From 4d037c26d97100d1deab53590cd537f484219381 Mon Sep 17 00:00:00 2001
From: Josh Baird <jbaird@galileo.io>
Date: Wed, 6 May 2026 13:39:43 -0400
Subject: [PATCH 01/13] Add release-please config and CI.

Signed-off-by: Josh Baird <jbaird@galileo.io>
---
 .github/.release-please-manifest.json |  3 +++
 .github/release-please-config.json    | 21 +++++++++++++++++++++
 .github/workflows/release-please.yaml | 27 +++++++++++++++++++++++++++
 VERSION                               |  2 +-
 4 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 .github/.release-please-manifest.json
 create mode 100644 .github/release-please-config.json
 create mode 100644 .github/workflows/release-please.yaml

diff --git a/.github/.release-please-manifest.json b/.github/.release-please-manifest.json
new file mode 100644
index 000000000..2a266f81f
--- /dev/null
+++ b/.github/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "3.7.0"
+}
diff --git a/.github/release-please-config.json b/.github/release-please-config.json
new file mode 100644
index 000000000..bd20e761a
--- /dev/null
+++ b/.github/release-please-config.json
@@ -0,0 +1,21 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "simple",
+  "extra-files": [
+    {
+      "type": "yaml",
+      "path": "charts/fluent-operator/Chart.yaml",
+      "jsonpath": "$.appVersion"
+    },
+    {
+      "type": "yaml",
+      "path": "charts/fluent-operator-fluent-bit-crds/Chart.yaml",
+      "jsonpath": "$.appVersion"
+    },
+    {
+      "type": "yaml",
+      "path": "charts/fluent-operator-fluentd-crds/Chart.yaml",
+      "jsonpath": "$.appVersion"
+    }
+  ]
+}
diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
new file mode 100644
index 000000000..ace50dd7f
--- /dev/null
+++ b/.github/workflows/release-please.yaml
@@ -0,0 +1,27 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+    inputs:
+      release-as:
+        description: 'Override the next release version (e.g. 3.8.0). Leave empty for automatic versioning from conventional commits.'
+        required: false
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          config-file: .github/release-please-config.json
+          manifest-file: .github/.release-please-manifest.json
+          release-as: ${{ inputs.release-as }}
diff --git a/VERSION b/VERSION
index b9bc2fdcb..7c69a55db 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-latest
\ No newline at end of file
+3.7.0

From 6026045b4dba9accd1c5fa53df5469301b7ceec7 Mon Sep 17 00:00:00 2001
From: Josh Baird <jbaird@galileo.io>
Date: Wed, 6 May 2026 13:42:35 -0400
Subject: [PATCH 02/13] Add PR title linting.

Signed-off-by: Josh Baird <jbaird@galileo.io>
---
 .github/PULL_REQUEST_TEMPLATE.md     |  5 +++
 .github/workflows/pr-title-lint.yaml | 48 ++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 .github/workflows/pr-title-lint.yaml

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 30d38db80..3d144c48f 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,3 +1,8 @@
+<!--
+PR titles must follow Conventional Commits format: https://www.conventionalcommits.org
+Examples: feat: add X | fix: correct Y | chore: update Z | docs: improve W
+-->
+
 <!--
 Thank you for contributing to Fluent Operator!
 Your commits need to follow DCO: https://probot.github.io/apps/dco/
diff --git a/.github/workflows/pr-title-lint.yaml b/.github/workflows/pr-title-lint.yaml
new file mode 100644
index 000000000..8035ef0a7
--- /dev/null
+++ b/.github/workflows/pr-title-lint.yaml
@@ -0,0 +1,48 @@
+name: Lint PR Title
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - edited
+      - synchronize
+
+permissions:
+  pull-requests: write
+
+jobs:
+  lint:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        id: lint_pr_title
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+        if: always() && (steps.lint_pr_title.outputs.error_message != null)
+        with:
+          header: pr-title-lint-error
+          message: |
+            Thank you for your pull request! :wave:
+
+            Your PR title needs to follow the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) format so it can be included correctly in the changelog.
+
+            **Examples of valid titles:**
+            - `feat: add support for new filter plugin`
+            - `fix: correct nil pointer in controller reconcile`
+            - `chore: update dependencies`
+            - `docs: improve installation guide`
+
+            **Details:**
+            ```
+            ${{ steps.lint_pr_title.outputs.error_message }}
+            ```
+
+      - uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+        if: ${{ steps.lint_pr_title.outputs.error_message == null }}
+        with:
+          header: pr-title-lint-error
+          delete: true

From e04abafafdbabdcaa9a7f719e4f23f382dd8493a Mon Sep 17 00:00:00 2001
From: Josh Baird <jbaird@galileo.io>
Date: Wed, 6 May 2026 13:45:45 -0400
Subject: [PATCH 03/13] Add CI for publishing manifest assets.

