diff --git a/.github/workflows/issue_close_question.yml b/.github/workflows/issue_close_question.yml
index c6190d53840..258e1ea6495 100644
--- a/.github/workflows/issue_close_question.yml
+++ b/.github/workflows/issue_close_question.yml
@@ -5,18 +5,42 @@ on:
     - cron: "0 0 */1 * *"
   workflow_dispatch:
 
+permissions:
+  issues: write
+
 jobs:
   close-need-info:
     runs-on: ubuntu-latest
     steps:
-      - name: close-issues
-        uses: actions-cool/issues-helper@v3
+      - name: Close inactive question issues
+        uses: actions/github-script@v7
         with:
-          actions: 'close-issues'
-          token: ${{ secrets.GITHUB_TOKEN }}
-          labels: 'question'
-          inactive-day: 3
-          close-reason: 'not_planned'
-          body: |
-            Hello @${{ github.event.issue.user.login }}, this issue was closed due to no activities in 3 days.
-            你好 @${{ github.event.issue.user.login }}，此issue因超过3天未回复被关闭。
\ No newline at end of file
+          script: |
+            const label = 'question';
+            const inactiveDays = 3;
+            const cutoff = Date.now() - inactiveDays * 24 * 60 * 60 * 1000;
+            const issues = await github.paginate(github.rest.issues.listForRepo, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              labels: label,
+              per_page: 100,
+            });
+            for (const issue of issues) {
+              if (issue.pull_request) continue;
+              if (new Date(issue.updated_at).getTime() > cutoff) continue;
+              const user = issue.user.login;
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                body: `Hello @${user}, this issue was closed due to no activities in 3 days.\n你好 @${user}，此issue因超过3天未回复被关闭。`,
+              });
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                state: 'closed',
+                state_reason: 'not_planned',
+              });
+            }
diff --git a/.github/workflows/issue_close_stale.yml b/.github/workflows/issue_close_stale.yml
index 9691f052e32..1ae1f413b35 100644
--- a/.github/workflows/issue_close_stale.yml
+++ b/.github/workflows/issue_close_stale.yml
@@ -5,17 +5,42 @@ on:
     - cron: "0 0 */7 * *"
   workflow_dispatch:
 
+permissions:
+  issues: write
+
 jobs:
   close-inactive:
     runs-on: ubuntu-latest
     steps:
-      - name: close-issues
-        uses: actions-cool/issues-helper@v3
+      - name: Close inactive stale issues
+        uses: actions/github-script@v7
         with:
-          actions: 'close-issues'
-          token: ${{ secrets.GITHUB_TOKEN }}
-          labels: 'stale'
-          inactive-day: 8
-          close-reason: 'not_planned'
-          body: |
-            Hello @${{ github.event.issue.user.login }}, this issue was closed due to inactive more than 52 days. You can reopen or recreate it if you think it should continue. Thank you for your contributions again.
\ No newline at end of file
+          script: |
+            const label = 'stale';
+            const inactiveDays = 8;
+            const cutoff = Date.now() - inactiveDays * 24 * 60 * 60 * 1000;
+            const issues = await github.paginate(github.rest.issues.listForRepo, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              labels: label,
+              per_page: 100,
+            });
+            for (const issue of issues) {
+              if (issue.pull_request) continue;
+              if (new Date(issue.updated_at).getTime() > cutoff) continue;
+              const user = issue.user.login;
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                body: `Hello @${user}, this issue was closed due to inactive more than 52 days. You can reopen or recreate it if you think it should continue. Thank you for your contributions again.`,
+              });
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                state: 'closed',
+                state_reason: 'not_planned',
+              });
+            }
diff --git a/.github/workflows/issue_duplicate.yml b/.github/workflows/issue_duplicate.yml
index 24238daa35e..2bf19b131ac 100644
--- a/.github/workflows/issue_duplicate.yml
+++ b/.github/workflows/issue_duplicate.yml
@@ -4,22 +4,29 @@ on:
   issues:
     types: [labeled]
 
