diff --git a/.github/workflows/command-dispatch.yml b/.github/workflows/command-dispatch.yml
index 8f2aac3..1eb7077 100644
--- a/.github/workflows/command-dispatch.yml
+++ b/.github/workflows/command-dispatch.yml
@@ -1,18 +1,18 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
 env:
+  PROVIDER: mailgun
   DOTNETVERSION: |
-    6.0.x
-    3.1.301
+      6.0.x
+      3.1.301
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GOVERSION: 1.20.1
   JAVAVERSION: "11"
   MAILGUN_API_KEY: ${{ secrets.MAILGUN_API_KEY }}
-  NODEVERSION: 16.x
   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODEVERSION: 16.x
   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PROVIDER: mailgun
   PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
   PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
   PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 43d1e2a..69d07bb 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,18 +1,18 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
 env:
+  PROVIDER: mailgun
   DOTNETVERSION: |
-    6.0.x
-    3.1.301
+      6.0.x
+      3.1.301
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GOVERSION: 1.20.1
   JAVAVERSION: "11"
   MAILGUN_API_KEY: ${{ secrets.MAILGUN_API_KEY }}
-  NODEVERSION: 16.x
   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODEVERSION: 16.x
   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PROVIDER: mailgun
   PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
   PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
   PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
@@ -89,10 +89,10 @@ jobs:
     - name: Install plugins
       run: make install_plugins
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Set PACKAGE_VERSION to Env
       run: echo "PACKAGE_VERSION=$(pulumictl get version --language generic)" >>
-        $GITHUB_ENV
+        "$GITHUB_ENV"
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
@@ -166,11 +166,11 @@ jobs:
       run: cat ${{ env.COVERAGE_OUTPUT_DIR }}/shortSummary.txt
     - name: Upload coverage data to S3
       run: >-
-        summaryName="${PROVIDER}_summary_`date +"%Y-%m-%d_%H-%M-%S"`.json"
+        summaryName="${PROVIDER}_summary_$(date +"%Y-%m-%d_%H-%M-%S").json"
 
         s3FullURI="s3://${{ secrets.S3_COVERAGE_BUCKET_NAME }}/summaries/${summaryName}"
 
