From 95ac7bc38229c1855820d93f6c0eef9d2513aebc Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 17 Apr 2026 15:19:01 -0700
Subject: [PATCH 01/19] add checker job to enable required checks; remove
 vestigial name field

---
 .github/workflows/pr-test-suite.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pr-test-suite.yml b/.github/workflows/pr-test-suite.yml
index e3808f757..bf568ab26 100644
--- a/.github/workflows/pr-test-suite.yml
+++ b/.github/workflows/pr-test-suite.yml
@@ -19,9 +19,7 @@ concurrency:
 
 jobs:
   standard_tests_jobs:
-    name: standard_tests_jobs
     uses: "./.github/workflows/standard_tests_jobs.yml"
-
     with:
       # We set this here to avoid coverage data being uploaded from things like our
       # nightly pipeline. This is done because codecov (helpfully) keeps track of
@@ -29,3 +27,9 @@ jobs:
       # comparing two commits with an unequal number of uploads. Only uploading
       # coverage here should keep the number of uploads it sees consistent.
       uploadCoverage: true
+  all_success:
+    name: PR test suite success
+    needs: standard_tests_jobs
+    runs-on: ubuntu-latest
+    steps:
+      - run: true

From f8f6a24e5e426ac7ea91d15cf8da2124c390e2fd Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 17 Apr 2026 15:34:35 -0700
Subject: [PATCH 02/19] clean up name fields for reading test results

---
 .github/workflows/pr-test-suite.yml       | 1 +
 .github/workflows/standard_tests_jobs.yml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/pr-test-suite.yml b/.github/workflows/pr-test-suite.yml
index bf568ab26..d473e2748 100644
--- a/.github/workflows/pr-test-suite.yml
+++ b/.github/workflows/pr-test-suite.yml
@@ -19,6 +19,7 @@ concurrency:
 
 jobs:
   standard_tests_jobs:
+    name: Standard tests
     uses: "./.github/workflows/standard_tests_jobs.yml"
     with:
       # We set this here to avoid coverage data being uploaded from things like our
diff --git a/.github/workflows/standard_tests_jobs.yml b/.github/workflows/standard_tests_jobs.yml
index c2238d0cd..4f7d4959e 100644
--- a/.github/workflows/standard_tests_jobs.yml
+++ b/.github/workflows/standard_tests_jobs.yml
@@ -12,6 +12,7 @@ permissions:
 
 jobs:
   test:
+    name: '-' # Makes results viewing cleaner
     strategy:
       fail-fast: false
       matrix:

From 59034c89f344b35b5e7d7444fee9b8db3a1a1f6b Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 11:35:12 -0700
Subject: [PATCH 03/19] set persist-credentials to false as flagged by zizmor

---
 .github/workflows/sphinx_steps.yml | 2 ++
 .github/workflows/tox_steps.yml    | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/sphinx_steps.yml b/.github/workflows/sphinx_steps.yml
index c65ee78d6..b4a91e0c3 100644
--- a/.github/workflows/sphinx_steps.yml
+++ b/.github/workflows/sphinx_steps.yml
@@ -11,6 +11,8 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@v6.0.2
+        with:
+          persist-credentials: false
       - name: Build Sphinx Documentation
         run: |-
           set -e
diff --git a/.github/workflows/tox_steps.yml b/.github/workflows/tox_steps.yml
index 38dff477f..49841d2f4 100644
--- a/.github/workflows/tox_steps.yml
+++ b/.github/workflows/tox_steps.yml
@@ -39,6 +39,8 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v6.0.2
+      with:
+        persist-credentials: false
     # We run brew update because we've seen attempts to install an older version
     # of a package fail. See
     # https://github.com/actions/virtual-environments/issues/3165.