Signed-off-by: Josh Baird <jbaird@galileo.io>
---
 .github/workflows/upload-release-assets.yaml | 33 ++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .github/workflows/upload-release-assets.yaml

diff --git a/.github/workflows/upload-release-assets.yaml b/.github/workflows/upload-release-assets.yaml
new file mode 100644
index 000000000..54cb1e81d
--- /dev/null
+++ b/.github/workflows/upload-release-assets.yaml
@@ -0,0 +1,33 @@
+name: Upload Release Assets
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+
+jobs:
+  upload-assets:
+    name: Upload setup.yaml
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.release.tag_name }}
+
+      - name: Read version
+        id: version
+        run: echo "version=$(cat VERSION)" >> $GITHUB_OUTPUT
+
+      - name: Stamp image tag in setup.yaml
+        run: |
+          sed -i \
+            's|ghcr.io/fluent/fluent-operator/fluent-operator:latest|ghcr.io/fluent/fluent-operator/fluent-operator:v${{ steps.version.outputs.version }}|g' \
+            manifests/setup/setup.yaml
+
+      - name: Upload setup.yaml to release
+        run: gh release upload "${{ github.event.release.tag_name }}" manifests/setup/setup.yaml --clobber
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 4211bba6b8697fd09e869cf345bd711fe823548c Mon Sep 17 00:00:00 2001
From: Josh Baird <jbaird@galileo.io>
Date: Wed, 6 May 2026 13:46:10 -0400
Subject: [PATCH 04/13] Remove legacy relese-tool.

Signed-off-by: Josh Baird <jbaird@galileo.io>
---
 .github/workflows/release-tool.yaml | 136 ----------------------------
 1 file changed, 136 deletions(-)
 delete mode 100644 .github/workflows/release-tool.yaml

diff --git a/.github/workflows/release-tool.yaml b/.github/workflows/release-tool.yaml
deleted file mode 100644
index fa9369119..000000000
--- a/.github/workflows/release-tool.yaml
+++ /dev/null
@@ -1,136 +0,0 @@
-name: Create Release Pull Request
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'New version number (e.g., v2.2.0)'
-        required: true
-        type: string
-
-jobs:
-  validate-and-prepare:
-    name: Validate Version and Prepare Variables
-    runs-on: ubuntu-latest
-    outputs:
-      release_branch: ${{ steps.set-branch.outputs.branch }}
-      version_without_v: ${{ steps.set-version.outputs.version }}
-    steps:
-      - name: Validate version format
-        run: |
-          if ! [[ ${{ github.event.inputs.version }} =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Invalid version format. Please use vX.Y.Z"
-            exit 1
-          fi
-
-      - name: Set version without 'v' prefix
-        id: set-version
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          VERSION_WITHOUT_V="${VERSION#v}"
-          echo "version=${VERSION_WITHOUT_V}" >> $GITHUB_OUTPUT
-
-      - name: Set branch name
-        id: set-branch
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          VERSION_WITHOUT_V="${VERSION#v}"
-          if [[ $VERSION_WITHOUT_V =~ ^([0-9]+\.[0-9]+)\.0$ ]]; then
-            # If version ends with .0, use X.Y format
-            BRANCH="release-${BASH_REMATCH[1]}"
-          else
-            # Otherwise use full X.Y.Z format
-            BRANCH="release-${VERSION_WITHOUT_V}"
-          fi
-          echo "branch=${BRANCH}" >> $GITHUB_OUTPUT
-
-  create-branches:
-    name: Create Release Branches
-    needs: validate-and-prepare
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Configure Git
-        run: |
-          git config user.name "GitHub Actions Bot"
-          git config user.email "actions@github.com"
-
-      - name: Create target release branch
-        run: |
-          git checkout -b ${{ needs.validate-and-prepare.outputs.release_branch }}
-          git push --set-upstream origin ${{ needs.validate-and-prepare.outputs.release_branch }}
-
-      - name: Create work branch
-        run: |
-          git checkout -b ${{ needs.validate-and-prepare.outputs.release_branch }}-work
-          git push --set-upstream origin ${{ needs.validate-and-prepare.outputs.release_branch }}-work
-
-  update-versions:
-    name: Update Version References
-    needs: [validate-and-prepare, create-branches]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ needs.validate-and-prepare.outputs.release_branch }}-work
-
-      - name: Configure Git
-        run: |
-          git config user.name "GitHub Actions Bot"
-          git config user.email "actions@github.com"
-
-      - name: Update manifest files
-        run: |
-          # Update deployment manifests
-          files=(
-            "manifests/setup/fluent-operator-deployment.yaml"
-            "manifests/setup/setup.yaml"
-          )
-          for file in "${files[@]}"; do
-            if [ -f "$file" ]; then
-              sed -i 's/fluent-operator:latest/fluent-operator:v${{ needs.validate-and-prepare.outputs.version_without_v }}/' "$file"
-            else
-              echo "Warning: File $file not found"
-              exit 1
-            fi
-          done
-
-      - name: Update Helm chart values
-        run: |
-          if [ -f "charts/fluent-operator/values.yaml" ]; then
-            sed -i '/repository: "kubesphere\/fluent-operator"/!b;n;s/tag: "latest"/tag: "v${{ needs.validate-and-prepare.outputs.version_without_v }}"/' charts/fluent-operator/values.yaml
-          else
-            echo "Error: values.yaml not found"
-            exit 1
-          fi
-
-      - name: Update VERSION file
-        run: |
-          echo "v${{ needs.validate-and-prepare.outputs.version_without_v }}" > VERSION
-
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v8
-        with:
-          commit-message: "Bump version to v${{ needs.validate-and-prepare.outputs.version_without_v }}"
-          signoff: true
-          title: "Release v${{ needs.validate-and-prepare.outputs.version_without_v }}"
-          body: |
-            ## Release v${{ needs.validate-and-prepare.outputs.version_without_v }}
-
-            This PR updates version references for the v${{ needs.validate-and-prepare.outputs.version_without_v }} release.
-
-            ### Changes
-            The following files have been updated:
-            - manifests/setup/fluent-operator-deployment.yaml
-            - manifests/setup/setup.yaml
-            - charts/fluent-operator/values.yaml
-            - VERSION
-
-            Please review the changes carefully before merging.
-          branch: ${{ needs.validate-and-prepare.outputs.release_branch }}-work
-          base: ${{ needs.validate-and-prepare.outputs.release_branch }}
-          labels: |
-            release

