diff --git a/.github/workflows/acm-konflux-update-pr.yaml b/.github/workflows/acm-konflux-update-pr.yaml
index 26ea5f0..97ddf70 100644
--- a/.github/workflows/acm-konflux-update-pr.yaml
+++ b/.github/workflows/acm-konflux-update-pr.yaml
@@ -40,7 +40,7 @@ jobs:
       - name: Find github org name from repo name
         id: org
         run: |
-          echo "downstream=$(dirname ${{ matrix.repo }})" >> $GITHUB_OUTPUT
+          echo "downstream=$(dirname ${{ matrix.repo }})" >> "$GITHUB_OUTPUT"
       - name: Get auth token to list pull request for ${{ matrix.repo }}
         if: github.event_name != 'pull_request'
         id: pr
@@ -56,9 +56,9 @@ jobs:
           PR_LIST=$(gh pr list --repo ${{ matrix.repo }} --state open --json title)
           KONFLUX_PR=$(echo "$PR_LIST" | jq '.[] | select(.title | ascii_downcase | contains("konflux"))')
           if [ -n "$KONFLUX_PR" ]; then
-            echo "konflux_pr_exists=1" >> $GITHUB_OUTPUT
+            echo "konflux_pr_exists=1" >> "$GITHUB_OUTPUT"
           else
-            echo "konflux_pr_exists=0" >> $GITHUB_OUTPUT
+            echo "konflux_pr_exists=0" >> "$GITHUB_OUTPUT"
           fi
         env:
           GH_TOKEN: ${{ steps.pr.outputs.token }}
@@ -66,7 +66,7 @@ jobs:
         id: slack-message
         run: |
           if [ "${{ steps.check-prs.outputs.konflux_pr_exists }}" == "1" ]; then
-            echo "message=Unmerged Konflux PRs are present in https://github.com/${{ matrix.repo }}" >> $GITHUB_OUTPUT
+            echo "message=Unmerged Konflux PRs are present in https://github.com/${{ matrix.repo }}" >> "$GITHUB_OUTPUT"
           fi
       - name: Send Slack notification
         uses: 8398a7/action-slack@v3
diff --git a/.github/workflows/cmo-make-targets.yaml b/.github/workflows/cmo-make-targets.yaml
index 0161831..b1b6478 100644
--- a/.github/workflows/cmo-make-targets.yaml
+++ b/.github/workflows/cmo-make-targets.yaml
@@ -41,11 +41,11 @@ jobs:
   execute-make-targets:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         repository: openshift/cluster-monitoring-operator
         ref: master
-    - uses: actions/setup-go@v2
+    - uses: actions/setup-go@v5
       with:
         go-version: ${{ inputs.go-version }}
     - name: Execute make targets - ${{ inputs.make-targets }}
@@ -53,7 +53,7 @@ jobs:
     - name: Ignore if change is only in jsonnetfile.lock.json
       run: |
         # Reset jsonnetfile.lock.json if no dependencies were updated
-        changedFiles=$(git diff --name-only | grep -v 'jsonnetfile.lock.json' | wc -l)
+        changedFiles=$(git diff --name-only | grep -cv 'jsonnetfile.lock.json')
         if [[ "$changedFiles" -eq 0 ]]; then
           git checkout -- jsonnet/jsonnetfile.lock.json;
         fi
@@ -74,7 +74,7 @@ jobs:
     - name: Find branch name
       id: branch
       run: |
-        echo "sandbox=$(echo ${{ inputs.make-targets }} | sed 's/ /-/g')" >> $GITHUB_OUTPUT
+        echo "sandbox=$(echo ${{ inputs.make-targets }} | sed 's/ /-/g')" >> "$GITHUB_OUTPUT"
     - name: Create Pull Request
       id: create-pr
       uses: rhobs/create-pull-request@v3
@@ -94,9 +94,9 @@ jobs:
       id: slack-message
       run: |
         if [ "${{ steps.create-pr.outputs.pull-request-url }}" == "" ]; then
-          echo "message=No changes detected." >> $GITHUB_OUTPUT
+          echo "message=No changes detected." >> "$GITHUB_OUTPUT"
         else