-        aws s3 cp ${{ env.COVERAGE_OUTPUT_DIR }}/summary.json ${s3FullURI} --acl bucket-owner-full-control
+        aws s3 cp "${{ env.COVERAGE_OUTPUT_DIR }}/summary.json" "${s3FullURI}" --acl bucket-owner-full-control
   lint:
     container: golangci/golangci-lint:v1.51
     name: lint
@@ -184,8 +184,7 @@ jobs:
         path: ci-scripts
         repository: pulumi/scripts
     - name: Mark repo as safe directory
-      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER
-        }}/pulumi-${{ env.PROVIDER }}
+      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER }}/pulumi-${{ env.PROVIDER }}
     - name: Unshallow clone for tags
       run: git fetch --prune --unshallow --tags
     - name: Install Go
@@ -220,8 +219,7 @@ jobs:
         path: ci-scripts
         repository: pulumi/scripts
     - name: Mark repo as safe directory
-      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER
-        }}/pulumi-${{ env.PROVIDER }}
+      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER }}/pulumi-${{ env.PROVIDER }}
     - name: Unshallow clone for tags
       run: git fetch --prune --unshallow --tags
     - name: Install Go
@@ -274,12 +272,13 @@ jobs:
       run: make provider
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
-      run: >-
-        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
-
-        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
-
-        echo 'EOF' >> $GITHUB_ENV
+      run: |
+        EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+        {
+          echo "SCHEMA_CHANGES<<$EOF";
+          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
+          echo "$EOF";
+        } >> "$GITHUB_ENV"
     - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
       name: Comment on PR with Details of Schema Check
       uses: thollander/actions-comment-pull-request@v2
@@ -341,8 +340,7 @@ jobs:
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
     - name: Set PreRelease Version
-      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)"
-        >> $GITHUB_ENV
+      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)" >> "$GITHUB_ENV"
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v2
       with:
@@ -362,7 +360,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Publish SDKs
-      uses: pulumi/pulumi-package-publisher@v0.0.6
+      uses: pulumi/pulumi-package-publisher@v0.0.7
     - env:
         SLACK_CHANNEL: provider-upgrade-publish-status
         SLACK_COLOR: "#FF0000"
@@ -445,7 +443,7 @@ jobs:
       run: tar -zxf ${{ github.workspace }}/sdk/${{ matrix.language }}.tar.gz -C ${{
         github.workspace }}/sdk/${{ matrix.language }}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Install Python deps
       run: |-
         pip3 install virtualenv==20.0.23
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index a8ccc43..55adaa1 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -1,18 +1,18 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
 env:
+  PROVIDER: mailgun
   DOTNETVERSION: |
-    6.0.x
-    3.1.301
+      6.0.x
+      3.1.301
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GOVERSION: 1.20.1
   JAVAVERSION: "11"
   MAILGUN_API_KEY: ${{ secrets.MAILGUN_API_KEY }}
-  NODEVERSION: 16.x
   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODEVERSION: 16.x
   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PROVIDER: mailgun
   PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
   PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
   PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
@@ -89,10 +89,10 @@ jobs:
     - name: Install plugins
       run: make install_plugins
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Set PACKAGE_VERSION to Env
       run: echo "PACKAGE_VERSION=$(pulumictl get version --language generic)" >>
-        $GITHUB_ENV
+        "$GITHUB_ENV"
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
@@ -166,11 +166,11 @@ jobs:
       run: cat ${{ env.COVERAGE_OUTPUT_DIR }}/shortSummary.txt
     - name: Upload coverage data to S3
       run: >-
-        summaryName="${PROVIDER}_summary_`date +"%Y-%m-%d_%H-%M-%S"`.json"
+        summaryName="${PROVIDER}_summary_$(date +"%Y-%m-%d_%H-%M-%S").json"
 
         s3FullURI="s3://${{ secrets.S3_COVERAGE_BUCKET_NAME }}/summaries/${summaryName}"
 