From d72fdb8603c9f7d1646639c72f1c0acb57403f89 Mon Sep 17 00:00:00 2001
From: Josh Baird <jbaird@galileo.io>
Date: Wed, 6 May 2026 13:55:09 -0400
Subject: [PATCH 05/13] Rename VERSION to version.txt for release-please
 compat.

Signed-off-by: Josh Baird <jbaird@galileo.io>
---
 .github/workflows/upload-release-assets.yaml | 2 +-
 Makefile                                     | 2 +-
 tests/scripts/fluentd_e2e.sh                 | 2 +-
 VERSION => version.txt                       | 0
 4 files changed, 3 insertions(+), 3 deletions(-)
 rename VERSION => version.txt (100%)

diff --git a/.github/workflows/upload-release-assets.yaml b/.github/workflows/upload-release-assets.yaml
index 54cb1e81d..34e4e12e2 100644
--- a/.github/workflows/upload-release-assets.yaml
+++ b/.github/workflows/upload-release-assets.yaml
@@ -19,7 +19,7 @@ jobs:
 
       - name: Read version
         id: version
-        run: echo "version=$(cat VERSION)" >> $GITHUB_OUTPUT
+        run: echo "version=$(cat version.txt)" >> $GITHUB_OUTPUT
 
       - name: Stamp image tag in setup.yaml
         run: |
diff --git a/Makefile b/Makefile
index fbce96dee..7c5e5d465 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@ MAKEFLAGS = --warn-undefined-variables
 SHELL = /usr/bin/env bash -o pipefail
 .SHELLFLAGS = -ec
 
-VERSION ?= $(shell cat VERSION | tr -d " \t\n\r")
+VERSION ?= $(shell cat version.txt | tr -d " \t\n\r")
 FB_VERSION?=$(shell grep -v '^#' cmd/fluent-watcher/fluentbit/VERSION | tr -d " \t\n\r")
 # Image URL to use all building/pushing image targets
 FB_IMG ?= ghcr.io/fluent/fluent-operator/fluent-bit:v${FB_VERSION}
diff --git a/tests/scripts/fluentd_e2e.sh b/tests/scripts/fluentd_e2e.sh
index 81ac8cbe8..36349f772 100755
--- a/tests/scripts/fluentd_e2e.sh
+++ b/tests/scripts/fluentd_e2e.sh
@@ -12,7 +12,7 @@ PROJECT_ROOT="$PWD"
 E2E_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 LOGGING_NAMESPACE="fluent"
 IMAGE_TAG="$(date "+%Y-%m-%d-%H-%M-%S")"
-VERSION="$(tr -d " \t\n\r" < VERSION)"
+VERSION="$(tr -d " \t\n\r" < version.txt)"
 IMAGE_NAME="ghcr.io/fluent/fluent-operator/fluent-operator"
 KIND_CLUSTER="${KIND_CLUSTER:-fluent-operator-test-e2e}"
 
diff --git a/VERSION b/version.txt
similarity index 100%
rename from VERSION
rename to version.txt

From 4f6468722f07f6b2900599083051f6d21e511364 Mon Sep 17 00:00:00 2001
From: Josh Baird <jbaird@galileo.io>
Date: Wed, 6 May 2026 14:28:06 -0400
Subject: [PATCH 06/13] Update RELEASE.md

Signed-off-by: Josh Baird <jbaird@galileo.io>
---
 RELEASE.md | 116 +++++++++++++++++------------------------------------
 1 file changed, 37 insertions(+), 79 deletions(-)

diff --git a/RELEASE.md b/RELEASE.md
index 358253188..719f90341 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -51,106 +51,64 @@ This page describes the release process and the currently planned schedule for u
 | v3.6.0         | 2025-10-24            | Josh Baird (GitHub: @joshuabaird)       |
 | v3.7.0         | 2026-02-27            | Josh Baird (GitHub: @joshuabaird)       |
 
-
-### How to cut a new release
-
-> This guide is strongly based on the [Prometheus release instructions](https://github.com/prometheus/prometheus/blob/master/RELEASE.md).
-
-### Branch management and versioning strategy
+## Versioning strategy
 
 We use [Semantic Versioning](http://semver.org/).
 
