From c0e76d56cbf58c55a9201cf1d6e2d7268cdab46d Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Tue, 30 Jun 2026 19:38:03 -0700
Subject: [PATCH 01/20] add workflow and matcher

---
 .github/matchers/actionlint.json | 17 ++++++++++++++++
 .github/workflows/actionlint.yml | 35 ++++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 .github/matchers/actionlint.json
 create mode 100644 .github/workflows/actionlint.yml

diff --git a/.github/matchers/actionlint.json b/.github/matchers/actionlint.json
new file mode 100644
index 00000000000..4613e1617bf
--- /dev/null
+++ b/.github/matchers/actionlint.json
@@ -0,0 +1,17 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "actionlint",
+      "pattern": [
+        {
+          "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4,
+          "code": 5
+        }
+      ]
+    }
+  ]
+}
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
new file mode 100644
index 00000000000..50debcf6b99
--- /dev/null
+++ b/.github/workflows/actionlint.yml
@@ -0,0 +1,35 @@
+name: Actionlint
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - .github/**
+  pull_request:
+    paths:
+      - .github/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          sparse-checkout: |
+            .github
+
+      # Content copied from https://raw.githubusercontent.com/rhysd/actionlint/2ab3a12c7848f6c15faca9a92612ef4261d0e370/.github/actionlint-matcher.json
+      - name: Add ActionLint Problem Matcher
+        run: echo "::add-matcher::.github/matchers/actionlint.json"
+
+      - name: Lint workflows
+        uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
+        with:
+          args: -color -verbose

From 428baa36506c326945aa5d60730113c8285699a7 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Tue, 30 Jun 2026 20:12:34 -0700
Subject: [PATCH 02/20] [agentics-maintenance.yml] ignore "string should not be
 empty"

---
 .github/actionlint.yaml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 .github/actionlint.yaml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 00000000000..e70de53b646
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,6 @@
+paths:
+  # agentics-maintenance.yml is auto-generated (DO NOT EDIT) and intentionally uses an empty string
+  # as the default choice option for the 'operation' input.
+  .github/workflows/agentics-maintenance.yml:
+    ignore:
+      - 'string should not be empty'

From fc375be776099ac1ea6dcbeb25ada8987754d1f7 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Tue, 30 Jun 2026 21:29:08 -0700
Subject: [PATCH 03/20] [copilot-setup-steps.yml] quote to prevent word
 splitting

---
 .github/workflows/copilot-setup-steps.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 2cf4ff054f7..240bd95462c 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -51,7 +51,7 @@ jobs:
           node-version: "20"
 
       - name: Install golangci-lint
-        run: curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/v2.11.4/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.4
+        run: curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/v2.11.4/install.sh | sh -s -- -b "$(go env GOPATH)/bin" v2.11.4
 
       - name: Install cspell
         run: npm install -g cspell@8.13.1

From 2b171507286371d00adda273b6a3a35b9ac1d1f1 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Tue, 30 Jun 2026 21:32:40 -0700
Subject: [PATCH 04/20] ignore all agentic workflows

---
 .github/actionlint.yaml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index e70de53b646..0515fe98161 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -1,6 +1,10 @@
 paths:
-  # agentics-maintenance.yml is auto-generated (DO NOT EDIT) and intentionally uses an empty string
-  # as the default choice option for the 'operation' input.
+  .github/workflows/*.lock.yml:
+    ignore:
+      - ".+"
+
+  # Also generated by gh-aw
   .github/workflows/agentics-maintenance.yml:
     ignore:
-      - 'string should not be empty'
+      - ".+"
+

From ffa39555ba3d744892c0d361d7d51567fb184b70 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Tue, 30 Jun 2026 21:33:07 -0700
Subject: [PATCH 05/20] [lint-bicep.yml] quote to prevent word splitting