-        aws s3 cp ${{ env.COVERAGE_OUTPUT_DIR }}/summary.json ${s3FullURI} --acl bucket-owner-full-control
+        aws s3 cp "${{ env.COVERAGE_OUTPUT_DIR }}/summary.json" "${s3FullURI}" --acl bucket-owner-full-control
   lint:
     container: golangci/golangci-lint:v1.51
     name: lint
@@ -184,8 +184,7 @@ jobs:
         path: ci-scripts
         repository: pulumi/scripts
     - name: Mark repo as safe directory
-      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER
-        }}/pulumi-${{ env.PROVIDER }}
+      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER }}/pulumi-${{ env.PROVIDER }}
     - name: Unshallow clone for tags
       run: git fetch --prune --unshallow --tags
     - name: Install Go
@@ -220,8 +219,7 @@ jobs:
         path: ci-scripts
         repository: pulumi/scripts
     - name: Mark repo as safe directory
-      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER
-        }}/pulumi-${{ env.PROVIDER }}
+      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER }}/pulumi-${{ env.PROVIDER }}
     - name: Unshallow clone for tags
       run: git fetch --prune --unshallow --tags
     - name: Install Go
@@ -274,12 +272,13 @@ jobs:
       run: make provider
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
-      run: >-
-        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
-
-        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
-
-        echo 'EOF' >> $GITHUB_ENV
+      run: |
+        EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+        {
+          echo "SCHEMA_CHANGES<<$EOF";
+          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
+          echo "$EOF";
+        } >> "$GITHUB_ENV"
     - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
       name: Comment on PR with Details of Schema Check
       uses: thollander/actions-comment-pull-request@v2
@@ -341,8 +340,7 @@ jobs:
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
     - name: Set PreRelease Version
-      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)"
-        >> $GITHUB_ENV
+      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)" >> "$GITHUB_ENV"
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v2
       with:
@@ -362,7 +360,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Publish SDKs
-      uses: pulumi/pulumi-package-publisher@v0.0.6
+      uses: pulumi/pulumi-package-publisher@v0.0.7
     - env:
         SLACK_CHANNEL: provider-upgrade-publish-status
         SLACK_COLOR: "#FF0000"
@@ -445,7 +443,7 @@ jobs:
       run: tar -zxf ${{ github.workspace }}/sdk/${{ matrix.language }}.tar.gz -C ${{
         github.workspace }}/sdk/${{ matrix.language }}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Install Python deps
       run: |-
         pip3 install virtualenv==20.0.23
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index ad55323..2516d4f 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -1,19 +1,19 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
 env:
+  PROVIDER: mailgun
+  IS_PRERELEASE: true
   DOTNETVERSION: |
-    6.0.x
-    3.1.301
+      6.0.x
+      3.1.301
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GOVERSION: 1.20.1
-  IS_PRERELEASE: true
   JAVAVERSION: "11"
   MAILGUN_API_KEY: ${{ secrets.MAILGUN_API_KEY }}
-  NODEVERSION: 16.x
   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODEVERSION: 16.x
   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PROVIDER: mailgun
   PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
   PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
   PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
@@ -90,10 +90,10 @@ jobs:
     - name: Install plugins
       run: make install_plugins
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Set PACKAGE_VERSION to Env
       run: echo "PACKAGE_VERSION=$(pulumictl get version --language generic)" >>
-        $GITHUB_ENV
+        "$GITHUB_ENV"
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
@@ -134,8 +134,7 @@ jobs:
         path: ci-scripts
         repository: pulumi/scripts
     - name: Mark repo as safe directory
-      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER
-        }}/pulumi-${{ env.PROVIDER }}
+      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER }}/pulumi-${{ env.PROVIDER }}
     - name: Unshallow clone for tags
       run: git fetch --prune --unshallow --tags
     - name: Install Go
@@ -170,8 +169,7 @@ jobs:
         path: ci-scripts
         repository: pulumi/scripts
     - name: Mark repo as safe directory
-      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER
-        }}/pulumi-${{ env.PROVIDER }}
+      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER }}/pulumi-${{ env.PROVIDER }}
     - name: Unshallow clone for tags
       run: git fetch --prune --unshallow --tags
     - name: Install Go
@@ -224,12 +222,13 @@ jobs:
       run: make provider
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
-      run: >-
-        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
-
-        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
-
-        echo 'EOF' >> $GITHUB_ENV
+      run: |
+        EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+        {
+          echo "SCHEMA_CHANGES<<$EOF";
+          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
+          echo "$EOF";
+        } >> "$GITHUB_ENV"
     - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
       name: Comment on PR with Details of Schema Check
       uses: thollander/actions-comment-pull-request@v2
@@ -291,8 +290,7 @@ jobs:
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
     - name: Set PreRelease Version
-      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)"
-        >> $GITHUB_ENV
+      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)" >> "$GITHUB_ENV"
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v2
       with:
@@ -312,7 +310,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Publish SDKs
-      uses: pulumi/pulumi-package-publisher@v0.0.6
+      uses: pulumi/pulumi-package-publisher@v0.0.7
     - env:
         SLACK_CHANNEL: provider-upgrade-publish-status
         SLACK_COLOR: "#FF0000"
@@ -395,7 +393,7 @@ jobs:
       run: tar -zxf ${{ github.workspace }}/sdk/${{ matrix.language }}.tar.gz -C ${{
         github.workspace }}/sdk/${{ matrix.language }}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Install Python deps
       run: |-
         pip3 install virtualenv==20.0.23
