Release v5.3.2 into Main

.github/dependabot.yml

@@ -12,8 +12,12 @@ updates:
     commit-message:
       prefix: "chore"
       include: "scope"
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 3
     rebase-strategy: "auto"
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"
 
   # Enable version updates for pip - root directory
   - package-ecosystem: "pip"
@@ -27,7 +31,11 @@ updates:
     commit-message:
       prefix: "chore"
       include: "scope"
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 3
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
 
   # Enable version updates for pip - lisa-sdk
   - package-ecosystem: "pip"
@@ -41,7 +49,11 @@ updates:
     commit-message:
       prefix: "chore"
       include: "scope"
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 3
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
 
   # Enable version updates for pip - authorizer layer
   - package-ecosystem: "pip"
@@ -55,7 +67,11 @@ updates:
     commit-message:
       prefix: "chore"
       include: "scope"
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 3
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
 
   # Enable version updates for pip - common layer
   - package-ecosystem: "pip"
@@ -69,7 +85,11 @@ updates:
     commit-message:
       prefix: "chore"
       include: "scope"
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 3
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
 
   # Enable version updates for pip - fastapi layer
   - package-ecosystem: "pip"
@@ -83,7 +103,11 @@ updates:
     commit-message:
       prefix: "chore"
       include: "scope"
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 3
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
 
   # Enable version updates for pip - rest-api src
   - package-ecosystem: "pip"
@@ -97,7 +121,11 @@ updates:
     commit-message:
       prefix: "chore"
       include: "scope"
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 3
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
 
   # Enable version updates for pip - rag layer
   - package-ecosystem: "pip"
@@ -111,7 +139,11 @@ updates:
     commit-message:
       prefix: "chore"
       include: "scope"
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 3
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
 
   # Enable security updates for GitHub Actions
   - package-ecosystem: "github-actions"
@@ -125,7 +157,11 @@ updates:
     commit-message:
       prefix: "chore"
       include: "scope"
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 3
+    groups:
+      github-actions:
+        patterns:
+          - "*"
 
   # Enable updates for Docker - RAG ingestion
   - package-ecosystem: "docker"
@@ -140,6 +176,10 @@ updates:
       prefix: "chore"
       include: "scope"
     open-pull-requests-limit: 3
+    groups:
+      docker-dependencies:
+        patterns:
+          - "*"
 
   # Enable updates for Docker - vector store
   - package-ecosystem: "docker"
@@ -154,6 +194,10 @@ updates:
       prefix: "chore"
       include: "scope"
     open-pull-requests-limit: 3
+    groups:
+      docker-dependencies:
+        patterns:
+          - "*"
 
   # Enable updates for Docker - REST API
   - package-ecosystem: "docker"
@@ -168,6 +212,10 @@ updates:
       prefix: "chore"
       include: "scope"
     open-pull-requests-limit: 3
+    groups:
+      docker-dependencies:
+        patterns:
+          - "*"
 
   # Enable updates for Docker - MCP workbench
   - package-ecosystem: "docker"
@@ -182,6 +230,10 @@ updates:
       prefix: "chore"
       include: "scope"
     open-pull-requests-limit: 3
+    groups:
+      docker-dependencies:
+        patterns:
+          - "*"
 
   # Enable updates for Docker - VLLM
   - package-ecosystem: "docker"
@@ -196,6 +248,10 @@ updates:
       prefix: "chore"
       include: "scope"
     open-pull-requests-limit: 3
+    groups:
+      docker-dependencies:
+        patterns:
+          - "*"
 
   # Enable updates for Docker - TEI
   - package-ecosystem: "docker"
@@ -210,6 +266,10 @@ updates:
       prefix: "chore"
       include: "scope"
     open-pull-requests-limit: 3
+    groups:
+      docker-dependencies:
+        patterns:
+          - "*"
 