---
 .github/workflows/lint-bicep.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lint-bicep.yml b/.github/workflows/lint-bicep.yml
index 58b0c11e56c..e933237618a 100644
--- a/.github/workflows/lint-bicep.yml
+++ b/.github/workflows/lint-bicep.yml
@@ -17,8 +17,8 @@ jobs:
       - name: Upgrade bicep
         run: |
           which bicep
-          sudo curl -o $(which bicep) -L https://github.com/Azure/bicep/releases/download/v0.44.1/bicep-linux-x64
-          sudo chmod +x $(which bicep)
+          sudo curl -o "$(which bicep)" -L https://github.com/Azure/bicep/releases/download/v0.44.1/bicep-linux-x64
+          sudo chmod +x "$(which bicep)"
       - name: Lint .bicep files
         run: $ErrorActionPreference='Continue'; eng/scripts/Test-BicepLint.ps1 -Verbose
         shell: pwsh

From 019d51bdfff9ea5ed06aa676a2daf52ac2983c09 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Tue, 30 Jun 2026 21:33:57 -0700
Subject: [PATCH 06/20] [test-ext-azure-ai-agents.yml] quote to prevent word
 splitting

---
 .github/workflows/test-ext-azure-ai-agents.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-ext-azure-ai-agents.yml b/.github/workflows/test-ext-azure-ai-agents.yml
index 7f4bde79ec7..3a87e96e9fb 100644
--- a/.github/workflows/test-ext-azure-ai-agents.yml
+++ b/.github/workflows/test-ext-azure-ai-agents.yml
@@ -49,7 +49,7 @@ jobs:
           # Use the canonical ci-build.ps1 which includes security flags
           # (trimpath, pie, cfi, cfg, osusergo) matching release builds.
           # -BuildRecordMode produces both a production and a record-tagged binary.
-          pwsh -File ci-build.ps1 -BuildRecordMode -OutputFileName azure-ai-agents-linux-amd64 -Version $(cat version.txt | tr -d '\r\n')
+          pwsh -File ci-build.ps1 -BuildRecordMode -OutputFileName azure-ai-agents-linux-amd64 -Version "$(cat version.txt | tr -d '\r\n')"
           # Move production binary to bin/ where azd x pack expects it.
           mkdir -p bin
           mv azure-ai-agents-linux-amd64 bin/

From 8feb3ea0509a887b657ec10b4d11609bbbaa1cf6 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Tue, 30 Jun 2026 21:37:10 -0700
Subject: [PATCH 07/20] [validate-go-version.yml] convert bash loops to handle
 filenames with spaces

---
 .github/workflows/validate-go-version.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/validate-go-version.yml b/.github/workflows/validate-go-version.yml
index 32c7594a168..69b97b2bb3b 100644
--- a/.github/workflows/validate-go-version.yml
+++ b/.github/workflows/validate-go-version.yml
@@ -30,7 +30,7 @@ jobs:
           # Check all go.mod files
           echo ""
           echo "Checking go.mod files..."
-          for f in $(find cli/azd -name 'go.mod'); do
+          while IFS= read -r f; do
             VERSION=$(grep -m1 '^go ' "$f" | awk '{print $2}')
             if [ "$VERSION" != "$EXPECTED" ]; then
               echo "::error file=$f::Go version mismatch: found '$VERSION', expected '$EXPECTED'"
@@ -38,7 +38,7 @@ jobs:
             else
               echo "  OK: $f ($VERSION)"
             fi
-          done
+          done < <(find cli/azd -name 'go.mod')
 
           # Check ADO pipeline template
           echo ""
@@ -57,7 +57,7 @@ jobs:
           # Check Dockerfiles referencing golang:<version> base images
           echo ""
           echo "Checking Dockerfiles..."
-          for f in $(find cli/azd -name 'Dockerfile'); do
+          while IFS= read -r f; do
             DOCKER_VERSION=$(grep -oP 'golang:\K[\d.]+' "$f" | head -1)
             if [ -n "$DOCKER_VERSION" ] && [ "$DOCKER_VERSION" != "$EXPECTED" ]; then
               echo "::error file=$f::Dockerfile golang version mismatch: found '$DOCKER_VERSION', expected '$EXPECTED'"
@@ -65,7 +65,7 @@ jobs:
             elif [ -n "$DOCKER_VERSION" ]; then
               echo "  OK: $f (golang:$DOCKER_VERSION)"
             fi
-          done
+          done < <(find cli/azd -name 'Dockerfile')
 