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 54c190b..6d89140 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -1,18 +1,18 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
 env:
+  PROVIDER: mailgun
   DOTNETVERSION: |
-    6.0.x
-    3.1.301
+      6.0.x
+      3.1.301
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GOVERSION: 1.20.1
   JAVAVERSION: "11"
   MAILGUN_API_KEY: ${{ secrets.MAILGUN_API_KEY }}
-  NODEVERSION: 16.x
   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODEVERSION: 16.x
   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PROVIDER: mailgun
   PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
   PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
   PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 02d2a9a..79a11fa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,18 +1,18 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
 env:
+  PROVIDER: mailgun
   DOTNETVERSION: |
-    6.0.x
-    3.1.301
+      6.0.x
+      3.1.301
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GOVERSION: 1.20.1
   JAVAVERSION: "11"
   MAILGUN_API_KEY: ${{ secrets.MAILGUN_API_KEY }}
-  NODEVERSION: 16.x
   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODEVERSION: 16.x
   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PROVIDER: mailgun
   PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
   PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
   PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
@@ -89,10 +89,10 @@ jobs:
     - name: Install plugins
       run: make install_plugins
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Set PACKAGE_VERSION to Env
       run: echo "PACKAGE_VERSION=$(pulumictl get version --language generic)" >>
-        $GITHUB_ENV
+        "$GITHUB_ENV"
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
@@ -133,7 +133,7 @@ jobs:
         GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
       name: Dispatch Event
       run: pulumictl create docs-build pulumi-${{ env.PROVIDER }}
-        ${GITHUB_REF#refs/tags/}
+        "${GITHUB_REF#refs/tags/}"
   lint:
     container: golangci/golangci-lint:v1.51
     name: lint
@@ -147,8 +147,7 @@ jobs:
         path: ci-scripts
         repository: pulumi/scripts
     - name: Mark repo as safe directory
-      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER
-        }}/pulumi-${{ env.PROVIDER }}
+      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER }}/pulumi-${{ env.PROVIDER }}
     - name: Unshallow clone for tags
       run: git fetch --prune --unshallow --tags
     - name: Install Go
@@ -183,8 +182,7 @@ jobs:
         path: ci-scripts
         repository: pulumi/scripts
     - name: Mark repo as safe directory
-      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER
-        }}/pulumi-${{ env.PROVIDER }}
+      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER }}/pulumi-${{ env.PROVIDER }}
     - name: Unshallow clone for tags
       run: git fetch --prune --unshallow --tags
     - name: Install Go
@@ -237,12 +235,13 @@ jobs:
       run: make provider
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
-      run: >-
-        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
-
-        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
-
-        echo 'EOF' >> $GITHUB_ENV
+      run: |
+        EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+        {
+          echo "SCHEMA_CHANGES<<$EOF";
+          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
+          echo "$EOF";
+        } >> "$GITHUB_ENV"
     - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
       name: Comment on PR with Details of Schema Check
       uses: thollander/actions-comment-pull-request@v2
@@ -304,8 +303,7 @@ jobs:
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
     - name: Set PreRelease Version
-      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)"
-        >> $GITHUB_ENV
+      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)" >> "$GITHUB_ENV"
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v2
       with:
@@ -324,7 +322,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Publish SDKs
-      uses: pulumi/pulumi-package-publisher@v0.0.6
+      uses: pulumi/pulumi-package-publisher@v0.0.7
     - env:
         SLACK_CHANNEL: provider-upgrade-publish-status
         SLACK_COLOR: "#FF0000"
@@ -348,8 +346,8 @@ jobs:
       with:
         repo: pulumi/pulumictl
     - name: Add SDK version tag
-      run: git tag sdk/v$(pulumictl get version --language generic) && git push origin
-        sdk/v$(pulumictl get version --language generic)
+      run: git tag "sdk/v$(pulumictl get version --language generic)" && git push origin
+        "sdk/v$(pulumictl get version --language generic)"
   test:
     name: test
     needs: build_sdk
@@ -421,7 +419,7 @@ jobs:
       run: tar -zxf ${{ github.workspace }}/sdk/${{ matrix.language }}.tar.gz -C ${{
         github.workspace }}/sdk/${{ matrix.language }}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Install Python deps
       run: |-
         pip3 install virtualenv==20.0.23
diff --git a/.github/workflows/resync-build.yml b/.github/workflows/resync-build.yml
index 7915028..9341135 100644
--- a/.github/workflows/resync-build.yml
+++ b/.github/workflows/resync-build.yml
@@ -1,26 +1,26 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
 env:
+  PROVIDER: mailgun
+  PULUMI_EXTRA_MAPPING_ERROR: true
+  PULUMI_MISSING_MAPPING_ERROR: true
   DOTNETVERSION: |
-    6.0.x
-    3.1.301
+      6.0.x
+      3.1.301
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GOVERSION: 1.20.1
   JAVAVERSION: "11"
   MAILGUN_API_KEY: ${{ secrets.MAILGUN_API_KEY }}
-  NODEVERSION: 16.x
   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODEVERSION: 16.x
   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PROVIDER: mailgun
   PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
   PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
   PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
   PULUMI_API: https://api.pulumi-staging.io
-  PULUMI_EXTRA_MAPPING_ERROR: true
   PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
   PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  PULUMI_MISSING_MAPPING_ERROR: true
   PYPI_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
   PYTHONVERSION: "3.9"
   SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
@@ -43,8 +43,7 @@ jobs:
         repository: pulumi/ci-mgmt
     - id: run-url
