date>"
-    exit 1
- }
-
-ic_version=$1
-helm_chart_version=$2
-k8s_versions=$3
-release_date=$4
-
-if [ -z "${ic_version}" ]; then
-    usage
-fi
-
-if [ -z "${helm_chart_version}" ]; then
-    usage
-fi
-
-if [ -z "${k8s_versions}" ]; then
-    usage
-fi
-
-if [ -z "${release_date}" ]; then
-    usage
-fi
-
-# update releases docs
-file_path=${DOCS_TO_UPDATE_FOLDER}/releases.md
-if [ "${DEBUG}" != "false" ]; then
-    echo "Processing ${file_path}"
-fi
-file_name=$(basename "${file_path}")
-mv "${file_path}" "${TMPDIR}/${file_name}"
-sed -e "8r ${ROOTDIR}/hack/changelog-template.txt" "${TMPDIR}/${file_name}" | sed \
-    -e "s/%%TITLE%%/## $ic_version/g" \
-    -e "s/%%IC_VERSION%%/$ic_version/g" \
-    -e "s/%%HELM_CHART_VERSION%%/$helm_chart_version/g" \
-    -e "s/%%K8S_VERSIONS%%/$k8s_versions.\n/g" \
-    -e "s/%%RELEASE_DATE%%/$release_date/g" \
-    > ${file_path}
-if [ $? -ne 0 ]; then
-    echo "ERROR: failed processing ${file_path}"
-    mv "${TMPDIR}/${file_name}" "${file_path}"
-    exit 2
-fi
diff --git a/.github/scripts/release-notes.j2 b/.github/scripts/release-notes.j2
new file mode 100644
index 0000000000..f754b2166d
--- /dev/null
+++ b/.github/scripts/release-notes.j2
@@ -0,0 +1,37 @@
+## {{ version }}
+
+{{ release_date }}
+
+{%- set category_map = {
+  'Breaking Changes': 'Breaking Changes',
+  'Features': '🚀 Features',
+  'Fixes': '🐛 Bug Fixes',
+  'Helm Chart': 'Helm Chart',
+  'Dependencies': '⬆️ Dependencies'
+} %}
+{%- set icons = {
+  'Breaking Changes': 'fa-bomb',
+  'Features': 'fa-rocket',
+  'Fixes': 'fa-bug-slash',
+  'Helm Chart': 'fa-box',
+  'Dependencies': 'fa-upload'
+} %}
+{%- for category, key in category_map.items() %}
+{%- if sections.get(key) %}
+
+### <i class="fa-solid {{ icons[category] }}"></i> {{ category }}
+{%- for change in sections[key] %}
+- {{ change }}
+{%- endfor %}
+{%- endif %}
+{%- endfor %}
+
+### <i class="fa-solid fa-download"></i> Upgrade
+- For NGINX, use the {{ version }} images from our [DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name={{ version }}), [GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
+- For NGINX Plus, use the {{ version }} images from the F5 Container registry or build your own image using the {{ version }} source code.
+- For Helm, use version {{ HELM_CHART_VERSION }} of the chart.
+
+### <i class="fa-solid fa-life-ring"></i> Supported Platforms
+We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes versions: {{ K8S_VERSIONS }}.
+
+---
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 3a76cf5531..ee9377d96b 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -68,9 +68,13 @@ jobs:
           .github/scripts/release-version-update.sh \
             ${{ github.event.inputs.current_version }} ${{ github.event.inputs.current_helm_version }} ${{ github.event.inputs.current_operator_version }} \
             ${{ github.event.inputs.new_version }} ${{ github.event.inputs.new_helm_version }} ${{ github.event.inputs.new_operator_version }}
-          # .github/scripts/release-notes-update.sh \
-          #   ${{ github.event.inputs.new_version }} ${{ github.event.inputs.new_helm_version }} "${{ github.event.inputs.k8s_versions }}" \
-          #   "${{ github.event.inputs.release_date }}"
+          .github/scripts/release-docs.sh \
+            ${{ github.event.inputs.new_version }} ${{ github.event.inputs.new_helm_version }} ${{ github.event.inputs.new_operator_version }} \
+            "${{ github.event.inputs.k8s_versions }}" "${{ github.event.inputs.release_date }}"
+        env:
+          GITHUB_USERNAME: ${{ github.actor }}
+          GITHUB_EMAIL: ${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
diff --git a/.github/workflows/update-release-draft.yml b/.github/workflows/update-release-draft.yml
index f844431203..ac7c9e09ae 100644
--- a/.github/workflows/update-release-draft.yml
+++ b/.github/workflows/update-release-draft.yml
@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       branch:
-        description: "Release branch to update from"
+        description: "Release branch"
         required: true
         type: string
 
diff --git a/hack/changelog-template.txt b/hack/changelog-template.txt
deleted file mode 100644
index eab84898c6..0000000000
--- a/hack/changelog-template.txt
+++ /dev/null
@@ -1,29 +0,0 @@
-%%TITLE%%
-
-%%RELEASE_DATE%%
-
-### <i class="fa-solid fa-bomb"></i> Breaking Changes
-
-### <i class="fa-solid fa-rocket"></i> Features
-
-### <i class="fa-solid fa-bug-slash"></i> Fixes
-
-### <i class="fa-solid fa-box"></i> Helm Chart
-
-### <i class="fa-solid fa-upload"></i> Dependencies
-
-### <i class="fa-solid fa-download"></i> Upgrade
-
-- For NGINX, use the %%IC_VERSION%% images from our
-[DockerHub](https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=%%IC_VERSION%%),
-[GitHub Container](https://github.com/nginx/kubernetes-ingress/pkgs/container/kubernetes-ingress),
-[Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-ingress) or [Quay.io](https://quay.io/repository/nginx/nginx-ingress).
-- For NGINX Plus, use the %%IC_VERSION%% images from the F5 Container registry or build your own image using the %%IC_VERSION%% source code
-- For Helm, use version %%HELM_CHART_VERSION%% of the chart.
-
-### <i class="fa-solid fa-life-ring"></i> Supported Platforms
-
-We will provide technical support for NGINX Ingress Controller on any Kubernetes platform that is currently supported by
-its provider and that passes the Kubernetes conformance tests. This release was fully tested on the following Kubernetes
-versions: %%K8S_VERSIONS%%
----

From 80f58a288c2cf6ef49994ff08996e10daf3e2197 Mon Sep 17 00:00:00 2001
From: Paul Abel <p.abel@f5.com>
Date: Thu, 26 Jun 2025 13:44:54 +0100
Subject: [PATCH 2/9] file no longer required

---
 .github/release-rn.yml | 20 --------------------
 1 file changed, 20 deletions(-)
 delete mode 100644 .github/release-rn.yml

diff --git a/.github/release-rn.yml b/.github/release-rn.yml
deleted file mode 100644
index 51b4a8a1d9..0000000000
--- a/.github/release-rn.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-changelog:
-  exclude:
-    labels:
-      - skip changelog
-  categories:
-    - title: 💣 Breaking Changes
-      labels:
-        - change
-    - title: 🚀 Features
-      labels:
-        - enhancement
-    - title: 🐛 Bug Fixes
-      labels:
-        - bug
-    - title: 📦 Helm Chart
-      labels:
-        - helm_chart
-    - title: ⬆️ Dependencies
-      labels:
-        - dependencies

From cb204c88a570ef5dbee95ac065235aef35a43731 Mon Sep 17 00:00:00 2001
From: Paul Abel <p.abel@f5.com>
Date: Thu, 26 Jun 2025 14:18:37 +0100
Subject: [PATCH 3/9] add requirements.txt for running release notes generation
 script

---
 .github/dependabot.yml                |   7 +-
 .github/scripts/exclude_ci_files.txt  |   5 +-
 .github/scripts/pull-release-notes.py |  16 +-
 .github/scripts/requirements.txt      | 408 ++++++++++++++++++++++++++
 4 files changed, 425 insertions(+), 11 deletions(-)
 create mode 100644 .github/scripts/requirements.txt

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 55c11a6ac1..6ba988b35a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -45,7 +45,7 @@ updates:
           - "patch"
 
   - package-ecosystem: pip
-    directory: /tests
+    directory: /
     schedule:
       interval: weekly
     groups:
@@ -54,8 +54,3 @@ updates:
           - "major"
           - "minor"
           - "patch"
-
-  - package-ecosystem: gomod
-    directory: /site
-    schedule:
-      interval: weekly
diff --git a/.github/scripts/exclude_ci_files.txt b/.github/scripts/exclude_ci_files.txt
index 80a4bae44f..79fb3e2db5 100644
--- a/.github/scripts/exclude_ci_files.txt
+++ b/.github/scripts/exclude_ci_files.txt
@@ -10,11 +10,12 @@
 .github/ISSUE_TEMPLATE/*
 .github/scripts/create-release-tarballs.sh
 .github/scripts/docker-updater.sh
-.github/scripts/release-docs.sh
+.github/scripts/docs-shortcode-update.sh
 .github/scripts/pull-release-notes.py
+.github/scripts/release-docs.sh
 .github/scripts/release-notes.j2
-.github/scripts/docs-shortcode-update.sh
 .github/scripts/release-version-update.sh
+.github/scripts/requirements.txt
 .github/workflows/build-base-images.yml
 .github/workflows/build-ot-dependency.yml
 .github/workflows/build-test-image.yml
diff --git a/.github/scripts/pull-release-notes.py b/.github/scripts/pull-release-notes.py
index ba36e1ccc9..011b2d9063 100755
--- a/.github/scripts/pull-release-notes.py
+++ b/.github/scripts/pull-release-notes.py
@@ -25,13 +25,23 @@
 env = Environment(loader=FileSystemLoader(template_dir))
 template = env.get_template("release-notes.j2")
 