From a267b704e69798851d2c5443d3ea352c4a0ef6f5 Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 11:36:02 -0700
Subject: [PATCH 04/19] remove set -e since it's now implicit

---
 .github/workflows/sphinx_steps.yml | 1 -
 .github/workflows/tox_steps.yml    | 5 -----
 2 files changed, 6 deletions(-)

diff --git a/.github/workflows/sphinx_steps.yml b/.github/workflows/sphinx_steps.yml
index b4a91e0c3..7839ca028 100644
--- a/.github/workflows/sphinx_steps.yml
+++ b/.github/workflows/sphinx_steps.yml
@@ -15,7 +15,6 @@ jobs:
           persist-credentials: false
       - name: Build Sphinx Documentation
         run: |-
-          set -e
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends libaugeas-dev
           FINAL_STATUS=0
diff --git a/.github/workflows/tox_steps.yml b/.github/workflows/tox_steps.yml
index 49841d2f4..fd0b3e5a0 100644
--- a/.github/workflows/tox_steps.yml
+++ b/.github/workflows/tox_steps.yml
@@ -52,7 +52,6 @@ jobs:
       if: runner.os == 'macOS'
       id: mac_install
       run: |-
-        set -e
         unset HOMEBREW_NO_INSTALL_FROM_API
         brew untap homebrew/core homebrew/cask
         brew update
@@ -64,7 +63,6 @@ jobs:
     - name: Install Linux dependencies
       if: runner.os == 'Linux'
       run: |-
-        set -e
         sudo apt-get update
         sudo apt-get install -y --no-install-recommends \
           libaugeas-dev \
@@ -77,7 +75,6 @@ jobs:
         python-version: "${{ inputs.PYTHON_VERSION }}"
     - name: Install runtime dependencies
       run: |-
-        set -e
         python3 tools/pip_install.py tox
       shell: bash
     - name: Create test farm pem file
@@ -85,7 +82,6 @@ jobs:
       env:
         PEM_CONTENTS: "${{ inputs.AWS_TEST_FARM_PEM }}"
       run: |-
-        set -e
         echo "${PEM_CONTENTS}" >> $AWS_EC2_PEM_FILE
       shell: bash
     - name: Run tox
@@ -95,7 +91,6 @@ jobs:
         PIP_USE_PEP517: "${{ inputs.PIP_USE_PEP517 }}"
         TOXENV: "${{ inputs.TOXENV }}"
       run: |-
-        set -e
         export TARGET_BRANCH="`echo "${BUILD_SOURCEBRANCH}" | sed -E 's!refs/(heads|tags)/!!g'`"
         [ -z "${SYSTEM_PULLREQUEST_TARGETBRANCH}" ] || export TARGET_BRANCH="${SYSTEM_PULLREQUEST_TARGETBRANCH}"
         env

From e9de9fdf76758c5d904043f2f9ef59d214185b2d Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 11:39:44 -0700
Subject: [PATCH 05/19] secrets are now inherited; no need to be able to pass
 them into a workflow and we should not do so

---
 .github/workflows/tox_steps.yml | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/tox_steps.yml b/.github/workflows/tox_steps.yml
index fd0b3e5a0..fe50e7fc3 100644
--- a/.github/workflows/tox_steps.yml
+++ b/.github/workflows/tox_steps.yml
@@ -14,15 +14,6 @@ on:
         description: 'Upload coverage to Codecov'
         type: boolean
         default: false
-      AWS_ACCESS_KEY_ID:
-        description: 'access key ID for AWS'
-        type: string
-      AWS_SECRET_ACCESS_KEY:
-        description: 'access key for AWS'
-        type: string
-      AWS_TEST_FARM_PEM:
-        description: 'contents of AWS PEM file to be placed in $AWS_EC2_PEM_FILE from environment'
-        type: string
       test_name:
         type: string
 permissions:
@@ -80,14 +71,14 @@ jobs:
     - name: Create test farm pem file
       if: contains(inputs.TOXENV, 'test-farm')
       env:
-        PEM_CONTENTS: "${{ inputs.AWS_TEST_FARM_PEM }}"
+        PEM_CONTENTS: "${{ secrets.AWS_TEST_FARM_PEM }}"
       run: |-
         echo "${PEM_CONTENTS}" >> $AWS_EC2_PEM_FILE
       shell: bash
     - name: Run tox
       env:
-        AWS_ACCESS_KEY_ID: "${{ inputs.AWS_ACCESS_KEY_ID }}"
-        AWS_SECRET_ACCESS_KEY: "${{ inputs.AWS_SECRET_ACCESS_KEY }}"
+        AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
+        AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
         PIP_USE_PEP517: "${{ inputs.PIP_USE_PEP517 }}"
         TOXENV: "${{ inputs.TOXENV }}"
       run: |-

From 3c5b4114352dd5b9b83acad0a103df5675f90b94 Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 11:41:16 -0700
Subject: [PATCH 06/19] define AWS_EC2_PEM_FILE in env; it was lost in the
 actions conversion