           # Check devcontainer.json Go feature version
           echo ""

From 8d41431de2e07f6c6000f6bf3fb5c9519921b02f Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Tue, 30 Jun 2026 21:43:21 -0700
Subject: [PATCH 08/20] Remove empty line in actionlint.yaml

---
 .github/actionlint.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 0515fe98161..f6b20859fd0 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -7,4 +7,3 @@ paths:
   .github/workflows/agentics-maintenance.yml:
     ignore:
       - ".+"
-

From 1c25659fa4a5c1ea9a0fe00f75ef0892843856ef Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Tue, 30 Jun 2026 21:44:20 -0700
Subject: [PATCH 09/20] use checkout@v6 for consistency

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/actionlint.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 50debcf6b99..4f3c0386c11 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           sparse-checkout: |
             .github

From df2af4a4ed9e40e0a9a7ac7c8ff1937b6d7d87e2 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Tue, 30 Jun 2026 21:50:38 -0700
Subject: [PATCH 10/20] Fix read command to handle filenames with whitespace or
 newlines

---
 .github/workflows/validate-go-version.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/validate-go-version.yml b/.github/workflows/validate-go-version.yml
index 69b97b2bb3b..ee09e707477 100644
--- a/.github/workflows/validate-go-version.yml
+++ b/.github/workflows/validate-go-version.yml
@@ -30,7 +30,7 @@ jobs:
           # Check all go.mod files
           echo ""
           echo "Checking go.mod files..."
-          while IFS= read -r f; do
+          while IFS= read -r -d '' f; do
             VERSION=$(grep -m1 '^go ' "$f" | awk '{print $2}')
             if [ "$VERSION" != "$EXPECTED" ]; then
               echo "::error file=$f::Go version mismatch: found '$VERSION', expected '$EXPECTED'"
@@ -38,7 +38,7 @@ jobs:
             else
               echo "  OK: $f ($VERSION)"
             fi
-          done < <(find cli/azd -name 'go.mod')
+          done < <(find cli/azd -name 'go.mod' -print0)
 
           # Check ADO pipeline template
           echo ""
@@ -57,7 +57,7 @@ jobs:
           # Check Dockerfiles referencing golang:<version> base images
           echo ""
           echo "Checking Dockerfiles..."
-          while IFS= read -r f; do
+          while IFS= read -r -d '' f; do
             DOCKER_VERSION=$(grep -oP 'golang:\K[\d.]+' "$f" | head -1)
             if [ -n "$DOCKER_VERSION" ] && [ "$DOCKER_VERSION" != "$EXPECTED" ]; then
               echo "::error file=$f::Dockerfile golang version mismatch: found '$DOCKER_VERSION', expected '$EXPECTED'"
@@ -65,7 +65,7 @@ jobs:
             elif [ -n "$DOCKER_VERSION" ]; then
               echo "  OK: $f (golang:$DOCKER_VERSION)"
             fi
-          done < <(find cli/azd -name 'Dockerfile')
+          done < <(find cli/azd -name 'Dockerfile' -print0)
 
           # Check devcontainer.json Go feature version
           echo ""

From 97ee5ae4e46e0e2320cf07ec477baec7986a3337 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Tue, 30 Jun 2026 21:52:45 -0700
Subject: [PATCH 11/20] Rename job 'test' to 'actionlint' in workflow

---
 .github/workflows/actionlint.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 4f3c0386c11..1bd951bbdfa 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -15,7 +15,7 @@ permissions:
   contents: read
 
 jobs:
-  test:
+  actionlint:
     runs-on: ubuntu-latest
 
     steps:

From 3471989ef5c77128112dce56178667e10efc4a88 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Wed, 1 Jul 2026 15:50:15 -0700
Subject: [PATCH 12/20] Apply suggestion from @mikeharder

---
 .github/workflows/validate-go-version.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/validate-go-version.yml b/.github/workflows/validate-go-version.yml
index ee09e707477..adeea225de2 100644
--- a/.github/workflows/validate-go-version.yml
+++ b/.github/workflows/validate-go-version.yml
@@ -20,6 +20,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Validate Go version consistency
+        shell: bash
         run: |
           # Source of truth: cli/azd/go.mod
           EXPECTED=$(grep -m1 '^go ' cli/azd/go.mod | awk '{print $2}')