-# Set github environment
+# Setup required variables
 github_org = os.getenv("GITHUB_ORG", "nginx")
 github_repo = os.getenv("GITHUB_REPO", "kubernetes-ingress")
 token = os.environ.get("GITHUB_TOKEN")
 docker_pr_strings = ["Docker image update", "docker group", "docker-images group", "in /build"]
 golang_pr_strings = ["go group", "go_modules group"]
 
+# Setup regex's
+# Matches:
+# My new change by @gihubhandle in https://github.com/<org>/<repo>/pull/<number>
+# Captures change title and PR URL
+change_regex = r"^(.*) by @.* in (.*)$"
+# Matches:
+# https://github.com/<org>/<repo>/pull/<number>
+# Captures PR number
+pull_request_regex = r"^.*pull/(\d+)$"
+
 
 def parse_sections(markdown: str):
     sections = {}
@@ -116,10 +126,10 @@ def get_github_release(version, github_org, github_repo, token):
     go_dependencies = []
     docker_dependencies = []
     for line in changes:
-        change = re.search("^(.*) by @.* in (.*)$", line)
+        change = re.search(change_regex, line)
         change_title = change.group(1)
         pr_link = change.group(2)
-        pr_number = re.search(r"^.*pull/(\d+)$", pr_link).group(1)
+        pr_number = re.search(pull_request_regex, pr_link).group(1)
         pr = {"details": f"[{pr_number}]({pr_link})", "title": change_title.capitalize()}
         if "Dependencies" in title:
             # save section title for later use as lookup key to categories dict
diff --git a/.github/scripts/requirements.txt b/.github/scripts/requirements.txt
new file mode 100644
index 0000000000..57e7d3d573
--- /dev/null
+++ b/.github/scripts/requirements.txt
@@ -0,0 +1,408 @@
+#
+# This file is autogenerated by pip-compile with Python 3.13
+# by the following command:
+#
+#    pip-compile --generate-hashes --output-file=requirements.txt requirements.in
+#
+certifi==2025.6.15 \
+    --hash=sha256:2e0c7ce7cb5d8f8634ca55d2ba7e6ec2689a2fd6537d8dec1296a477a4910057 \
+    --hash=sha256:d747aa5a8b9bbbb1bb8c22bb13e22bd1f18e9796defa16bab421f7f7a317323b
+    # via requests
+cffi==1.17.1 \
+    --hash=sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8 \
+    --hash=sha256:0984a4925a435b1da406122d4d7968dd861c1385afe3b45ba82b750f229811e2 \
+    --hash=sha256:0e2b1fac190ae3ebfe37b979cc1ce69c81f4e4fe5746bb401dca63a9062cdaf1 \
+    --hash=sha256:0f048dcf80db46f0098ccac01132761580d28e28bc0f78ae0d58048063317e15 \
+    --hash=sha256:1257bdabf294dceb59f5e70c64a3e2f462c30c7ad68092d01bbbfb1c16b1ba36 \
+    --hash=sha256:1c39c6016c32bc48dd54561950ebd6836e1670f2ae46128f67cf49e789c52824 \
+    --hash=sha256:1d599671f396c4723d016dbddb72fe8e0397082b0a77a4fab8028923bec050e8 \
+    --hash=sha256:28b16024becceed8c6dfbc75629e27788d8a3f9030691a1dbf9821a128b22c36 \
+    --hash=sha256:2bb1a08b8008b281856e5971307cc386a8e9c5b625ac297e853d36da6efe9c17 \
+    --hash=sha256:30c5e0cb5ae493c04c8b42916e52ca38079f1b235c2f8ae5f4527b963c401caf \
+    --hash=sha256:31000ec67d4221a71bd3f67df918b1f88f676f1c3b535a7eb473255fdc0b83fc \
+    --hash=sha256:386c8bf53c502fff58903061338ce4f4950cbdcb23e2902d86c0f722b786bbe3 \
+    --hash=sha256:3edc8d958eb099c634dace3c7e16560ae474aa3803a5df240542b305d14e14ed \
+    --hash=sha256:45398b671ac6d70e67da8e4224a065cec6a93541bb7aebe1b198a61b58c7b702 \
+    --hash=sha256:46bf43160c1a35f7ec506d254e5c890f3c03648a4dbac12d624e4490a7046cd1 \
+    --hash=sha256:4ceb10419a9adf4460ea14cfd6bc43d08701f0835e979bf821052f1805850fe8 \
+    --hash=sha256:51392eae71afec0d0c8fb1a53b204dbb3bcabcb3c9b807eedf3e1e6ccf2de903 \
+    --hash=sha256:5da5719280082ac6bd9aa7becb3938dc9f9cbd57fac7d2871717b1feb0902ab6 \
+    --hash=sha256:610faea79c43e44c71e1ec53a554553fa22321b65fae24889706c0a84d4ad86d \
+    --hash=sha256:636062ea65bd0195bc012fea9321aca499c0504409f413dc88af450b57ffd03b \
+    --hash=sha256:6883e737d7d9e4899a8a695e00ec36bd4e5e4f18fabe0aca0efe0a4b44cdb13e \
+    --hash=sha256:6b8b4a92e1c65048ff98cfe1f735ef8f1ceb72e3d5f0c25fdb12087a23da22be \
+    --hash=sha256:6f17be4345073b0a7b8ea599688f692ac3ef23ce28e5df79c04de519dbc4912c \
+    --hash=sha256:706510fe141c86a69c8ddc029c7910003a17353970cff3b904ff0686a5927683 \
+    --hash=sha256:72e72408cad3d5419375fc87d289076ee319835bdfa2caad331e377589aebba9 \
+    --hash=sha256:733e99bc2df47476e3848417c5a4540522f234dfd4ef3ab7fafdf555b082ec0c \
+    --hash=sha256:7596d6620d3fa590f677e9ee430df2958d2d6d6de2feeae5b20e82c00b76fbf8 \
+    --hash=sha256:78122be759c3f8a014ce010908ae03364d00a1f81ab5c7f4a7a5120607ea56e1 \
+    --hash=sha256:805b4371bf7197c329fcb3ead37e710d1bca9da5d583f5073b799d5c5bd1eee4 \
+    --hash=sha256:85a950a4ac9c359340d5963966e3e0a94a676bd6245a4b55bc43949eee26a655 \
+    --hash=sha256:8f2cdc858323644ab277e9bb925ad72ae0e67f69e804f4898c070998d50b1a67 \
+    --hash=sha256:9755e4345d1ec879e3849e62222a18c7174d65a6a92d5b346b1863912168b595 \
+    --hash=sha256:98e3969bcff97cae1b2def8ba499ea3d6f31ddfdb7635374834cf89a1a08ecf0 \
+    --hash=sha256:a08d7e755f8ed21095a310a693525137cfe756ce62d066e53f502a83dc550f65 \
+    --hash=sha256:a1ed2dd2972641495a3ec98445e09766f077aee98a1c896dcb4ad0d303628e41 \
+    --hash=sha256:a24ed04c8ffd54b0729c07cee15a81d964e6fee0e3d4d342a27b020d22959dc6 \
+    --hash=sha256:a45e3c6913c5b87b3ff120dcdc03f6131fa0065027d0ed7ee6190736a74cd401 \
+    --hash=sha256:a9b15d491f3ad5d692e11f6b71f7857e7835eb677955c00cc0aefcd0669adaf6 \
+    --hash=sha256:ad9413ccdeda48c5afdae7e4fa2192157e991ff761e7ab8fdd8926f40b160cc3 \
+    --hash=sha256:b2ab587605f4ba0bf81dc0cb08a41bd1c0a5906bd59243d56bad7668a6fc6c16 \
+    --hash=sha256:b62ce867176a75d03a665bad002af8e6d54644fad99a3c70905c543130e39d93 \
+    --hash=sha256:c03e868a0b3bc35839ba98e74211ed2b05d2119be4e8a0f224fba9384f1fe02e \
+    --hash=sha256:c59d6e989d07460165cc5ad3c61f9fd8f1b4796eacbd81cee78957842b834af4 \
+    --hash=sha256:c7eac2ef9b63c79431bc4b25f1cd649d7f061a28808cbc6c47b534bd789ef964 \
+    --hash=sha256:c9c3d058ebabb74db66e431095118094d06abf53284d9c81f27300d0e0d8bc7c \
+    --hash=sha256:ca74b8dbe6e8e8263c0ffd60277de77dcee6c837a3d0881d8c1ead7268c9e576 \
+    --hash=sha256:caaf0640ef5f5517f49bc275eca1406b0ffa6aa184892812030f04c2abf589a0 \
+    --hash=sha256:cdf5ce3acdfd1661132f2a9c19cac174758dc2352bfe37d98aa7512c6b7178b3 \
+    --hash=sha256:d016c76bdd850f3c626af19b0542c9677ba156e4ee4fccfdd7848803533ef662 \
+    --hash=sha256:d01b12eeeb4427d3110de311e1774046ad344f5b1a7403101878976ecd7a10f3 \
+    --hash=sha256:d63afe322132c194cf832bfec0dc69a99fb9bb6bbd550f161a49e9e855cc78ff \
+    --hash=sha256:da95af8214998d77a98cc14e3a3bd00aa191526343078b530ceb0bd710fb48a5 \
+    --hash=sha256:dd398dbc6773384a17fe0d3e7eeb8d1a21c2200473ee6806bb5e6a8e62bb73dd \
+    --hash=sha256:de2ea4b5833625383e464549fec1bc395c1bdeeb5f25c4a3a82b5a8c756ec22f \
+    --hash=sha256:de55b766c7aa2e2a3092c51e0483d700341182f08e67c63630d5b6f200bb28e5 \