       name: Create URL to the run output
-      run: echo ::set-output
-        name=run-url::https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID
+      run:  echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> "$GITHUB_OUTPUT"
     - name: Unshallow clone for tags
       run: git fetch --prune --unshallow --tags
     - name: Install Go
@@ -71,12 +70,12 @@ jobs:
       with:
         python-version: ${{ env.PYTHONVERSION }}
     - name: Sync with ci-mgmt
-      run: cp -r ci-mgmt/provider-ci/providers/$PROVIDER/repo/. .
+      run: cp -r "ci-mgmt/provider-ci/providers/$PROVIDER/repo/." .
     - name: Remove ci-mgmt directory
       run: rm -rf ci-mgmt
     - name: Required entries for gitignore
       run: |-
-        cat <<- EOF > $RUNNER_TEMP/gitignore
+        cat <<- EOF > "$RUNNER_TEMP/gitignore"
         sdk/java/build
         sdk/java/.gradle
         sdk/java/gradle
@@ -85,7 +84,10 @@ jobs:
         EOF
       shell: bash
     - name: Adding missing lines to .gitignore
-      run: comm -23 <(sort $RUNNER_TEMP/gitignore) <(sort .gitignore) >> .gitignore
+      run: |
+        comm -23 <(sort "$RUNNER_TEMP/gitignore") <(sort .gitignore) >> .gitignore.temp
+        cat .gitignore.temp >> .gitignore
+        rm .gitignore.temp
       shell: bash
     - name: Build
       run: make build
diff --git a/.github/workflows/run-acceptance-tests.yml b/.github/workflows/run-acceptance-tests.yml
index 77dd0b6..f2b9370 100644
--- a/.github/workflows/run-acceptance-tests.yml
+++ b/.github/workflows/run-acceptance-tests.yml
@@ -1,19 +1,19 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
 env:
+  PROVIDER: mailgun
+  PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }}
   DOTNETVERSION: |
-    6.0.x
-    3.1.301
+      6.0.x
+      3.1.301
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GOVERSION: 1.20.1
   JAVAVERSION: "11"
   MAILGUN_API_KEY: ${{ secrets.MAILGUN_API_KEY }}
-  NODEVERSION: 16.x
   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODEVERSION: 16.x
   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PROVIDER: mailgun
-  PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }}
   PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
   PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
   PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
@@ -94,10 +94,10 @@ jobs:
     - name: Install plugins
       run: make install_plugins
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Set PACKAGE_VERSION to Env
       run: echo "PACKAGE_VERSION=$(pulumictl get version --language generic)" >>
-        $GITHUB_ENV
+        "$GITHUB_ENV"
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
@@ -132,8 +132,7 @@ jobs:
     steps:
     - id: run-url
       name: Create URL to the run output
-      run: echo ::set-output
-        name=run-url::https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID
+      run: echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> "$GITHUB_OUTPUT"
     - name: Update with Result
       uses: peter-evans/create-or-update-comment@v1
       with:
@@ -158,8 +157,7 @@ jobs:
         path: ci-scripts
         repository: pulumi/scripts
     - name: Mark repo as safe directory
-      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER
-        }}/pulumi-${{ env.PROVIDER }}
+      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER }}/pulumi-${{ env.PROVIDER }}
     - name: Unshallow clone for tags
       run: git fetch --prune --unshallow --tags
     - name: Install Go
@@ -198,8 +196,7 @@ jobs:
         path: ci-scripts
         repository: pulumi/scripts
     - name: Mark repo as safe directory
-      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER
-        }}/pulumi-${{ env.PROVIDER }}
+      run: git config --global --add safe.directory /__w/pulumi-${{ env.PROVIDER }}/pulumi-${{ env.PROVIDER }}
     - name: Unshallow clone for tags
       run: git fetch --prune --unshallow --tags
     - name: Install Go
@@ -256,12 +253,13 @@ jobs:
       run: make provider
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
-      run: >-
-        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
-
-        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
-
-        echo 'EOF' >> $GITHUB_ENV
+      run: |
+        EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+        {
+          echo "SCHEMA_CHANGES<<$EOF";
+          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
+          echo "$EOF";
+        } >> "$GITHUB_ENV"
     - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
       name: Comment on PR with Details of Schema Check
       uses: thollander/actions-comment-pull-request@v2
@@ -380,7 +378,7 @@ jobs:
       run: tar -zxf ${{ github.workspace }}/sdk/${{ matrix.language }}.tar.gz -C ${{
         github.workspace }}/sdk/${{ matrix.language }}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Install Python deps
       run: |-
         pip3 install virtualenv==20.0.23
diff --git a/.github/workflows/update-bridge.yml b/.github/workflows/update-bridge.yml
index e2c241e..d95ee83 100644
--- a/.github/workflows/update-bridge.yml
+++ b/.github/workflows/update-bridge.yml
@@ -63,13 +63,11 @@ jobs:
         committer: pulumi-bot <bot@pulumi.com>
         labels: impact/no-changelog-required
         team-reviewers: platform-integrations
-        title: Update pulumi-terraform-bridge to v${{ github.event.inputs.bridge_version
-          }}
+        title: Update pulumi-terraform-bridge to v${{ github.event.inputs.bridge_version }}
         token: ${{ secrets.PULUMI_BOT_TOKEN }}
     - if: steps.create-pr.outputs.pull-request-operation == 'created' &&
         github.event.inputs.automerge == 'true'
-      run: gh pr merge --auto --squash ${{ steps.create-pr.outputs.pull-request-number
-        }}
+      run: gh pr merge --auto --squash ${{ steps.create-pr.outputs.pull-request-number }}
 name: Update pulumi-terraform-bridge
 on:
   workflow_dispatch:
diff --git a/Makefile b/Makefile
index 8d0305a..e2b752d 100644
--- a/Makefile
+++ b/Makefile
@@ -34,26 +34,26 @@ build_dotnet: upstream
 	pulumictl get version --language dotnet
 	$(WORKING_DIR)/bin/$(TFGEN) dotnet --out sdk/dotnet/
 	cd sdk/dotnet/ && \
-		echo "module fake_dotnet_module // Exclude this directory from Go tools\n\ngo 1.17" > go.mod && \
+		printf "module fake_dotnet_module // Exclude this directory from Go tools\n\ngo 1.17\n" > go.mod && \
 		echo "$(DOTNET_VERSION)" >version.txt && \
 		dotnet build /p:Version=$(DOTNET_VERSION)
 
