diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index c6dfb0ebda4e..2b78a90bccb8 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,3 +1,7 @@
-# web + desktop packages
-packages/app/      @Hona @Brendonovich
-packages/desktop/  @Hona @Brendonovich
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#example-of-a-codeowners-file
+# This is a comment.
+# Each line is a file pattern followed by one or more owners.
+
+# These owners will be the default owners for everything in
+# the repo.
+* @johnko
diff --git a/.github/workflows/beta.yml b/.github/disabled_workflows/beta.yml
similarity index 100%
rename from .github/workflows/beta.yml
rename to .github/disabled_workflows/beta.yml
diff --git a/.github/workflows/close-issues.yml b/.github/disabled_workflows/close-issues.yml
similarity index 100%
rename from .github/workflows/close-issues.yml
rename to .github/disabled_workflows/close-issues.yml
diff --git a/.github/workflows/close-prs.yml b/.github/disabled_workflows/close-prs.yml
similarity index 100%
rename from .github/workflows/close-prs.yml
rename to .github/disabled_workflows/close-prs.yml
diff --git a/.github/workflows/compliance-close.yml b/.github/disabled_workflows/compliance-close.yml
similarity index 100%
rename from .github/workflows/compliance-close.yml
rename to .github/disabled_workflows/compliance-close.yml
diff --git a/.github/workflows/containers.yml b/.github/disabled_workflows/containers.yml
similarity index 100%
rename from .github/workflows/containers.yml
rename to .github/disabled_workflows/containers.yml
diff --git a/.github/workflows/deploy.yml b/.github/disabled_workflows/deploy.yml
similarity index 100%
rename from .github/workflows/deploy.yml
rename to .github/disabled_workflows/deploy.yml
diff --git a/.github/workflows/docs-locale-sync.yml b/.github/disabled_workflows/docs-locale-sync.yml
similarity index 100%
rename from .github/workflows/docs-locale-sync.yml
rename to .github/disabled_workflows/docs-locale-sync.yml
diff --git a/.github/workflows/docs-update.yml b/.github/disabled_workflows/docs-update.yml
similarity index 100%
rename from .github/workflows/docs-update.yml
rename to .github/disabled_workflows/docs-update.yml
diff --git a/.github/workflows/duplicate-issues.yml b/.github/disabled_workflows/duplicate-issues.yml
similarity index 100%
rename from .github/workflows/duplicate-issues.yml
rename to .github/disabled_workflows/duplicate-issues.yml
diff --git a/.github/workflows/generate.yml b/.github/disabled_workflows/generate.yml
similarity index 100%
rename from .github/workflows/generate.yml
rename to .github/disabled_workflows/generate.yml
diff --git a/.github/workflows/nix-eval.yml b/.github/disabled_workflows/nix-eval.yml
similarity index 100%
rename from .github/workflows/nix-eval.yml
rename to .github/disabled_workflows/nix-eval.yml
diff --git a/.github/workflows/nix-hashes.yml b/.github/disabled_workflows/nix-hashes.yml
similarity index 100%
rename from .github/workflows/nix-hashes.yml
rename to .github/disabled_workflows/nix-hashes.yml
diff --git a/.github/workflows/notify-discord.yml b/.github/disabled_workflows/notify-discord.yml
similarity index 100%
rename from .github/workflows/notify-discord.yml
rename to .github/disabled_workflows/notify-discord.yml
diff --git a/.github/workflows/opencode.yml b/.github/disabled_workflows/opencode.yml
similarity index 100%
rename from .github/workflows/opencode.yml
rename to .github/disabled_workflows/opencode.yml
diff --git a/.github/workflows/pr-management.yml b/.github/disabled_workflows/pr-management.yml
similarity index 100%
rename from .github/workflows/pr-management.yml
rename to .github/disabled_workflows/pr-management.yml
diff --git a/.github/workflows/pr-standards.yml b/.github/disabled_workflows/pr-standards.yml
similarity index 100%
rename from .github/workflows/pr-standards.yml
rename to .github/disabled_workflows/pr-standards.yml
diff --git a/.github/workflows/publish-github-action.yml b/.github/disabled_workflows/publish-github-action.yml
similarity index 100%
rename from .github/workflows/publish-github-action.yml
rename to .github/disabled_workflows/publish-github-action.yml
diff --git a/.github/workflows/publish-vscode.yml b/.github/disabled_workflows/publish-vscode.yml
similarity index 100%
rename from .github/workflows/publish-vscode.yml
rename to .github/disabled_workflows/publish-vscode.yml
diff --git a/.github/workflows/publish.yml b/.github/disabled_workflows/publish.yml