---
 .github/workflows/tox_steps.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/tox_steps.yml b/.github/workflows/tox_steps.yml
index fe50e7fc3..c0288d2ac 100644
--- a/.github/workflows/tox_steps.yml
+++ b/.github/workflows/tox_steps.yml
@@ -72,6 +72,7 @@ jobs:
       if: contains(inputs.TOXENV, 'test-farm')
       env:
         PEM_CONTENTS: "${{ secrets.AWS_TEST_FARM_PEM }}"
+        AWS_EC2_PEM_FILE: ${{ github.workspace }}/GHAKeyPair.pem
       run: |-
         echo "${PEM_CONTENTS}" >> $AWS_EC2_PEM_FILE
       shell: bash

From e73f1eccd054ca0246964a8d30c5aaee0c47be75 Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 11:42:03 -0700
Subject: [PATCH 07/19] mac_install id no longer needed, it's an artifact of
 interim testing

---
 .github/workflows/tox_steps.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/tox_steps.yml b/.github/workflows/tox_steps.yml
index c0288d2ac..9f4d0c3bb 100644
--- a/.github/workflows/tox_steps.yml
+++ b/.github/workflows/tox_steps.yml
@@ -41,7 +41,6 @@ jobs:
     # fail on git clones: https://github.com/orgs/Homebrew/discussions/4612.
     - name: Install MacOS dependencies
       if: runner.os == 'macOS'
-      id: mac_install
       run: |-
         unset HOMEBREW_NO_INSTALL_FROM_API
         brew untap homebrew/core homebrew/cask

From 52613ca83c87629181a524e4871934ab7d3a0c06 Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 11:43:22 -0700
Subject: [PATCH 08/19] remove TARGET_BRANCH that's no longer used anyway

---
 .github/workflows/tox_steps.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/tox_steps.yml b/.github/workflows/tox_steps.yml
index 9f4d0c3bb..758327bf2 100644
--- a/.github/workflows/tox_steps.yml
+++ b/.github/workflows/tox_steps.yml
@@ -82,8 +82,6 @@ jobs:
         PIP_USE_PEP517: "${{ inputs.PIP_USE_PEP517 }}"
         TOXENV: "${{ inputs.TOXENV }}"
       run: |-
-        export TARGET_BRANCH="`echo "${BUILD_SOURCEBRANCH}" | sed -E 's!refs/(heads|tags)/!!g'`"
-        [ -z "${SYSTEM_PULLREQUEST_TARGETBRANCH}" ] || export TARGET_BRANCH="${SYSTEM_PULLREQUEST_TARGETBRANCH}"
         env
         python3 -m tox run
       shell: bash

From 4e472309745d591f4aed75a81fe33ab832cc77a0 Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 11:50:51 -0700
Subject: [PATCH 09/19] remove uploading to codecov, since we don't use that
 anymore

---
 .github/workflows/pr-test-suite.yml       | 10 +-------
 .github/workflows/standard_tests_jobs.yml |  7 ------
 .github/workflows/tox_steps.yml           | 30 -----------------------
 3 files changed, 1 insertion(+), 46 deletions(-)

diff --git a/.github/workflows/pr-test-suite.yml b/.github/workflows/pr-test-suite.yml
index d473e2748..816c81606 100644
--- a/.github/workflows/pr-test-suite.yml
+++ b/.github/workflows/pr-test-suite.yml
@@ -1,5 +1,4 @@
-# We run the test suite on commits to main so codecov gets coverage data
-# about the main branch and can use it to track coverage changes.
+# We run the test suite on commits to main to double check that everything is good after merging
 name: PR test suite
 on:
   push:
@@ -21,13 +20,6 @@ jobs:
   standard_tests_jobs:
     name: Standard tests
     uses: "./.github/workflows/standard_tests_jobs.yml"
-    with:
-      # We set this here to avoid coverage data being uploaded from things like our
-      # nightly pipeline. This is done because codecov (helpfully) keeps track of
-      # the number of coverage uploads for a commit and displays a warning when
-      # comparing two commits with an unequal number of uploads. Only uploading
-      # coverage here should keep the number of uploads it sees consistent.
-      uploadCoverage: true
   all_success:
     name: PR test suite success
     needs: standard_tests_jobs
diff --git a/.github/workflows/standard_tests_jobs.yml b/.github/workflows/standard_tests_jobs.yml
index 4f7d4959e..3bfd02ffd 100644
--- a/.github/workflows/standard_tests_jobs.yml
+++ b/.github/workflows/standard_tests_jobs.yml
@@ -1,12 +1,6 @@
-# Environment variables defined in a calling workflow are not accessible to this reusable workflow. Refer to the documentation for further details on this limitation.
 name: Standard tests jobs
 on:
   workflow_call:
-    inputs:
-      uploadCoverage:
-        description: 'Upload coverage to Codecov'
-        type: boolean
-        default: false
 permissions:
   contents: read
 