 build_go: upstream
 	$(WORKING_DIR)/bin/$(TFGEN) go --out sdk/go/
-	cd sdk && go list `grep -e "^module" go.mod | cut -d ' ' -f 2`/go/... | xargs go build
+	cd sdk && go list "$$(grep -e "^module" go.mod | cut -d ' ' -f 2)/go/..." | xargs go build
 
 build_java: PACKAGE_VERSION := $(shell pulumictl get version --language generic)
 build_java: bin/pulumi-java-gen upstream
 	$(WORKING_DIR)/bin/$(JAVA_GEN) generate --schema provider/cmd/$(PROVIDER)/schema.json --out sdk/java  --build gradle-nexus
 	cd sdk/java/ && \
-		echo "module fake_java_module // Exclude this directory from Go tools\n\ngo 1.17" > go.mod && \
+		printf "module fake_java_module // Exclude this directory from Go tools\n\ngo 1.17\n" > go.mod && \
 		gradle --console=plain build
 
 build_nodejs: VERSION := $(shell pulumictl get version --language javascript)
 build_nodejs: upstream
 	$(WORKING_DIR)/bin/$(TFGEN) nodejs --out sdk/nodejs/
 	cd sdk/nodejs/ && \
-		echo "module fake_nodejs_module // Exclude this directory from Go tools\n\ngo 1.17" > go.mod && \
+		printf "module fake_nodejs_module // Exclude this directory from Go tools\n\ngo 1.17\n" > go.mod && \
 		yarn install && \
 		yarn run tsc && \
 		cp ../../README.md ../../LICENSE* package.json yarn.lock ./bin/ && \
@@ -63,7 +63,7 @@ build_python: PYPI_VERSION := $(shell pulumictl get version --language python)
 build_python: upstream
 	$(WORKING_DIR)/bin/$(TFGEN) python --out sdk/python/
 	cd sdk/python/ && \
-		echo "module fake_python_module // Exclude this directory from Go tools\n\ngo 1.17" > go.mod && \
+		printf "module fake_python_module // Exclude this directory from Go tools\n\ngo 1.17\n" > go.mod && \
 		cp ../../README.md . && \
 		python3 setup.py clean --all 2>/dev/null && \
 		rm -rf ./bin/ ../python.bin/ && cp -R . ../python.bin && mv ../python.bin ./bin && \
@@ -122,4 +122,4 @@ upstream.rebase:
 bin/pulumi-java-gen:
 	$(shell pulumictl download-binary -n pulumi-language-java -v $(JAVA_GEN_VERSION) -r pulumi/pulumi-java)
 