+    --hash=sha256:df8b1c11f177bc2313ec4b2d46baec87a5f3e71fc8b45dab2ee7cae86d9aba14 \
+    --hash=sha256:e03eab0a8677fa80d646b5ddece1cbeaf556c313dcfac435ba11f107ba117b5d \
+    --hash=sha256:e221cf152cff04059d011ee126477f0d9588303eb57e88923578ace7baad17f9 \
+    --hash=sha256:e31ae45bc2e29f6b2abd0de1cc3b9d5205aa847cafaecb8af1476a609a2f6eb7 \
+    --hash=sha256:edae79245293e15384b51f88b00613ba9f7198016a5948b5dddf4917d4d26382 \
+    --hash=sha256:f1e22e8c4419538cb197e4dd60acc919d7696e5ef98ee4da4e01d3f8cfa4cc5a \
+    --hash=sha256:f3a2b4222ce6b60e2e8b337bb9596923045681d71e5a082783484d845390938e \
+    --hash=sha256:f6a16c31041f09ead72d69f583767292f750d24913dadacf5756b966aacb3f1a \
+    --hash=sha256:f75c7ab1f9e4aca5414ed4d8e5c0e303a34f4421f8a0d47a4d019ceff0ab6af4 \
+    --hash=sha256:f79fc4fc25f1c8698ff97788206bb3c2598949bfe0fef03d299eb1b5356ada99 \
+    --hash=sha256:f7f5baafcc48261359e14bcd6d9bff6d4b28d9103847c9e136694cb0501aef87 \
+    --hash=sha256:fc48c783f9c87e60831201f2cce7f3b2e4846bf4d8728eabe54d60700b318a0b
+    # via
+    #   cryptography
+    #   pynacl
+charset-normalizer==3.4.2 \
+    --hash=sha256:005fa3432484527f9732ebd315da8da8001593e2cf46a3d817669f062c3d9ed4 \
+    --hash=sha256:046595208aae0120559a67693ecc65dd75d46f7bf687f159127046628178dc45 \
+    --hash=sha256:0c29de6a1a95f24b9a1aa7aefd27d2487263f00dfd55a77719b530788f75cff7 \
+    --hash=sha256:0c8c57f84ccfc871a48a47321cfa49ae1df56cd1d965a09abe84066f6853b9c0 \
+    --hash=sha256:0f5d9ed7f254402c9e7d35d2f5972c9bbea9040e99cd2861bd77dc68263277c7 \
+    --hash=sha256:18dd2e350387c87dabe711b86f83c9c78af772c748904d372ade190b5c7c9d4d \
+    --hash=sha256:1b1bde144d98e446b056ef98e59c256e9294f6b74d7af6846bf5ffdafd687a7d \
+    --hash=sha256:1c95a1e2902a8b722868587c0e1184ad5c55631de5afc0eb96bc4b0d738092c0 \
+    --hash=sha256:1cad5f45b3146325bb38d6855642f6fd609c3f7cad4dbaf75549bf3b904d3184 \
+    --hash=sha256:21b2899062867b0e1fde9b724f8aecb1af14f2778d69aacd1a5a1853a597a5db \
+    --hash=sha256:24498ba8ed6c2e0b56d4acbf83f2d989720a93b41d712ebd4f4979660db4417b \
+    --hash=sha256:25a23ea5c7edc53e0f29bae2c44fcb5a1aa10591aae107f2a2b2583a9c5cbc64 \
+    --hash=sha256:289200a18fa698949d2b39c671c2cc7a24d44096784e76614899a7ccf2574b7b \
+    --hash=sha256:28a1005facc94196e1fb3e82a3d442a9d9110b8434fc1ded7a24a2983c9888d8 \
+    --hash=sha256:32fc0341d72e0f73f80acb0a2c94216bd704f4f0bce10aedea38f30502b271ff \
+    --hash=sha256:36b31da18b8890a76ec181c3cf44326bf2c48e36d393ca1b72b3f484113ea344 \
+    --hash=sha256:3c21d4fca343c805a52c0c78edc01e3477f6dd1ad7c47653241cf2a206d4fc58 \
+    --hash=sha256:3fddb7e2c84ac87ac3a947cb4e66d143ca5863ef48e4a5ecb83bd48619e4634e \
+    --hash=sha256:43e0933a0eff183ee85833f341ec567c0980dae57c464d8a508e1b2ceb336471 \
+    --hash=sha256:4a476b06fbcf359ad25d34a057b7219281286ae2477cc5ff5e3f70a246971148 \
+    --hash=sha256:4e594135de17ab3866138f496755f302b72157d115086d100c3f19370839dd3a \
+    --hash=sha256:50bf98d5e563b83cc29471fa114366e6806bc06bc7a25fd59641e41445327836 \
+    --hash=sha256:5a9979887252a82fefd3d3ed2a8e3b937a7a809f65dcb1e068b090e165bbe99e \
+    --hash=sha256:5baececa9ecba31eff645232d59845c07aa030f0c81ee70184a90d35099a0e63 \
+    --hash=sha256:5bf4545e3b962767e5c06fe1738f951f77d27967cb2caa64c28be7c4563e162c \
+    --hash=sha256:6333b3aa5a12c26b2a4d4e7335a28f1475e0e5e17d69d55141ee3cab736f66d1 \
+    --hash=sha256:65c981bdbd3f57670af8b59777cbfae75364b483fa8a9f420f08094531d54a01 \
+    --hash=sha256:68a328e5f55ec37c57f19ebb1fdc56a248db2e3e9ad769919a58672958e8f366 \
+    --hash=sha256:6a0289e4589e8bdfef02a80478f1dfcb14f0ab696b5a00e1f4b8a14a307a3c58 \
+    --hash=sha256:6b66f92b17849b85cad91259efc341dce9c1af48e2173bf38a85c6329f1033e5 \
+    --hash=sha256:6c9379d65defcab82d07b2a9dfbfc2e95bc8fe0ebb1b176a3190230a3ef0e07c \
+    --hash=sha256:6fc1f5b51fa4cecaa18f2bd7a003f3dd039dd615cd69a2afd6d3b19aed6775f2 \
+    --hash=sha256:70f7172939fdf8790425ba31915bfbe8335030f05b9913d7ae00a87d4395620a \
+    --hash=sha256:721c76e84fe669be19c5791da68232ca2e05ba5185575086e384352e2c309597 \
+    --hash=sha256:7222ffd5e4de8e57e03ce2cef95a4c43c98fcb72ad86909abdfc2c17d227fc1b \
+    --hash=sha256:75d10d37a47afee94919c4fab4c22b9bc2a8bf7d4f46f87363bcf0573f3ff4f5 \
+    --hash=sha256:76af085e67e56c8816c3ccf256ebd136def2ed9654525348cfa744b6802b69eb \
+    --hash=sha256:770cab594ecf99ae64c236bc9ee3439c3f46be49796e265ce0cc8bc17b10294f \
+    --hash=sha256:7a6ab32f7210554a96cd9e33abe3ddd86732beeafc7a28e9955cdf22ffadbab0 \
+    --hash=sha256:7c48ed483eb946e6c04ccbe02c6b4d1d48e51944b6db70f697e089c193404941 \
+    --hash=sha256:7f56930ab0abd1c45cd15be65cc741c28b1c9a34876ce8c17a2fa107810c0af0 \
+    --hash=sha256:8075c35cd58273fee266c58c0c9b670947c19df5fb98e7b66710e04ad4e9ff86 \
+    --hash=sha256:8272b73e1c5603666618805fe821edba66892e2870058c94c53147602eab29c7 \
+    --hash=sha256:82d8fd25b7f4675d0c47cf95b594d4e7b158aca33b76aa63d07186e13c0e0ab7 \
+    --hash=sha256:844da2b5728b5ce0e32d863af26f32b5ce61bc4273a9c720a9f3aa9df73b1455 \
+    --hash=sha256:8755483f3c00d6c9a77f490c17e6ab0c8729e39e6390328e42521ef175380ae6 \
+    --hash=sha256:915f3849a011c1f593ab99092f3cecfcb4d65d8feb4a64cf1bf2d22074dc0ec4 \
+    --hash=sha256:926ca93accd5d36ccdabd803392ddc3e03e6d4cd1cf17deff3b989ab8e9dbcf0 \
+    --hash=sha256:982bb1e8b4ffda883b3d0a521e23abcd6fd17418f6d2c4118d257a10199c0ce3 \
+    --hash=sha256:98f862da73774290f251b9df8d11161b6cf25b599a66baf087c1ffe340e9bfd1 \
+    --hash=sha256:9cbfacf36cb0ec2897ce0ebc5d08ca44213af24265bd56eca54bee7923c48fd6 \
+    --hash=sha256:a370b3e078e418187da8c3674eddb9d983ec09445c99a3a263c2011993522981 \
+    --hash=sha256:a955b438e62efdf7e0b7b52a64dc5c3396e2634baa62471768a64bc2adb73d5c \
+    --hash=sha256:aa6af9e7d59f9c12b33ae4e9450619cf2488e2bbe9b44030905877f0b2324980 \
+    --hash=sha256:aa88ca0b1932e93f2d961bf3addbb2db902198dca337d88c89e1559e066e7645 \
+    --hash=sha256:aaeeb6a479c7667fbe1099af9617c83aaca22182d6cf8c53966491a0f1b7ffb7 \
+    --hash=sha256:aaf27faa992bfee0264dc1f03f4c75e9fcdda66a519db6b957a3f826e285cf12 \
+    --hash=sha256:b2680962a4848b3c4f155dc2ee64505a9c57186d0d56b43123b17ca3de18f0fa \
+    --hash=sha256:b2d318c11350e10662026ad0eb71bb51c7812fc8590825304ae0bdd4ac283acd \
+    --hash=sha256:b33de11b92e9f75a2b545d6e9b6f37e398d86c3e9e9653c4864eb7e89c5773ef \
+    --hash=sha256:b3daeac64d5b371dea99714f08ffc2c208522ec6b06fbc7866a450dd446f5c0f \
+    --hash=sha256:be1e352acbe3c78727a16a455126d9ff83ea2dfdcbc83148d2982305a04714c2 \
+    --hash=sha256:bee093bf902e1d8fc0ac143c88902c3dfc8941f7ea1d6a8dd2bcb786d33db03d \
+    --hash=sha256:c72fbbe68c6f32f251bdc08b8611c7b3060612236e960ef848e0a517ddbe76c5 \
+    --hash=sha256:c9e36a97bee9b86ef9a1cf7bb96747eb7a15c2f22bdb5b516434b00f2a599f02 \
+    --hash=sha256:cddf7bd982eaa998934a91f69d182aec997c6c468898efe6679af88283b498d3 \
