diff --git a/.github/PklProject b/.github/PklProject
index 2813653c..75e83955 100644
--- a/.github/PklProject
+++ b/.github/PklProject
@@ -2,9 +2,9 @@ amends "pkl:Project"
 
 dependencies {
   ["pkl.impl.ghactions"] {
-    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0.7.1"
+    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.0.1"
   }
   ["gha"] {
-    uri = "package://pkg.pkl-lang.org/github.com/stefma/pkl-gha/com.github.action@0.0.6"
+    uri = "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.1.0"
   }
 }
diff --git a/.github/PklProject.deps.json b/.github/PklProject.deps.json
index 53cb0d2c..041e340c 100644
--- a/.github/PklProject.deps.json
+++ b/.github/PklProject.deps.json
@@ -1,18 +1,18 @@
 {
   "schemaVersion": 1,
   "resolvedDependencies": {
-    "package://pkg.pkl-lang.org/github.com/stefma/pkl-gha/com.github.action@0": {
+    "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/github.com/stefma/pkl-gha/com.github.action@0.0.6",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.1.0",
       "checksums": {
-        "sha256": "84365239996740252a91abab084d443aa3a3438f375b667ac16cb765461c1555"
+        "sha256": "efe5b1f58648baeac651e88107e13ceb58860c8e28ac18098b857445dc0185b7"
       }
     },
-    "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0": {
+    "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0.7.1",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.0.1",
       "checksums": {
-        "sha256": "f8efc4b174855a2fafdab8ed792de4b0cb89b0516d688c8540eea13af20e0f80"
+        "sha256": "f6fcf3e3e580520ad526b92274c373a78f4ced3d2b0dd52e422fc3e0847f307f"
       }
     }
   }
diff --git a/.github/index.pkl b/.github/index.pkl
index aae112c2..787cc966 100644
--- a/.github/index.pkl
+++ b/.github/index.pkl
@@ -196,27 +196,3 @@ release {
       }
     } |> toWorkflowJobs
 }
-
-output {
-  files {
-    [[true]] {
-      renderer {
-        converters {
-          ["jobs"] = (it: Mapping<String, Workflow.Job>) ->
-            it
-              .toMap()
-              .mapValues((name, job) ->
-                if (name.contains("linux") && !name.contains("alpine"))
-                  job
-                    .toMap()
-                    .put("container", new Dynamic {
-                      image = "redhat/ubi8:8.10"
-                    })
-                else
-                  job
-              )
-        }
-      }
-    }
-  }
-}
diff --git a/.github/jobs/BuildJavaExecutableJob.pkl b/.github/jobs/BuildJavaExecutableJob.pkl
index 2bef70fe..230d5879 100644
--- a/.github/jobs/BuildJavaExecutableJob.pkl
+++ b/.github/jobs/BuildJavaExecutableJob.pkl
@@ -1,7 +1,6 @@
 extends "GradleJob.pkl"
 
-import "@gha/actions/Artifact.pkl"
-import "@gha/actions/Common.pkl"
+import "@gha/catalog.pkl"
 
 // Keep this in sync with projects that build java executables
 local projects: List<String> = List("pkl-doc", "pkl-cli", "pkl-codegen-java", "pkl-codegen-kotlin")
@@ -17,13 +16,13 @@ local command =
   }.join(" ")
 
 steps {
-  new Common.Checkout {}
+  catalog.`actions/checkout@v6`
   new {
     name = "gradle build java executables"
     shell = "bash"
     run = command
   }
-  new Artifact.Upload {
+  (catalog.`actions/upload-artifact@v5`) {
     name = "Upload executable artifacts"
     with {
       name = "executable-java"
diff --git a/.github/jobs/BuildNativeJob.pkl b/.github/jobs/BuildNativeJob.pkl
index 00dca532..ce98185a 100644
--- a/.github/jobs/BuildNativeJob.pkl
+++ b/.github/jobs/BuildNativeJob.pkl
@@ -1,7 +1,7 @@
 extends "GradleJob.pkl"
 
-import "@gha/actions/Artifact.pkl"
-import "@gha/Context.pkl"
+import "@gha/catalog.pkl"
+import "@gha/context.pkl"
 