   # Enable updates for Docker - instructor
   - package-ecosystem: "docker"
@@ -224,6 +284,10 @@ updates:
       prefix: "chore"
       include: "scope"
     open-pull-requests-limit: 3
+    groups:
+      docker-dependencies:
+        patterns:
+          - "*"
 
   # Enable updates for Docker - TGI
   - package-ecosystem: "docker"
@@ -238,3 +302,7 @@ updates:
       prefix: "chore"
       include: "scope"
     open-pull-requests-limit: 3
+    groups:
+      docker-dependencies:
+        patterns:
+          - "*"

.github/workflows/code.deploy.demo.yml

@@ -20,7 +20,7 @@ jobs:
     environment: demo
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@3d21ddcb5087c3d29b7e19fe293e3455fabe32af # v4
         with:
@@ -33,11 +33,11 @@ jobs:
         run: |
           echo "${{vars.CONFIG_YAML}}" > config-custom.yaml
       - name: Set up Python 3.11
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v5
         with:
           python-version: "3.11"
       - name: Use Node.js 20.x
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v4
         with:
           node-version: 20.x
       - name: Install CDK dependencies

.github/workflows/code.deploy.dev.yml

@@ -20,7 +20,7 @@ jobs:
     environment: dev
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@3d21ddcb5087c3d29b7e19fe293e3455fabe32af # v4
         with:
@@ -33,11 +33,11 @@ jobs:
         run: |
           echo "${{vars.CONFIG_YAML}}" > config-custom.yaml
       - name: Set up Python 3.11
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v5
         with:
           python-version: "3.11"
       - name: Use Node.js 20.x
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v4
         with:
           node-version: 20.x
       - name: Install CDK dependencies

.github/workflows/code.draft-release-and-tag.yml

@@ -16,7 +16,7 @@ jobs:
     if: (startsWith(github.event.pull_request.head.ref, 'release/' ) || startsWith(github.event.pull_request.head.ref, 'hotfix/')) && github.event.pull_request.merged == true && github.event.pull_request.base.ref == 'main'
     steps:
       - name: Checkout Source Tag
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           ref: main
       - name: Get Version

.github/workflows/code.end-to-end-test.nightly.yml

@@ -28,9 +28,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: notify_e2e_start
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v4
         with:
           node-version: '18'
           cache: 'npm'

.github/workflows/code.hotfix.branch.yml

@@ -21,7 +21,7 @@ jobs:
       pull-requests: write  # Required for creating PRs
     steps:
       - name: Checkout Source Tag
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           ref: refs/tags/${{ github.event.inputs.source_tag }}
       - name: Create Hotfix Branch and Update Version

.github/workflows/code.merge.main-to-develop.yml

@@ -14,7 +14,7 @@ jobs:
       contents: write  # Required for merging branches
     steps:
       - name: Checkout main
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           ref: main
           ssh-key: ${{ secrets.DEPLOYMENT_SSH_KEY }}

.github/workflows/code.publish.yml

@@ -13,9 +13,9 @@ jobs:
       contents: read
       packages: write  # Required for npm package publishing
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       # Setup .npmrc file to publish to GitHub Packages
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v4
         with:
           node-version: '20.x'
           registry-url: 'https://npm.pkg.github.com'