+    --hash=sha256:cf713fe9a71ef6fd5adf7a79670135081cd4431c2943864757f0fa3a65b1fafd \
+    --hash=sha256:d11b54acf878eef558599658b0ffca78138c8c3655cf4f3a4a673c437e67732e \
+    --hash=sha256:d41c4d287cfc69060fa91cae9683eacffad989f1a10811995fa309df656ec214 \
+    --hash=sha256:d524ba3f1581b35c03cb42beebab4a13e6cdad7b36246bd22541fa585a56cccd \
+    --hash=sha256:daac4765328a919a805fa5e2720f3e94767abd632ae410a9062dff5412bae65a \
+    --hash=sha256:db4c7bf0e07fc3b7d89ac2a5880a6a8062056801b83ff56d8464b70f65482b6c \
+    --hash=sha256:dc7039885fa1baf9be153a0626e337aa7ec8bf96b0128605fb0d77788ddc1681 \
+    --hash=sha256:dccab8d5fa1ef9bfba0590ecf4d46df048d18ffe3eec01eeb73a42e0d9e7a8ba \
+    --hash=sha256:dedb8adb91d11846ee08bec4c8236c8549ac721c245678282dcb06b221aab59f \
+    --hash=sha256:e45ba65510e2647721e35323d6ef54c7974959f6081b58d4ef5d87c60c84919a \
+    --hash=sha256:e53efc7c7cee4c1e70661e2e112ca46a575f90ed9ae3fef200f2a25e954f4b28 \
+    --hash=sha256:e635b87f01ebc977342e2697d05b56632f5f879a4f15955dfe8cef2448b51691 \
+    --hash=sha256:e70e990b2137b29dc5564715de1e12701815dacc1d056308e2b17e9095372a82 \
+    --hash=sha256:e8082b26888e2f8b36a042a58307d5b917ef2b1cacab921ad3323ef91901c71a \
+    --hash=sha256:e8323a9b031aa0393768b87f04b4164a40037fb2a3c11ac06a03ffecd3618027 \
+    --hash=sha256:e92fca20c46e9f5e1bb485887d074918b13543b1c2a1185e69bb8d17ab6236a7 \
+    --hash=sha256:eb30abc20df9ab0814b5a2524f23d75dcf83cde762c161917a2b4b7b55b1e518 \
+    --hash=sha256:eba9904b0f38a143592d9fc0e19e2df0fa2e41c3c3745554761c5f6447eedabf \
+    --hash=sha256:ef8de666d6179b009dce7bcb2ad4c4a779f113f12caf8dc77f0162c29d20490b \
+    --hash=sha256:efd387a49825780ff861998cd959767800d54f8308936b21025326de4b5a42b9 \
+    --hash=sha256:f0aa37f3c979cf2546b73e8222bbfa3dc07a641585340179d768068e3455e544 \
+    --hash=sha256:f4074c5a429281bf056ddd4c5d3b740ebca4d43ffffe2ef4bf4d2d05114299da \
+    --hash=sha256:f69a27e45c43520f5487f27627059b64aaf160415589230992cec34c5e18a509 \
+    --hash=sha256:fb707f3e15060adf5b7ada797624a6c6e0138e2a26baa089df64c68ee98e040f \
+    --hash=sha256:fcbe676a55d7445b22c10967bceaaf0ee69407fbe0ece4d032b6eb8d4565982a \
+    --hash=sha256:fdb20a30fe1175ecabed17cbf7812f7b804b8a315a25f24678bcdf120a90077f
+    # via requests
+cryptography==45.0.4 \
+    --hash=sha256:0339a692de47084969500ee455e42c58e449461e0ec845a34a6a9b9bf7df7fb8 \
+    --hash=sha256:03dbff8411206713185b8cebe31bc5c0eb544799a50c09035733716b386e61a4 \
+    --hash=sha256:06509dc70dd71fa56eaa138336244e2fbaf2ac164fc9b5e66828fccfd2b680d6 \
+    --hash=sha256:0cf13c77d710131d33e63626bd55ae7c0efb701ebdc2b3a7952b9b23a0412862 \
+    --hash=sha256:23b9c3ea30c3ed4db59e7b9619272e94891f8a3a5591d0b656a7582631ccf750 \
+    --hash=sha256:25eb4d4d3e54595dc8adebc6bbd5623588991d86591a78c2548ffb64797341e2 \
+    --hash=sha256:2882338b2a6e0bd337052e8b9007ced85c637da19ef9ecaf437744495c8c2999 \
+    --hash=sha256:3530382a43a0e524bc931f187fc69ef4c42828cf7d7f592f7f249f602b5a4ab0 \
+    --hash=sha256:425a9a6ac2823ee6e46a76a21a4e8342d8fa5c01e08b823c1f19a8b74f096069 \
+    --hash=sha256:46cf7088bf91bdc9b26f9c55636492c1cce3e7aaf8041bbf0243f5e5325cfb2d \
+    --hash=sha256:4828190fb6c4bcb6ebc6331f01fe66ae838bb3bd58e753b59d4b22eb444b996c \
+    --hash=sha256:49fe9155ab32721b9122975e168a6760d8ce4cffe423bcd7ca269ba41b5dfac1 \
+    --hash=sha256:4ca0f52170e821bc8da6fc0cc565b7bb8ff8d90d36b5e9fdd68e8a86bdf72036 \
+    --hash=sha256:51dfbd4d26172d31150d84c19bbe06c68ea4b7f11bbc7b3a5e146b367c311349 \
+    --hash=sha256:5f31e6b0a5a253f6aa49be67279be4a7e5a4ef259a9f33c69f7d1b1191939872 \
+    --hash=sha256:627ba1bc94f6adf0b0a2e35d87020285ead22d9f648c7e75bb64f367375f3b22 \
+    --hash=sha256:680806cf63baa0039b920f4976f5f31b10e772de42f16310a6839d9f21a26b0d \
+    --hash=sha256:6a3511ae33f09094185d111160fd192c67aa0a2a8d19b54d36e4c78f651dc5ad \
+    --hash=sha256:6a5bf57554e80f75a7db3d4b1dacaa2764611ae166ab42ea9a72bcdb5d577637 \
+    --hash=sha256:6b613164cb8425e2f8db5849ffb84892e523bf6d26deb8f9bb76ae86181fa12b \
+    --hash=sha256:7405ade85c83c37682c8fe65554759800a4a8c54b2d96e0f8ad114d31b808d57 \
+    --hash=sha256:7aad98a25ed8ac917fdd8a9c1e706e5a0956e06c498be1f713b61734333a4507 \
+    --hash=sha256:7bedbe4cc930fa4b100fc845ea1ea5788fcd7ae9562e669989c11618ae8d76ee \
+    --hash=sha256:7ef2dde4fa9408475038fc9aadfc1fb2676b174e68356359632e980c661ec8f6 \
+    --hash=sha256:817ee05c6c9f7a69a16200f0c90ab26d23a87701e2a284bd15156783e46dbcc8 \
+    --hash=sha256:944e9ccf67a9594137f942d5b52c8d238b1b4e46c7a0c2891b7ae6e01e7c80a4 \
+    --hash=sha256:964bcc28d867e0f5491a564b7debb3ffdd8717928d315d12e0d7defa9e43b723 \
+    --hash=sha256:96d4819e25bf3b685199b304a0029ce4a3caf98947ce8a066c9137cc78ad2c58 \
+    --hash=sha256:a77c6fb8d76e9c9f99f2f3437c1a4ac287b34eaf40997cfab1e9bd2be175ac39 \
+    --hash=sha256:b0a97c927497e3bc36b33987abb99bf17a9a175a19af38a892dc4bbb844d7ee2 \
+    --hash=sha256:b97737a3ffbea79eebb062eb0d67d72307195035332501722a9ca86bab9e3ab2 \
+    --hash=sha256:bbc505d1dc469ac12a0a064214879eac6294038d6b24ae9f71faae1448a9608d \
+    --hash=sha256:c22fe01e53dc65edd1945a2e6f0015e887f84ced233acecb64b4daadb32f5c97 \
+    --hash=sha256:ce1678a2ccbe696cf3af15a75bb72ee008d7ff183c9228592ede9db467e64f1b \
+    --hash=sha256:e00a6c10a5c53979d6242f123c0a97cff9f3abed7f064fc412c36dc521b5f257 \
+    --hash=sha256:eaa3e28ea2235b33220b949c5a0d6cf79baa80eab2eb5607ca8ab7525331b9ff \
+    --hash=sha256:f3fe7a5ae34d5a414957cc7f457e2b92076e72938423ac64d215722f6cf49a9e
+    # via pyjwt
+deprecated==1.2.18 \
+    --hash=sha256:422b6f6d859da6f2ef57857761bfb392480502a64c3028ca9bbe86085d72115d \
+    --hash=sha256:bd5011788200372a32418f888e326a09ff80d0214bd961147cfed01b5c018eec
+    # via pygithub
+idna==3.10 \
+    --hash=sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9 \
+    --hash=sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3
+    # via requests
+jinja2==3.1.6 \
+    --hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \
+    --hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67
+    # via -r requirements.in
+markupsafe==3.0.2 \
+    --hash=sha256:0bff5e0ae4ef2e1ae4fdf2dfd5b76c75e5c2fa4132d05fc1b0dabcd20c7e28c4 \
+    --hash=sha256:0f4ca02bea9a23221c0182836703cbf8930c5e9454bacce27e767509fa286a30 \
+    --hash=sha256:1225beacc926f536dc82e45f8a4d68502949dc67eea90eab715dea3a21c1b5f0 \
+    --hash=sha256:131a3c7689c85f5ad20f9f6fb1b866f402c445b220c19fe4308c0b147ccd2ad9 \
+    --hash=sha256:15ab75ef81add55874e7ab7055e9c397312385bd9ced94920f2802310c930396 \
+    --hash=sha256:1a9d3f5f0901fdec14d8d2f66ef7d035f2157240a433441719ac9a3fba440b13 \
+    --hash=sha256:1c99d261bd2d5f6b59325c92c73df481e05e57f19837bdca8413b9eac4bd8028 \
+    --hash=sha256:1e084f686b92e5b83186b07e8a17fc09e38fff551f3602b249881fec658d3eca \