 /// Whether to link to musl. Otherwise, links to glibc.
 musl: Boolean(implies(module.os == "linux")) = false
@@ -12,7 +12,7 @@ project: String
 extraGradleArgs {
   when (os == "macOS" && arch == "amd64") {
     "-Dpkl.targetArch=\(module.arch)"
-    "-Dpkl.native--native-compiler-path=\(Context.github.workspace)/.github/scripts/cc_macos_amd64.sh"
+    "-Dpkl.native--native-compiler-path=\(context.github.workspace)/.github/scripts/cc_macos_amd64.sh"
   }
   when (musl) {
     "-Dpkl.musl=true"
@@ -48,7 +48,7 @@ steps {
     shell = "bash"
     run = "./gradlew \(module.gradleArgs) \(project):buildNative"
   }
-  new Artifact.Upload {
+  (catalog.`actions/upload-artifact@v5`) {
     name = "Upload executable artifacts"
     with {
       name =
@@ -62,3 +62,11 @@ steps {
     }
   }
 }
+
+fixed job {
+  when (os == "linux" && !musl) {
+    container {
+      image = "redhat/ubi8:8.10"
+    }
+  }
+}
diff --git a/.github/jobs/DeployJob.pkl b/.github/jobs/DeployJob.pkl
index 2db12c9a..bf2703d4 100644
--- a/.github/jobs/DeployJob.pkl
+++ b/.github/jobs/DeployJob.pkl
@@ -1,7 +1,6 @@
 extends "GradleJob.pkl"
 
-import "@gha/actions/Artifact.pkl"
-import "@gha/actions/Common.pkl"
+import "@gha/catalog.pkl"
 import "@gha/Workflow.pkl"
 import "@pkl.impl.ghactions/helpers.pkl"
 
@@ -14,8 +13,8 @@ arch = "amd64"
 os = "linux"
 
 steps {
-  new Common.Checkout {}
-  new Artifact.Download {
+  catalog.`actions/checkout@v6`
+  (catalog.`actions/download-artifact@v5`) {
     with {
       pattern = "executable-**"
       `merge-multiple` = true
diff --git a/.github/jobs/GithubRelease.pkl b/.github/jobs/GithubRelease.pkl
index 56a47683..05528eb1 100644
--- a/.github/jobs/GithubRelease.pkl
+++ b/.github/jobs/GithubRelease.pkl
@@ -2,8 +2,8 @@ module GithubRelease
 
 extends "PklJob.pkl"
 
-import "@gha/actions/Artifact.pkl"
-import "@gha/Context.pkl"
+import "@gha/catalog.pkl"
+import "@gha/context.pkl"
 
 fixed job {
   `runs-on` = "ubuntu-latest"
@@ -12,7 +12,7 @@ fixed job {
   }
   needs = "deploy-release"
   steps {
-    new Artifact.Download {
+    (catalog.`actions/download-artifact@v5`) {
       with {
         pattern = "executable-**"
         `merge-multiple` = true
@@ -21,10 +21,10 @@ fixed job {
     new {
       name = "Publish release on GitHub"
       env {
-        ["GH_TOKEN"] = Context.github.token
-        ["TAG_NAME"] = Context.github.refName
-        ["GIT_SHA"] = Context.github.sha
-        ["GH_REPO"] = Context.github.repository
+        ["GH_TOKEN"] = context.github.token
+        ["TAG_NAME"] = context.github.refName
+        ["GIT_SHA"] = context.github.sha
+        ["GH_REPO"] = context.github.repository
       }
       // language=bash
       run =
diff --git a/.github/jobs/GradleJob.pkl b/.github/jobs/GradleJob.pkl
index f6185fb9..8e3b1210 100644
--- a/.github/jobs/GradleJob.pkl
+++ b/.github/jobs/GradleJob.pkl
@@ -2,9 +2,8 @@ abstract module GradleJob
 
 extends "PklJob.pkl"
 
-import "@gha/actions/Common.pkl"
-import "@gha/actions/Setup.pkl"
 import "@gha/Workflow.pkl"
+import "@gha/catalog.pkl"
 