From a20c677cda56c64ed5f002e991b739ce7e4ecf80 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Wed, 1 Jul 2026 15:52:44 -0700
Subject: [PATCH 13/20] [lint-bicep.yml] eliminate redundant "which bicep"
 calls

---
 .github/workflows/lint-bicep.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lint-bicep.yml b/.github/workflows/lint-bicep.yml
index e933237618a..965ccb2da87 100644
--- a/.github/workflows/lint-bicep.yml
+++ b/.github/workflows/lint-bicep.yml
@@ -16,9 +16,9 @@ jobs:
       - uses: actions/checkout@v6
       - name: Upgrade bicep
         run: |
-          which bicep
-          sudo curl -o "$(which bicep)" -L https://github.com/Azure/bicep/releases/download/v0.44.1/bicep-linux-x64
-          sudo chmod +x "$(which bicep)"
+          BICEP_PATH=$(which bicep)
+          sudo curl -o "$BICEP_PATH" -L https://github.com/Azure/bicep/releases/download/v0.44.1/bicep-linux-x64
+          sudo chmod +x "$BICEP_PATH"
       - name: Lint .bicep files
         run: $ErrorActionPreference='Continue'; eng/scripts/Test-BicepLint.ps1 -Verbose
         shell: pwsh

From ad4f63c0de0e19f4f5072d51fa5b397741e3940f Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Wed, 1 Jul 2026 15:53:43 -0700
Subject: [PATCH 14/20] echo bicep path

---
 .github/workflows/lint-bicep.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/lint-bicep.yml b/.github/workflows/lint-bicep.yml
index 965ccb2da87..d8929a0567c 100644
--- a/.github/workflows/lint-bicep.yml
+++ b/.github/workflows/lint-bicep.yml
@@ -17,6 +17,7 @@ jobs:
       - name: Upgrade bicep
         run: |
           BICEP_PATH=$(which bicep)
+          echo "$BICEP_PATH"
           sudo curl -o "$BICEP_PATH" -L https://github.com/Azure/bicep/releases/download/v0.44.1/bicep-linux-x64
           sudo chmod +x "$BICEP_PATH"
       - name: Lint .bicep files

From 6eef51be8e43c7cab8300a4f2ab467be429a1df3 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Wed, 1 Jul 2026 15:56:51 -0700
Subject: [PATCH 15/20] Revert "echo bicep path"

This reverts commit ad4f63c0de0e19f4f5072d51fa5b397741e3940f.
---
 .github/workflows/lint-bicep.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/lint-bicep.yml b/.github/workflows/lint-bicep.yml
index d8929a0567c..965ccb2da87 100644
--- a/.github/workflows/lint-bicep.yml
+++ b/.github/workflows/lint-bicep.yml
@@ -17,7 +17,6 @@ jobs:
       - name: Upgrade bicep
         run: |
           BICEP_PATH=$(which bicep)
-          echo "$BICEP_PATH"
           sudo curl -o "$BICEP_PATH" -L https://github.com/Azure/bicep/releases/download/v0.44.1/bicep-linux-x64
           sudo chmod +x "$BICEP_PATH"
       - name: Lint .bicep files

From a60c17d4f175fd826d880b5c9aee513740774759 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Wed, 1 Jul 2026 15:57:09 -0700
Subject: [PATCH 16/20] Revert "[lint-bicep.yml] eliminate redundant "which
 bicep" calls"

This reverts commit a20c677cda56c64ed5f002e991b739ce7e4ecf80.
---
 .github/workflows/lint-bicep.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lint-bicep.yml b/.github/workflows/lint-bicep.yml
index 965ccb2da87..e933237618a 100644
--- a/.github/workflows/lint-bicep.yml
+++ b/.github/workflows/lint-bicep.yml
@@ -16,9 +16,9 @@ jobs:
       - uses: actions/checkout@v6
       - name: Upgrade bicep
         run: |
-          BICEP_PATH=$(which bicep)
-          sudo curl -o "$BICEP_PATH" -L https://github.com/Azure/bicep/releases/download/v0.44.1/bicep-linux-x64
-          sudo chmod +x "$BICEP_PATH"
+          which bicep
+          sudo curl -o "$(which bicep)" -L https://github.com/Azure/bicep/releases/download/v0.44.1/bicep-linux-x64
+          sudo chmod +x "$(which bicep)"
       - name: Lint .bicep files
         run: $ErrorActionPreference='Continue'; eng/scripts/Test-BicepLint.ps1 -Verbose
         shell: pwsh