-We maintain a separate branch for each minor release, named `release-<major>.<minor>`, e.g. `release-1.1`, `release-2.0`.
-
-The usual flow is to merge new features and changes into the master branch and to merge bug fixes into the latest release branch. Bug fixes are then merged into master from the latest release branch. The master branch should always contain all commits from the latest release branch.
-
-If a bug fix got accidentally merged into master, cherry-pick commits have to be created in the latest release branch, which then have to be merged back into master. Try to avoid that situation.
-
-Maintaining the release branches for older minor releases happens on a best effort basis.
-
-### Prepare your release
-
-For a new major or minor release, work from the `main` branch. For a patch release, work in the branch of the minor release you want to patch (e.g. `release-0.1` if you're releasing `v0.1.1`).
+Version bumps are driven automatically by [Conventional Commits](https://www.conventionalcommits.org/) in PR titles:
 
-Add an entry for the new version to the `CHANGELOG.md` file. Entries in the `CHANGELOG.md` should be in this order:
+| Commit prefix | Effect |
+|---|---|
+| `feat:` | Minor version bump |
+| `fix:` | Patch version bump |
+| `feat!:` or `BREAKING CHANGE:` | Major version bump |
+| `chore:`, `docs:`, `ci:`, etc. | No version bump (excluded from changelog) |
 
-- `[CHANGE]`
-- `[FEATURE]`
-- `[ENHANCEMENT]`
-- `[BUGFIX]`
+## How to cut a new release
 
-Create a PR for the changes to be reviewed.
+Releases are fully automated via [release-please](https://github.com/googleapis/release-please-action). The only human action required is **merging the Release PR**.
 
-### Publish the new release
+### Minor and major releases
 
-For new minor and major releases, create the `release-<major>.<minor>` branch starting at the PR merge commit.
-From now on, all work happens on the `release-<major>.<minor>` branch.
+1. As PRs merge to `master`, release-please continuously updates a **Release PR** that accumulates the changelog and bumps `version.txt` and all `Chart.yaml` `appVersion` fields.
+2. When you are ready to ship, review the Release PR — edit the changelog body if needed — and merge it.
+3. release-please automatically pushes the git tag and creates the GitHub Release.
+4. The [`build-op-image`](./github/workflows/build-op-image.yaml) workflow fires on the tag and builds and pushes multi-arch operator images to GHCR and Docker Hub.
+5. The [`upload-release-assets`](.github/workflows/upload-release-assets.yaml) workflow fires on the release publication and attaches `setup.yaml` (with the correct image tag stamped in) as a release asset.
 
-Bump the version in the `VERSION` file in the root of the repository.
+To force a specific version instead of the auto-calculated one, dispatch the [Release Please](https://github.com/fluent/fluent-operator/actions/workflows/release-please.yaml) workflow manually with the `release-as` input set to the desired version (e.g. `3.8.0`).
 
-Regenerate setup.yaml based on latest code and then commit the changed bundle.yaml to the `release-<major>.<minor>` branch:
+### Patch releases
 
-```bash
-make manifests
-git add ./
-git commit -s -m "regenerate setup.yaml"
-git push
-```
+For a patch release against an older minor line (e.g. `v3.7.1`):
 
-Images will be automatically built and pushed whenever code changes or a tag is created. If users want to build images manually, use the following command:
+1. Create a `release-3.7` branch from the `v3.7.0` tag if it does not already exist.
+2. Cherry-pick the relevant fix commits onto that branch.
+3. Dispatch the [Release Please](https://github.com/fluent/fluent-operator/actions/workflows/release-please.yaml) workflow targeting the `release-3.7` branch with `release-as: 3.7.1`.
+4. Review and merge the resulting Release PR on the `release-3.7` branch.
+5. Cherry-pick the fix commits back into `master` if they are not already there.
 
-```bash
-make build-op-amd64 -e FO_IMG=<image of fluent operator>
-docker push <image of fluent operator>
-make build-fb-amd64 -e FB_IMG=<image of fluent bit>
-docker push <image of fluent bit>
-make build-fd-amd64 -e FD_IMG=<image of fluentd>
-docker push <image of fluentd>
-```
+### Publish updated Helm chart
 
-Tag the new release with a tag named `v<major>.<minor>.<patch>`, e.g. `v2.1.3`. Note the `v` prefix. You can do the tagging on the commandline:
+The `appVersion` fields in the three chart `Chart.yaml` files in this repo are bumped automatically by the Release PR. After merging the Release PR, the chart still needs to be manually synced to [fluent/helm-charts](https://github.com/fluent/helm-charts/tree/main/charts/fluent-operator/) where users install from:
 
-```bash
-tag="$(< VERSION)"
-git tag -a "${tag}" -m "${tag}"
-git push origin "${tag}"
-```
+- Copy the updated `charts/fluent-operator/` directory to a branch in `fluent/helm-charts`
+- Bump the chart `version` field (separate from `appVersion`) per the helm-charts versioning convention
+- Open a PR in `fluent/helm-charts`
 
