diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index cf1f49b..a506e1e 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1 +1 @@
-* @jmeridth @sutterj @zkoppert
+* @github/ospo-github-actions
diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml
index 44967b3..fb2ec4b 100644
--- a/.github/release-drafter.yml
+++ b/.github/release-drafter.yml
@@ -5,7 +5,7 @@ template: |
   # Changelog
   $CHANGES
 
-  See details of [all code changes](https://github.com/github/evergreen/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION) since previous release
+  See details of [all code changes](https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION) since previous release
 
 categories:
   - title: "🚀 Features"
@@ -32,14 +32,17 @@ version-resolver:
   major:
     labels:
       - "breaking"
+      - "major"
   minor:
     labels:
       - "enhancement"
       - "fix"
+      - "minor"
   patch:
     labels:
       - "documentation"
       - "maintenance"
+      - "patch"
   default: patch
 autolabeler:
   - label: "automation"
diff --git a/.github/workflows/auto-labeler.yml b/.github/workflows/auto-labeler.yml
index 9fe305e..7e41954 100644
--- a/.github/workflows/auto-labeler.yml
+++ b/.github/workflows/auto-labeler.yml
@@ -1,24 +1,18 @@
 ---
 name: Auto Labeler
-
 on:
   # pull_request_target event is required for autolabeler to support all PRs including forks
   pull_request_target:
     types: [opened, reopened, edited, synchronize]
-
 permissions:
   contents: read
-
 jobs:
   main:
     permissions:
       contents: write
       pull-requests: write
-    name: Auto label pull requests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          config-name: release-drafter.yml
+    uses: github/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml@1406afbf7a795f706f04644059cecbb3b2f0c1a0
+    with:
+      config-name: release-drafter.yml
+    secrets:
+      github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/contributors_report.yaml b/.github/workflows/contributors_report.yaml
index 714db86..f7c6bb1 100644
--- a/.github/workflows/contributors_report.yaml
+++ b/.github/workflows/contributors_report.yaml
@@ -29,7 +29,7 @@ jobs:
           echo "END_DATE=$end_date" >> "$GITHUB_ENV"
 
       - name: Run contributor action
-        uses: github/contributors@90922d5748ecaf8417a3b7a0eedb4892c8fa1c44
+        uses: github/contributors@695ea9d3f1c31f6ff67ab7d6a964a15f8ef9fa04
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           START_DATE: ${{ env.START_DATE }}
diff --git a/.github/workflows/major-version-updater.yml b/.github/workflows/major-version-updater.yml
deleted file mode 100644
index 1d59854..0000000
--- a/.github/workflows/major-version-updater.yml
+++ /dev/null
@@ -1,33 +0,0 @@
----
-name: Major Version Updater
-# Whenever a new release is made, push a major version tag
-on:
-  release:
-    types: [published]
-
-permissions:
-  contents: read
-
-jobs:
-  update-major-version-tag:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v4.2.2
-
-      - name: version
-        id: version
-        shell: bash
-        run: |
-          # shellcheck disable=all
-          tag=${GITHUB_REF/refs\/tags\//};
-          version=${tag#v} ;
-          major=${version%%.*} ;
-          { echo "tag=${tag}"; echo "version=${version}"; echo "major=${major}"; } >> "$GITHUB_OUTPUT"
-
-      - name: force update major tag
-        run: |
-          git tag v${{ steps.version.outputs.major }}
-          git push origin refs/tags/v${{ steps.version.outputs.major }} -f
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index 7fb238c..70f1974 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -1,38 +1,17 @@
 ## Reference: https://github.com/amannn/action-semantic-pull-request
 ---
 name: "Lint PR Title"
-
 on:
   pull_request_target:
-    types: [opened, edited, edited, synchronize]
-
+    types: [opened, reopened, edited, synchronize]
 permissions:
   contents: read
-
 jobs:
   main:
     permissions:
+      contents: read
       pull-requests: read
       statuses: write
-    name: Validate PR title
-    runs-on: ubuntu-latest
-    steps:
-      - uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          # Configure which types are allowed (newline-delimited).
-          # From: https://github.com/commitizen/conventional-commit-types/blob/master/index.json
-          # listing all below
-          types: |
-            build
-            chore
-            ci
-            docs
-            feat
-            fix
-            perf
-            refactor
-            revert
-            style
-            test
+    uses: github/ospo-reusable-workflows/.github/workflows/pr-title.yaml@1406afbf7a795f706f04644059cecbb3b2f0c1a0
+    secrets:
+      github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c7ed471..05ad3c6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,94 +1,50 @@
 ---
 name: Release
-
 on:
   workflow_dispatch:
   pull_request_target:
     types: [closed]
     branches: [main]
-
 permissions:
   contents: read
-
 jobs:
-  create_release:
-    # release if
-    # manual deployment OR
-    # merged to main and labelled with release labels
-    if: |
-      (github.event_name == 'workflow_dispatch') ||
-      (github.event.pull_request.merged == true &&
-      (contains(github.event.pull_request.labels.*.name, 'breaking') ||
-      contains(github.event.pull_request.labels.*.name, 'feature') ||
-      contains(github.event.pull_request.labels.*.name, 'vuln') ||
-      contains(github.event.pull_request.labels.*.name, 'release')))
-    outputs:
-      full-tag: ${{ steps.release-drafter.outputs.tag_name }}
-      short-tag: ${{ steps.get_tag_name.outputs.SHORT_TAG }}
-      body: ${{ steps.release-drafter.outputs.body }}
-    runs-on: ubuntu-latest
+  release:
     permissions:
       contents: write
       pull-requests: read
-    steps:
-      - uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348
-        id: release-drafter
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          config-name: release-drafter.yml
-          publish: true
-      - name: Get the short tag
-        id: get_tag_name
-        run: |
-          short_tag=$(echo ${{ steps.release-drafter.outputs.tag_name }} | cut -d. -f1)
-          echo "SHORT_TAG=$short_tag" >> "$GITHUB_OUTPUT"
-  create_action_images:
-    needs: create_release
-    runs-on: ubuntu-latest
+    uses: github/ospo-reusable-workflows/.github/workflows/release.yaml@53a9c808122ffaae9af948f72139fb4bd44ab74c
+    with:
+      publish: true
+      release-config-name: release-drafter.yml
+    secrets:
+      github-token: ${{ secrets.GITHUB_TOKEN }}
+  release_image:
+    needs: release
     permissions:
+      contents: write
+      discussions: write
       packages: write
-    env:
-      REGISTRY: ghcr.io
-      IMAGE_NAME: ${{ github.repository }}
-    steps:
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5
-      - name: Log in to the Container registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/checkout@v4.2.2
-      - name: Push Docker Image
-        if: ${{ success() }}
-        uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create_release.outputs.full-tag }}
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create_release.outputs.short-tag }}
-          platforms: linux/amd64,linux/arm64
-          provenance: false
-          sbom: false
-  create_discussion:
-    needs: create_release
-    runs-on: ubuntu-latest
+      pull-requests: read
+    uses: github/ospo-reusable-workflows/.github/workflows/release-image.yaml@53a9c808122ffaae9af948f72139fb4bd44ab74c
+    with:
+      image-name: ${{ github.repository }}
+      full-tag: ${{ needs.release.outputs.full-tag }}
+      short-tag: ${{ needs.release.outputs.short-tag }}
+    secrets:
+      github-token: ${{ secrets.GITHUB_TOKEN }}
+      image-registry: ghcr.io
+      image-registry-username: ${{ github.actor }}
+      image-registry-password: ${{ secrets.GITHUB_TOKEN }}
+  release_discussion:
+    needs: release
     permissions:
+      contents: read
       discussions: write
-    steps:
-      - name: Create an announcement discussion for release
-        uses: abirismyname/create-discussion@6e6ef67e5eeb042343ef8b3d8d0f5d545cbdf024
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          title: ${{ needs.create_release.outputs.full-tag }}
-          body: ${{ needs.create_release.outputs.body }}
-          repository-id: ${{ secrets.RELEASE_DISCUSSION_REPOSITORY_ID }}
-          category-id: ${{ secrets.RELEASE_DISCUSSION_CATEGORY_ID }}
+    uses: github/ospo-reusable-workflows/.github/workflows/release-discussion.yaml@53a9c808122ffaae9af948f72139fb4bd44ab74c
+    with:
+      full-tag: ${{ needs.release.outputs.full-tag }}
+      body: ${{ needs.release.outputs.body }}
+    secrets:
+      github-token: ${{ secrets.GITHUB_TOKEN }}
+      discussion-repository-id: ${{ secrets.RELEASE_DISCUSSION_REPOSITORY_ID }}
+      discussion-category-id: ${{ secrets.RELEASE_DISCUSSION_CATEGORY_ID }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 0bd89f1..db7be29 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -36,12 +36,12 @@ jobs:
           results_format: sarif
           publish_results: true
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v4.4.3
+        uses: actions/upload-artifact@v4.6.0
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
+        uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
         with:
           sarif_file: results.sarif
diff --git a/Dockerfile b/Dockerfile
index 954d54c..2a8598e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 #checkov:skip=CKV_DOCKER_2
 #checkov:skip=CKV_DOCKER_3
-FROM python:3.13.1-slim@sha256:f41a75c9cee9391c09e0139f7b49d4b1fbb119944ec740ecce4040626dc07bed
+FROM python:3.13.1-slim@sha256:23a81be7b258c8f516f7a60e80943cace4350deb8204cf107c7993e343610d47
 LABEL org.opencontainers.image.source https://github.com/github/evergreen
 
 WORKDIR /action/workspace
diff --git a/requirements-test.txt b/requirements-test.txt
index b5aa65b..825a151 100644
--- a/requirements-test.txt
+++ b/requirements-test.txt
@@ -1,9 +1,9 @@
 black==24.10.0
 flake8==7.1.1
-mypy==1.13.0
+mypy==1.14.1
 mypy-extensions==1.0.0
-pylint==3.3.2
+pylint==3.3.3
 pytest==8.3.4
 pytest-cov==6.0.0
-types-PyYAML==6.0.12.20240917
+types-PyYAML==6.0.12.20241230
 types-requests==2.32.0.20241016
diff --git a/requirements.txt b/requirements.txt
index 4ce4ecf..e60f51e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,4 +1,4 @@
 github3.py==4.0.1
 requests==2.32.3
 python-dotenv==1.0.1
-ruamel.yaml==0.18.6
+ruamel.yaml==0.18.10