From 1bb1b53d2e2b51ec567afb97ae670b7247fd6e99 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Wed, 1 Jul 2026 15:57:26 -0700
Subject: [PATCH 17/20] Revert "Apply suggestion from @mikeharder"

This reverts commit 3471989ef5c77128112dce56178667e10efc4a88.
---
 .github/workflows/validate-go-version.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/validate-go-version.yml b/.github/workflows/validate-go-version.yml
index adeea225de2..ee09e707477 100644
--- a/.github/workflows/validate-go-version.yml
+++ b/.github/workflows/validate-go-version.yml
@@ -20,7 +20,6 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Validate Go version consistency
-        shell: bash
         run: |
           # Source of truth: cli/azd/go.mod
           EXPECTED=$(grep -m1 '^go ' cli/azd/go.mod | awk '{print $2}')

From 2cf9d8dbd8163727fe9b71e4ab6336d988342353 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Wed, 1 Jul 2026 15:57:38 -0700
Subject: [PATCH 18/20] Revert "Fix read command to handle filenames with
 whitespace or newlines"

This reverts commit df2af4a4ed9e40e0a9a7ac7c8ff1937b6d7d87e2.
---
 .github/workflows/validate-go-version.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/validate-go-version.yml b/.github/workflows/validate-go-version.yml
index ee09e707477..69b97b2bb3b 100644
--- a/.github/workflows/validate-go-version.yml
+++ b/.github/workflows/validate-go-version.yml
@@ -30,7 +30,7 @@ jobs:
           # Check all go.mod files
           echo ""
           echo "Checking go.mod files..."
-          while IFS= read -r -d '' f; do
+          while IFS= read -r f; do
             VERSION=$(grep -m1 '^go ' "$f" | awk '{print $2}')
             if [ "$VERSION" != "$EXPECTED" ]; then
               echo "::error file=$f::Go version mismatch: found '$VERSION', expected '$EXPECTED'"
@@ -38,7 +38,7 @@ jobs:
             else
               echo "  OK: $f ($VERSION)"
             fi
-          done < <(find cli/azd -name 'go.mod' -print0)
+          done < <(find cli/azd -name 'go.mod')
 
           # Check ADO pipeline template
           echo ""
@@ -57,7 +57,7 @@ jobs:
           # Check Dockerfiles referencing golang:<version> base images
           echo ""
           echo "Checking Dockerfiles..."
-          while IFS= read -r -d '' f; do
+          while IFS= read -r f; do
             DOCKER_VERSION=$(grep -oP 'golang:\K[\d.]+' "$f" | head -1)
             if [ -n "$DOCKER_VERSION" ] && [ "$DOCKER_VERSION" != "$EXPECTED" ]; then
               echo "::error file=$f::Dockerfile golang version mismatch: found '$DOCKER_VERSION', expected '$EXPECTED'"
@@ -65,7 +65,7 @@ jobs:
             elif [ -n "$DOCKER_VERSION" ]; then
               echo "  OK: $f (golang:$DOCKER_VERSION)"
             fi
-          done < <(find cli/azd -name 'Dockerfile' -print0)
+          done < <(find cli/azd -name 'Dockerfile')
 
           # Check devcontainer.json Go feature version
           echo ""

From 2d3229667c243c808b5822e297902682bc52c876 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Wed, 1 Jul 2026 15:57:51 -0700
Subject: [PATCH 19/20] Revert "[validate-go-version.yml] convert bash loops to
 handle filenames with spaces"