+permissions:
+  issues: write
+
 jobs:
   create-comment:
     runs-on: ubuntu-latest
     if: github.event.label.name == 'duplicate'
     steps:
-      - name: Create comment
-        uses: actions-cool/issues-helper@v3
-        with:
-          actions: 'create-comment'
-          token: ${{ secrets.GITHUB_TOKEN }}
-          issue-number: ${{ github.event.issue.number }}
-          body: |
-            Hello @${{ github.event.issue.user.login }}, your issue is a duplicate and will be closed.
-            你好 @${{ github.event.issue.user.login }}，你的issue是重复的，将被关闭。
-      - name: Close issue
-        uses: actions-cool/issues-helper@v3
+      - name: Comment and close
+        uses: actions/github-script@v7
         with:
-          actions: 'close-issue'
-          token: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
+          script: |
+            const user = context.payload.issue.user.login;
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: `Hello @${user}, your issue is a duplicate and will be closed.\n你好 @${user}，你的issue是重复的，将被关闭。`,
+            });
+            await github.rest.issues.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              state: 'closed',
+              state_reason: 'not_planned',
+            });
diff --git a/.github/workflows/issue_invalid.yml b/.github/workflows/issue_invalid.yml
index fdb0ba8bb9b..8cd55fb8294 100644
--- a/.github/workflows/issue_invalid.yml
+++ b/.github/workflows/issue_invalid.yml
@@ -4,22 +4,29 @@ on:
   issues:
     types: [labeled]
 
+permissions:
+  issues: write
+
 jobs:
   create-comment:
     runs-on: ubuntu-latest
     if: github.event.label.name == 'invalid'
     steps:
-      - name: Create comment
-        uses: actions-cool/issues-helper@v3
-        with:
-          actions: 'create-comment'
-          token: ${{ secrets.GITHUB_TOKEN }}
-          issue-number: ${{ github.event.issue.number }}
-          body: |
-            Hello @${{ github.event.issue.user.login }}, your issue is invalid and will be closed.
-            你好 @${{ github.event.issue.user.login }}，你的issue无效，将被关闭。
-      - name: Close issue
-        uses: actions-cool/issues-helper@v3
+      - name: Comment and close
+        uses: actions/github-script@v7
         with:
-          actions: 'close-issue'
-          token: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
+          script: |
+            const user = context.payload.issue.user.login;
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: `Hello @${user}, your issue is invalid and will be closed.\n你好 @${user}，你的issue无效，将被关闭。`,
+            });
+            await github.rest.issues.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              state: 'closed',
+              state_reason: 'not_planned',
+            });
diff --git a/.github/workflows/issue_on_close.yml b/.github/workflows/issue_on_close.yml
index c90c2c0cb6d..f33423cc56b 100644
--- a/.github/workflows/issue_on_close.yml
+++ b/.github/workflows/issue_on_close.yml
@@ -4,14 +4,28 @@ on:
   issues:
     types: [closed]
 
+permissions:
+  issues: write
+
 jobs:
   rm-working:
     runs-on: ubuntu-latest
     steps:
       - name: Remove working label
-        uses: actions-cool/issues-helper@v3
+        uses: actions/github-script@v7
         with:
-          actions: 'remove-labels'
-          token: ${{ secrets.GITHUB_TOKEN }}
-          issue-number: ${{ github.event.issue.number }}
-          labels: 'working,pr-welcome'
+          script: |
+            const labels = ['working', 'pr-welcome'];
+            for (const name of labels) {
+              try {
+                await github.rest.issues.removeLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: context.issue.number,
+                  name,
+                });
+              } catch (e) {
+                // 404 means the label was not present on the issue; ignore it.
+                if (e.status !== 404) throw e;
+              }
+            }
diff --git a/.github/workflows/issue_question.yml b/.github/workflows/issue_question.yml
index 3b285ac04ac..9e7ce320b46 100644
--- a/.github/workflows/issue_question.yml
+++ b/.github/workflows/issue_question.yml
@@ -4,17 +4,22 @@ on:
   issues:
     types: [labeled]
 
+permissions:
+  issues: write
+
 jobs:
   create-comment:
     runs-on: ubuntu-latest
     if: github.event.label.name == 'question'
     steps:
       - name: Create comment
-        uses: actions-cool/issues-helper@v3.6.0
+        uses: actions/github-script@v7
         with:
-          actions: 'create-comment'
-          token: ${{ secrets.GITHUB_TOKEN }}
-          issue-number: ${{ github.event.issue.number }}
-          body: |
-            Hello @${{ github.event.issue.user.login }}, please input issue by template and add detail. Issues labeled by `question` will be closed if no activities in 3 days.
-            你好 @${{ github.event.issue.user.login }}，请按照issue模板填写, 并详细说明问题/日志记录/复现步骤/复现链接/实现思路或提供更多信息等, 3天内未回复issue自动关闭。
\ No newline at end of file
+          script: |
+            const user = context.payload.issue.user.login;
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: `Hello @${user}, please input issue by template and add detail. Issues labeled by \`question\` will be closed if no activities in 3 days.\n你好 @${user}，请按照issue模板填写, 并详细说明问题/日志记录/复现步骤/复现链接/实现思路或提供更多信息等, 3天内未回复issue自动关闭。`,
+            });
diff --git a/.github/workflows/issue_wontfix.yml b/.github/workflows/issue_wontfix.yml
index 316f6e4d4b1..546abb03e17 100644
--- a/.github/workflows/issue_wontfix.yml
+++ b/.github/workflows/issue_wontfix.yml
@@ -4,22 +4,29 @@ on:
   issues:
     types: [labeled]
 