-Commit all the changes.
-
-Finally, create a new release:
-
-- Go to https://github.com/fluent/fluent-operator/releases/new.
-- Associate the new release with the previously pushed tag.
-- Add release notes based on `CHANGELOG.md`.
-- Add file `setup.yaml` from `manifests/setup/setup.yaml` and then click "Publish release".
-
-For patch releases, cherry-pick the commits from the release branch into the master branch.
-
-#### Publish updated Helm chart
-
-This repo includes a "development" chart in the [charts/](./charts/fluent-operator/) directory. For each release, this chart must be published to the [fluent/helm-charts](https://github.com/fluent/helm-charts/tree/main/charts/fluent-operator/) repository which is where Fluent Operators install the chart from. This is currently a manual process. Follow these instructions to update and publish the chart:
-
-- Bump `version` and `appVersion` in the [charts/fluent-operator/Chart.yaml](./charts/fluent-operator/Chart.yaml) file in this repo
-- Bump `version` and `appVersion` in the [charts/fluent-operator/charts/fluent-bit-crds/Chart.yaml](./charts/fluent-operator/charts/fluent-bit-crds/Chart.yaml) and [charts/fluent-operator/charts/fluentd-crds/Chart.yaml](./charts/fluent-operator/charts/fluentd-crds/Chart.yaml) directory
-- Bump the `fluent-bit-crds` and `fluentd-crds` version under `dependencies` in [charts/fluent-operator/Chart.yaml](./charts/fluent-operator/Chart.yaml)
-- Manually "sync" (copy, open a PR) the local [chart](./charts/fluent-operator) to [fluent/helm-charts](https://github.com/fluent/helm-charts/tree/main/charts/fluent-operator/)
+Do the same for the `fluent-operator-fluentd-crds` and `fluent-operator-fluent-bit-crds` charts.
 
 ## Fluentd/Fluent-bit Images
 
-Fluent Operator uses [custom builds](./cmd/fluent-watcher/README.md) of both Fluentd and Fluent-bit.  These images can (and often should be) be published out-of-band of Fluent Operator releases.
+Fluent Operator uses [custom builds](./cmd/fluent-watcher/README.md) of both Fluentd and Fluent Bit. These images can (and often should) be published out-of-band of Fluent Operator releases.
 
-### Fluent-bit
+### Fluent Bit
 
-To publish a new fluent-bit image:
-
-* Execute the [bump-fluent-bit-version](https://github.com/fluent/fluent-operator/actions/workflows/bump-fluent-bit-version.yaml) workflow dispatch to generate a PR to update fluent-bit version references in this repo
-* Merge the PR generated by the [bump-fluent-bit-version](https://github.com/fluent/fluent-operator/actions/workflows/bump-fluent-bit-version.yaml) workflow. (This will [automatically trigger the release](https://github.com/fluent/fluent-operator/blob/master/.github/workflows/build-fluentbit-image.yaml#L4-L8) of the new fluent-bit image)
+1. Execute the [bump-fluent-bit-version](https://github.com/fluent/fluent-operator/actions/workflows/bump-fluent-bit-version.yaml) workflow dispatch to generate a PR updating all Fluent Bit version references in this repo.
+2. Merge the PR. This automatically triggers the [build-fluentbit-image](https://github.com/fluent/fluent-operator/actions/workflows/build-fluentbit-image.yaml) workflow which builds and pushes the new image.
 
 ### Fluentd
 
-To publish a new fluentd image:
-
-* Open a PR to update all references of the image/tag in this repo with the new image tag (TODO: automate this like the fluent-bit release process) including the `cmd/fluent-watcher/fluentd/VERSION` file
-* Merge the PR
-* Execute the [publish-fluentd-image](https://github.com/fluent/fluent-operator/actions/workflows/publish-fluentd-image.yaml) workflow dispatch to build and publish the new image
+1. Open a PR updating all references to the image tag in this repo, including `cmd/fluent-watcher/fluentd/VERSION`.
+2. Merge the PR.
+3. Execute the [publish-fluentd-image](https://github.com/fluent/fluent-operator/actions/workflows/publish-fluentd-image.yaml) workflow dispatch to build and push the new image.

From 5a7925adf7553275bcef626928cc73742fa87967 Mon Sep 17 00:00:00 2001
From: Josh Baird <jbaird@galileo.io>
Date: Wed, 6 May 2026 14:30:05 -0400
Subject: [PATCH 07/13] Update install docs in README.

Signed-off-by: Josh Baird <jbaird@galileo.io>
---
 README.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 5f132a46c..71826df73 100644
--- a/README.md
+++ b/README.md
@@ -133,9 +133,9 @@ Kubernetes v1.16.13+ is necessary for running Fluent Operator.
 Install the latest stable version
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/fluent/fluent-operator/release-3.7/manifests/setup/setup.yaml
+kubectl apply -f https://github.com/fluent/fluent-operator/releases/latest/download/setup.yaml
 