 /// Whether this is a release build or not.
 isRelease: Boolean = false
@@ -21,9 +20,9 @@ nightlyMacOS: Boolean(implies(os == "macOS")) = false
 
 extraGradleArgs: Listing<String>
 
-steps: Listing<*Workflow.Step | Workflow.TypedStep>
+steps: Listing<Workflow.Step>
 
-preSteps: Listing<*Workflow.Step | Workflow.TypedStep>
+preSteps: Listing<Workflow.Step>
 
 /// The fetch depth to use when doing a git checkout.
 fetchDepth: Int?
@@ -73,14 +72,14 @@ fixed job {
   steps {
     ...preSteps
     // full checkout (needed for spotless)
-    new Common.Checkout {
+    (catalog.`actions/checkout@v6`) {
       when (fetchDepth != null) {
         with {
           `fetch-depth` = fetchDepth
         }
       }
     }
-    new Setup.Java {
+    (catalog.`actions/setup-java@v5`) {
       with {
         `java-version` = "21"
         distribution = "temurin"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b05b8a1d..4e8b8ac3 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,6 +1,4 @@
-# Do not modify!
-# This file was generated from a template using https://github.com/StefMa/pkl-gha
-
+# Generated from Workflow.pkl. DO NOT EDIT.
 name: Build
 'on':
   push:
@@ -20,8 +18,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -51,8 +50,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -81,7 +81,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -96,8 +98,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -126,8 +129,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -135,7 +139,9 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: gradle build java executables
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
@@ -165,7 +171,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -200,7 +208,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -240,7 +250,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -275,7 +287,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -312,7 +326,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -419,7 +435,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -455,7 +473,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -490,7 +510,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -530,7 +552,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -565,7 +589,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -602,7 +628,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -709,7 +737,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -738,7 +768,7 @@ jobs:
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
   publish-test-results:
-    if: '!failure() && !cancelled()'
+    if: '!cancelled()'
     needs:
     - gradle-check
     - gradle-check-windows
@@ -760,7 +790,7 @@ jobs:
       checks: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@v5
       with:
         pattern: test-results-xml-*
     - name: Publish test results
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 29bfdb0f..5d09557d 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,6 +1,4 @@
-# Do not modify!
-# This file was generated from a template using https://github.com/StefMa/pkl-gha
-
+# Generated from Workflow.pkl. DO NOT EDIT.
 name: Build (main)
 'on':
   push:
@@ -19,8 +17,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -50,8 +49,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -80,7 +80,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -95,8 +97,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -125,8 +128,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -134,7 +138,9 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: gradle build java executables
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
@@ -164,7 +170,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -199,7 +207,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -239,7 +249,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -274,7 +286,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -311,7 +325,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -418,7 +434,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -454,7 +472,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -489,7 +509,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -529,7 +551,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -564,7 +588,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -601,7 +627,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -708,7 +736,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -760,15 +790,19 @@ jobs:
       LANG: en_US.UTF-8
     environment: maven-release
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
         cache: gradle
-    - uses: actions/checkout@v5
-    - uses: actions/download-artifact@v6
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+    - uses: actions/download-artifact@v5
       with:
         pattern: executable-**
         merge-multiple: true
@@ -780,7 +814,7 @@ jobs:
         ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEUSERNAME }}
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true --no-parallel publishToSonatype
   publish-test-results:
-    if: '!failure() && !cancelled()'
+    if: '!cancelled()'
     needs:
     - gradle-check
     - gradle-check-windows
@@ -802,7 +836,7 @@ jobs:
       checks: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@v5
       with:
         pattern: test-results-xml-*
     - name: Publish test results
diff --git a/.github/workflows/prb.yml b/.github/workflows/prb.yml
index 0eccc3e8..24859ecb 100644
--- a/.github/workflows/prb.yml
+++ b/.github/workflows/prb.yml
@@ -1,6 +1,4 @@
-# Do not modify!
-# This file was generated from a template using https://github.com/StefMa/pkl-gha
-
+# Generated from Workflow.pkl. DO NOT EDIT.
 name: Pull Request
 'on':
   pull_request: {}
@@ -15,8 +13,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -48,8 +47,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -82,7 +82,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -119,7 +121,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -160,7 +164,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -197,7 +203,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -236,7 +244,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -345,7 +355,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -382,7 +394,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -419,7 +433,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -460,7 +476,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -497,7 +515,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -536,7 +556,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -645,7 +667,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -686,7 +710,9 @@ jobs:
   check-pkl-github-actions:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: Setup Pkl
       id: setup-pkl
       env:
diff --git a/.github/workflows/release-branch.yml b/.github/workflows/release-branch.yml
index 3507cd70..73cdacb8 100644
--- a/.github/workflows/release-branch.yml
+++ b/.github/workflows/release-branch.yml
@@ -1,6 +1,4 @@
-# Do not modify!
-# This file was generated from a template using https://github.com/StefMa/pkl-gha
-
+# Generated from Workflow.pkl. DO NOT EDIT.
 name: Build (release branch)
 'on':
   push:
@@ -19,8 +17,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -50,8 +49,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -80,7 +80,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -95,8 +97,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -125,8 +128,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -134,7 +138,9 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: gradle build java executables
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
@@ -164,7 +170,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -199,7 +207,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -239,7 +249,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -274,7 +286,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -311,7 +325,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -418,7 +434,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -454,7 +472,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -489,7 +509,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -529,7 +551,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -564,7 +588,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -601,7 +627,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -708,7 +736,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -737,7 +767,7 @@ jobs:
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
   publish-test-results:
-    if: '!failure() && !cancelled()'
+    if: '!cancelled()'
     needs:
     - gradle-check
     - gradle-check-windows
@@ -759,7 +789,7 @@ jobs:
       checks: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@v5
       with:
         pattern: test-results-xml-*
     - name: Publish test results
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 934bd221..0bf40b7c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,6 +1,4 @@
-# Do not modify!
-# This file was generated from a template using https://github.com/StefMa/pkl-gha
-
+# Generated from Workflow.pkl. DO NOT EDIT.
 name: Release
 'on':
   push:
@@ -19,8 +17,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -50,8 +49,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -80,7 +80,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -95,8 +97,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -125,8 +128,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
+        persist-credentials: false
         fetch-depth: 0
     - uses: actions/setup-java@v5
       with:
@@ -134,7 +138,9 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - name: gradle build java executables
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
@@ -164,7 +170,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -199,7 +207,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -239,7 +249,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -274,7 +286,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -311,7 +325,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -418,7 +434,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -454,7 +472,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -489,7 +509,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -529,7 +551,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -564,7 +588,9 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -601,7 +627,9 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -708,7 +736,9 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
@@ -760,15 +790,19 @@ jobs:
       LANG: en_US.UTF-8
     environment: maven-release
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
     - uses: actions/setup-java@v5
       with:
         java-version: '21'
         distribution: temurin
         architecture: x64
         cache: gradle
-    - uses: actions/checkout@v5
-    - uses: actions/download-artifact@v6
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+    - uses: actions/download-artifact@v5
       with:
         pattern: executable-**
         merge-multiple: true
@@ -785,7 +819,7 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@v5
       with:
         pattern: executable-**
         merge-multiple: true
@@ -806,7 +840,7 @@ jobs:
           --notes "Release notes: https://pkl-lang.org/main/current/release-notes/changelog.html#release-${TAG_NAME}" \
           */build/executable/*
   publish-test-results:
-    if: '!failure() && !cancelled()'
+    if: '!cancelled()'
     needs:
     - gradle-check
     - gradle-check-windows
@@ -828,7 +862,7 @@ jobs:
       checks: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@v5
       with:
         pattern: test-results-xml-*
     - name: Publish test results
diff --git a/.github/workflows/test_report.yml b/.github/workflows/test_report.yml
index cfc4f762..5434cd11 100644
--- a/.github/workflows/test_report.yml
+++ b/.github/workflows/test_report.yml
@@ -1,6 +1,4 @@
-# Do not modify!
-# This file was generated from a template using https://github.com/StefMa/pkl-gha
-
+# Generated from Workflow.pkl. DO NOT EDIT.
 name: PR Test Reports
 'on':
   workflow_run:
@@ -24,7 +22,7 @@ jobs:
       with:
         path: artifacts
         name: test-results-.*
-        name_is_regex: true
+        name_is_regexp: true
         run_id: ${{ github.event.workflow_run.id }}
     - name: Publish test results
       uses: EnricoMi/publish-unit-test-result-action@v2