@@ -43,7 +37,6 @@ jobs:
       PYTHON_VERSION: "${{  matrix.PYTHON_VERSION  }}"
       PIP_USE_PEP517: "${{ matrix.PIP_USE_PEP517 }}"
       TOXENV: "${{ matrix.TOXENV }}"
-      uploadCoverage: "${{ inputs.uploadCoverage }}"
       IMAGE_NAME: "${{ matrix.IMAGE_NAME }}"
       test_name: "test"
   test_sphinx_builds:
diff --git a/.github/workflows/tox_steps.yml b/.github/workflows/tox_steps.yml
index 758327bf2..dce0fcb1b 100644
--- a/.github/workflows/tox_steps.yml
+++ b/.github/workflows/tox_steps.yml
@@ -10,18 +10,11 @@ on:
         type: string
       PIP_USE_PEP517:
         type: string
-      uploadCoverage:
-        description: 'Upload coverage to Codecov'
-        type: boolean
-        default: false
       test_name:
         type: string
 permissions:
   contents: read
 
-env:
-  uploadCoverage: ${{ inputs.uploadCoverage }}
-
 jobs:
   tox_all:
     name: ${{ inputs.test_name }} ${{ inputs.IMAGE_NAME }}-${{ inputs.TOXENV }}
@@ -85,26 +78,3 @@ jobs:
         env
         python3 -m tox run
       shell: bash
-    - name: Upload coverage data
-      if: env.uploadCoverage == true && (startsWith(matrix.TOXENV, 'cover') || startsWith(matrix.TOXENV, 'integration'))
-      run: |-
-        python3 tools/pip_install.py -I coverage
-        case "${{ runner.os }}" in
-          Darwin)
-            CODECOV_URL="https://uploader.codecov.io/latest/macos/codecov"
-            ;;
-          Linux)
-            CODECOV_URL="https://uploader.codecov.io/latest/linux/codecov"
-            ;;
-          Windows_NT)
-            CODECOV_URL="https://uploader.codecov.io/latest/windows/codecov.exe"
-            ;;
-          *)
-            echo "Unexpected OS"
-            exit 0
-        esac
-        curl --retry 3 -o codecov "$CODECOV_URL"
-        chmod +x codecov
-        coverage xml
-        ./codecov || echo "Uploading coverage data failed"
-      shell: bash

From 23738a1c6e87a5abc7ddec6c76b815bbf1fe21d7 Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 11:57:09 -0700
Subject: [PATCH 10/19] remove test_name since github already has that context,
 swap order of toxenv and image name

---
 .github/workflows/standard_tests_jobs.yml | 1 -
 .github/workflows/tox_steps.yml           | 4 +---
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/standard_tests_jobs.yml b/.github/workflows/standard_tests_jobs.yml
index 3bfd02ffd..4f830c514 100644
--- a/.github/workflows/standard_tests_jobs.yml
+++ b/.github/workflows/standard_tests_jobs.yml
@@ -38,6 +38,5 @@ jobs:
       PIP_USE_PEP517: "${{ matrix.PIP_USE_PEP517 }}"
       TOXENV: "${{ matrix.TOXENV }}"
       IMAGE_NAME: "${{ matrix.IMAGE_NAME }}"
-      test_name: "test"
   test_sphinx_builds:
     uses: "./.github/workflows/sphinx_steps.yml"
diff --git a/.github/workflows/tox_steps.yml b/.github/workflows/tox_steps.yml
index dce0fcb1b..f9a3cfb1d 100644
--- a/.github/workflows/tox_steps.yml
+++ b/.github/workflows/tox_steps.yml
@@ -10,14 +10,12 @@ on:
         type: string
       PIP_USE_PEP517:
         type: string
-      test_name:
-        type: string
 permissions:
   contents: read
 
 jobs:
   tox_all:
-    name: ${{ inputs.test_name }} ${{ inputs.IMAGE_NAME }}-${{ inputs.TOXENV }}
+    name: ${{ inputs.TOXENV }} ${{ inputs.IMAGE_NAME }}
     runs-on:
       - "${{ inputs.IMAGE_NAME }}"
     steps:

From 6f2aa2f37658e337ddece3090cf183436660cb51 Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 12:21:42 -0700
Subject: [PATCH 11/19] use consistent naming and capitalization for sphinx
 builds as well

---
 .github/workflows/sphinx_steps.yml        | 2 +-
 .github/workflows/standard_tests_jobs.yml | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sphinx_steps.yml b/.github/workflows/sphinx_steps.yml
index 7839ca028..865a8cffe 100644
--- a/.github/workflows/sphinx_steps.yml
+++ b/.github/workflows/sphinx_steps.yml
@@ -13,7 +13,7 @@ jobs:
         uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
-      - name: Build Sphinx Documentation
+      - name: build sphinx documentation
         run: |-
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends libaugeas-dev
diff --git a/.github/workflows/standard_tests_jobs.yml b/.github/workflows/standard_tests_jobs.yml
index 4f830c514..676bacf76 100644
--- a/.github/workflows/standard_tests_jobs.yml
+++ b/.github/workflows/standard_tests_jobs.yml
@@ -39,4 +39,5 @@ jobs:
       TOXENV: "${{ matrix.TOXENV }}"
       IMAGE_NAME: "${{ matrix.IMAGE_NAME }}"
   test_sphinx_builds:
+    name: '-' # Makes results viewing cleaner
     uses: "./.github/workflows/sphinx_steps.yml"

From b0e5900e52212854f36868d2e3cf25a0330f36d1 Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 12:28:58 -0700
Subject: [PATCH 12/19] use github actions syntax for groups and errors

---
 .github/workflows/sphinx_steps.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/sphinx_steps.yml b/.github/workflows/sphinx_steps.yml
index 865a8cffe..efd8ac936 100644
--- a/.github/workflows/sphinx_steps.yml
+++ b/.github/workflows/sphinx_steps.yml
@@ -24,15 +24,15 @@ jobs:
           for doc_path in */docs
           do
             echo ""
-            echo "##[group]Building $doc_path"
+            echo "::group::Building $doc_path"
             if ! sphinx-build -W --keep-going -b html $doc_path $doc_path/_build/html; then
               FINAL_STATUS=1
               FAILED_BUILDS[${#FAILED_BUILDS[@]}]="${doc_path%/docs}"
             fi
-            echo "##[endgroup]"
+            echo "::endgroup::"
           done
           if [[ $FINAL_STATUS -ne 0 ]]; then
-            echo "##[error]The following builds failed: ${FAILED_BUILDS[*]}"
+            echo "::error::The following builds failed: ${FAILED_BUILDS[*]}"
             exit 1
           fi
         shell: bash

From cfa43e860ba0e86c889724c85bd05b73c1fd571e Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 12:44:36 -0700
Subject: [PATCH 13/19] put the sphinx capitalization change in the right place

---
 .github/workflows/sphinx_steps.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sphinx_steps.yml b/.github/workflows/sphinx_steps.yml
index efd8ac936..35b9b38ae 100644
--- a/.github/workflows/sphinx_steps.yml
+++ b/.github/workflows/sphinx_steps.yml
@@ -6,14 +6,14 @@ permissions:
 
 jobs:
   test_sphinx_builds:
-    name: Build Sphinx Documentation
+    name: build sphinx documentation
     runs-on: ubuntu-latest
     steps:
       - name: checkout
         uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
-      - name: build sphinx documentation
+      - name: Build Sphinx Documentation
         run: |-
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends libaugeas-dev

From 0f5ac81a6b8bad2492dffe6c70b210a6009d2606 Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 12:58:46 -0700
Subject: [PATCH 14/19] add a comment to test if debugging turned off correctly

---
 .github/workflows/sphinx_steps.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/sphinx_steps.yml b/.github/workflows/sphinx_steps.yml
index 35b9b38ae..2d7ca3ef7 100644
--- a/.github/workflows/sphinx_steps.yml
+++ b/.github/workflows/sphinx_steps.yml
@@ -23,7 +23,7 @@ jobs:
           source venv/bin/activate
           for doc_path in */docs
           do
-            echo ""
+            echo "" # add comment to test if debug logging turned off correctly
             echo "::group::Building $doc_path"
             if ! sphinx-build -W --keep-going -b html $doc_path $doc_path/_build/html; then
               FINAL_STATUS=1