-# You can change the namespace in manifests/setup/kustomization.yaml in corresponding release branch
+# You can change the namespace in manifests/setup/kustomization.yaml
 # and then use command below to install to another namespace
 # kubectl kustomize manifests/setup/ | kubectl apply -f -
 ```
@@ -143,7 +143,7 @@ kubectl apply -f https://raw.githubusercontent.com/fluent/fluent-operator/releas
 Install the development version
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/fluent/fluentbit-operator/master/manifests/setup/setup.yaml
+kubectl apply -f https://raw.githubusercontent.com/fluent/fluent-operator/master/manifests/setup/setup.yaml
 
 # You can change the namespace in manifests/setup/kustomization.yaml
 # and then use command below to install to another namespace

From 8ec8f8b34728ef346ad2f2813ef09fd60596e73e Mon Sep 17 00:00:00 2001
From: Josh Baird <jbaird@galileo.io>
Date: Wed, 6 May 2026 14:30:28 -0400
Subject: [PATCH 08/13] Remove legacy docker build job.

Signed-off-by: Josh Baird <jbaird@galileo.io>
---
 .github/workflows/main.yaml | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index de29bc1b7..66940f4e9 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -134,22 +134,3 @@ jobs:
 
       - name: Run build all binaries
         run: make binary
-
-  # docker-build:
-  #   runs-on: ubuntu-22.04
-  #   timeout-minutes: 30
-  #   name: Docker amd64 build
-  #   steps:
-  #     - name: Checkout code
-  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-  #       with:
-  #         fetch-depth: 0
-
-  #     - name: Install Go
-  #       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-  #       with:
-  #         go-version-file: go.mod
-  #         cache-dependency-path: go.sum
-
-  #     - name: Run docker build
-  #       run: make build-amd64

From 55357dfd737c0b0fd33c2fbd40f43751632ff25a Mon Sep 17 00:00:00 2001
From: Josh Baird <jbaird@galileo.io>
Date: Fri, 8 May 2026 08:41:46 -0400
Subject: [PATCH 09/13] Harden PR lint workflow.

Signed-off-by: Josh Baird <jbaird@galileo.io>
---
 .github/workflows/pr-title-lint.yaml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pr-title-lint.yaml b/.github/workflows/pr-title-lint.yaml
index 8035ef0a7..c433d82d0 100644
--- a/.github/workflows/pr-title-lint.yaml
+++ b/.github/workflows/pr-title-lint.yaml
@@ -1,20 +1,26 @@
 name: Lint PR Title
 
 on:
+  # This workflow uses pull_request_target because it needs "pull_request: write" to
+  # post comments (not possible with pull_request).
+  #
+  # WARNING!
+  # We MJST ensure that code is NEVER checked out (eg, actions/checkout) in this
+  # workflow, otherwise it opens up a path for attacker-controlled PR code execution!
   pull_request_target:
     types:
       - opened
       - reopened
       - edited
-      - synchronize
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 jobs:
   lint:
     name: Validate PR title
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         id: lint_pr_title

From e5701355a91b646bc845a7da159d7d798d9ac459 Mon Sep 17 00:00:00 2001
From: Josh Baird <jbaird@galileo.io>
Date: Fri, 8 May 2026 08:47:29 -0400
Subject: [PATCH 10/13] Fix typo.

Signed-off-by: Josh Baird <jbaird@galileo.io>
---
 .github/workflows/pr-title-lint.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pr-title-lint.yaml b/.github/workflows/pr-title-lint.yaml
index c433d82d0..7fb2cd919 100644
--- a/.github/workflows/pr-title-lint.yaml
+++ b/.github/workflows/pr-title-lint.yaml
@@ -5,7 +5,7 @@ on:
   # post comments (not possible with pull_request).
   #
   # WARNING!
-  # We MJST ensure that code is NEVER checked out (eg, actions/checkout) in this
+  # We MUST ensure that code is NEVER checked out (eg, actions/checkout) in this
   # workflow, otherwise it opens up a path for attacker-controlled PR code execution!
   pull_request_target:
     types:

From c38797dbfd8f20065ee379619cdf21133f51668d Mon Sep 17 00:00:00 2001
From: Josh Baird <jbaird@galileo.io>
Date: Fri, 8 May 2026 08:56:02 -0400
Subject: [PATCH 11/13] Add CODEOWNERS.

Signed-off-by: Josh Baird <jbaird@galileo.io>
---
 .github/CODEOWNERS | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 .github/CODEOWNERS

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 000000000..f8a5d9c9e
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,16 @@
+# Fluent Operator Code Owners
+# ----------------------
+# The following file list the code owners or responsibles for code
+# review on different components or extensions of Fluent Bit, applicable for
+# any original code author (not only maintainers).
+#
+# NOTE: if you are a original code author and you are not listed here, please
+# open a PR with the proper modification :)
+
+# CI
+# ------------------------------------
+/.github/ @joshuabaird @benjaminhuo @cw-Guo @marcofranssen @wanjunlei
+
+# CODEOWNERS
+# ------------------------------------
+.github/CODEOWNERS  @joshuabaird @benjaminhuo @cw-Guo @marcofranssen @wanjunlei