+    --hash=sha256:2181e67807fc2fa785d0592dc2d6206c019b9502410671cc905d132a92866557 \
+    --hash=sha256:2cb8438c3cbb25e220c2ab33bb226559e7afb3baec11c4f218ffa7308603c832 \
+    --hash=sha256:3169b1eefae027567d1ce6ee7cae382c57fe26e82775f460f0b2778beaad66c0 \
+    --hash=sha256:3809ede931876f5b2ec92eef964286840ed3540dadf803dd570c3b7e13141a3b \
+    --hash=sha256:38a9ef736c01fccdd6600705b09dc574584b89bea478200c5fbf112a6b0d5579 \
+    --hash=sha256:3d79d162e7be8f996986c064d1c7c817f6df3a77fe3d6859f6f9e7be4b8c213a \
+    --hash=sha256:444dcda765c8a838eaae23112db52f1efaf750daddb2d9ca300bcae1039adc5c \
+    --hash=sha256:48032821bbdf20f5799ff537c7ac3d1fba0ba032cfc06194faffa8cda8b560ff \
+    --hash=sha256:4aa4e5faecf353ed117801a068ebab7b7e09ffb6e1d5e412dc852e0da018126c \
+    --hash=sha256:52305740fe773d09cffb16f8ed0427942901f00adedac82ec8b67752f58a1b22 \
+    --hash=sha256:569511d3b58c8791ab4c2e1285575265991e6d8f8700c7be0e88f86cb0672094 \
+    --hash=sha256:57cb5a3cf367aeb1d316576250f65edec5bb3be939e9247ae594b4bcbc317dfb \
+    --hash=sha256:5b02fb34468b6aaa40dfc198d813a641e3a63b98c2b05a16b9f80b7ec314185e \
+    --hash=sha256:6381026f158fdb7c72a168278597a5e3a5222e83ea18f543112b2662a9b699c5 \
+    --hash=sha256:6af100e168aa82a50e186c82875a5893c5597a0c1ccdb0d8b40240b1f28b969a \
+    --hash=sha256:6c89876f41da747c8d3677a2b540fb32ef5715f97b66eeb0c6b66f5e3ef6f59d \
+    --hash=sha256:6e296a513ca3d94054c2c881cc913116e90fd030ad1c656b3869762b754f5f8a \
+    --hash=sha256:70a87b411535ccad5ef2f1df5136506a10775d267e197e4cf531ced10537bd6b \
+    --hash=sha256:7e94c425039cde14257288fd61dcfb01963e658efbc0ff54f5306b06054700f8 \
+    --hash=sha256:846ade7b71e3536c4e56b386c2a47adf5741d2d8b94ec9dc3e92e5e1ee1e2225 \
+    --hash=sha256:88416bd1e65dcea10bc7569faacb2c20ce071dd1f87539ca2ab364bf6231393c \
+    --hash=sha256:88b49a3b9ff31e19998750c38e030fc7bb937398b1f78cfa599aaef92d693144 \
+    --hash=sha256:8c4e8c3ce11e1f92f6536ff07154f9d49677ebaaafc32db9db4620bc11ed480f \
+    --hash=sha256:8e06879fc22a25ca47312fbe7c8264eb0b662f6db27cb2d3bbbc74b1df4b9b87 \
+    --hash=sha256:9025b4018f3a1314059769c7bf15441064b2207cb3f065e6ea1e7359cb46db9d \
+    --hash=sha256:93335ca3812df2f366e80509ae119189886b0f3c2b81325d39efdb84a1e2ae93 \
+    --hash=sha256:9778bd8ab0a994ebf6f84c2b949e65736d5575320a17ae8984a77fab08db94cf \
+    --hash=sha256:9e2d922824181480953426608b81967de705c3cef4d1af983af849d7bd619158 \
+    --hash=sha256:a123e330ef0853c6e822384873bef7507557d8e4a082961e1defa947aa59ba84 \
+    --hash=sha256:a904af0a6162c73e3edcb969eeeb53a63ceeb5d8cf642fade7d39e7963a22ddb \
+    --hash=sha256:ad10d3ded218f1039f11a75f8091880239651b52e9bb592ca27de44eed242a48 \
+    --hash=sha256:b424c77b206d63d500bcb69fa55ed8d0e6a3774056bdc4839fc9298a7edca171 \
+    --hash=sha256:b5a6b3ada725cea8a5e634536b1b01c30bcdcd7f9c6fff4151548d5bf6b3a36c \
+    --hash=sha256:ba8062ed2cf21c07a9e295d5b8a2a5ce678b913b45fdf68c32d95d6c1291e0b6 \
+    --hash=sha256:ba9527cdd4c926ed0760bc301f6728ef34d841f405abf9d4f959c478421e4efd \
+    --hash=sha256:bbcb445fa71794da8f178f0f6d66789a28d7319071af7a496d4d507ed566270d \
+    --hash=sha256:bcf3e58998965654fdaff38e58584d8937aa3096ab5354d493c77d1fdd66d7a1 \
+    --hash=sha256:c0ef13eaeee5b615fb07c9a7dadb38eac06a0608b41570d8ade51c56539e509d \
+    --hash=sha256:cabc348d87e913db6ab4aa100f01b08f481097838bdddf7c7a84b7575b7309ca \
+    --hash=sha256:cdb82a876c47801bb54a690c5ae105a46b392ac6099881cdfb9f6e95e4014c6a \
+    --hash=sha256:cfad01eed2c2e0c01fd0ecd2ef42c492f7f93902e39a42fc9ee1692961443a29 \
+    --hash=sha256:d16a81a06776313e817c951135cf7340a3e91e8c1ff2fac444cfd75fffa04afe \
+    --hash=sha256:d8213e09c917a951de9d09ecee036d5c7d36cb6cb7dbaece4c71a60d79fb9798 \
+    --hash=sha256:e07c3764494e3776c602c1e78e298937c3315ccc9043ead7e685b7f2b8d47b3c \
+    --hash=sha256:e17c96c14e19278594aa4841ec148115f9c7615a47382ecb6b82bd8fea3ab0c8 \
+    --hash=sha256:e444a31f8db13eb18ada366ab3cf45fd4b31e4db1236a4448f68778c1d1a5a2f \
+    --hash=sha256:e6a2a455bd412959b57a172ce6328d2dd1f01cb2135efda2e4576e8a23fa3b0f \
+    --hash=sha256:eaa0a10b7f72326f1372a713e73c3f739b524b3af41feb43e4921cb529f5929a \
+    --hash=sha256:eb7972a85c54febfb25b5c4b4f3af4dcc731994c7da0d8a0b4a6eb0640e1d178 \
+    --hash=sha256:ee55d3edf80167e48ea11a923c7386f4669df67d7994554387f84e7d8b0a2bf0 \
+    --hash=sha256:f3818cb119498c0678015754eba762e0d61e5b52d34c8b13d770f0719f7b1d79 \
+    --hash=sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430 \
+    --hash=sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50
+    # via jinja2
+pycparser==2.22 \
+    --hash=sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6 \
+    --hash=sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc
+    # via cffi
+pygithub==2.6.1 \
+    --hash=sha256:6f2fa6d076ccae475f9fc392cc6cdbd54db985d4f69b8833a28397de75ed6ca3 \
+    --hash=sha256:b5c035392991cca63959e9453286b41b54d83bf2de2daa7d7ff7e4312cebf3bf
+    # via -r requirements.in
+pyjwt[crypto]==2.10.1 \
+    --hash=sha256:3cc5772eb20009233caf06e9d8a0577824723b44e6648ee0a2aedb6cf9381953 \
+    --hash=sha256:dcdd193e30abefd5debf142f9adfcdd2b58004e644f25406ffaebd50bd98dacb
+    # via pygithub
+pynacl==1.5.0 \
+    --hash=sha256:06b8f6fa7f5de8d5d2f7573fe8c863c051225a27b61e6860fd047b1775807858 \
+    --hash=sha256:0c84947a22519e013607c9be43706dd42513f9e6ae5d39d3613ca1e142fba44d \
+    --hash=sha256:20f42270d27e1b6a29f54032090b972d97f0a1b0948cc52392041ef7831fee93 \
+    --hash=sha256:401002a4aaa07c9414132aaed7f6836ff98f59277a234704ff66878c2ee4a0d1 \
+    --hash=sha256:52cb72a79269189d4e0dc537556f4740f7f0a9ec41c1322598799b0bdad4ef92 \
+    --hash=sha256:61f642bf2378713e2c2e1de73444a3778e5f0a38be6fee0fe532fe30060282ff \
+    --hash=sha256:8ac7448f09ab85811607bdd21ec2464495ac8b7c66d146bf545b0f08fb9220ba \
+    --hash=sha256:a36d4a9dda1f19ce6e03c9a784a2921a4b726b02e1c736600ca9c22029474394 \
+    --hash=sha256:a422368fc821589c228f4c49438a368831cb5bbc0eab5ebe1d7fac9dded6567b \
+    --hash=sha256:e46dae94e34b085175f8abb3b0aaa7da40767865ac82c928eeb9e57e1ea8a543
+    # via pygithub
+requests==2.32.4 \
+    --hash=sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c \
+    --hash=sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422
+    # via pygithub
+typing-extensions==4.14.0 \
+    --hash=sha256:8676b788e32f02ab42d9e7c61324048ae4c6d844a399eebace3d4979d75ceef4 \
+    --hash=sha256:a1514509136dd0b477638fc68d6a91497af5076466ad0fa6c338e44e359944af
+    # via pygithub
+urllib3==2.5.0 \
+    --hash=sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760 \
+    --hash=sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc
+    # via
+    #   pygithub
+    #   requests
+wrapt==1.17.2 \
+    --hash=sha256:08e7ce672e35efa54c5024936e559469436f8b8096253404faeb54d2a878416f \