From 9ba5d3317a84e6277cdb8868b8f4738e93cf6a0d Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 13:01:53 -0700
Subject: [PATCH 15/19] group more outputs in sphinx tests

---
 .github/workflows/sphinx_steps.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sphinx_steps.yml b/.github/workflows/sphinx_steps.yml
index 2d7ca3ef7..1347742bd 100644
--- a/.github/workflows/sphinx_steps.yml
+++ b/.github/workflows/sphinx_steps.yml
@@ -15,15 +15,17 @@ jobs:
           persist-credentials: false
       - name: Build Sphinx Documentation
         run: |-
+          echo "::group::Install dependencies"
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends libaugeas-dev
+          echo "::endgroup::"
           FINAL_STATUS=0
           declare -a FAILED_BUILDS
           tools/venv.py
           source venv/bin/activate
           for doc_path in */docs
           do
-            echo "" # add comment to test if debug logging turned off correctly
+            echo ""
             echo "::group::Building $doc_path"
             if ! sphinx-build -W --keep-going -b html $doc_path $doc_path/_build/html; then
               FINAL_STATUS=1

From 87b13716cd3b268f65a9c1f46f09aba1e70b20c5 Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 13:04:17 -0700
Subject: [PATCH 16/19] group venv as well! these should maybe be separate
 steps but whatever

---
 .github/workflows/sphinx_steps.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/sphinx_steps.yml b/.github/workflows/sphinx_steps.yml
index 1347742bd..9b78f23e9 100644
--- a/.github/workflows/sphinx_steps.yml
+++ b/.github/workflows/sphinx_steps.yml
@@ -21,8 +21,10 @@ jobs:
           echo "::endgroup::"
           FINAL_STATUS=0
           declare -a FAILED_BUILDS
+          echo "::group::Setup venv"
           tools/venv.py
           source venv/bin/activate
+          echo "::endgroup::"
           for doc_path in */docs
           do
             echo ""

From 269d85668169561fd215f1b29df48e2d1c1b8cf8 Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 13:08:29 -0700
Subject: [PATCH 17/19] remove github.ref from concurency group name

---
 .github/workflows/pr-test-suite.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pr-test-suite.yml b/.github/workflows/pr-test-suite.yml
index 816c81606..760638b82 100644
--- a/.github/workflows/pr-test-suite.yml
+++ b/.github/workflows/pr-test-suite.yml
@@ -13,7 +13,7 @@ permissions:
   contents: read
 concurrency:
   # https://stackoverflow.com/questions/74117321/if-condition-in-concurrency-in-gha
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:

From b6fe14e0f769ddac8e1e0920067acfb4a255a5df Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 13:09:15 -0700
Subject: [PATCH 18/19] add a comment to check concurrency; this should stop
 the previous test and run this instead

---
 .github/workflows/pr-test-suite.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/pr-test-suite.yml b/.github/workflows/pr-test-suite.yml
index 760638b82..53dfd0692 100644
--- a/.github/workflows/pr-test-suite.yml
+++ b/.github/workflows/pr-test-suite.yml
@@ -13,6 +13,7 @@ permissions:
   contents: read
 concurrency:
   # https://stackoverflow.com/questions/74117321/if-condition-in-concurrency-in-gha
+  # adding this comment to push again to check concurrency"
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 

From ed82edd001a3602218d6e0ff9419fa3a11cc7864 Mon Sep 17 00:00:00 2001
From: Erica Portnoy <erica@eff.org>
Date: Fri, 24 Apr 2026 13:10:18 -0700
Subject: [PATCH 19/19] remove comment added to check concurrency

---
 .github/workflows/pr-test-suite.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/pr-test-suite.yml b/.github/workflows/pr-test-suite.yml
index 53dfd0692..760638b82 100644
--- a/.github/workflows/pr-test-suite.yml
+++ b/.github/workflows/pr-test-suite.yml
@@ -13,7 +13,6 @@ permissions:
   contents: read
 concurrency:
   # https://stackoverflow.com/questions/74117321/if-condition-in-concurrency-in-gha
-  # adding this comment to push again to check concurrency"
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true