From afa4eeb75cbe0ad5d07e7e113e040187ae6da80f Mon Sep 17 00:00:00 2001
From: Josh Baird <jbaird@galileo.io>
Date: Fri, 8 May 2026 09:06:02 -0400
Subject: [PATCH 12/13] Add actionlint to CI.

Signed-off-by: Josh Baird <jbaird@galileo.io>
---
 .github/workflows/lint.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 416150c0b..fd4d536fc 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,10 +4,14 @@ on:
   push:
   pull_request:
 
+permissions: {}
+
 jobs:
   lint:
     name: Run on Ubuntu
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Clone the code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -21,3 +25,15 @@ jobs:
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
           version: v2.11.4
+
+  actionlint:
+    name: Lint GitHub Actions workflows
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Run actionlint
+        uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12

From 9c0ff836e2efe4a7d8a286881815262af118dedb Mon Sep 17 00:00:00 2001
From: Josh Baird <jbaird@galileo.io>
Date: Fri, 8 May 2026 10:39:51 -0400
Subject: [PATCH 13/13] Fix actionlint failures.

Signed-off-by: Josh Baird <jbaird@galileo.io>
---
 .github/workflows/build-fluentbit-image.yaml   | 16 +++++++++-------
 .github/workflows/build-fluentd-image.yaml     | 14 ++++++++------
 .github/workflows/build-op-image.yaml          |  2 +-
 .github/workflows/bump-fluent-bit-version.yaml |  9 +++------
 .github/workflows/lint-test.yaml               |  2 +-
 .github/workflows/main.yaml                    |  3 ++-
 .github/workflows/upload-release-assets.yaml   |  2 +-
 7 files changed, 25 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/build-fluentbit-image.yaml b/.github/workflows/build-fluentbit-image.yaml
index be40fc6ed..9f518a0a8 100644
--- a/.github/workflows/build-fluentbit-image.yaml
+++ b/.github/workflows/build-fluentbit-image.yaml
@@ -37,9 +37,9 @@ jobs:
         run: |
           VERSION=$(cat cmd/fluent-watcher/fluentbit/VERSION)  # Read the version from the VERSION file
           VERSION_WITHOUT_V=${VERSION#v}
-          MAJOR_MINOR=$(echo $VERSION_WITHOUT_V | cut -d. -f1-2)
+          MAJOR_MINOR=$(echo "$VERSION_WITHOUT_V" | cut -d. -f1-2)
 
-          if skopeo inspect docker://${{ env.GHCR_REPO }}:${VERSION}; then
+          if skopeo inspect "docker://${{ env.GHCR_REPO }}:${VERSION}"; then
             echo "${VERSION} tag already exists, assuming we're building a patch release!"
             LATEST_PATCH_VERSION=$(skopeo list-tags docker://${{ env.GHCR_REPO }} | grep -E "${VERSION}-[0-9]+" | sort | uniq | tail -1 | tr -d \" | cut -d'-' -f2 | tr -d ',')
             NEW_PATCH_VERSION=$((LATEST_PATCH_VERSION + 1))
@@ -50,9 +50,11 @@ jobs:
             IMAGE_BASE_TAG="${VERSION}"
           fi
 
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "image-base-tag=$IMAGE_BASE_TAG" >> $GITHUB_OUTPUT
-          echo "image-major-minor=$MAJOR_MINOR" >> $GITHUB_OUTPUT
+          {
+            echo "version=$VERSION"
+            echo "image-base-tag=$IMAGE_BASE_TAG"
+            echo "image-major-minor=$MAJOR_MINOR"
+          } >> "$GITHUB_OUTPUT"
 
   build-tags:
     name: Get image tags
@@ -157,7 +159,7 @@ jobs:
           platform="${{ matrix.platform }}"
           # Convert "linux/amd64" or "linux/arm64" to just amd64 or arm64 for the output variable name
           arch=${platform#linux/}
-          echo "${arch}=${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT
+          echo "${arch}=${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"
 
   build-debug:
     name: Build/push debug image (${{ matrix.platform }})
@@ -219,7 +221,7 @@ jobs:
           platform="${{ matrix.platform }}"
           # Convert "linux/amd64" to just amd64 for the output variable name
           arch=${platform#linux/}
-          echo "${arch}=${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT
+          echo "${arch}=${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"
 
   manifest:
     name: Publish image manifests
diff --git a/.github/workflows/build-fluentd-image.yaml b/.github/workflows/build-fluentd-image.yaml
index 1cea71291..b9d15dfc6 100644
--- a/.github/workflows/build-fluentd-image.yaml
+++ b/.github/workflows/build-fluentd-image.yaml
@@ -27,7 +27,7 @@ jobs:
         id: get-version
         run: |
           VERSION=$(cat cmd/fluent-watcher/fluentd/VERSION)
-          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
+          echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
 
   determine-tags:
     needs: [get-version]
@@ -43,9 +43,9 @@ jobs:
         run: |
           VERSION=${{ needs.get-version.outputs.VERSION }}
           VERSION_WITHOUT_V=${VERSION#v}
-          MAJOR_MINOR=$(echo $VERSION_WITHOUT_V | cut -d. -f1-2)
+          MAJOR_MINOR=$(echo "$VERSION_WITHOUT_V" | cut -d. -f1-2)
 
-          if skopeo inspect docker://${{ env.GHCR_REPO }}:${VERSION}; then
+          if skopeo inspect "docker://${{ env.GHCR_REPO }}:${VERSION}"; then