This reverts commit 8feb3ea0509a887b657ec10b4d11609bbbaa1cf6.
---
 .github/workflows/validate-go-version.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/validate-go-version.yml b/.github/workflows/validate-go-version.yml
index 69b97b2bb3b..32c7594a168 100644
--- a/.github/workflows/validate-go-version.yml
+++ b/.github/workflows/validate-go-version.yml
@@ -30,7 +30,7 @@ jobs:
           # Check all go.mod files
           echo ""
           echo "Checking go.mod files..."
-          while IFS= read -r f; do
+          for f in $(find cli/azd -name 'go.mod'); do
             VERSION=$(grep -m1 '^go ' "$f" | awk '{print $2}')
             if [ "$VERSION" != "$EXPECTED" ]; then
               echo "::error file=$f::Go version mismatch: found '$VERSION', expected '$EXPECTED'"
@@ -38,7 +38,7 @@ jobs:
             else
               echo "  OK: $f ($VERSION)"
             fi
-          done < <(find cli/azd -name 'go.mod')
+          done
 
           # Check ADO pipeline template
           echo ""
@@ -57,7 +57,7 @@ jobs:
           # Check Dockerfiles referencing golang:<version> base images
           echo ""
           echo "Checking Dockerfiles..."
-          while IFS= read -r f; do
+          for f in $(find cli/azd -name 'Dockerfile'); do
             DOCKER_VERSION=$(grep -oP 'golang:\K[\d.]+' "$f" | head -1)
             if [ -n "$DOCKER_VERSION" ] && [ "$DOCKER_VERSION" != "$EXPECTED" ]; then
               echo "::error file=$f::Dockerfile golang version mismatch: found '$DOCKER_VERSION', expected '$EXPECTED'"
@@ -65,7 +65,7 @@ jobs:
             elif [ -n "$DOCKER_VERSION" ]; then
               echo "  OK: $f (golang:$DOCKER_VERSION)"
             fi
-          done < <(find cli/azd -name 'Dockerfile')
+          done
 
           # Check devcontainer.json Go feature version
           echo ""

From 7efdb99df15b74ed1b7f06ddba7c6648cc751480 Mon Sep 17 00:00:00 2001
From: Mike Harder <mharder@microsoft.com>
Date: Thu, 2 Jul 2026 13:10:44 -0700
Subject: [PATCH 20/20] [validate-go-version.yml] use while loop for improved
 handling of filenames

---
 .github/workflows/validate-go-version.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/validate-go-version.yml b/.github/workflows/validate-go-version.yml
index 32c7594a168..69b97b2bb3b 100644
--- a/.github/workflows/validate-go-version.yml
+++ b/.github/workflows/validate-go-version.yml
@@ -30,7 +30,7 @@ jobs:
           # Check all go.mod files
           echo ""
           echo "Checking go.mod files..."
-          for f in $(find cli/azd -name 'go.mod'); do
+          while IFS= read -r f; do
             VERSION=$(grep -m1 '^go ' "$f" | awk '{print $2}')
             if [ "$VERSION" != "$EXPECTED" ]; then
               echo "::error file=$f::Go version mismatch: found '$VERSION', expected '$EXPECTED'"
@@ -38,7 +38,7 @@ jobs:
             else
               echo "  OK: $f ($VERSION)"
             fi
-          done
+          done < <(find cli/azd -name 'go.mod')
 
           # Check ADO pipeline template
           echo ""
@@ -57,7 +57,7 @@ jobs:
           # Check Dockerfiles referencing golang:<version> base images
           echo ""
           echo "Checking Dockerfiles..."
-          for f in $(find cli/azd -name 'Dockerfile'); do
+          while IFS= read -r f; do
             DOCKER_VERSION=$(grep -oP 'golang:\K[\d.]+' "$f" | head -1)
             if [ -n "$DOCKER_VERSION" ] && [ "$DOCKER_VERSION" != "$EXPECTED" ]; then
               echo "::error file=$f::Dockerfile golang version mismatch: found '$DOCKER_VERSION', expected '$EXPECTED'"
@@ -65,7 +65,7 @@ jobs:
             elif [ -n "$DOCKER_VERSION" ]; then
               echo "  OK: $f (golang:$DOCKER_VERSION)"
             fi
-          done
+          done < <(find cli/azd -name 'Dockerfile')
 
           # Check devcontainer.json Go feature version
           echo ""