similarity index 100%
rename from .github/workflows/publish.yml
rename to .github/disabled_workflows/publish.yml
diff --git a/.github/workflows/release-github-action.yml b/.github/disabled_workflows/release-github-action.yml
similarity index 100%
rename from .github/workflows/release-github-action.yml
rename to .github/disabled_workflows/release-github-action.yml
diff --git a/.github/workflows/review.yml b/.github/disabled_workflows/review.yml
similarity index 100%
rename from .github/workflows/review.yml
rename to .github/disabled_workflows/review.yml
diff --git a/.github/workflows/stats.yml b/.github/disabled_workflows/stats.yml
similarity index 100%
rename from .github/workflows/stats.yml
rename to .github/disabled_workflows/stats.yml
diff --git a/.github/workflows/storybook.yml b/.github/disabled_workflows/storybook.yml
similarity index 100%
rename from .github/workflows/storybook.yml
rename to .github/disabled_workflows/storybook.yml
diff --git a/.github/workflows/test.yml b/.github/disabled_workflows/test.yml
similarity index 100%
rename from .github/workflows/test.yml
rename to .github/disabled_workflows/test.yml
diff --git a/.github/workflows/triage.yml b/.github/disabled_workflows/triage.yml
similarity index 100%
rename from .github/workflows/triage.yml
rename to .github/disabled_workflows/triage.yml
diff --git a/.github/workflows/typecheck.yml b/.github/disabled_workflows/typecheck.yml
similarity index 100%
rename from .github/workflows/typecheck.yml
rename to .github/disabled_workflows/typecheck.yml
diff --git a/.github/git-has-uncommited-changes.sh b/.github/git-has-uncommited-changes.sh
new file mode 100644
index 000000000000..371a9d3c45a2
--- /dev/null
+++ b/.github/git-has-uncommited-changes.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+git version
+
+git diff --exit-code
diff --git a/.github/helm-dep.sh b/.github/helm-dep.sh
new file mode 100644
index 000000000000..c2e488bd162c
--- /dev/null
+++ b/.github/helm-dep.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+set -ex
+
+if git diff --name-only | grep lab/renovatebotwrapper; then
+
+  cd ./lab/renovatebotwrapper
+
+  helm repo add argo https://argoproj.github.io/argo-helm
+  helm repo add coredns https://coredns.github.io/helm
+  helm repo add istio https://istio-release.storage.googleapis.com/charts
+  helm repo add jetstack https://charts.jetstack.io
+  helm repo add metrics-server https://kubernetes-sigs.github.io/metrics-server/
+  helm repo add mojo2600 https://mojo2600.github.io/pihole-kubernetes/
+  helm repo add openfaas https://openfaas.github.io/faas-netes/
+  helm repo add traefik https://traefik.github.io/charts
+
+  # to fetch versions that Chart.lock has defined
+  helm dep build
+
+  cd ./charts
+
+  # clean chart sources since files could have been deleted upstream
+  for i in $(find . -maxdepth 1 -name '*.tgz' -print0 | xargs -0 --max-procs=1 --verbose -I{} tar tf {} 2>/dev/null | cut -f1 -d/ | sort -u); do
+    if [ -d ./"$i"/ ]; then
+      rm -fr ./"$i"/
+    fi
+  done
+
+  # extract chart sources
+  find . -maxdepth 1 -name '*.tgz' -print0 | xargs -0 --max-procs=1 --verbose -I{} tar xvf {}
+
+  rm -v ./*.tgz
+
+fi
diff --git a/.github/pre-commit.sh b/.github/pre-commit.sh
new file mode 100644
index 000000000000..6b6c2e91ba35
--- /dev/null
+++ b/.github/pre-commit.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+ANY_ERROR=false
+
+set +e
+
+if type tofu &>/dev/null; then
+  bash -ex .github/opentofu-fmt.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+  bash -ex .github/opentofu-validate.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+
+if type terraform &>/dev/null; then
+  bash -ex .github/terraform-fmt.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+  bash -ex .github/terraform-validate.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+
+if type shellcheck &>/dev/null; then
+  bash -ex .github/shellcheck.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+
+if type shfmt &>/dev/null; then
+  bash -ex .github/shfmt.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+
+set -e
+
+if [[ "true" == "$ANY_ERROR" ]]; then
+  exit 1
+fi
diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 000000000000..f25ae8116f75
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,14 @@
+{
+  "allowedCommands": [
+    "/bin/bash .github/helm-dep.sh"
+  ],
+  "extends": [
+    "github>johnko/renovate-config"
+  ],
+  "postUpgradeTasks": {
+    "commands": [