-          echo "message=PR ${{ steps.create-pr.outputs.pull-request-url }} has been ${{ steps.create-pr.outputs.pull-request-operation || 'updated' }}." >> $GITHUB_OUTPUT
+          echo "message=PR ${{ steps.create-pr.outputs.pull-request-url }} has been ${{ steps.create-pr.outputs.pull-request-operation || 'updated' }}." >> "$GITHUB_OUTPUT"
         fi
     - uses: 8398a7/action-slack@v3
       continue-on-error: true
diff --git a/.github/workflows/merge-acm-flow.yaml b/.github/workflows/merge-acm-flow.yaml
index 66c5429..c003190 100644
--- a/.github/workflows/merge-acm-flow.yaml
+++ b/.github/workflows/merge-acm-flow.yaml
@@ -264,12 +264,12 @@ jobs:
           if [ "${{ steps.create-pr.outcome }}" != "success" ]; then
             echo "${{ steps.create-pr.outcome }}"
             PR_URL=$(gh pr list --json url --jq '.[0].url' --repo ${{ inputs.downstream }} --state open  --head automated-updates-acm-${{ inputs.downstream-branch }})
-              if [ ! -z "$PR_URL" ]; then
-                echo "pr_exists=1" >> $GITHUB_OUTPUT
-                echo "pr_url=$PR_URL" >> $GITHUB_OUTPUT
+              if [ -n "$PR_URL" ]; then
+                echo "pr_exists=1" >> "$GITHUB_OUTPUT"
+                echo "pr_url=$PR_URL" >> "$GITHUB_OUTPUT"
                 echo "PR exists >>  $PR_URL"
               else
-                echo "pr_exists=0" >> $GITHUB_OUTPUT
+                echo "pr_exists=0" >> "$GITHUB_OUTPUT"
               fi
           fi
       - name: Compose slack message body
@@ -283,9 +283,9 @@ jobs:
             PR_URL="${{ steps.create-pr.outputs.pull-request-url }}"
           fi
           if [ "${{ steps.fork-sync.outputs.status }}" == "uptodate" ] || [ "${{ steps.fork-sync.outputs.status }}" == "ahead" ]; then
-            echo "message=${{ inputs.downstream }} is already ${{ steps.fork-sync.outputs.status }} with tag ${{ steps.org.outputs.downstream-version }}." >> $GITHUB_OUTPUT
+            echo "message=${{ inputs.downstream }} is already ${{ steps.fork-sync.outputs.status }} with tag ${{ steps.org.outputs.downstream-version }}." >> "$GITHUB_OUTPUT"
           else
-            echo "message=PR $PR_URL has been ${{ steps.create-pr.outputs.pull-request-operation || 'updated' }}." >> $GITHUB_OUTPUT
+            echo "message=PR $PR_URL has been ${{ steps.create-pr.outputs.pull-request-operation || 'updated' }}." >> "$GITHUB_OUTPUT"
           fi
       - uses: 8398a7/action-slack@v3
         if: github.event_name != 'pull_request' && (success() || steps.fork-sync.outputs.status == 'uptodate' || steps.fork-sync.outputs.status == 'ahead' || steps.pr-exists.outputs.pr_exists == '1')
diff --git a/.github/workflows/merge-flow.yaml b/.github/workflows/merge-flow.yaml
index b6ab058..e338c53 100644
--- a/.github/workflows/merge-flow.yaml
+++ b/.github/workflows/merge-flow.yaml
@@ -82,9 +82,11 @@ jobs:
       - name: Find github org name from repo name
         id: org
         run: |
-          echo "upstream=$(dirname ${{ inputs.upstream }})" >> $GITHUB_OUTPUT
-          echo "downstream=$(dirname ${{ inputs.downstream }})" >> $GITHUB_OUTPUT
-          echo "sandbox=$(dirname ${{ inputs.sandbox }})" >> $GITHUB_OUTPUT
+          {
+          echo "upstream=$(dirname ${{ inputs.upstream }})"
+          echo "downstream=$(dirname ${{ inputs.downstream }})"
+          echo "sandbox=$(dirname ${{ inputs.sandbox }})" 
+          } >> "$GITHUB_OUTPUT"
           DOWNSTREAM_VERSION=$(curl -sL "https://raw.githubusercontent.com/${{ inputs.downstream }}/${{ inputs.downstream-branch }}/VERSION")