+    --hash=sha256:0a6e821770cf99cc586d33833b2ff32faebdbe886bd6322395606cf55153246c \
+    --hash=sha256:0b929ac182f5ace000d459c59c2c9c33047e20e935f8e39371fa6e3b85d56f4a \
+    --hash=sha256:129a150f5c445165ff941fc02ee27df65940fcb8a22a61828b1853c98763a64b \
+    --hash=sha256:13e6afb7fe71fe7485a4550a8844cc9ffbe263c0f1a1eea569bc7091d4898555 \
+    --hash=sha256:1473400e5b2733e58b396a04eb7f35f541e1fb976d0c0724d0223dd607e0f74c \
+    --hash=sha256:18983c537e04d11cf027fbb60a1e8dfd5190e2b60cc27bc0808e653e7b218d1b \
+    --hash=sha256:1a7ed2d9d039bd41e889f6fb9364554052ca21ce823580f6a07c4ec245c1f5d6 \
+    --hash=sha256:1e1fe0e6ab7775fd842bc39e86f6dcfc4507ab0ffe206093e76d61cde37225c8 \
+    --hash=sha256:1fb5699e4464afe5c7e65fa51d4f99e0b2eadcc176e4aa33600a3df7801d6662 \
+    --hash=sha256:2696993ee1eebd20b8e4ee4356483c4cb696066ddc24bd70bcbb80fa56ff9061 \
+    --hash=sha256:35621ae4c00e056adb0009f8e86e28eb4a41a4bfa8f9bfa9fca7d343fe94f998 \
+    --hash=sha256:36ccae62f64235cf8ddb682073a60519426fdd4725524ae38874adf72b5f2aeb \
+    --hash=sha256:3cedbfa9c940fdad3e6e941db7138e26ce8aad38ab5fe9dcfadfed9db7a54e62 \
+    --hash=sha256:3d57c572081fed831ad2d26fd430d565b76aa277ed1d30ff4d40670b1c0dd984 \
+    --hash=sha256:3fc7cb4c1c744f8c05cd5f9438a3caa6ab94ce8344e952d7c45a8ed59dd88392 \
+    --hash=sha256:4011d137b9955791f9084749cba9a367c68d50ab8d11d64c50ba1688c9b457f2 \
+    --hash=sha256:40d615e4fe22f4ad3528448c193b218e077656ca9ccb22ce2cb20db730f8d306 \
+    --hash=sha256:410a92fefd2e0e10d26210e1dfb4a876ddaf8439ef60d6434f21ef8d87efc5b7 \
+    --hash=sha256:41388e9d4d1522446fe79d3213196bd9e3b301a336965b9e27ca2788ebd122f3 \
+    --hash=sha256:468090021f391fe0056ad3e807e3d9034e0fd01adcd3bdfba977b6fdf4213ea9 \
+    --hash=sha256:49703ce2ddc220df165bd2962f8e03b84c89fee2d65e1c24a7defff6f988f4d6 \
+    --hash=sha256:4a721d3c943dae44f8e243b380cb645a709ba5bd35d3ad27bc2ed947e9c68192 \
+    --hash=sha256:4afd5814270fdf6380616b321fd31435a462019d834f83c8611a0ce7484c7317 \
+    --hash=sha256:4c82b8785d98cdd9fed4cac84d765d234ed3251bd6afe34cb7ac523cb93e8b4f \
+    --hash=sha256:4db983e7bca53819efdbd64590ee96c9213894272c776966ca6306b73e4affda \
+    --hash=sha256:582530701bff1dec6779efa00c516496968edd851fba224fbd86e46cc6b73563 \
+    --hash=sha256:58455b79ec2661c3600e65c0a716955adc2410f7383755d537584b0de41b1d8a \
+    --hash=sha256:58705da316756681ad3c9c73fd15499aa4d8c69f9fd38dc8a35e06c12468582f \
+    --hash=sha256:5bb1d0dbf99411f3d871deb6faa9aabb9d4e744d67dcaaa05399af89d847a91d \
+    --hash=sha256:5c803c401ea1c1c18de70a06a6f79fcc9c5acfc79133e9869e730ad7f8ad8ef9 \
+    --hash=sha256:5cbabee4f083b6b4cd282f5b817a867cf0b1028c54d445b7ec7cfe6505057cf8 \
+    --hash=sha256:612dff5db80beef9e649c6d803a8d50c409082f1fedc9dbcdfde2983b2025b82 \
+    --hash=sha256:62c2caa1585c82b3f7a7ab56afef7b3602021d6da34fbc1cf234ff139fed3cd9 \
+    --hash=sha256:69606d7bb691b50a4240ce6b22ebb319c1cfb164e5f6569835058196e0f3a845 \
+    --hash=sha256:6d9187b01bebc3875bac9b087948a2bccefe464a7d8f627cf6e48b1bbae30f82 \
+    --hash=sha256:6ed6ffac43aecfe6d86ec5b74b06a5be33d5bb9243d055141e8cabb12aa08125 \
+    --hash=sha256:703919b1633412ab54bcf920ab388735832fdcb9f9a00ae49387f0fe67dad504 \
+    --hash=sha256:766d8bbefcb9e00c3ac3b000d9acc51f1b399513f44d77dfe0eb026ad7c9a19b \
+    --hash=sha256:80dd7db6a7cb57ffbc279c4394246414ec99537ae81ffd702443335a61dbf3a7 \
+    --hash=sha256:8112e52c5822fc4253f3901b676c55ddf288614dc7011634e2719718eaa187dc \
+    --hash=sha256:8c8b293cd65ad716d13d8dd3624e42e5a19cc2a2f1acc74b30c2c13f15cb61a6 \
+    --hash=sha256:8fdbdb757d5390f7c675e558fd3186d590973244fab0c5fe63d373ade3e99d40 \
+    --hash=sha256:91bd7d1773e64019f9288b7a5101f3ae50d3d8e6b1de7edee9c2ccc1d32f0c0a \
+    --hash=sha256:95c658736ec15602da0ed73f312d410117723914a5c91a14ee4cdd72f1d790b3 \
+    --hash=sha256:99039fa9e6306880572915728d7f6c24a86ec57b0a83f6b2491e1d8ab0235b9a \
+    --hash=sha256:9a2bce789a5ea90e51a02dfcc39e31b7f1e662bc3317979aa7e5538e3a034f72 \
+    --hash=sha256:9a7d15bbd2bc99e92e39f49a04653062ee6085c0e18b3b7512a4f2fe91f2d681 \
+    --hash=sha256:9abc77a4ce4c6f2a3168ff34b1da9b0f311a8f1cfd694ec96b0603dff1c79438 \
+    --hash=sha256:9e8659775f1adf02eb1e6f109751268e493c73716ca5761f8acb695e52a756ae \
+    --hash=sha256:9fee687dce376205d9a494e9c121e27183b2a3df18037f89d69bd7b35bcf59e2 \
+    --hash=sha256:a5aaeff38654462bc4b09023918b7f21790efb807f54c000a39d41d69cf552cb \
+    --hash=sha256:a604bf7a053f8362d27eb9fefd2097f82600b856d5abe996d623babd067b1ab5 \
+    --hash=sha256:abbb9e76177c35d4e8568e58650aa6926040d6a9f6f03435b7a522bf1c487f9a \
+    --hash=sha256:acc130bc0375999da18e3d19e5a86403667ac0c4042a094fefb7eec8ebac7cf3 \
+    --hash=sha256:b18f2d1533a71f069c7f82d524a52599053d4c7166e9dd374ae2136b7f40f7c8 \
+    --hash=sha256:b4e42a40a5e164cbfdb7b386c966a588b1047558a990981ace551ed7e12ca9c2 \
+    --hash=sha256:b5e251054542ae57ac7f3fba5d10bfff615b6c2fb09abeb37d2f1463f841ae22 \
+    --hash=sha256:b60fb58b90c6d63779cb0c0c54eeb38941bae3ecf7a73c764c52c88c2dcb9d72 \
+    --hash=sha256:b870b5df5b71d8c3359d21be8f0d6c485fa0ebdb6477dda51a1ea54a9b558061 \
+    --hash=sha256:ba0f0eb61ef00ea10e00eb53a9129501f52385c44853dbd6c4ad3f403603083f \
+    --hash=sha256:bb87745b2e6dc56361bfde481d5a378dc314b252a98d7dd19a651a3fa58f24a9 \
+    --hash=sha256:bb90fb8bda722a1b9d48ac1e6c38f923ea757b3baf8ebd0c82e09c5c1a0e7a04 \
+    --hash=sha256:bc570b5f14a79734437cb7b0500376b6b791153314986074486e0b0fa8d71d98 \
+    --hash=sha256:c86563182421896d73858e08e1db93afdd2b947a70064b813d515d66549e15f9 \
+    --hash=sha256:c958bcfd59bacc2d0249dcfe575e71da54f9dcf4a8bdf89c4cb9a68a1170d73f \
+    --hash=sha256:d18a4865f46b8579d44e4fe1e2bcbc6472ad83d98e22a26c963d46e4c125ef0b \
+    --hash=sha256:d5e2439eecc762cd85e7bd37161d4714aa03a33c5ba884e26c81559817ca0925 \
+    --hash=sha256:e3890b508a23299083e065f435a492b5435eba6e304a7114d2f919d400888cc6 \
+    --hash=sha256:e496a8ce2c256da1eb98bd15803a79bee00fc351f5dfb9ea82594a3f058309e0 \
+    --hash=sha256:e8b2816ebef96d83657b56306152a93909a83f23994f4b30ad4573b00bd11bb9 \
+    --hash=sha256:eaf675418ed6b3b31c7a989fd007fa7c3be66ce14e5c3b27336383604c9da85c \
+    --hash=sha256:ec89ed91f2fa8e3f52ae53cd3cf640d6feff92ba90d62236a81e4e563ac0e991 \
+    --hash=sha256:ecc840861360ba9d176d413a5489b9a0aff6d6303d7e733e2c4623cfa26904a6 \
+    --hash=sha256:f09b286faeff3c750a879d336fb6d8713206fc97af3adc14def0cdd349df6000 \
+    --hash=sha256:f393cda562f79828f38a819f4788641ac7c4085f30f1ce1a68672baa686482bb \
+    --hash=sha256:f917c1180fdb8623c2b75a99192f4025e412597c50b2ac870f156de8fb101119 \
+    --hash=sha256:fc78a84e2dfbc27afe4b2bd7c80c8db9bca75cc5b85df52bfe634596a1da846b \
+    --hash=sha256:ff04ef6eec3eee8a5efef2401495967a916feaa353643defcc03fc74fe213b58
+    # via deprecated