-.PHONY: development build build_sdks install_go_sdk install_java_sdk install_python_sdk install_sdks only_build build_dotnet build_go build_java build_nodejs build_python clean cleanup help install_dotnet_sdk install_nodejs_sdk install_plugins lint_provider provider test tfgen upstream upstream.finalize upstream.rebase
\ No newline at end of file
+.PHONY: development build build_sdks install_go_sdk install_java_sdk install_python_sdk install_sdks only_build build_dotnet build_go build_java build_nodejs build_python clean cleanup help install_dotnet_sdk install_nodejs_sdk install_plugins lint_provider provider test tfgen upstream upstream.finalize upstream.rebase
diff --git a/scripts/upstream.sh b/scripts/upstream.sh
index 494a184..14a4df4 100644
--- a/scripts/upstream.sh
+++ b/scripts/upstream.sh
@@ -1,8 +1,9 @@
+#
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
 set -e
 
-# $1 is the current make command being run.
+# "$1" is the current make command being run.
 # It is used to make the error message more actionable.
 err_rebase_in_progress() {
   cat <<EOF
@@ -14,7 +15,7 @@ complete the 'git rebase' in './upstream' and then run:
 If you want to abandon the rebase currently in progress and
 execute this target anyway, run:
 
-    rm rebase-in-progress && make $1
+    rm rebase-in-progress && make "$1"
 
 EOF
   exit 1
@@ -22,7 +23,7 @@ EOF
 
 assert_upstream() {
   if [ ! -d upstream ]; then
-    echo "No upstream directory detected. $1 does not make sense in this context."
+    echo "No upstream directory detected. \"$1\" does not make sense in this context."
     exit 1
   fi
 }
@@ -32,11 +33,11 @@ rebase_in_progress() {
   return $?
 }
 
-# $1 is the current make command being run.
+# "$1" is the current make command being run.
 # It is used to make the error message more actionable.
 assert_no_rebase_in_progress() {
   if rebase_in_progress; then
-     err_rebase_in_progress $1
+     err_rebase_in_progress "$1"
   fi
 }
 