           if [[ "${DOWNSTREAM_VERSION}" =~ ^$|"404: Not Found" ]]; then
             # Strip the trailing URL from the expression.
@@ -101,7 +103,7 @@ jobs:
               exit 1
             fi
           fi
-          echo "downstream-version=${DOWNSTREAM_VERSION}" >> $GITHUB_OUTPUT
+          echo "downstream-version=${DOWNSTREAM_VERSION}" >> "$GITHUB_OUTPUT"
       - uses: madhead/semver-utils@latest
         id: version
         with:
@@ -114,18 +116,18 @@ jobs:
           SEMVER_RESULT="${{ steps.version.outputs.comparison-result }}"
           echo "${{ inputs.downstream }}@${{ steps.org.outputs.downstream-version }} ${SEMVER_RESULT} ${{ inputs.upstream }}@${{ steps.upstream.outputs.release }}"
           if [ "${SEMVER_RESULT}" == "<" ]; then
-            echo "status=outdated" >> $GITHUB_OUTPUT
+            echo "status=outdated" >> "$GITHUB_OUTPUT"
             echo "::notice::downstream outdated"
           elif [ "${SEMVER_RESULT}" == "=" ]; then
-            echo "status=uptodate" >> $GITHUB_OUTPUT
+            echo "status=uptodate" >> "$GITHUB_OUTPUT"
             echo "::notice::downstream up-to-date"
             exit 0
           else
-            echo "status=ahead" >> $GITHUB_OUTPUT
+            echo "status=ahead" >> "$GITHUB_OUTPUT"
             echo "::notice::downstream ahead"
             exit 0
           fi
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           repository: ${{ inputs.downstream }}
           fetch-depth: 0
@@ -139,7 +141,7 @@ jobs:
       - name: Merge with upstream ${{ steps.upstream.outputs.release }} tag
         id: merge
         run: |
-          git merge refs/tags/${{ steps.upstream.outputs.release }} --no-edit || echo 'MERGE_CONFLICT=true' >> $GITHUB_OUTPUT
+          git merge refs/tags/${{ steps.upstream.outputs.release }} --no-edit || echo 'MERGE_CONFLICT=true' >> "$GITHUB_OUTPUT"
       - name: Resolve conflict using upstream contents
         if: ${{ steps.merge.outputs.MERGE_CONFLICT == 'true' && inputs.restore-upstream != ''}}
         run: |
@@ -175,10 +177,10 @@ jobs:
           echo "$version_from_tag" > VERSION
           git add VERSION
           git diff --cached --exit-code || git commit -s -m "[bot] add VERSION file with ${version_from_tag}"
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v5
         with:
           go-version: ${{ inputs.go-version }}
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@v4
         with:
           node-version: ${{ inputs.node-version }}
       - name: Remove dependabot configuration
@@ -261,9 +263,9 @@ jobs:
         id: slack-message
         run: |
           if [ "${{ steps.create-pr.outputs.pull-request-url }}" == "" ] || [ ${{ steps.fork-sync.outputs.status }} == "uptodate" ] || [ ${{ steps.fork-sync.outputs.status }} == "ahead" ] ; then
-            echo "message=${{ inputs.downstream }} is already ${{ steps.fork-sync.outputs.status }} with tag ${{ steps.org.outputs.downstream-version }}." >> $GITHUB_OUTPUT
+            echo "message=${{ inputs.downstream }} is already ${{ steps.fork-sync.outputs.status }} with tag ${{ steps.org.outputs.downstream-version }}." >> "$GITHUB_OUTPUT"
           else
-            echo "message=PR ${{ steps.create-pr.outputs.pull-request-url }} has been ${{ steps.create-pr.outputs.pull-request-operation || 'updated' }}." >> $GITHUB_OUTPUT
+            echo "message=PR ${{ steps.create-pr.outputs.pull-request-url }} has been ${{ steps.create-pr.outputs.pull-request-operation || 'updated' }}." >> "$GITHUB_OUTPUT"
           fi
       - uses: 8398a7/action-slack@v3
         if: github.event_name != 'pull_request' && (success() || steps.fork-sync.outputs.status == 'uptodate' || steps.fork-sync.outputs.status == 'ahead')