             echo "${VERSION} tag already exists, assuming we're building a patch release!"
             LATEST_PATCH_VERSION=$(skopeo list-tags docker://${{ env.GHCR_REPO }} | grep -E "${VERSION}-[0-9]+" | sort | uniq | tail -1 | tr -d \" | cut -d'-' -f2 | tr -d ',')
             NEW_PATCH_VERSION=$((LATEST_PATCH_VERSION + 1))
@@ -56,8 +56,10 @@ jobs:
             IMAGE_BASE_TAG="${VERSION}"
           fi
 
-          echo "IMAGE_BASE_TAG=$IMAGE_BASE_TAG" >> $GITHUB_OUTPUT
-          echo "IMAGE_MAJOR_MINOR=$MAJOR_MINOR" >> $GITHUB_OUTPUT
+          {
+            echo "IMAGE_BASE_TAG=$IMAGE_BASE_TAG"
+            echo "IMAGE_MAJOR_MINOR=$MAJOR_MINOR"
+          } >> "$GITHUB_OUTPUT"
 
   build:
     name: Build/push image (${{ matrix.platform }})
@@ -145,7 +147,7 @@ jobs:
           platform="${{ matrix.platform }}"
           # Convert "linux/amd64" to just amd64 for the output variable name
           arch=${platform#linux/}
-          echo "${arch}=${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT
+          echo "${arch}=${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"
 
   manifest:
     name: Publish image manifest
diff --git a/.github/workflows/build-op-image.yaml b/.github/workflows/build-op-image.yaml
index 9c7bed515..0a575b44d 100644
--- a/.github/workflows/build-op-image.yaml
+++ b/.github/workflows/build-op-image.yaml
@@ -157,7 +157,7 @@ jobs:
           platform="${{ matrix.platform }}"
           # Convert "linux/amd64" to just amd64 for the output variable name
           arch=${platform#linux/}
-          echo "${arch}=${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT
+          echo "${arch}=${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"
 
   manifest:
     name: Publish image manifest
diff --git a/.github/workflows/bump-fluent-bit-version.yaml b/.github/workflows/bump-fluent-bit-version.yaml
index 1ee8fb951..de7f4c525 100644
--- a/.github/workflows/bump-fluent-bit-version.yaml
+++ b/.github/workflows/bump-fluent-bit-version.yaml
@@ -43,8 +43,7 @@ jobs:
 
       - name: Update version in VERSION file
         run: |
-          echo ${{ github.event.inputs.version }} > cmd/fluent-watcher/fluentbit/VERSION
-          if [ $? -ne 0 ]; then
+          if ! echo "${{ github.event.inputs.version }}" > cmd/fluent-watcher/fluentbit/VERSION; then
             echo "Failed to update VERSION file"
             exit 1
           fi
@@ -60,8 +59,7 @@ jobs:
             "manifests/regex-parser/fluentbit-fluentBit.yaml"
           )
           for file in "${files[@]}"; do
-            sed -i 's|image: ghcr.io/fluent/fluent-operator/fluent-bit:.*|image: ghcr.io/fluent/fluent-operator/fluent-bit:${{ github.event.inputs.version }}|' "$file"
-            if [ $? -ne 0 ]; then
+            if ! sed -i 's|image: ghcr.io/fluent/fluent-operator/fluent-bit:.*|image: ghcr.io/fluent/fluent-operator/fluent-bit:${{ github.event.inputs.version }}|' "$file"; then
               echo "Failed to update $file"
               exit 1
             fi
@@ -69,8 +67,7 @@ jobs:
 
       - name: Update version in values.yaml
         run: |
-          sed -i '/repository: "ghcr.io\/fluent\/fluent-operator\/fluent-bit"/!b;n;s/tag: .*/tag: "${{ github.event.inputs.version }}"/' charts/fluent-operator/values.yaml
-          if [ $? -ne 0 ]; then
+          if ! sed -i '/repository: "ghcr.io\/fluent\/fluent-operator\/fluent-bit"/!b;n;s/tag: .*/tag: "${{ github.event.inputs.version }}"/' charts/fluent-operator/values.yaml; then
             echo "Failed to update values.yaml"
             exit 1
           fi
diff --git a/.github/workflows/lint-test.yaml b/.github/workflows/lint-test.yaml
index 51d0e82c5..832b7a802 100644
--- a/.github/workflows/lint-test.yaml
+++ b/.github/workflows/lint-test.yaml
@@ -24,7 +24,7 @@ jobs:
         run: |
           changed=$(ct list-changed --chart-dirs charts/fluent-operator --config .github/ct.yaml)
           if [[ -n "$changed" ]]; then
-            echo "changed=true" >> $GITHUB_OUTPUT
+            echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Run chart-testing (lint)
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 66940f4e9..6a8368ed6 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -73,7 +73,8 @@ jobs:
 
       - name: Go mod
         run: |
-          export PATH=$PATH:$(go env GOPATH)/bin
+          GOPATH=$(go env GOPATH)
+          export PATH="$PATH:$GOPATH/bin"
           go mod download
 
       - name: Install kubebuilder
diff --git a/.github/workflows/upload-release-assets.yaml b/.github/workflows/upload-release-assets.yaml
index 34e4e12e2..c2663ded3 100644
--- a/.github/workflows/upload-release-assets.yaml
+++ b/.github/workflows/upload-release-assets.yaml
@@ -19,7 +19,7 @@ jobs:
 
       - name: Read version
         id: version
-        run: echo "version=$(cat version.txt)" >> $GITHUB_OUTPUT
+        run: echo "version=$(cat version.txt)" >> "$GITHUB_OUTPUT"
 
       - name: Stamp image tag in setup.yaml
         run: |