diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3a3d4df..6b4d34b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -97,11 +97,13 @@ jobs:
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
       run: >-
-        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
+        {
+          echo 'SCHEMA_CHANGES<<EOF';
 
-        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
+          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
 
-        echo 'EOF' >> $GITHUB_ENV
+          echo 'EOF';
+        } >> "$GITHUB_ENV"
       env:
         GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
     - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
@@ -133,7 +135,7 @@ jobs:
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-    - name: Commit ${{ matrix.language }} SDK changes for Renovate
+    - name: Commit SDK changes for Renovate
       if: failure() && steps.worktreeClean.outcome == 'failure' &&
         contains(github.actor, 'renovate') && github.event_name ==
         'pull_request'
@@ -171,7 +173,7 @@ jobs:
             sdk/go/*/internal/pulumiUtilities.go \
             sdk/nodejs/package.json
 
-        git commit -m 'Commit ${{ matrix.language }} SDK for Renovate'
+        git commit -m 'Commit SDK for Renovate'
 
 
         # Push with pulumi-bot credentials to trigger a re-run of the
@@ -287,7 +289,7 @@ jobs:
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-    - name: Commit ${{ matrix.language }} SDK changes for Renovate
+    - name: Commit SDK changes for Renovate
       if: failure() && steps.worktreeClean.outcome == 'failure' &&
         contains(github.actor, 'renovate') && github.event_name ==
         'pull_request'
@@ -325,7 +327,7 @@ jobs:
             sdk/go/*/internal/pulumiUtilities.go \
             sdk/nodejs/package.json
 
-        git commit -m 'Commit ${{ matrix.language }} SDK for Renovate'
+        git commit -m 'Commit SDK for Renovate'
 
 
         # Push with pulumi-bot credentials to trigger a re-run of the
@@ -454,7 +456,7 @@ jobs:
       run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
         github.workspace}}/sdk/${{ matrix.language}}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Install Node dependencies
       run: yarn global add typescript
     - run: dotnet nuget add source ${{ github.workspace }}/nuget
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index 4c46ac7..b2d394b 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -89,11 +89,13 @@ jobs:
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
       run: >-
-        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
+        {
+          echo 'SCHEMA_CHANGES<<EOF';
 
-        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
+          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
 
-        echo 'EOF' >> $GITHUB_ENV
+          echo 'EOF';
+        } >> "$GITHUB_ENV"
       env:
         GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
     - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
@@ -125,7 +127,7 @@ jobs:
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-    - name: Commit ${{ matrix.language }} SDK changes for Renovate
+    - name: Commit SDK changes for Renovate
       if: failure() && steps.worktreeClean.outcome == 'failure' &&
         contains(github.actor, 'renovate') && github.event_name ==
         'pull_request'
@@ -163,7 +165,7 @@ jobs:
             sdk/go/*/internal/pulumiUtilities.go \
             sdk/nodejs/package.json
 
-        git commit -m 'Commit ${{ matrix.language }} SDK for Renovate'
+        git commit -m 'Commit SDK for Renovate'
 
 
         # Push with pulumi-bot credentials to trigger a re-run of the
@@ -426,7 +428,7 @@ jobs:
       run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
         github.workspace}}/sdk/${{ matrix.language}}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Install Node dependencies
       run: yarn global add typescript
     - run: dotnet nuget add source ${{ github.workspace }}/nuget
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f60e4cd..36f5eb4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -89,11 +89,13 @@ jobs:
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
       run: >-
-        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
+        {
+          echo 'SCHEMA_CHANGES<<EOF';
 
-        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
+          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
 
-        echo 'EOF' >> $GITHUB_ENV
+          echo 'EOF';
+        } >> "$GITHUB_ENV"
       env:
         GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
     - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
@@ -125,7 +127,7 @@ jobs:
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-    - name: Commit ${{ matrix.language }} SDK changes for Renovate
+    - name: Commit SDK changes for Renovate
       if: failure() && steps.worktreeClean.outcome == 'failure' &&
         contains(github.actor, 'renovate') && github.event_name ==
         'pull_request'
@@ -163,7 +165,7 @@ jobs:
             sdk/go/*/internal/pulumiUtilities.go \
             sdk/nodejs/package.json
 
-        git commit -m 'Commit ${{ matrix.language }} SDK for Renovate'
+        git commit -m 'Commit SDK for Renovate'
 
 
         # Push with pulumi-bot credentials to trigger a re-run of the
@@ -279,7 +281,7 @@ jobs:
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-    - name: Commit ${{ matrix.language }} SDK changes for Renovate
+    - name: Commit SDK changes for Renovate
       if: failure() && steps.worktreeClean.outcome == 'failure' &&
         contains(github.actor, 'renovate') && github.event_name ==
         'pull_request'
@@ -317,7 +319,7 @@ jobs:
             sdk/go/*/internal/pulumiUtilities.go \
             sdk/nodejs/package.json
 