.github/workflows/code.release.branch.yml

@@ -19,28 +19,11 @@ jobs:
       pull-requests: write  # Required for creating PRs
     steps:
       - name: Checkout Develop Branch
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           ref: develop
           fetch-depth: 0  # Fetch full history for proper branch comparison
-      - name: Create Release Branch and Update Version
-        run: |
-          git config --global user.email "evmann@amazon.com"
-          git config --global user.name "github_actions_lisa"
-          RELEASE_TAG=${{ github.event.inputs.release_tag }}
-          git checkout -b release/${{ github.event.inputs.release_tag }}
-          echo "$( jq --arg version ${RELEASE_TAG:1} '.version = $version' lib/user-interface/react/package.json )" > lib/user-interface/react/package.json
-          echo "$( jq --arg version ${RELEASE_TAG:1} '.version = $version' package.json )" > package.json
-          sed -E -i -e "s/version = \"[0-9\.].+\"/version = \"${RELEASE_TAG:1}\"/g" lisa-sdk/pyproject.toml
-          echo ${RELEASE_TAG:1} > VERSION
-          # Update package-lock.json to reflect new version
-          npm install
-          # Ensure all changes including package-lock.json are committed
-          git add .
-          git commit -m "Updating version for release ${{ github.event.inputs.release_tag }}"
-          git push origin release/${{ github.event.inputs.release_tag }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.LEAD_ACCESS_TOKEN }}
+          ssh-key: ${{ secrets.DEPLOYMENT_SSH_KEY }}
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@3d21ddcb5087c3d29b7e19fe293e3455fabe32af # v4
         with:
@@ -52,10 +35,8 @@ jobs:
         run: |
           # Fetch main branch with full history for proper commit comparison
           git fetch --no-tags origin main:main
-          git fetch --no-tags origin develop:develop
         env:
           GITHUB_TOKEN: ${{ secrets.LEAD_ACCESS_TOKEN }}
-
       - name: Generate PR Description with Bedrock
         id: generate_description
         run: |
@@ -65,33 +46,38 @@ jobs:
           .github/scripts/generate-pr-description.sh "${{ github.event.inputs.release_tag }}"
         env:
           GITHUB_TOKEN: ${{ secrets.LEAD_ACCESS_TOKEN }}
-
-      - name: Draft Pull Request
+      - name: Create Release Branch and Update Version
         run: |
-          # Switch to release branch to ensure proper context for PR creation
-          git checkout release/${{ github.event.inputs.release_tag }}
-
+          git config --global user.email "evmann@amazon.com"
+          git config --global user.name "github_actions_lisa"
+          RELEASE_TAG=${{ github.event.inputs.release_tag }}
+          git checkout -b release/${{ github.event.inputs.release_tag }}
+          echo "$( jq --arg version ${RELEASE_TAG:1} '.version = $version' lib/user-interface/react/package.json )" > lib/user-interface/react/package.json
+          echo "$( jq --arg version ${RELEASE_TAG:1} '.version = $version' package.json )" > package.json
+          sed -E -i -e "s/version = \"[0-9\.].+\"/version = \"${RELEASE_TAG:1}\"/g" lisa-sdk/pyproject.toml
+          echo ${RELEASE_TAG:1} > VERSION
+          # Update package-lock.json to reflect new version
+          npm install
           # Add the generated PR description to the top of CHANGELOG.md
           echo "📝 Adding release notes to CHANGELOG.md..."
-
           # Create a temporary file with the new content
           {
             echo "${{ steps.generate_description.outputs.DESCRIPTION }}"
             echo ""  # Add blank line separator
             cat CHANGELOG.md
           } > CHANGELOG_temp.md
-
           # Replace the original with the updated content
           mv CHANGELOG_temp.md CHANGELOG.md
-
-          # Commit the changelog update to the release branch
-          git config --global user.email "evmann@amazon.com"
-          git config --global user.name "github_actions_lisa"
-          git add CHANGELOG.md
-          git commit -m "Add ${{ github.event.inputs.release_tag }} changelog entry"
+          echo "✅ Changelog updated and committed to release branch"
+          # Ensure all changes including package-lock.json are committed
+          git add .
+          git commit -m "Updating version for release ${{ github.event.inputs.release_tag }}"
           git push origin release/${{ github.event.inputs.release_tag }}
 
-          echo "✅ Changelog updated and committed to release branch"
+      - name: Draft Pull Request
+        run: |
+          # Switch to release branch to ensure proper context for PR creation
+          git checkout release/${{ github.event.inputs.release_tag }}
 
           # Create the draft pull request
           gh pr create -d \