From 876f81f1eb9d1422a5d7ac9f3f87ed25e15c1b7d Mon Sep 17 00:00:00 2001
From: Paul Abel <p.abel@f5.com>
Date: Thu, 26 Jun 2025 14:19:12 +0100
Subject: [PATCH 4/9] test script in pipeline

---
 .github/workflows/release-pr.yml | 34 +++++++++++++++++++++++---------
 1 file changed, 25 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index ee9377d96b..3e19b1d0ea 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -1,6 +1,9 @@
 name: Release PR
 
 on:
+  push:
+    branches:
+      chore/update-release-notes
   workflow_dispatch:
     inputs:
       current_version:
@@ -35,6 +38,15 @@ on:
         description: "Date for this release"
         required: true
         default: "%d %b %Y"
+      dry_run:
+        description: "Don't create any PR's"
+        type: boolean
+        default: false
+      debug:
+        description: "Enable debug logging"
+        type: boolean
+        default: false
+
 
 defaults:
   run:
@@ -68,6 +80,7 @@ jobs:
           .github/scripts/release-version-update.sh \
             ${{ github.event.inputs.current_version }} ${{ github.event.inputs.current_helm_version }} ${{ github.event.inputs.current_operator_version }} \
             ${{ github.event.inputs.new_version }} ${{ github.event.inputs.new_helm_version }} ${{ github.event.inputs.new_operator_version }}
+          pip install --require-hashes -r .github/scripts/requirements.txt --no-deps
           .github/scripts/release-docs.sh \
             ${{ github.event.inputs.new_version }} ${{ github.event.inputs.new_helm_version }} ${{ github.event.inputs.new_operator_version }} \
             "${{ github.event.inputs.k8s_versions }}" "${{ github.event.inputs.release_date }}"
@@ -75,13 +88,16 @@ jobs:
           GITHUB_USERNAME: ${{ github.actor }}
           GITHUB_EMAIL: ${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DRY_RUN: ${{ inputs.dry_run && 'true' || 'true' }}
+          DEBUG: ${{ inputs.debug && 'true' || 'true' }}
 
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: Release ${{ github.event.inputs.new_version }}
-          title: Release ${{ github.event.inputs.new_version }}
-          branch: docs/release-${{ github.event.inputs.new_version }}
-          body: |
-            This automated PR updates the docs for ${{ github.event.inputs.new_version }} release.
+      # - name: Create Pull Request
+      #   uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+      #   with:
+      #     token: ${{ secrets.GITHUB_TOKEN }}
+      #     commit-message: Release ${{ github.event.inputs.new_version }}
+      #     title: Release ${{ github.event.inputs.new_version }}
+      #     branch: docs/release-${{ github.event.inputs.new_version }}
+      #     body: |
+      #       This automated PR updates the docs for ${{ github.event.inputs.new_version }} release.
+      #   if: ${{ ! inputs.dry_run }}

From 974712eb966e464cc7a98f4646d39b01e6234c5f Mon Sep 17 00:00:00 2001
From: Paul Abel <p.abel@f5.com>
Date: Thu, 26 Jun 2025 14:32:23 +0100
Subject: [PATCH 5/9] debugging

---
 .github/workflows/release-pr.yml | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 3e19b1d0ea..c6fb6d53a8 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -65,7 +65,7 @@ jobs:
       - name: Branch
         id: branch
         run: |
-          version=${{ github.event.inputs.new_version }}
+          version=${{ inputs.new_version && inputs.new_version || '5.1' }}
           version=${version%.*}
           echo "branch=release-$version" >> $GITHUB_OUTPUT
 