-        git commit -m 'Commit ${{ matrix.language }} SDK for Renovate'
+        git commit -m 'Commit SDK for Renovate'
 
 
         # Push with pulumi-bot credentials to trigger a re-run of the
@@ -426,7 +428,7 @@ jobs:
       run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
         github.workspace}}/sdk/${{ matrix.language}}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Install Node dependencies
       run: yarn global add typescript
     - run: dotnet nuget add source ${{ github.workspace }}/nuget
@@ -713,7 +715,7 @@ jobs:
         repo: pulumi/pulumictl
     - name: Dispatch Event
       run: pulumictl create docs-build pulumi-${{ env.PROVIDER }}
-        ${GITHUB_REF#refs/tags/}
+        "${GITHUB_REF#refs/tags/}"
       env:
         GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
     name: dispatch_docs_build
diff --git a/.github/workflows/run-acceptance-tests.yml b/.github/workflows/run-acceptance-tests.yml
index 70871cf..e15b1ec 100644
--- a/.github/workflows/run-acceptance-tests.yml
+++ b/.github/workflows/run-acceptance-tests.yml
@@ -57,7 +57,7 @@ jobs:
     - name: Create URL to the run output
       id: vars
       run: echo
-        run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID
+        "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
         >> "$GITHUB_OUTPUT"
     - name: Update with Result
       uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
@@ -105,11 +105,13 @@ jobs:
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
       run: >-
-        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
+        {
+          echo 'SCHEMA_CHANGES<<EOF';
 
-        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
+          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
 
-        echo 'EOF' >> $GITHUB_ENV
+          echo 'EOF';
+        } >> "$GITHUB_ENV"
       env:
         GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
     - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
@@ -141,7 +143,7 @@ jobs:
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-    - name: Commit ${{ matrix.language }} SDK changes for Renovate
+    - name: Commit SDK changes for Renovate
       if: failure() && steps.worktreeClean.outcome == 'failure' &&
         contains(github.actor, 'renovate') && github.event_name ==
         'pull_request'
@@ -179,7 +181,7 @@ jobs:
             sdk/go/*/internal/pulumiUtilities.go \
             sdk/nodejs/package.json
 
-        git commit -m 'Commit ${{ matrix.language }} SDK for Renovate'
+        git commit -m 'Commit SDK for Renovate'
 
 
         # Push with pulumi-bot credentials to trigger a re-run of the
@@ -299,7 +301,7 @@ jobs:
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-    - name: Commit ${{ matrix.language }} SDK changes for Renovate
+    - name: Commit SDK changes for Renovate
       if: failure() && steps.worktreeClean.outcome == 'failure' &&
         contains(github.actor, 'renovate') && github.event_name ==
         'pull_request'
@@ -337,8 +339,7 @@ jobs:
             sdk/go/*/internal/pulumiUtilities.go \
             sdk/nodejs/package.json
 
-        git commit -m 'Commit ${{ matrix.language }} SDK for Renovate'
-
+        git commit -m 'Commit SDK for Renovate'
 
         # Push with pulumi-bot credentials to trigger a re-run of the
 
@@ -451,7 +452,7 @@ jobs:
       run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
         github.workspace}}/sdk/${{ matrix.language}}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Install Node dependencies
       run: yarn global add typescript
     - run: dotnet nuget add source ${{ github.workspace }}/nuget
diff --git a/.github/workflows/weekly-pulumi-update.yml b/.github/workflows/weekly-pulumi-update.yml
index 6d2d2e0..d499530 100644
--- a/.github/workflows/weekly-pulumi-update.yml
+++ b/.github/workflows/weekly-pulumi-update.yml
@@ -85,7 +85,7 @@ jobs:
 
         git checkout -b update-pulumi/${{ github.run_id }}-${{ github.run_number }}
 
-        for MODFILE in $(find . -name go.mod); do pushd $(dirname $MODFILE); go get github.com/pulumi/pulumi/pkg/v3 github.com/pulumi/pulumi/sdk/v3; go mod tidy; popd; done
+        find . -name go.mod -execdir sh -c 'go get github.com/pulumi/pulumi/pkg/v3 github.com/pulumi/pulumi/sdk/v3; go mod tidy' \;
 
         gh repo view pulumi/pulumi --json latestRelease --jq .latestRelease.tagName | sed 's/^v//' > .pulumi.version
 
@@ -132,7 +132,7 @@ jobs:
 
         # See https://github.com/cli/cli/issues/6485#issuecomment-2560935183 for --head workaround
 
-        gh pr create -t "$msg" -b "$msg" --head $(git branch --show-current)
+        gh pr create -t "$msg" -b "$msg" --head "$(git branch --show-current)"
       env:
         GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
     name: weekly-pulumi-update