+      "/bin/bash .github/helm-dep.sh"
+    ],
+    "executionMode": "branch"
+  }
+}
diff --git a/.github/setup-git-pre-commit-hooks.sh b/.github/setup-git-pre-commit-hooks.sh
new file mode 100644
index 000000000000..e73a4d08be61
--- /dev/null
+++ b/.github/setup-git-pre-commit-hooks.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+SCRIPT_DIR=$(dirname "$0")
+pushd "$SCRIPT_DIR"
+
+if [[ -e ./pre-commit.sh ]] && [[ -d ../.git/hooks ]]; then
+  install -m 700 ./pre-commit.sh ../.git/hooks/pre-commit
+fi
diff --git a/.github/shellcheck.sh b/.github/shellcheck.sh
new file mode 100644
index 000000000000..5c32d7eee9fa
--- /dev/null
+++ b/.github/shellcheck.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -exo pipefail
+
+# when running in CI and shellcheck doesn't exist, install it
+if [[ "true" == "$CI" ]]; then
+  if ! type shellcheck &>/dev/null; then
+    SUDO=''
+    if type sudo &>/dev/null; then
+      SUDO=sudo
+    fi
+    if type brew &>/dev/null; then
+      brew install shellcheck
+    elif type snap &>/dev/null; then
+      INSTALL_COMMAND="snap install shellcheck"
+      # shellcheck disable=SC2086
+      $INSTALL_COMMAND || $SUDO $INSTALL_COMMAND
+    elif type apt &>/dev/null; then
+      SUDO=''
+      if type sudo &>/dev/null; then
+        SUDO=sudo
+      fi
+      INSTALL_COMMAND="apt install --yes shellcheck"
+      # shellcheck disable=SC2086
+      $INSTALL_COMMAND || $SUDO $INSTALL_COMMAND
+    fi
+  fi
+fi
+set -u
+
+shellcheck --version
+
+set +e
+
+# git submodule status | awk '{print "-a -not -path **/"$2"/**"}' | tr "\n" " " | sed "s,\*\*/,'*/,g" | sed "s,/\*\*,/*',g" ; echo "\\"
+
+find . -type f \( -name '*.sh' -o -name '*.envrc' \) \
+  -a -not -path '*/.terraform/modules/*' \
+  \
+  -a -not -path '*/.bash-git-prompt/*' -a -not -path '*/.zsh/kube-ps1/*' -a -not -path '*/.zsh/pure/*' -a -not -path '*/.zsh/zsh-colored-man-pages/*' -a -not -path '*/.zsh/zsh-command-time/*' -a -not -path '*/docker-files/squid/ref/docker-squid-cache-all/*' -a -not -path '*/docker-files/squid/ref/squid-in-a-can/*' -a -not -path '*/docker-files/squid/ref/squid-npm/*' \
+  \
+  -a -not -name 'macos-homebrew.sh' \
+  -print0 | xargs -0 --max-procs=2 --verbose -I{} shellcheck --check-sourced --external-sources {}
diff --git a/.github/shfmt.sh b/.github/shfmt.sh
new file mode 100644
index 000000000000..2f3b2d311693
--- /dev/null
+++ b/.github/shfmt.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+set -exo pipefail
+
+# when running in CI and shfmt doesn't exist, install it
+if [[ "true" == "$CI" ]]; then
+  if ! type shfmt &>/dev/null; then
+    SUDO=''
+    if type sudo &>/dev/null; then
+      SUDO=sudo
+    fi
+    if type brew &>/dev/null; then
+      brew install shfmt
+    elif type snap &>/dev/null; then
+      INSTALL_COMMAND="snap install shfmt"
+      # shellcheck disable=SC2086
+      $INSTALL_COMMAND || $SUDO $INSTALL_COMMAND
+    elif type go &>/dev/null; then
+      if [[ ! -d "$HOME/bin" ]]; then
+        mkdir -p "$HOME/bin"
+      fi
+      export GOBIN="$HOME/bin"
+      export PATH="$GOBIN:$PATH"
+      go install mvdan.cc/sh/v3/cmd/shfmt@v3.11.0
+      ls -l "$GOBIN/shfmt"
+    elif type apt &>/dev/null; then
+      SUDO=''
+      if type sudo &>/dev/null; then
+        SUDO=sudo
+      fi
+      INSTALL_COMMAND="apt install --yes shfmt"
+      # shellcheck disable=SC2086
+      $INSTALL_COMMAND || $SUDO $INSTALL_COMMAND
+    fi
+  fi
+fi
+set -u
+
+shfmt --version
+
+# Diff with
+shfmt --diff --simplify --indent 2 --case-indent ./
+find . -type f -name '*.envrc' -print0 | xargs -0 --max-procs=2 --verbose -I{} shfmt --diff --simplify --indent 2 --case-indent {}
+
+# Fix with
+# shfmt --write --simplify --indent 2 --case-indent ./
+# find . -type f -name '*.envrc' -print0 | xargs -0 --max-procs=2 --verbose -I{} shfmt --write --simplify --indent 2 --case-indent {}
+# bash -ex ./.github/git-has-uncommited-changes.sh
diff --git a/.github/yq-pretty.sh b/.github/yq-pretty.sh
new file mode 100644
index 000000000000..318a0e09376d
--- /dev/null
+++ b/.github/yq-pretty.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+yq --version
+
+find . -type f \( -name '*.yaml' -o -name '*.yml' \) -not -path '*/lab/charts/*' -not -path '*/lab/traefik/*' -not -path '*/docker-files/squid/ref/*' -print0 | xargs -0 --max-procs=2 --verbose -I{} yq --exit-status --inplace --no-colors --prettyPrint 'sort_keys(..)' {}
+
+bash -ex ./.github/git-has-uncommited-changes.sh