@@ -78,12 +78,19 @@ jobs:
       - name: Replace
         run: |
           .github/scripts/release-version-update.sh \
-            ${{ github.event.inputs.current_version }} ${{ github.event.inputs.current_helm_version }} ${{ github.event.inputs.current_operator_version }} \
-            ${{ github.event.inputs.new_version }} ${{ github.event.inputs.new_helm_version }} ${{ github.event.inputs.new_operator_version }}
+            ${{ inputs.current_version && inputs.current_version || '5.0.0' }} \
+            ${{ inputs.current_helm_version && inputs.current_helm_version || '2.1.0' }} \
+            ${{ inputs.current_operator_version && inputs.current_operator_version || '3.1.0' }} \
+            ${{ inputs.new_version && inputs.new_version || '5.1.0' }} \
+            ${{ inputs.new_helm_version && inputs.new_helm_version || '2.2.0' }} \
+            ${{ inputs.new_operator_version && inputs.new_operator_version || '3.2.0' }}
           pip install --require-hashes -r .github/scripts/requirements.txt --no-deps
           .github/scripts/release-docs.sh \
-            ${{ github.event.inputs.new_version }} ${{ github.event.inputs.new_helm_version }} ${{ github.event.inputs.new_operator_version }} \
-            "${{ github.event.inputs.k8s_versions }}" "${{ github.event.inputs.release_date }}"
+            ${{ inputs.new_version && inputs.new_version || '5.1.0' }} \
+            ${{ inputs.new_helm_version && inputs.new_helm_version || '2.2.0' }} \
+            ${{ inputs.new_operator_version && inputs.new_operator_version || '3.2.0' }} \
+            "${{ inputs.k8s_versions && inputs.k8s_versions || '1.25-1.33' }}" \
+            "${{ inputs.release_date && inputs.release_date || '30 Jun 2025' }}"
         env:
           GITHUB_USERNAME: ${{ github.actor }}
           GITHUB_EMAIL: ${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com

From 110886c84008af2dc0b6b4e19e5fec4fcd41dde4 Mon Sep 17 00:00:00 2001
From: Paul Abel <p.abel@f5.com>
Date: Thu, 26 Jun 2025 14:33:28 +0100
Subject: [PATCH 6/9] fixup version

---
 .github/workflows/release-pr.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index c6fb6d53a8..d4a0c76b5d 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -65,7 +65,7 @@ jobs:
       - name: Branch
         id: branch
         run: |
-          version=${{ inputs.new_version && inputs.new_version || '5.1' }}
+          version=${{ inputs.new_version && inputs.new_version || '5.1.0' }}
           version=${version%.*}
           echo "branch=release-$version" >> $GITHUB_OUTPUT
 

From c31814d8255ade593a7c7204c4d6dc15a1e24ffb Mon Sep 17 00:00:00 2001
From: Paul Abel <p.abel@f5.com>
Date: Thu, 26 Jun 2025 14:40:03 +0100
Subject: [PATCH 7/9] debugging

---
 .github/scripts/release-version-update.sh | 2 +-
 .github/workflows/release-pr.yml          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/scripts/release-version-update.sh b/.github/scripts/release-version-update.sh
index 990ebc3645..eaa9e1d262 100755
--- a/.github/scripts/release-version-update.sh
+++ b/.github/scripts/release-version-update.sh
@@ -135,4 +135,4 @@ for i in ${example_files}; do
     fi
 done
 
-make test-update-snaps
+#make test-update-snaps
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index d4a0c76b5d..f4dbdd2e0f 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -72,7 +72,7 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.branch.outputs.branch }}
+          ref: chore/update-release-notes
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Replace

From d914c8b0688dd9d1f6914f23701d68b5b30dbdb8 Mon Sep 17 00:00:00 2001
From: Paul Abel <p.abel@f5.com>
Date: Thu, 26 Jun 2025 14:42:32 +0100
Subject: [PATCH 8/9] remove debug

---
 .github/scripts/release-version-update.sh |  2 +-
 .github/workflows/release-pr.yml          | 49 +++++++++++------------
 2 files changed, 24 insertions(+), 27 deletions(-)

diff --git a/.github/scripts/release-version-update.sh b/.github/scripts/release-version-update.sh
index eaa9e1d262..990ebc3645 100755
--- a/.github/scripts/release-version-update.sh
+++ b/.github/scripts/release-version-update.sh
@@ -135,4 +135,4 @@ for i in ${example_files}; do
     fi
 done
 
-#make test-update-snaps
+make test-update-snaps
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index f4dbdd2e0f..552b2979fb 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -1,9 +1,6 @@
 name: Release PR
 
 on:
-  push:
-    branches:
-      chore/update-release-notes
   workflow_dispatch:
     inputs:
       current_version:
@@ -65,32 +62,32 @@ jobs:
       - name: Branch
         id: branch
         run: |
-          version=${{ inputs.new_version && inputs.new_version || '5.1.0' }}
+          version=${{ inputs.new_version }}
           version=${version%.*}
           echo "branch=release-$version" >> $GITHUB_OUTPUT
 
       - name: Checkout Repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: chore/update-release-notes
+          ref: ${{ steps.branch.outputs.branch }}
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Replace
         run: |
           .github/scripts/release-version-update.sh \
-            ${{ inputs.current_version && inputs.current_version || '5.0.0' }} \
-            ${{ inputs.current_helm_version && inputs.current_helm_version || '2.1.0' }} \
-            ${{ inputs.current_operator_version && inputs.current_operator_version || '3.1.0' }} \
-            ${{ inputs.new_version && inputs.new_version || '5.1.0' }} \
-            ${{ inputs.new_helm_version && inputs.new_helm_version || '2.2.0' }} \
-            ${{ inputs.new_operator_version && inputs.new_operator_version || '3.2.0' }}
+            ${{ inputs.current_version }} \
+            ${{ inputs.current_helm_version }} \
+            ${{ inputs.current_operator_version }} \
+            ${{ inputs.new_version }} \
+            ${{ inputs.new_helm_version }} \
+            ${{ inputs.new_operator_version }}
           pip install --require-hashes -r .github/scripts/requirements.txt --no-deps
           .github/scripts/release-docs.sh \
-            ${{ inputs.new_version && inputs.new_version || '5.1.0' }} \
-            ${{ inputs.new_helm_version && inputs.new_helm_version || '2.2.0' }} \
-            ${{ inputs.new_operator_version && inputs.new_operator_version || '3.2.0' }} \
-            "${{ inputs.k8s_versions && inputs.k8s_versions || '1.25-1.33' }}" \
-            "${{ inputs.release_date && inputs.release_date || '30 Jun 2025' }}"
+            ${{ inputs.new_version }} \
+            ${{ inputs.new_helm_version }} \
+            ${{ inputs.new_operator_version }} \
+            "${{ inputs.k8s_versions }}" \
+            "${{ inputs.release_date }}"
         env:
           GITHUB_USERNAME: ${{ github.actor }}
           GITHUB_EMAIL: ${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com
@@ -98,13 +95,13 @@ jobs:
           DRY_RUN: ${{ inputs.dry_run && 'true' || 'true' }}
           DEBUG: ${{ inputs.debug && 'true' || 'true' }}
 
-      # - name: Create Pull Request
-      #   uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
-      #   with:
-      #     token: ${{ secrets.GITHUB_TOKEN }}
-      #     commit-message: Release ${{ github.event.inputs.new_version }}
-      #     title: Release ${{ github.event.inputs.new_version }}
-      #     branch: docs/release-${{ github.event.inputs.new_version }}
-      #     body: |
-      #       This automated PR updates the docs for ${{ github.event.inputs.new_version }} release.
-      #   if: ${{ ! inputs.dry_run }}
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: Release ${{ github.event.inputs.new_version }}
+          title: Release ${{ github.event.inputs.new_version }}
+          branch: docs/release-${{ github.event.inputs.new_version }}
+          body: |
+            This automated PR updates the docs for ${{ github.event.inputs.new_version }} release.
+        if: ${{ ! inputs.dry_run }}

From e4cb754140972fabfae8425afd926aed70cc8ccf Mon Sep 17 00:00:00 2001
From: Paul Abel <p.abel@f5.com>
Date: Thu, 26 Jun 2025 14:44:49 +0100
Subject: [PATCH 9/9] address copilot feedback

---
 .github/scripts/pull-release-notes.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/scripts/pull-release-notes.py b/.github/scripts/pull-release-notes.py
index 011b2d9063..77a169230a 100755
--- a/.github/scripts/pull-release-notes.py
+++ b/.github/scripts/pull-release-notes.py
@@ -6,7 +6,7 @@
 import sys
 
 from github import Auth, Github
-from jinja2 import Environment, FileSystemLoader
+from jinja2 import Environment, FileSystemLoader, select_autoescape
 
 # parse args
 parser = argparse.ArgumentParser()
@@ -22,7 +22,7 @@
 
 # Set up Jinja2 environment
 template_dir = os.path.dirname(os.path.abspath(__file__))
-env = Environment(loader=FileSystemLoader(template_dir))
+env = Environment(loader=FileSystemLoader(template_dir), autoescape=select_autoescape(["j2"]))
 template = env.get_template("release-notes.j2")
 
 # Setup required variables