@@ -68,29 +69,29 @@ This will finalize the changes you made back into the patch set.
 EOF
 }
 
-# $1 is the current make command being run.
+# "$1" is the current make command being run.
 # It is used to make the error message more actionable.
 start_rebase() {
-  assert_upstream
-  assert_no_rebase_in_progress $1
+  assert_upstream "$1"
+  assert_no_rebase_in_progress "$1"
 
   git submodule update --force --init
   rm -rf .git/modules/upstream/rebase-merge
   cd upstream && git fetch
 
   if [ -z "$TO" ]; then
-     echo '$TO not set, assuming TO is the upstream SHA currently committed.'
+     echo "\$TO not set, assuming TO is the upstream SHA currently committed."
   else
      git checkout "$TO"
   fi
 
   git branch -f local
-  git checkout -B pulumi-patch ${FROM}
+  git checkout -B pulumi-patch "${FROM}"
   git branch --set-upstream-to=local pulumi-patch
 
   for patch in ../patches/*.patch; do
     echo "Applying $patch"
-    if ! git apply --3way $patch; then
+    if ! git apply --3way "$patch"; then
       echo
       echo "Failed to apply patch. Please run 'make upstream.rebase FROM=$TAG' where '$TAG' allows the patch set to apply cleanly"
       echo
@@ -109,7 +110,7 @@ start_rebase() {
   fi
 }
 
-# $1 is the current make command being run.
+# "$1" is the current make command being run.
 # It is used to make the error message more actionable.
 assert_rebase_in_progress() {
   if ! rebase_in_progress; then
@@ -121,32 +122,32 @@ To start an upstream rebase, run
 
 If you are absolutly sure you are already in a rebase, run
 
-    touch rebase-in-progress && make $1
+    touch rebase-in-progress && make "$1"
 
 EOF
     exit 1
   fi
 }
 
-# $1 is the current make command being run.
+# "$1" is the current make command being run.
 # It is used to make the error message more actionable.
 apply() {
   assert_upstream
-  assert_no_rebase_in_progress $1
+  assert_no_rebase_in_progress "$1"
 
   git submodule update --force --init
   # Iterating over the patches folder in sorted order,
   # apply the patch using a 3-way merge strategy. This mirrors the default behavior of 'git merge'
   cd upstream
   for patch in ../patches/*.patch; do
-    if ! git apply --3way $patch; then
+    if ! git apply --3way "$patch"; then
       cat <<EOF
 
-make $1' failed to apply a patch. This is because there is a conflict between
+make "$1"' failed to apply a patch. This is because there is a conflict between
 the checked out version of upstream and the patch set. To resolve this conflict
 run:
 
-    FROM=$(echo '$LAST_KNOWN_GOOD_COMMIT') make upstream.rebase
+    FROM=\$LAST_KNOWN_GOOD_COMMIT make upstream.rebase
 
 This will walk you through resolving the conflict and producing a patch set that
 cleanly applies to the current upstream.
@@ -157,14 +158,14 @@ EOF
   done
 }
 
-# $1 is the current make command being run.
+# "$1" is the current make command being run.
 # It is used to make the error message more actionable.
 end_rebase() {
-  assert_rebase_in_progress $1
+  assert_rebase_in_progress "$1"
 
   if [ -d .git/modules/upstream/rebase-merge ]; then
     echo "rebase still in progress in './upstream'. Please resolve the rebase in"
-    echo "'./upstream' and then run 'make $1' again."
+    echo "'./upstream' and then run 'make \"$1\"' again."
     exit 1
   fi
 
@@ -176,13 +177,13 @@ end_rebase() {
 
 case $2 in
   apply)
-    apply $1
+    apply "$1"
     ;;
   start_rebase)
-    start_rebase $1
+    start_rebase "$1"
     ;;
   end_rebase)
-    end_rebase $1
+    end_rebase "$1"
     ;;
   *)
     cat <<EOF