+permissions:
+  issues: write
+
 jobs:
   lock-issue:
     runs-on: ubuntu-latest
     if: github.event.label.name == 'wontfix'
     steps:
-      - name: Create comment
-        uses: actions-cool/issues-helper@v3
-        with:
-          actions: 'create-comment'
-          token: ${{ secrets.GITHUB_TOKEN }}
-          issue-number: ${{ github.event.issue.number }}
-          body: |
-            Hello @${{ github.event.issue.user.login }}, this issue will not be worked on and will be closed.
-            你好 @${{ github.event.issue.user.login }}，这不会被处理，将被关闭。
-      - name: Close issue
-        uses: actions-cool/issues-helper@v3
+      - name: Comment and close
+        uses: actions/github-script@v7
         with:
-          actions: 'close-issue'
-          token: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
+          script: |
+            const user = context.payload.issue.user.login;
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: `Hello @${user}, this issue will not be worked on and will be closed.\n你好 @${user}，这不会被处理，将被关闭。`,
+            });
+            await github.rest.issues.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              state: 'closed',
+              state_reason: 'not_planned',
+            });
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2257826b064..8ab782bc49f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,13 @@ on:
   release:
     types: [ published ]
 
+# Re-publishing the same tag recreates the release (new id), which would leave
+# any in-flight run pointing at a deleted release id and fail with 404. Cancel
+# the stale run so only the newest publish for a given tag proceeds.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.release.tag_name }}
+  cancel-in-progress: true
+
 jobs:
   release:
     strategy:
diff --git a/.github/workflows/release_android.yml b/.github/workflows/release_android.yml
index 7e071cbe2ff..c6b13eea6db 100644
--- a/.github/workflows/release_android.yml
+++ b/.github/workflows/release_android.yml
@@ -4,6 +4,13 @@ on:
   release:
     types: [ published ]
 
+# Re-publishing the same tag recreates the release (new id), which would leave
+# any in-flight run pointing at a deleted release id and fail with 404. Cancel
+# the stale run so only the newest publish for a given tag proceeds.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.release.tag_name }}
+  cancel-in-progress: true
+
 jobs:
   release_android:
     strategy:
diff --git a/.github/workflows/release_freebsd.yml b/.github/workflows/release_freebsd.yml
index 70dcecb10f9..4a0a67bfedf 100644
--- a/.github/workflows/release_freebsd.yml
+++ b/.github/workflows/release_freebsd.yml
@@ -4,6 +4,13 @@ on:
   release:
     types: [ published ]
 
+# Re-publishing the same tag recreates the release (new id), which would leave
+# any in-flight run pointing at a deleted release id and fail with 404. Cancel
+# the stale run so only the newest publish for a given tag proceeds.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.release.tag_name }}
+  cancel-in-progress: true
+
 jobs:
   release_freebsd:
     strategy:
diff --git a/.github/workflows/release_linux_musl.yml b/.github/workflows/release_linux_musl.yml
index bb5291a9ac2..6172b643811 100644
--- a/.github/workflows/release_linux_musl.yml
+++ b/.github/workflows/release_linux_musl.yml
@@ -4,6 +4,13 @@ on:
   release:
     types: [ published ]
 
+# Re-publishing the same tag recreates the release (new id), which would leave
+# any in-flight run pointing at a deleted release id and fail with 404. Cancel
+# the stale run so only the newest publish for a given tag proceeds.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.release.tag_name }}
+  cancel-in-progress: true
+
 jobs:
   release_linux_musl:
     strategy:
diff --git a/.github/workflows/release_linux_musl_arm.yml b/.github/workflows/release_linux_musl_arm.yml
index 0e8a9618a76..27ed07e222e 100644
--- a/.github/workflows/release_linux_musl_arm.yml
+++ b/.github/workflows/release_linux_musl_arm.yml
@@ -4,6 +4,13 @@ on:
   release:
     types: [ published ]
 
+# Re-publishing the same tag recreates the release (new id), which would leave
+# any in-flight run pointing at a deleted release id and fail with 404. Cancel
+# the stale run so only the newest publish for a given tag proceeds.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.release.tag_name }}
+  cancel-in-progress: true
+
 jobs:
   release_linux_musl_arm:
     strategy: