diff --git a/.circleci/config.yml b/.circleci/config.yml
index a429a96cf0..f6e4a1605e 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -2,21 +2,20 @@ version: 2
 jobs:
   test:
     docker:
-    - image: ghcr.io/runatlantis/testing-env:2021.08.31
+    - image: ghcr.io/runatlantis/testing-env:2022.11.17
     steps:
     - checkout
-    - run: make test-all
     - run: make check-fmt
     - run: make check-lint
   e2e:
     docker:
-    - image: circleci/golang:1.17 # If you update this, update it in the Makefile too
+    - image: cimg/go:1.19 # If you update this, update it in the Makefile too
       environment:
         # This version of TF will be downloaded before Atlantis is started.
         # We do this instead of setting --default-tf-version because setting
         # that flag starts the download asynchronously so we'd have a race
         # condition.
-        TERRAFORM_VERSION: 1.3.1
+        TERRAFORM_VERSION: 1.3.5
     steps:
     - checkout
     - run: make build-service
@@ -42,7 +41,7 @@ jobs:
     - run: |
         dockerize -wait tcp://localhost:8080 -- \
           muffet \
-            -e 'https://github\.com/runatlantis/atlantis/edit/master/.*' \
+            -e 'https://github\.com/runatlantis/atlantis/edit/main/.*' \
             -e 'https://github.com/runatlantis/helm-charts#customization' \
             --header 'Accept-Encoding:deflate, gzip' \
             --buffer-size 8192 \
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
index 26a6099486..6e661b9768 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -11,33 +11,37 @@ assignees: ''
 
 ### Community Note
 
-* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
-* Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
-* If you are interested in working on this issue or have submitted a pull request, please leave a comment.
+- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
+- Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
+- If you are interested in working on this issue or have submitted a pull request, please leave a comment.
 
 <!--- Thank you for keeping this note for the community --->
 
 ---
 
-- [ ] I'd be willing to implement this feature ([contributing guide](https://github.com/runatlantis/atlantis/blob/master/CONTRIBUTING.md))
+- [ ] I'd be willing to implement this feature ([contributing guide](https://github.com/runatlantis/atlantis/blob/main/CONTRIBUTING.md))
 
 **Describe the user story**
-
+<!--
 A clear and concise description of what workflow is meant to be improved.
 Example: "As a developer, I often want to do <something>, but I often face <problem>".
+-->
 
 **Describe the solution you'd like**
-
+<!--
 A clear and concise description of what you want to happen. Consider that atlantis is used
 by many people, and your particular use case might not make sense to implement in the core.
+-->
 
 **Describe the drawbacks of your solution**
-
+<!--
 This section is important not only to identify future issues, but also for us to see whether
 you thought through your request. When filling it, ask yourself what are the problems we could
 have maintaining what you propose. How often will it break?
+-->
 
 **Describe alternatives you've considered**
-
+<!--
 A clear and concise description of any alternative solutions or features you've considered,
 and why you think they wouldn't be good enough.
+-->
diff --git a/.github/workflows/atlantis-base.yml b/.github/workflows/atlantis-base.yml
index d145239f8d..f5f1280bc1 100644
--- a/.github/workflows/atlantis-base.yml
+++ b/.github/workflows/atlantis-base.yml
@@ -6,7 +6,11 @@ on:
       - 'docker-base/**'
       - '.github/workflows/atlantis-base.yml'
     branches:
-      - "master"
+      - "main"
+  pull_request:
+    paths:
+      - 'docker-base/**'
+      - '.github/workflows/atlantis-base.yml'
   workflow_dispatch:
 
 defaults:
@@ -45,7 +49,7 @@ jobs:
       with:
         context: docker-base
         platforms: linux/arm64/v8,linux/amd64,linux/arm/v7
-        push: true
+        push: ${{ github.event_name != 'pull_request' }}
         tags: |
           ghcr.io/${{ github.repository_owner }}/atlantis-base:${{env.TODAY}}
           ghcr.io/${{ github.repository_owner }}/atlantis-base:latest
diff --git a/.github/workflows/atlantis-image.yml b/.github/workflows/atlantis-image.yml
index ec1d306305..2070fda21e 100644
--- a/.github/workflows/atlantis-image.yml
+++ b/.github/workflows/atlantis-image.yml
@@ -3,10 +3,14 @@ name: atlantis-image
 on:
   push:
     branches:
-      - 'master'
+      - 'main'
     tags:
       - v*.*.* # stable release like, v0.19.2
       - v*.*.*-pre.* # pre release like, v0.19.0-pre.calendardate
+  pull_request:
+    paths:
+      - 'Dockerfile'
+      - '.github/workflows/atlantis-image.yml'
   workflow_dispatch:
 
 concurrency:
@@ -20,7 +24,7 @@ jobs:
     - uses: actions/checkout@v3
     - uses: actions/setup-go@v3
       with:
-        go-version: 1.17
+        go-version: 1.19
 
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v2
@@ -40,38 +44,31 @@ jobs:
 
     # Publish dev image to container registry
     - name: Build and push atlantis:dev image
-      if: ${{ github.event_name == 'push'}}
+      if: ${{ contains(fromJson('["push", "pull_request"]'), github.event_name) }}
       uses: docker/build-push-action@v3
       with:
         context: .
         platforms: linux/arm64/v8,linux/amd64,linux/arm/v7
-        push: true
+        push: ${{ github.event_name != 'pull_request' }}
         tags: |
           ghcr.io/${{ github.repository_owner }}/atlantis:dev
 
     # Publish release to container registry
     - name: populate release version
-      if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') }}
+      if: |
+        contains(fromJson('["push", "pull_request"]'), github.event_name) &&
+        startsWith(github.ref, 'refs/tags/')
       run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
 
-    - name: Build and push atlantis:${{ env.RELEASE_VERSION }} image for pre release
-      if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') && contains(github.ref, '-pre.') }}
+    - name: Build and push atlantis:${{ env.RELEASE_VERSION }} image for  ${{ contains(github.ref, 'pre') ? "pre" : "stable" }} release
+      if: |
+        contains(fromJson('["push", "pull_request"]'), github.event_name) &&
+        startsWith(github.ref, 'refs/tags/')
       uses: docker/build-push-action@v3
       with:
         context: .
         platforms: linux/arm64/v8,linux/amd64,linux/arm/v7
-        push: true
+        push: ${{ github.event_name != 'pull_request' }}
         tags: |
           ghcr.io/${{ github.repository_owner }}/atlantis:${{ env.RELEASE_VERSION }}
-          ghcr.io/${{ github.repository_owner }}/atlantis:latest
-
-    - name: Build and push atlantis:${{ env.RELEASE_VERSION }} image for stable release
-      if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') && (!contains(github.ref, '-pre.')) }}
-      uses: docker/build-push-action@v3
-      with:
-        context: .
-        platforms: linux/arm64/v8,linux/amd64,linux/arm/v7
-        push: true
-        tags: |
-          ghcr.io/${{ github.repository_owner }}/atlantis:${{ env.RELEASE_VERSION }}
-          ghcr.io/${{ github.repository_owner }}/atlantis:prerelease-latest
+          ghcr.io/${{ github.repository_owner }}/atlantis:${{ contains(github.ref, 'pre') ? "prerelease-latest" : "latest") }}
diff --git a/.github/workflows/ci-link-checker-image.yml b/.github/workflows/ci-link-checker-image.yml
index 81fff31f85..8b8efab170 100644
--- a/.github/workflows/ci-link-checker-image.yml
+++ b/.github/workflows/ci-link-checker-image.yml
@@ -5,7 +5,7 @@ on:
     paths:
       - '.github/website_link_checker/**'
     branches:
-      - "master"
+      - "main"
   workflow_dispatch:
 
 concurrency:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5427c2a652..0838078513 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v3
       with:
-        go-version: 1.17
+        go-version: 1.19
 
     - name: Run GoReleaser for stable release
       uses: goreleaser/goreleaser-action@v3
@@ -35,7 +35,7 @@ jobs:
         echo "::set-output name=RELEASE_TAG::${GITHUB_REF#refs/tags/}"
         gh api repos/$GITHUB_REPOSITORY/releases/generate-notes \
           -f tag_name="${GITHUB_REF#refs/tags/}" \
-          -f target_commitish=master \
+          -f target_commitish=main \
           -q .body > tmp-CHANGELOG.md
       env:
         GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 0e64565fc3..130a3a40a6 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -8,7 +8,11 @@ jobs:
     steps:
       - uses: actions/stale@v6
         with:
-          stale-pr-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
-          days-before-stale: 30
-          days-before-close: 5
+          stale-pr-message: 'This issue is stale because it has been open for 6 months with no activity. Remove stale label or comment or this will be closed in 1 month.'
+          stale-issue-message: This issue is stale because it has been open for 6 months with no activity. Remove stale label or comment or this will be closed in 1 month.'
+          remove-stale-when-updated: true
+          # 6 months
+          days-before-stale: 183
+          # 1 month
+          days-before-close: 31
           only-labels: 'waiting-on-response'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5041a8b635..07fa50bcbc 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -3,10 +3,10 @@ name: tester
 on:
   push:
     branches:
-      - "master"
+      - "main"
   pull_request:
     branches:
-      - "master"
+      - "main"
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
@@ -15,10 +15,7 @@ jobs:
   test:
     name: runner / gotest
     runs-on: ubuntu-22.04
-    container: ghcr.io/runatlantis/testing-env:2021.08.31
+    container: ghcr.io/runatlantis/testing-env:2022.11.17
     steps:
-      # user in image needs write access to do anything
-      - name: setup
-        run: sudo chmod -R 777 $GITHUB_WORKSPACE /github /__w/_temp
       - uses: actions/checkout@v3.0.2
       - run: make test-all
diff --git a/.github/workflows/testing-env-image.yml b/.github/workflows/testing-env-image.yml
index 49b168ce39..f67e74b2ce 100644
--- a/.github/workflows/testing-env-image.yml
+++ b/.github/workflows/testing-env-image.yml
@@ -6,7 +6,11 @@ on:
       - "testing/**"
       - ".github/workflows/testing-env-image.yml"
     branches:
-      - "master"
+      - "main"
+  pull_request:
+    paths:
+      - 'testing/**'
+      - '.github/workflows/testing-env-image.yml'
   workflow_dispatch:
 
 concurrency:
@@ -41,7 +45,7 @@ jobs:
       with:
         context: testing
         platforms: linux/arm64/v8,linux/amd64,linux/arm/v7
-        push: true
+        push: ${{ github.event_name != 'pull_request' }}
         tags: |
            ghcr.io/runatlantis/testing-env:${{env.TODAY}}
            ghcr.io/runatlantis/testing-env:latest
diff --git a/.gitignore b/.gitignore
index 5fe3071760..4d65d8cf0b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,6 +15,7 @@ golangci-lint
 atlantis
 .devcontainer
 atlantis.env
+*.act
 
 # gitreleaser
 dist/
diff --git a/.golangci.yml b/.golangci.yml
index e403447ec5..a55bc4497a 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -10,7 +10,6 @@ linters:
   - gosec
   - gosimple
   - ineffassign
-  - interfacer
   - staticcheck
   - structcheck
   - typecheck
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3a6205cd33..e70b3756ee 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,9 +1,17 @@
-# v0.20.0
+# v0.20.1
 
 Bugfixes and new Features
 
 ## What's Changed
 
+https://github.com/runatlantis/atlantis/releases/tag/v0.20.1
+
+# v0.20.0
+
+Broken build due to github action issues
+
+## What's Changed
+
 https://github.com/runatlantis/atlantis/releases/tag/v0.20.0
 
 # v0.19.8
@@ -1715,7 +1723,7 @@ These are the changes in detail:
     ```
 
     The `w` group permission was added so that in OpenShift, the random uid can write
-    their own login entry (https://github.com/runatlantis/atlantis/blob/master/docker-entrypoint.sh#L28)
+    their own login entry (https://github.com/runatlantis/atlantis/blob/main/docker-entrypoint.sh#L28)
     which is required because `terraform` expects the running user to have an entry
     in `/etc/passwd`.
 
@@ -2458,7 +2466,7 @@ None
 assume role session with the GitHub username of the user running the Atlantis command
 use the `atlantis_user` terraform variable alongside Terraform's
 [built-in support](https://www.terraform.io/docs/providers/aws/#assume-role) for assume role
-(see https://github.com/runatlantis/atlantis/blob/master/README.md#assume-role-session-names)
+(see https://github.com/runatlantis/atlantis/blob/main/README.md#assume-role-session-names)
 * Atlantis has a docker image now ([#123](https://github.com/hootsuite/atlantis/pull/123)). Here is how you can try it out:
 
 ```bash
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 864293f65c..615946e805 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -11,12 +11,12 @@
 * When sending lengthy log-files, consider posting them as a gist (https://gist.github.com). Don't forget to remove sensitive data from your logfiles before posting (you can replace those parts with "REDACTED").
 
 # Reporting Security Issues
-We take security issues seriously. Please email us directly at security [at] runatlantis.io instead of opening an issue.
+We take security issues seriously. Please report a security vulnerability to the maintainers using [private vulnerability reporting](https://github.com/runatlantis/atlantis/security/advisories/new).
 
 # Updating The Website
 * To view the generated website locally, run `yarn website:dev` and then
 open your browser to http://localhost:8080.
-* The website will be regenerated when your pull request is merged to master.
+* The website will be regenerated when your pull request is merged to main.
 
 # Developing
 
@@ -78,7 +78,7 @@ docker run --rm -v $(pwd):/go/src/github.com/runatlantis/atlantis -w /go/src/git
 
 ## Calling Your Local Atlantis From GitHub
 - Create a test terraform repository in your GitHub.
-- Create a personal access token for Atlantis. See [Create a GitHub token](https://github.com/runatlantis/atlantis/tree/master/runatlantis.io/docs/access-credentials.md#generating-an-access-token).
+- Create a personal access token for Atlantis. See [Create a GitHub token](https://github.com/runatlantis/atlantis/tree/main/runatlantis.io/docs/access-credentials.md#generating-an-access-token).
 - Start Atlantis in server mode using that token:
 ```
 atlantis server --gh-user <your username> --gh-token <your token> --repo-allowlist <your repo> --gh-webhook-secret <your webhook secret> --log-level debug
@@ -88,7 +88,7 @@ atlantis server --gh-user <your username> --gh-token <your token> --repo-allowli
 ```
 ngrok http 4141
 ```
-- Create a Webhook in your repo and use the `https` url that `ngrok` printed out after running `ngrok http 4141`. Be sure to append `/events` so your webhook url looks something like `https://efce3bcd.ngrok.io/events`. See [Add GitHub Webhook](https://github.com/runatlantis/atlantis/blob/master/runatlantis.io/docs/configuring-webhooks.md#configuring-webhooks).
+- Create a Webhook in your repo and use the `https` url that `ngrok` printed out after running `ngrok http 4141`. Be sure to append `/events` so your webhook url looks something like `https://efce3bcd.ngrok.io/events`. See [Add GitHub Webhook](https://github.com/runatlantis/atlantis/blob/main/runatlantis.io/docs/configuring-webhooks.md#configuring-webhooks).
 - Create a pull request and type `atlantis help`. You should see the request in the `ngrok` and Atlantis logs and you should also see Atlantis comment back.
 
 ## Code Style
@@ -163,9 +163,9 @@ go get github.com/petergtz/pegomock/...
 # Creating a New Release
 1. Update version number in `main.go`.
 1. Update image tag version in the [kustomize/bundle.yaml](kustomize/bundle.yaml).
-1. Update `CHANGELOG.md` with latest release number and information (this URL might be useful: https://github.com/runatlantis/atlantis/compare/v0.3.5...master)
-1. Create a pull request and merge to master
-1. Check out master and fetch latest
+1. Update `CHANGELOG.md` with latest release number and information (this URL might be useful: https://github.com/runatlantis/atlantis/compare/v0.3.5...main)
+1. Create a pull request and merge to main
+1. Check out main and fetch latest
 1. Run `make release`
     1. If you get `signal: killed` errors, bump up your Docker resources to have more memory, e.g. 6 G.B.
 1. Go to https://github.com/runatlantis/atlantis/releases and click "Draft a new release"
@@ -173,5 +173,5 @@ go get github.com/petergtz/pegomock/...
     1. The title of the release is the same as the tag (ex. v0.2.2)
     1. Fill in description by copying from the CHANGELOG just without the Downloads section
     1. Drag in binaries made with `make release`
-1. Re-run master branch build to ensure tag gets pushed to Github: https://github.com/runatlantis/atlantis/pkgs/container/atlantis
+1. Re-run main branch build to ensure tag gets pushed to Github: https://github.com/runatlantis/atlantis/pkgs/container/atlantis
 1. Update the default version in `Chart.yaml` in [the official Helm chart](https://github.com/runatlantis/helm-charts/blob/main/charts/atlantis/values.yaml).
diff --git a/Dockerfile b/Dockerfile
index ed5143afc7..d379b56323 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Stage 1: build artifact
-FROM golang:1.19.2-alpine AS builder
+FROM golang:1.19.3-alpine AS builder
 
 WORKDIR /app
 COPY . /app
@@ -7,17 +7,17 @@ RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -v -o atlantis .
 
 # Stage 2
 # The runatlantis/atlantis-base is created by docker-base/Dockerfile.
-FROM ghcr.io/runatlantis/atlantis-base:2022.10.06 AS base
+FROM ghcr.io/runatlantis/atlantis-base:2022.11.13 AS base
 
 # Get the architecture the image is being built for
 ARG TARGETPLATFORM
 
 # install terraform binaries
-ENV DEFAULT_TERRAFORM_VERSION=1.3.1
+ENV DEFAULT_TERRAFORM_VERSION=1.3.5
 
 # In the official Atlantis image we only have the latest of each Terraform version.
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-RUN AVAILABLE_TERRAFORM_VERSIONS="0.11.15 0.12.31 0.13.7 0.14.11 0.15.5 1.0.11 1.1.9 1.2.9 ${DEFAULT_TERRAFORM_VERSION}" && \
+RUN AVAILABLE_TERRAFORM_VERSIONS="1.0.11 1.1.9 1.2.9 ${DEFAULT_TERRAFORM_VERSION}" && \
     case "${TARGETPLATFORM}" in \
         "linux/amd64") TERRAFORM_ARCH=amd64 ;; \
         "linux/arm64") TERRAFORM_ARCH=arm64 ;; \
@@ -36,7 +36,7 @@ RUN AVAILABLE_TERRAFORM_VERSIONS="0.11.15 0.12.31 0.13.7 0.14.11 0.15.5 1.0.11 1
     done && \
     ln -s "/usr/local/bin/tf/versions/${DEFAULT_TERRAFORM_VERSION}/terraform" /usr/local/bin/terraform
 
-ENV DEFAULT_CONFTEST_VERSION=0.34.0
+ENV DEFAULT_CONFTEST_VERSION=0.35.0
 
 RUN AVAILABLE_CONFTEST_VERSIONS="${DEFAULT_CONFTEST_VERSION}" && \
     case ${TARGETPLATFORM} in \
diff --git a/Dockerfile.dev b/Dockerfile.dev
index cd0de4a7ed..d9ed7aad63 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -1,6 +1,6 @@
 FROM ghcr.io/runatlantis/atlantis:latest
 COPY atlantis /usr/local/bin/atlantis
 # TODO: remove this once we get this in the base image
-ENV DEFAULT_CONFTEST_VERSION=0.34.0
+ENV DEFAULT_CONFTEST_VERSION=0.35.0
 
 WORKDIR /atlantis/src
diff --git a/Makefile b/Makefile
index cd6a6884fe..38497806ca 100644
--- a/Makefile
+++ b/Makefile
@@ -4,8 +4,6 @@ PKG := $(shell go list ./... | grep -v e2e | grep -v static | grep -v mocks | gr
 PKG_COMMAS := $(shell go list ./... | grep -v e2e | grep -v static | grep -v mocks | grep -v testing | tr '\n' ',')
 IMAGE_NAME := runatlantis/atlantis
 
-.PHONY: test
-
 .DEFAULT_GOAL := help
 help: ## List targets & descriptions
 	@cat Makefile* | grep -E '^[a-zA-Z_-]+:.*?## .*$$' | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
@@ -25,19 +23,28 @@ build-service: ## Build the main Go service
 go-generate: ## Run go generate in all packages
 	./scripts/go-generate.sh
 
-regen-mocks: ## Delete all mocks and matchers and then run go generate to regen them.
+regen-mocks: ## Delete and regenerate all mocks
 	find . -type f | grep mocks/mock_ | xargs rm
 	find . -type f | grep mocks/matchers | xargs rm
 	@# not using $(PKG) here because that includes directories that have now
 	@# been made empty, causing go generate to fail.
 	./scripts/go-generate.sh
 
+.PHONY: test
 test: ## Run tests
 	@go test -short $(PKG)
 
+.PHONY: docker/test
+docker/test: ## Run tests in docker
+	docker run -it -v $(pwd):/atlantis ghcr.io/runatlantis/testing-env:2022.11.17 sh -c "cd /atlantis && make test"
+
 test-all: ## Run tests including integration
 	@go test  $(PKG)
 
+.PHONY: docker/test-all
+docker/test-all: ## Run all tests in docker
+	docker run -it -v $(pwd):/atlantis ghcr.io/runatlantis/testing-env:2022.11.17 sh -c "cd /atlantis && make test-all"
+
 test-coverage:
 	@mkdir -p .cover
 	@go test -covermode atomic -coverprofile .cover/cover.out $(PKG)
@@ -51,11 +58,11 @@ dev-docker:
 	GOOS=linux GOARCH=amd64 go build -o atlantis .
 	docker build -f Dockerfile.dev -t atlantis-dev .
 
-dist: ## Package up everything in static/ using go-bindata-assetfs so it can be served by a single binary
+dist: ## Package static/ using go-bindata-assetfs into a single binary
 	rm -f server/static/bindata_assetfs.go && go-bindata-assetfs -o bindata_assetfs.go -pkg static -prefix server server/static/... && mv bindata_assetfs.go server/static
 
 release: ## Create packages for a release
-	docker run -v $$(pwd):/go/src/github.com/runatlantis/atlantis circleci/golang:1.17 sh -c 'cd /go/src/github.com/runatlantis/atlantis && scripts/binary-release.sh'
+	docker run -v $$(pwd):/go/src/github.com/runatlantis/atlantis cimg/go:1.19 sh -c 'cd /go/src/github.com/runatlantis/atlantis && scripts/binary-release.sh'
 
 fmt: ## Run goimports (which also formats)
 	goimports -w $$(find . -type f -name '*.go' ! -path "./vendor/*" ! -path "./server/static/bindata_assetfs.go" ! -path "**/mocks/*")
@@ -64,7 +71,7 @@ lint: ## Run linter locally
 	golangci-lint run
 
 check-lint: ## Run linter in CI/CD. If running locally use 'lint'
-	curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b ./bin v1.39.0
+	curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b ./bin v1.49.0
 	./bin/golangci-lint run -j 4 --timeout 5m
 
 check-fmt: ## Fail if not formatted
diff --git a/README.md b/README.md
index f0b7dd2434..52be8e15af 100644
--- a/README.md
+++ b/README.md
@@ -2,8 +2,8 @@
 
 [![SuperDopeBadge](./runatlantis.io/.vuepress/public/hightower-super-dope.svg)](https://twitter.com/kelseyhightower/status/893260922222813184)
 [![Go Report Card](https://goreportcard.com/badge/github.com/runatlantis/atlantis)](https://goreportcard.com/report/github.com/runatlantis/atlantis)
-[![codecov](https://codecov.io/gh/runatlantis/atlantis/branch/master/graph/badge.svg)](https://codecov.io/gh/runatlantis/atlantis)
-[![CircleCI](https://circleci.com/gh/runatlantis/atlantis/tree/master.svg?style=shield)](https://circleci.com/gh/runatlantis/atlantis/tree/master)
+[![codecov](https://codecov.io/gh/runatlantis/atlantis/branch/main/graph/badge.svg)](https://codecov.io/gh/runatlantis/atlantis)
+[![CircleCI](https://circleci.com/gh/runatlantis/atlantis/tree/main.svg?style=shield)](https://circleci.com/gh/runatlantis/atlantis/tree/main)
 [![Slack](https://img.shields.io/badge/Join-Atlantis%20Community%20Slack-red)](https://join.slack.com/t/atlantis-community/shared_invite/enQtNzc4NDM3OTA3ODI0LTA5NDQ4YTA3NTAxM2I3ZmIxMGNiYWJhNmY4YjBjZjM3OWMzNGI0NTcxNzY2NjRhODIyODA4YmNjOTBiOThhNTI)
 
 <p align="center">
diff --git a/SECURITY.md b/SECURITY.md
index 5f7cb7d2b2..7c6f94f07e 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,4 +2,4 @@
 
 ## Reporting a Vulnerability
 
-We take security issues seriously. Please email us directly at security [at] runatlantis.io instead of opening an issue.
+We take security issues seriously. Please report a security vulnerability to the maintainers using [private vulnerability reporting](https://github.com/runatlantis/atlantis/security/advisories/new).
diff --git a/cmd/server.go b/cmd/server.go
index 877aa6c25c..be5dd3b8f6 100644
--- a/cmd/server.go
+++ b/cmd/server.go
@@ -37,63 +37,65 @@ import (
 // 3. Add your flag's description etc. to the stringFlags, intFlags, or boolFlags slices.
 const (
 	// Flag names.
-	ADWebhookPasswordFlag       = "azuredevops-webhook-password" // nolint: gosec
-	ADWebhookUserFlag           = "azuredevops-webhook-user"
-	ADTokenFlag                 = "azuredevops-token" // nolint: gosec
-	ADUserFlag                  = "azuredevops-user"
-	ADHostnameFlag              = "azuredevops-hostname"
-	AllowForkPRsFlag            = "allow-fork-prs"
-	AllowRepoConfigFlag         = "allow-repo-config"
-	AtlantisURLFlag             = "atlantis-url"
-	AutomergeFlag               = "automerge"
-	AutoplanFileListFlag        = "autoplan-file-list"
-	BitbucketBaseURLFlag        = "bitbucket-base-url"
-	BitbucketTokenFlag          = "bitbucket-token"
-	BitbucketUserFlag           = "bitbucket-user"
-	BitbucketWebhookSecretFlag  = "bitbucket-webhook-secret"
-	ConfigFlag                  = "config"
-	CheckoutStrategyFlag        = "checkout-strategy"
-	DataDirFlag                 = "data-dir"
-	DefaultTFVersionFlag        = "default-tf-version"
-	DisableApplyAllFlag         = "disable-apply-all"
-	DisableApplyFlag            = "disable-apply"
-	DisableAutoplanFlag         = "disable-autoplan"
-	DisableMarkdownFoldingFlag  = "disable-markdown-folding"
-	DisableRepoLockingFlag      = "disable-repo-locking"
-	EnablePolicyChecksFlag      = "enable-policy-checks"
-	EnableRegExpCmdFlag         = "enable-regexp-cmd"
-	EnableDiffMarkdownFormat    = "enable-diff-markdown-format"
-	GHHostnameFlag              = "gh-hostname"
-	GHTeamAllowlistFlag         = "gh-team-allowlist"
-	GHTokenFlag                 = "gh-token"
-	GHUserFlag                  = "gh-user"
-	GHAppIDFlag                 = "gh-app-id"
-	GHAppKeyFlag                = "gh-app-key"
-	GHAppKeyFileFlag            = "gh-app-key-file"
-	GHAppSlugFlag               = "gh-app-slug"
-	GHOrganizationFlag          = "gh-org"
-	GHWebhookSecretFlag         = "gh-webhook-secret"               // nolint: gosec
-	GHAllowMergeableBypassApply = "gh-allow-mergeable-bypass-apply" // nolint: gosec
-	GitlabHostnameFlag          = "gitlab-hostname"
-	GitlabTokenFlag             = "gitlab-token"
-	GitlabUserFlag              = "gitlab-user"
-	GitlabWebhookSecretFlag     = "gitlab-webhook-secret" // nolint: gosec
-	APISecretFlag               = "api-secret"
-	HidePrevPlanComments        = "hide-prev-plan-comments"
-	LockingDBType               = "locking-db-type"
-	LogLevelFlag                = "log-level"
-	ParallelPoolSize            = "parallel-pool-size"
-	StatsNamespace              = "stats-namespace"
-	AllowDraftPRs               = "allow-draft-prs"
-	PortFlag                    = "port"
-	RedisDB                     = "redis-db"
-	RedisHost                   = "redis-host"
-	RedisPassword               = "redis-password"
-	RedisPort                   = "redis-port"
-	RedisTLSEnabled             = "redis-tls-enabled"
-	RedisInsecureSkipVerify     = "redis-insecure-skip-verify"
-	RepoConfigFlag              = "repo-config"
-	RepoConfigJSONFlag          = "repo-config-json"
+	ADWebhookPasswordFlag            = "azuredevops-webhook-password" // nolint: gosec
+	ADWebhookUserFlag                = "azuredevops-webhook-user"
+	ADTokenFlag                      = "azuredevops-token" // nolint: gosec
+	ADUserFlag                       = "azuredevops-user"
+	ADHostnameFlag                   = "azuredevops-hostname"
+	AllowForkPRsFlag                 = "allow-fork-prs"
+	AllowRepoConfigFlag              = "allow-repo-config"
+	AtlantisURLFlag                  = "atlantis-url"
+	AutomergeFlag                    = "automerge"
+	AutoplanFileListFlag             = "autoplan-file-list"
+	BitbucketBaseURLFlag             = "bitbucket-base-url"
+	BitbucketTokenFlag               = "bitbucket-token"
+	BitbucketUserFlag                = "bitbucket-user"
+	BitbucketWebhookSecretFlag       = "bitbucket-webhook-secret"
+	ConfigFlag                       = "config"
+	CheckoutStrategyFlag             = "checkout-strategy"
+	DataDirFlag                      = "data-dir"
+	DefaultTFVersionFlag             = "default-tf-version"
+	DisableApplyAllFlag              = "disable-apply-all"
+	DisableApplyFlag                 = "disable-apply"
+	DisableAutoplanFlag              = "disable-autoplan"
+	DisableMarkdownFoldingFlag       = "disable-markdown-folding"
+	DisableRepoLockingFlag           = "disable-repo-locking"
+	EnablePolicyChecksFlag           = "enable-policy-checks"
+	EnableRegExpCmdFlag              = "enable-regexp-cmd"
+	EnableDiffMarkdownFormat         = "enable-diff-markdown-format"
+	GHHostnameFlag                   = "gh-hostname"
+	GHTeamAllowlistFlag              = "gh-team-allowlist"
+	GHTokenFlag                      = "gh-token"
+	GHUserFlag                       = "gh-user"
+	GHAppIDFlag                      = "gh-app-id"
+	GHAppKeyFlag                     = "gh-app-key"
+	GHAppKeyFileFlag                 = "gh-app-key-file"
+	GHAppSlugFlag                    = "gh-app-slug"
+	GHOrganizationFlag               = "gh-org"
+	GHWebhookSecretFlag              = "gh-webhook-secret"               // nolint: gosec
+	GHAllowMergeableBypassApply      = "gh-allow-mergeable-bypass-apply" // nolint: gosec
+	GitlabHostnameFlag               = "gitlab-hostname"
+	GitlabTokenFlag                  = "gitlab-token"
+	GitlabUserFlag                   = "gitlab-user"
+	GitlabWebhookSecretFlag          = "gitlab-webhook-secret" // nolint: gosec
+	APISecretFlag                    = "api-secret"
+	HidePrevPlanComments             = "hide-prev-plan-comments"
+	QuietPolicyChecks                = "quiet-policy-checks"
+	LockingDBType                    = "locking-db-type"
+	LogLevelFlag                     = "log-level"
+	MarkdownTemplateOverridesDirFlag = "markdown-template-overrides-dir"
+	ParallelPoolSize                 = "parallel-pool-size"
+	StatsNamespace                   = "stats-namespace"
+	AllowDraftPRs                    = "allow-draft-prs"
+	PortFlag                         = "port"
+	RedisDB                          = "redis-db"
+	RedisHost                        = "redis-host"
+	RedisPassword                    = "redis-password"
+	RedisPort                        = "redis-port"
+	RedisTLSEnabled                  = "redis-tls-enabled"
+	RedisInsecureSkipVerify          = "redis-insecure-skip-verify"
+	RepoConfigFlag                   = "repo-config"
+	RepoConfigJSONFlag               = "repo-config-json"
 	// RepoWhitelistFlag is deprecated for RepoAllowlistFlag.
 	RepoWhitelistFlag          = "repo-whitelist"
 	RepoAllowlistFlag          = "repo-allowlist"
@@ -115,36 +117,38 @@ const (
 	TFEHostnameFlag            = "tfe-hostname"
 	TFELocalExecutionModeFlag  = "tfe-local-execution-mode"
 	TFETokenFlag               = "tfe-token"
-	WriteGitCredsFlag          = "write-git-creds"
+	WriteGitCredsFlag          = "write-git-creds" // nolint: gosec
 	WebBasicAuthFlag           = "web-basic-auth"
 	WebUsernameFlag            = "web-username"
 	WebPasswordFlag            = "web-password"
+	WebsocketCheckOrigin       = "websocket-check-origin"
 
 	// NOTE: Must manually set these as defaults in the setDefaults function.
-	DefaultADBasicUser             = ""
-	DefaultADBasicPassword         = ""
-	DefaultADHostname              = "dev.azure.com"
-	DefaultAutoplanFileList        = "**/*.tf,**/*.tfvars,**/*.tfvars.json,**/terragrunt.hcl,**/.terraform.lock.hcl"
-	DefaultCheckoutStrategy        = "branch"
-	DefaultBitbucketBaseURL        = bitbucketcloud.BaseURL
-	DefaultDataDir                 = "~/.atlantis"
-	DefaultGHHostname              = "github.com"
-	DefaultGitlabHostname          = "gitlab.com"
-	DefaultLockingDBType           = "boltdb"
-	DefaultLogLevel                = "info"
-	DefaultParallelPoolSize        = 15
-	DefaultStatsNamespace          = "atlantis"
-	DefaultPort                    = 4141
-	DefaultRedisDB                 = 0
-	DefaultRedisPort               = 6379
-	DefaultRedisTLSEnabled         = false
-	DefaultRedisInsecureSkipVerify = false
-	DefaultTFDownloadURL           = "https://releases.hashicorp.com"
-	DefaultTFEHostname             = "app.terraform.io"
-	DefaultVCSStatusName           = "atlantis"
-	DefaultWebBasicAuth            = false
-	DefaultWebUsername             = "atlantis"
-	DefaultWebPassword             = "atlantis"
+	DefaultADBasicUser                  = ""
+	DefaultADBasicPassword              = ""
+	DefaultADHostname                   = "dev.azure.com"
+	DefaultAutoplanFileList             = "**/*.tf,**/*.tfvars,**/*.tfvars.json,**/terragrunt.hcl,**/.terraform.lock.hcl"
+	DefaultCheckoutStrategy             = "branch"
+	DefaultBitbucketBaseURL             = bitbucketcloud.BaseURL
+	DefaultDataDir                      = "~/.atlantis"
+	DefaultMarkdownTemplateOverridesDir = "~/.markdown_templates"
+	DefaultGHHostname                   = "github.com"
+	DefaultGitlabHostname               = "gitlab.com"
+	DefaultLockingDBType                = "boltdb"
+	DefaultLogLevel                     = "info"
+	DefaultParallelPoolSize             = 15
+	DefaultStatsNamespace               = "atlantis"
+	DefaultPort                         = 4141
+	DefaultRedisDB                      = 0
+	DefaultRedisPort                    = 6379
+	DefaultRedisTLSEnabled              = false
+	DefaultRedisInsecureSkipVerify      = false
+	DefaultTFDownloadURL                = "https://releases.hashicorp.com"
+	DefaultTFEHostname                  = "app.terraform.io"
+	DefaultVCSStatusName                = "atlantis"
+	DefaultWebBasicAuth                 = false
+	DefaultWebUsername                  = "atlantis"
+	DefaultWebPassword                  = "atlantis"
 )
 
 var stringFlags = map[string]stringFlag{
@@ -201,7 +205,7 @@ var stringFlags = map[string]stringFlag{
 	CheckoutStrategyFlag: {
 		description: "How to check out pull requests. Accepts either 'branch' (default) or 'merge'." +
 			" If set to branch, Atlantis will check out the source branch of the pull request." +
-			" If set to merge, Atlantis will check out the destination branch of the pull request (ex. master)" +
+			" If set to merge, Atlantis will check out the destination branch of the pull request (ex. main, master)" +
 			" and then locally perform a git merge of the source branch." +
 			" This effectively means Atlantis operates on the repo as it will look" +
 			" after the pull request is merged.",
@@ -284,6 +288,10 @@ var stringFlags = map[string]stringFlag{
 		description:  "Log level. Either debug, info, warn, or error.",
 		defaultValue: DefaultLogLevel,
 	},
+	MarkdownTemplateOverridesDirFlag: {
+		description:  "Directory for custom overrides to the markdown templates used for comments.",
+		defaultValue: DefaultMarkdownTemplateOverridesDir,
+	},
 	StatsNamespace: {
 		description:  "Namespace for aggregating stats.",
 		defaultValue: DefaultStatsNamespace,
@@ -410,6 +418,10 @@ var boolFlags = map[string]boolFlag{
 			"VCS support is limited to: GitHub.",
 		defaultValue: false,
 	},
+	QuietPolicyChecks: {
+		description:  "Exclude policy check comments from pull requests unless there's an actual error from conftest. This also excludes warnings.",
+		defaultValue: false,
+	},
 	RedisTLSEnabled: {
 		description:  "Enable TLS on the connection to Redis with a min TLS version of 1.2",
 		defaultValue: DefaultRedisTLSEnabled,
@@ -470,6 +482,10 @@ var boolFlags = map[string]boolFlag{
 		description:  "Switches on or off the Basic Authentication on the HTTP Middleware interface",
 		defaultValue: DefaultWebBasicAuth,
 	},
+	WebsocketCheckOrigin: {
+		description:  "Enable websocket origin check",
+		defaultValue: false,
+	},
 }
 var intFlags = map[string]intFlag{
 	ParallelPoolSize: {
@@ -666,6 +682,9 @@ func (s *ServerCmd) run() error {
 	if err := s.setDataDir(&userConfig); err != nil {
 		return err
 	}
+	if err := s.setMarkdownTemplateOverridesDir(&userConfig); err != nil {
+		return err
+	}
 	s.setVarFileAllowlist(&userConfig)
 	if err := s.deprecationWarnings(&userConfig); err != nil {
 		return err
@@ -682,6 +701,7 @@ func (s *ServerCmd) run() error {
 		RepoConfigJSONFlag:      RepoConfigJSONFlag,
 		SilenceForkPRErrorsFlag: SilenceForkPRErrorsFlag,
 	})
+
 	if err != nil {
 		return errors.Wrap(err, "initializing server")
 	}
@@ -716,6 +736,9 @@ func (s *ServerCmd) setDefaults(c *server.UserConfig) {
 	if c.LogLevel == "" {
 		c.LogLevel = DefaultLogLevel
 	}
+	if c.MarkdownTemplateOverridesDir == "" {
+		c.MarkdownTemplateOverridesDir = DefaultMarkdownTemplateOverridesDir
+	}
 	if c.ParallelPoolSize == 0 {
 		c.ParallelPoolSize = DefaultParallelPoolSize
 	}
@@ -881,6 +904,30 @@ func (s *ServerCmd) setDataDir(userConfig *server.UserConfig) error {
 	return nil
 }
 
+// setMarkdownTemplateOverridesDir checks if ~ was used in markdown-template-overrides-dir and converts it to the actual
+// home directory. If we don't do this, we'll create a directory called "~"
+// instead of actually using home. It also converts relative paths to absolute.
+func (s *ServerCmd) setMarkdownTemplateOverridesDir(userConfig *server.UserConfig) error {
+	finalPath := userConfig.MarkdownTemplateOverridesDir
+
+	// Convert ~ to the actual home dir.
+	if strings.HasPrefix(finalPath, "~/") {
+		var err error
+		finalPath, err = homedir.Expand(finalPath)
+		if err != nil {
+			return errors.Wrap(err, "determining home directory")
+		}
+	}
+
+	// Convert relative paths to absolute.
+	finalPath, err := filepath.Abs(finalPath)
+	if err != nil {
+		return errors.Wrap(err, "making markdown-template-overrides-dir absolute")
+	}
+	userConfig.MarkdownTemplateOverridesDir = finalPath
+	return nil
+}
+
 // setVarFileAllowlist checks if var-file-allowlist is unassigned and makes it default to data-dir for better backward
 // compatibility.
 func (s *ServerCmd) setVarFileAllowlist(userConfig *server.UserConfig) {
diff --git a/cmd/server_test.go b/cmd/server_test.go
index c8110dfa48..09941e4aba 100644
--- a/cmd/server_test.go
+++ b/cmd/server_test.go
@@ -51,66 +51,67 @@ func (s *ServerStarterMock) Start() error {
 // Adding a new flag? Add it to this slice for testing in alphabetical
 // order.
 var testFlags = map[string]interface{}{
-	ADTokenFlag:                "ad-token",
-	ADUserFlag:                 "ad-user",
-	ADWebhookPasswordFlag:      "ad-wh-pass",
-	ADWebhookUserFlag:          "ad-wh-user",
-	AtlantisURLFlag:            "url",
-	AllowForkPRsFlag:           true,
-	AllowRepoConfigFlag:        true,
-	AutomergeFlag:              true,
-	AutoplanFileListFlag:       "**/*.tf,**/*.yml",
-	BitbucketBaseURLFlag:       "https://bitbucket-base-url.com",
-	BitbucketTokenFlag:         "bitbucket-token",
-	BitbucketUserFlag:          "bitbucket-user",
-	BitbucketWebhookSecretFlag: "bitbucket-secret",
-	CheckoutStrategyFlag:       "merge",
-	DataDirFlag:                "/path",
-	DefaultTFVersionFlag:       "v0.11.0",
-	DisableApplyAllFlag:        true,
-	DisableApplyFlag:           true,
-	DisableMarkdownFoldingFlag: true,
-	DisableRepoLockingFlag:     true,
-	GHHostnameFlag:             "ghhostname",
-	GHTokenFlag:                "token",
-	GHUserFlag:                 "user",
-	GHAppIDFlag:                int64(0),
-	GHAppKeyFlag:               "",
-	GHAppKeyFileFlag:           "",
-	GHAppSlugFlag:              "atlantis",
-	GHOrganizationFlag:         "",
-	GHWebhookSecretFlag:        "secret",
-	GitlabHostnameFlag:         "gitlab-hostname",
-	GitlabTokenFlag:            "gitlab-token",
-	GitlabUserFlag:             "gitlab-user",
-	GitlabWebhookSecretFlag:    "gitlab-secret",
-	LockingDBType:              "boltdb",
-	LogLevelFlag:               "debug",
-	StatsNamespace:             "atlantis",
-	AllowDraftPRs:              true,
-	PortFlag:                   8181,
-	ParallelPoolSize:           100,
-	RepoAllowlistFlag:          "github.com/runatlantis/atlantis",
-	RequireApprovalFlag:        true,
-	RequireMergeableFlag:       true,
-	SilenceNoProjectsFlag:      false,
-	SilenceForkPRErrorsFlag:    true,
-	SilenceAllowlistErrorsFlag: true,
-	SilenceVCSStatusNoPlans:    true,
-	SkipCloneNoChanges:         true,
-	SlackTokenFlag:             "slack-token",
-	SSLCertFileFlag:            "cert-file",
-	SSLKeyFileFlag:             "key-file",
-	TFDownloadURLFlag:          "https://my-hostname.com",
-	TFEHostnameFlag:            "my-hostname",
-	TFELocalExecutionModeFlag:  true,
-	TFETokenFlag:               "my-token",
-	VCSStatusName:              "my-status",
-	WriteGitCredsFlag:          true,
-	DisableAutoplanFlag:        true,
-	EnablePolicyChecksFlag:     false,
-	EnableRegExpCmdFlag:        false,
-	EnableDiffMarkdownFormat:   false,
+	ADTokenFlag:                      "ad-token",
+	ADUserFlag:                       "ad-user",
+	ADWebhookPasswordFlag:            "ad-wh-pass",
+	ADWebhookUserFlag:                "ad-wh-user",
+	AtlantisURLFlag:                  "url",
+	AllowForkPRsFlag:                 true,
+	AllowRepoConfigFlag:              true,
+	AutomergeFlag:                    true,
+	AutoplanFileListFlag:             "**/*.tf,**/*.yml",
+	BitbucketBaseURLFlag:             "https://bitbucket-base-url.com",
+	BitbucketTokenFlag:               "bitbucket-token",
+	BitbucketUserFlag:                "bitbucket-user",
+	BitbucketWebhookSecretFlag:       "bitbucket-secret",
+	CheckoutStrategyFlag:             "merge",
+	DataDirFlag:                      "/path",
+	DefaultTFVersionFlag:             "v0.11.0",
+	DisableApplyAllFlag:              true,
+	DisableApplyFlag:                 true,
+	DisableMarkdownFoldingFlag:       true,
+	DisableRepoLockingFlag:           true,
+	GHHostnameFlag:                   "ghhostname",
+	GHTokenFlag:                      "token",
+	GHUserFlag:                       "user",
+	GHAppIDFlag:                      int64(0),
+	GHAppKeyFlag:                     "",
+	GHAppKeyFileFlag:                 "",
+	GHAppSlugFlag:                    "atlantis",
+	GHOrganizationFlag:               "",
+	GHWebhookSecretFlag:              "secret",
+	GitlabHostnameFlag:               "gitlab-hostname",
+	GitlabTokenFlag:                  "gitlab-token",
+	GitlabUserFlag:                   "gitlab-user",
+	GitlabWebhookSecretFlag:          "gitlab-secret",
+	LockingDBType:                    "boltdb",
+	LogLevelFlag:                     "debug",
+	MarkdownTemplateOverridesDirFlag: "/path2",
+	StatsNamespace:                   "atlantis",
+	AllowDraftPRs:                    true,
+	PortFlag:                         8181,
+	ParallelPoolSize:                 100,
+	RepoAllowlistFlag:                "github.com/runatlantis/atlantis",
+	RequireApprovalFlag:              true,
+	RequireMergeableFlag:             true,
+	SilenceNoProjectsFlag:            false,
+	SilenceForkPRErrorsFlag:          true,
+	SilenceAllowlistErrorsFlag:       true,
+	SilenceVCSStatusNoPlans:          true,
+	SkipCloneNoChanges:               true,
+	SlackTokenFlag:                   "slack-token",
+	SSLCertFileFlag:                  "cert-file",
+	SSLKeyFileFlag:                   "key-file",
+	TFDownloadURLFlag:                "https://my-hostname.com",
+	TFEHostnameFlag:                  "my-hostname",
+	TFELocalExecutionModeFlag:        true,
+	TFETokenFlag:                     "my-token",
+	VCSStatusName:                    "my-status",
+	WriteGitCredsFlag:                true,
+	DisableAutoplanFlag:              true,
+	EnablePolicyChecksFlag:           false,
+	EnableRegExpCmdFlag:              false,
+	EnableDiffMarkdownFormat:         false,
 }
 
 func TestExecute_Defaults(t *testing.T) {
@@ -128,17 +129,20 @@ func TestExecute_Defaults(t *testing.T) {
 	hostname, err := os.Hostname()
 	Ok(t, err)
 
-	// Get our home dir since that's what data-dir defaulted to.
+	// Get our home dir since that's what data-dir and markdown-template-overrides-dir defaulted to.
 	dataDir, err := homedir.Expand("~/.atlantis")
 	Ok(t, err)
+	markdownTemplateOverridesDir, err := homedir.Expand("~/.markdown_templates")
+	Ok(t, err)
 
 	strExceptions := map[string]string{
-		GHUserFlag:           "user",
-		GHTokenFlag:          "token",
-		DataDirFlag:          dataDir,
-		AtlantisURLFlag:      "http://" + hostname + ":4141",
-		RepoAllowlistFlag:    "*",
-		VarFileAllowlistFlag: dataDir,
+		GHUserFlag:                       "user",
+		GHTokenFlag:                      "token",
+		DataDirFlag:                      dataDir,
+		MarkdownTemplateOverridesDirFlag: markdownTemplateOverridesDir,
+		AtlantisURLFlag:                  "http://" + hostname + ":4141",
+		RepoAllowlistFlag:                "*",
+		VarFileAllowlistFlag:             dataDir,
 	}
 	strIgnore := map[string]bool{
 		"config": true,
diff --git a/docker-base/Dockerfile b/docker-base/Dockerfile
index 9c49967753..3865690713 100644
--- a/docker-base/Dockerfile
+++ b/docker-base/Dockerfile
@@ -1,7 +1,7 @@
 # This Dockerfile builds our base image with gosu, dumb-init and the atlantis
 # user. We split this from the main Dockerfile because this base doesn't change
 # and also because it kept breaking the build due to flakiness.
-FROM alpine:3.16.2
+FROM alpine:3.16.3
 LABEL authors="Anubhav Mishra, Luke Kysow"
 
 # We use gosu to step down from root and run as the atlantis user so we need
@@ -25,12 +25,22 @@ ENV GIT_LFS_VERSION=3.1.2
 ARG TARGETPLATFORM
 
 # Install packages needed for running Atlantis.
-RUN apk add --no-cache ca-certificates curl git unzip bash openssh libcap dumb-init gcompat && \
+RUN apk add --no-cache \
+        ca-certificates=20220614-r0 \
+        curl=7.83.1-r4 \
+        git=2.36.3-r0 \
+        unzip=6.0-r9 \
+        bash=5.1.16-r2 \
+        openssh=9.0_p1-r2 \
+        libcap=2.64-r0 \
+        dumb-init=1.2.5-r1 \
+        gcompat=1.0.0-r4 && \
     # Install packages needed for building dependencies.
-    apk add --no-cache --virtual .build-deps gnupg openssl && \
+    apk add --no-cache --virtual .build-deps \
+        gnupg=2.2.35-r4 \
+        openssl=1.1.1s-r0 && \
     mkdir -p /tmp/build && \
     cd /tmp/build && \
-
     # git-lfs
     case ${TARGETPLATFORM} in \
         "linux/amd64") GIT_LFS_ARCH=amd64 ;; \
@@ -42,7 +52,6 @@ RUN apk add --no-cache ca-certificates curl git unzip bash openssh libcap dumb-i
     chmod +x git-lfs && \
     mv git-lfs /usr/bin/git-lfs && \
     git-lfs --version && \
-
     # gosu
     case ${TARGETPLATFORM} in \
         "linux/amd64") GOSU_ARCH=amd64 ;; \
@@ -62,7 +71,6 @@ RUN apk add --no-cache ca-certificates curl git unzip bash openssh libcap dumb-i
     chmod +x gosu && \
     cp gosu /bin && \
     gosu --version && \
-
     # Cleanup
     cd /tmp && \
     rm -rf /tmp/build && \
@@ -70,7 +78,3 @@ RUN apk add --no-cache ca-certificates curl git unzip bash openssh libcap dumb-i
     gpgconf --kill gpg-agent && \
     apk del .build-deps && \
     rm -rf /root/.gnupg
-
-# Set up nsswitch.conf for Go's "netgo" implementation
-# - https://github.com/golang/go/blob/go1.9.1/src/net/conf.go#L194-L275
-RUN [ ! -e /etc/nsswitch.conf ] && echo 'hosts: files dns' > /etc/nsswitch.conf
diff --git a/e2e/e2e.go b/e2e/e2e.go
index 5addf721e0..724c6cd5a2 100644
--- a/e2e/e2e.go
+++ b/e2e/e2e.go
@@ -20,7 +20,7 @@ import (
 	"os/exec"
 	"time"
 
-	"github.com/google/go-github/v28/github"
+	"github.com/google/go-github/v48/github"
 )
 
 type E2ETester struct {
@@ -110,7 +110,7 @@ func (t *E2ETester) Start() (*E2EResult, error) {
 	title := fmt.Sprintf("This is a test pull request for atlantis e2e test for %s project type", t.projectType.Name)
 	head := fmt.Sprintf("%s:%s", t.ownerName, branchName)
 	body := ""
-	base := "master"
+	base := "main"
 	newPullRequest := &github.NewPullRequest{Title: &title, Head: &head, Body: &body, Base: &base}
 
 	pull, _, err := t.githubClient.client.PullRequests.Create(t.githubClient.ctx, t.ownerName, t.repoName, newPullRequest)
diff --git a/e2e/github.go b/e2e/github.go
index b260ff3c62..e49f67d75b 100644
--- a/e2e/github.go
+++ b/e2e/github.go
@@ -16,7 +16,7 @@ package main
 import (
 	"context"
 
-	"github.com/google/go-github/v28/github"
+	"github.com/google/go-github/v48/github"
 )
 
 type GithubClient struct {
diff --git a/e2e/go.mod b/e2e/go.mod
index 6df8833bd0..be1943db3e 100644
--- a/e2e/go.mod
+++ b/e2e/go.mod
@@ -1,11 +1,14 @@
 module github.com/runatlantis/atlantis/e2e
 
-go 1.17
+go 1.19
 
 require (
-	github.com/google/go-github/v28 v28.0.0
-	github.com/google/go-querystring v1.0.0 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
-	github.com/hashicorp/go-multierror v1.0.0
-	golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 // indirect
+	github.com/google/go-github/v48 v48.0.0
+	github.com/hashicorp/go-multierror v1.1.1
+)
+
+require (
+	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	golang.org/x/crypto v0.1.0 // indirect
 )
diff --git a/e2e/go.sum b/e2e/go.sum
index 694d623743..6956a8fea8 100644
--- a/e2e/go.sum
+++ b/e2e/go.sum
@@ -1,17 +1,14 @@
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/google/go-github/v28 v28.0.0 h1:+UjHI4+1W/vsXR4jJBWt0ZA74XHbvt5yBAvsf1M3bgM=
-github.com/google/go-github/v28 v28.0.0/go.mod h1:+5GboIspo7F0NG2qsvfYh7en6F3EK37uyqv+c35AR3s=
-github.com/google/go-querystring v1.0.0 h1:Xkwi/a1rcvNg1PPYe5vI8GbeBY/jrVuDX5ASuANWTrk=
-github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-github/v48 v48.0.0 h1:9H5fWVXFK6ZsRriyPbjtnFAkJnoj0WKFtTYfpCRrTm8=
+github.com/google/go-github/v48 v48.0.0/go.mod h1:dDlehKBDo850ZPvCTK0sEqTCVWcrGl2LcDiajkYi89Y=
+github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
+github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-multierror v1.0.0 h1:iVjPR7a6H0tWELX5NxNe7bYopibicUzc7uPribsnS6o=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90PveolxSbWFaJdECFbxSq0Mqo2M=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+golang.org/x/crypto v0.1.0 h1:MDRAIl0xIo9Io2xV565hzXHw3zVseKrJKodhohM5CjU=
+golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/e2e/main.go b/e2e/main.go
index ee837d9908..c04c62c74c 100644
--- a/e2e/main.go
+++ b/e2e/main.go
@@ -21,7 +21,7 @@ import (
 
 	"fmt"
 
-	"github.com/google/go-github/v28/github"
+	"github.com/google/go-github/v48/github"
 	multierror "github.com/hashicorp/go-multierror"
 )
 
diff --git a/go.mod b/go.mod
index 75bbee6296..9615d561b5 100644
--- a/go.mod
+++ b/go.mod
@@ -1,152 +1,150 @@
 module github.com/runatlantis/atlantis
 
-go 1.17
-
-replace google.golang.org/grpc => google.golang.org/grpc v1.29.1
+go 1.19
 
 require (
+	github.com/Masterminds/semver v1.5.0
 	github.com/Masterminds/sprig/v3 v3.2.2
-	github.com/alicebob/miniredis/v2 v2.23.0
+	github.com/alicebob/miniredis/v2 v2.23.1
 	github.com/bradleyfalzon/ghinstallation/v2 v2.1.0
-	github.com/briandowns/spinner v0.0.0-20170614154858-48dbb65d7bd5
+	github.com/briandowns/spinner v1.19.0
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/elazarl/go-bindata-assetfs v1.0.1
 	github.com/flynn-archive/go-shlex v0.0.0-20150515145356-3f9db97f8568
-	github.com/go-ozzo/ozzo-validation v0.0.0-20170913164239-85dcd8368eba
-	github.com/go-redis/redis/v9 v9.0.0-beta.2
+	github.com/go-ozzo/ozzo-validation v3.6.0+incompatible
+	github.com/go-redis/redis/v9 v9.0.0-rc.1
 	github.com/go-test/deep v1.0.8
 	github.com/golang-jwt/jwt/v4 v4.4.2
 	github.com/google/go-github/v31 v31.0.0
-	github.com/google/uuid v1.1.2-0.20200519141726-cb32006e483f
+	github.com/google/uuid v1.3.0
 	github.com/gorilla/mux v1.8.0
 	github.com/gorilla/websocket v1.5.0
 	github.com/hashicorp/go-getter v1.6.2
 	github.com/hashicorp/go-version v1.6.0
-	github.com/hashicorp/terraform-config-inspect v0.0.0-20200806211835-c481b8bfa41e
+	github.com/hashicorp/terraform-config-inspect v0.0.0-20221020162138-81db043ad408
 	github.com/mcdafydd/go-azuredevops v0.12.1
-	github.com/microcosm-cc/bluemonday v1.0.20
-	github.com/mitchellh/colorstring v0.0.0-20150917214807-8631ce90f286
+	github.com/microcosm-cc/bluemonday v1.0.21
+	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/moby/moby v20.10.18+incompatible
+	github.com/moby/moby v20.10.21+incompatible
 	github.com/mohae/deepcopy v0.0.0-20170603005431-491d3605edfb
-	github.com/nlopes/slack v0.4.0
 	github.com/petergtz/pegomock v2.9.0+incompatible
 	github.com/pkg/errors v0.9.1
 	github.com/remeh/sizedwaitgroup v1.0.0
-	github.com/shurcooL/githubv4 v0.0.0-20191127044304-8f68eb5628d0
-	github.com/spf13/cobra v0.0.0-20170905172051-b78744579491
+	github.com/shurcooL/githubv4 v0.0.0-20221021030919-a134b1472cc7
+	github.com/slack-go/slack v0.11.4
+	github.com/spf13/cobra v1.6.1
 	github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper v1.13.0
-	github.com/stretchr/testify v1.8.0
+	github.com/spf13/viper v1.14.0
+	github.com/stretchr/testify v1.8.1
 	github.com/urfave/cli v1.22.10
 	github.com/urfave/negroni v1.0.0
-	github.com/xanzy/go-gitlab v0.69.0
+	github.com/warrensbox/terraform-switcher v0.1.1-0.20221027055942-201c8e92e997
+	github.com/xanzy/go-gitlab v0.74.0
 	go.etcd.io/bbolt v1.3.6
 	go.uber.org/zap v1.23.0
-	golang.org/x/sync v0.0.0-20220513210516-0976fa681c29
-	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
+	golang.org/x/term v0.2.0
+	golang.org/x/text v0.4.0
 	gopkg.in/go-playground/validator.v9 v9.31.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
-	cloud.google.com/go v0.100.2 // indirect
-	cloud.google.com/go/storage v1.14.0 // indirect
-	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.1.1 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
-	github.com/apparentlymart/go-textseg/v12 v12.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
-	github.com/aws/aws-sdk-go v1.34.0 // indirect
+	github.com/aws/aws-sdk-go v1.44.140 // indirect
+	github.com/go-playground/locales v0.14.0 // indirect
+	github.com/go-playground/universal-translator v0.18.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.15.0
+	github.com/inconshreveable/mousetrap v1.0.1 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/leodido/go-urn v1.2.1 // indirect
+	github.com/shurcooL/graphql v0.0.0-20220606043923-3cf50f8a0a29 // indirect
+	github.com/sirupsen/logrus v1.9.0 // indirect
+	go.uber.org/atomic v1.10.0 // indirect
+	gopkg.in/go-playground/assert.v1 v1.2.1 // indirect
+)
+
+require (
+	github.com/cactus/go-statsd-client/statsd v0.0.0-20200623234511-94959e3146b2
+	github.com/twmb/murmur3 v1.1.6 // indirect
+	github.com/uber-go/tally v3.5.0+incompatible
+)
+
+require (
+	cloud.google.com/go v0.107.0 // indirect
+	cloud.google.com/go/compute v1.12.1 // indirect
+	cloud.google.com/go/compute/metadata v0.2.1 // indirect
+	cloud.google.com/go/iam v0.7.0 // indirect
+	cloud.google.com/go/storage v1.28.0 // indirect
+	github.com/Masterminds/goutils v1.1.1 // indirect
+	github.com/Masterminds/semver/v3 v3.1.1 // indirect
+	github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a // indirect
+	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
-	github.com/benbjohnson/clock v1.1.0 // indirect
+	github.com/benbjohnson/clock v1.3.0 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d // indirect
+	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/fatih/color v1.13.0 // indirect
-	github.com/fsnotify/fsnotify v1.5.4 // indirect
-	github.com/go-playground/locales v0.12.1 // indirect
-	github.com/go-playground/universal-translator v0.16.0 // indirect
+	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/go-cmp v0.5.8 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/go-github/v45 v45.2.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.4.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.2.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.7.0 // indirect
 	github.com/gorilla/css v1.0.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.1 // indirect
 	github.com/hashicorp/go-safetemp v1.0.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.6.0 // indirect
-	github.com/huandu/xstrings v1.3.1 // indirect
-	github.com/imdario/mergo v0.3.11 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
-	github.com/jmespath/go-jmespath v0.4.0 // indirect
-	github.com/klauspost/compress v1.11.2 // indirect
-	github.com/leodido/go-urn v1.2.0 // indirect
-	github.com/lusis/slack-test v0.0.0-20190426140909-c40012f20018 // indirect
+	github.com/huandu/xstrings v1.3.3 // indirect
+	github.com/imdario/mergo v0.3.13 // indirect
+	github.com/klauspost/compress v1.15.12 // indirect
+	github.com/m3db/prometheus_client_golang v1.12.8 // indirect
+	github.com/m3db/prometheus_client_model v0.2.1 // indirect
+	github.com/m3db/prometheus_common v0.34.7 // indirect
 	github.com/magiconair/properties v1.8.6 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
-	github.com/mitchellh/copystructure v1.0.0 // indirect
-	github.com/mitchellh/go-testing-interface v1.0.0 // indirect
-	github.com/mitchellh/go-wordwrap v1.0.0 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.16 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/mitchellh/reflectwalk v1.0.0 // indirect
-	github.com/onsi/gomega v1.20.0 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/onsi/gomega v1.21.1 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
+	github.com/pelletier/go-toml/v2 v2.0.6 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/russross/blackfriday/v2 v2.0.1 // indirect
-	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/shurcooL/graphql v0.0.0-20181231061246-d48a9a75455f // indirect
-	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
-	github.com/sirupsen/logrus v1.8.1 // indirect
-	github.com/spf13/afero v1.8.2 // indirect
+	github.com/prometheus/procfs v0.8.0 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/shopspring/decimal v1.3.1 // indirect
+	github.com/spf13/afero v1.9.3 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/subosito/gotenv v1.4.1 // indirect
-	github.com/ulikunitz/xz v0.5.8 // indirect
-	github.com/zclconf/go-cty v1.5.1 // indirect
-	go.opencensus.io v0.23.0 // indirect
-	go.uber.org/atomic v1.9.0 // indirect
-	go.uber.org/multierr v1.6.0 // indirect
-	golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4 // indirect
-	golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b // indirect
-	golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20220411224347-583f2d630306 // indirect
-	golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df // indirect
-	google.golang.org/api v0.81.0 // indirect
+	github.com/ulikunitz/xz v0.5.10 // indirect
+	github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64 // indirect
+	github.com/zclconf/go-cty v1.12.1 // indirect
+	go.opencensus.io v0.24.0 // indirect
+	go.uber.org/multierr v1.8.0 // indirect
+	golang.org/x/crypto v0.3.0 // indirect
+	golang.org/x/net v0.2.0 // indirect
+	golang.org/x/oauth2 v0.2.0 // indirect
+	golang.org/x/sys v0.2.0 // indirect
+	golang.org/x/time v0.2.0 // indirect
+	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
+	google.golang.org/api v0.103.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220519153652-3a47de7e79bd // indirect
-	google.golang.org/grpc v1.46.2 // indirect
-	google.golang.org/protobuf v1.28.0 // indirect
-	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
-	gopkg.in/go-playground/assert.v1 v1.2.1 // indirect
+	google.golang.org/genproto v0.0.0-20221117204609-8f9c96812029 // indirect
+	google.golang.org/grpc v1.50.1 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-)
-
-require (
-	github.com/cactus/go-statsd-client/statsd v0.0.0-20200623234511-94959e3146b2
-	github.com/twmb/murmur3 v1.1.6 // indirect
-	github.com/uber-go/tally v3.4.3+incompatible
-)
-
-require (
-	cloud.google.com/go/compute v1.6.1 // indirect
-	cloud.google.com/go/iam v0.3.0 // indirect
-	github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a // indirect
-	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
-	github.com/google/go-github/v45 v45.2.0 // indirect
-	github.com/m3db/prometheus_client_golang v0.8.1 // indirect
-	github.com/m3db/prometheus_client_model v0.1.0 // indirect
-	github.com/m3db/prometheus_common v0.1.0 // indirect
-	github.com/m3db/prometheus_procfs v0.8.1 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.5 // indirect
-	github.com/yuin/gopher-lua v0.0.0-20210529063254-f4c35e4016d9 // indirect
-	golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5 // indirect
 	gotest.tools/v3 v3.3.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 3f9cf54353..7a19275d0e 100644
--- a/go.sum
+++ b/go.sum
@@ -1,3 +1,4 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
 cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
@@ -16,36 +17,23 @@ cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHOb
 cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
 cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
 cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
-cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
-cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
-cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
-cloud.google.com/go v0.83.0/go.mod h1:Z7MJUsANfY0pYPdw0lbnivPx4/vhy/e2FEkSkF7vAVY=
-cloud.google.com/go v0.84.0/go.mod h1:RazrYuxIK6Kb7YrzzhPoLmCVzl7Sup4NrbKPg8KHSUM=
-cloud.google.com/go v0.87.0/go.mod h1:TpDYlFy7vuLzZMMZ+B6iRiELaY7z/gJPaqbMx6mlWcY=
-cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aDQ=
-cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
-cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4=
-cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
-cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
-cloud.google.com/go v0.100.2 h1:t9Iw5QH5v4XtlEQaCtUY7x6sCABps8sW0acw7e2WQ6Y=
-cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w99A=
+cloud.google.com/go v0.107.0 h1:qkj22L7bgkl6vIeZDlOY2po43Mx/TIa2Wsa7VR+PEww=
+cloud.google.com/go v0.107.0/go.mod h1:wpc2eNrD7hXUTy8EKS10jkxpZBjASrORK7goS+3YX2I=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/compute v0.1.0/go.mod h1:GAesmwr110a34z04OlxYkATPBEfVhkymfTBXtfbBFow=
-cloud.google.com/go/compute v1.3.0/go.mod h1:cCZiE1NHEtai4wiufUhW8I8S1JKkAnhnQJWM7YD99wM=
-cloud.google.com/go/compute v1.5.0/go.mod h1:9SMHyhJlzhlkJqrPAc839t2BZFTSk6Jdj6mkzQJeu0M=
-cloud.google.com/go/compute v1.6.0/go.mod h1:T29tfhtVbq1wvAPo0E3+7vhgmkOYeXjhFvz/FMzPu0s=
-cloud.google.com/go/compute v1.6.1 h1:2sMmt8prCn7DPaG4Pmh0N3Inmc8cT8ae5k1M6VJ9Wqc=
-cloud.google.com/go/compute v1.6.1/go.mod h1:g85FgpzFvNULZ+S8AYq87axRKuf2Kh7deLqV/jJ3thU=
+cloud.google.com/go/compute v1.12.1 h1:gKVJMEyqV5c/UnpzjjQbo3Rjvvqpr9B1DFSbJC4OXr0=
+cloud.google.com/go/compute v1.12.1/go.mod h1:e8yNOBcBONZU1vJKCvCoDw/4JQsA0dpM4x/6PIIOocU=
+cloud.google.com/go/compute/metadata v0.2.1 h1:efOwf5ymceDhK6PKMnnrTHP4pppY5L22mle96M1yP48=
+cloud.google.com/go/compute/metadata v0.2.1/go.mod h1:jgHgmJd2RKBGzXqF5LR2EZMGxBkeanZ9wwa75XHJgOM=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/firestore v1.6.1/go.mod h1:asNXNOzBdyVQmEU+ggO8UPodTkEVFW5Qx+rwHnAz+EY=
-cloud.google.com/go/iam v0.3.0 h1:exkAomrVUuzx9kWFI1wm3KI0uoDeUFPB4kKGzx6x+Gc=
-cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY=
+cloud.google.com/go/iam v0.7.0 h1:k4MuwOsS7zGJJ+QfZ5vBK8SgHBAvYN/23BWsiihJ1vs=
+cloud.google.com/go/iam v0.7.0/go.mod h1:H5Br8wRaDGNc8XP3keLc4unfUUZeyH3Sfl9XpQEYOeg=
+cloud.google.com/go/longrunning v0.3.0 h1:NjljC+FYPV3uh5/OwWT6pVU+doBqMg2x/rZlE+CamDs=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
@@ -55,20 +43,20 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.14.0 h1:6RRlFMv1omScs6iq2hfE3IvgE+l6RfJPampq8UZc5TU=
 cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
+cloud.google.com/go/storage v1.28.0 h1:DLrIZ6xkeZX6K70fU/boWx5INJumt6f+nwwWSHXzzGY=
+cloud.google.com/go/storage v1.28.0/go.mod h1:qlgZML35PXA3zoEnIkiPLY4/TOkUleufRlu6qmcf7sI=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
+github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
+github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver/v3 v3.1.1 h1:hLg3sBzpNErnxhQtUy/mmLR2I9foDujNK030IGemrRc=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/Masterminds/sprig/v3 v3.2.2 h1:17jRggJu518dr3QaafizSXOjKYp94wKfABxUmyxvxX8=
 github.com/Masterminds/sprig/v3 v3.2.2/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
-github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
-github.com/agext/levenshtein v1.2.2/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
 github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
@@ -78,39 +66,29 @@ github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRF
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
 github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a h1:HbKu58rmZpUGpz5+4FfNmIU+FmZg2P3Xaj2v2bfNWmk=
 github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
-github.com/alicebob/miniredis/v2 v2.23.0 h1:+lwAJYjvvdIVg6doFHuotFjueJ/7KY10xo/vm3X3Scw=
-github.com/alicebob/miniredis/v2 v2.23.0/go.mod h1:XNqvJdQJv5mSuVMc0ynneafpnL/zv52acZ6kqeS0t88=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/apparentlymart/go-dump v0.0.0-20180507223929-23540a00eaa3/go.mod h1:oL81AME2rN47vu18xqj1S1jPIPuN7afo62yKTNn3XMM=
-github.com/apparentlymart/go-textseg v1.0.0 h1:rRmlIsPEEhUTIKQb7T++Nz/A5Q6C9IuX2wFoYVvnCs0=
-github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
-github.com/apparentlymart/go-textseg/v12 v12.0.0 h1:bNEQyAGak9tojivJNkoqWErVCQbjdL7GzRt3F8NvfJ0=
-github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
-github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
-github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
-github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/alicebob/miniredis/v2 v2.23.1 h1:jR6wZggBxwWygeXcdNyguCOCIjPsZyNUNlAkTx2fu0U=
+github.com/alicebob/miniredis/v2 v2.23.1/go.mod h1:84TWKZlxYkfgMucPBf5SOQBYJceZeQRFIaQgNMiCX6Q=
+github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
+github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/aws/aws-sdk-go v1.15.78/go.mod h1:E3/ieXAlvM0XWO57iftYVDLLvQ824smPP3ATZkfNZeM=
-github.com/aws/aws-sdk-go v1.34.0 h1:brux2dRrlwCF5JhTL7MUT3WUwo9zfDHZZp3+g3Mvlmo=
-github.com/aws/aws-sdk-go v1.34.0/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
+github.com/aws/aws-sdk-go v1.44.140 h1:6MxVSiAORc6AG+oh6401TEgWHb1ZzFL8y6+eBLoJtdU=
+github.com/aws/aws-sdk-go v1.44.140/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
-github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
-github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/benbjohnson/clock v1.3.0 h1:ip6w0uFQkncKQ979AypyG0ER7mqUSBdKLOgAle/AT8A=
+github.com/benbjohnson/clock v1.3.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d h1:xDfNPAt8lFiC1UJrqV3uuy861HCTo708pDMbjHHdCas=
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d/go.mod h1:6QX/PXZ00z/TKoufEY6K/a0k6AhaJrQKdFe6OfVXsa4=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bradleyfalzon/ghinstallation/v2 v2.1.0 h1:5+NghM1Zred9Z078QEZtm28G/kfDfZN/92gkDlLwGVA=
 github.com/bradleyfalzon/ghinstallation/v2 v2.1.0/go.mod h1:Xg3xPRN5Mcq6GDqeUVhFbjEWMb4JHCyWEeeBGEYQoTU=
-github.com/briandowns/spinner v0.0.0-20170614154858-48dbb65d7bd5 h1:osZyZB7J4kE1tKLeaUjV6+uZVBfS835T0I/RxmwWw1w=
-github.com/briandowns/spinner v0.0.0-20170614154858-48dbb65d7bd5/go.mod h1:hw/JEQBIE+c/BLI4aKM8UU8v+ZqrD3h7HC27kKt8JQU=
+github.com/briandowns/spinner v1.19.0 h1:s8aq38H+Qju89yhp89b4iIiMzMm8YN3p6vGpwyh/a8E=
+github.com/briandowns/spinner v1.19.0/go.mod h1:mQak9GHqbspjC/5iUx3qMlIho8xBS/ppAL/hX5SmPJU=
 github.com/cactus/go-statsd-client/statsd v0.0.0-20200623234511-94959e3146b2 h1:GgJnJEJYymy/lx+1zXOO2TvGPRQJJ9vz4onxnA9gF3k=
 github.com/cactus/go-statsd-client/statsd v0.0.0-20200623234511-94959e3146b2/go.mod h1:l/bIBLeOl9eX+wxJAzxS4TveKRtAqlyDpHjhkfO0MEI=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -121,64 +99,59 @@ github.com/cheggaaa/pb v1.0.27/go.mod h1:pQciLPpbU0oxA0h+VJYYLxO+XeDQb5pZijXscXH
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
-github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d h1:U+s90UTSYgptZMwQh2aRr3LuazLJIa+Pg3Kc1ylSYVY=
+github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
+github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
-github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/elazarl/go-bindata-assetfs v1.0.1 h1:m0kkaHRKEu7tUIUFVwhGGGYClXvyl4RE03qmvRTNfbw=
 github.com/elazarl/go-bindata-assetfs v1.0.1/go.mod h1:v+YaWX3bdea5J/mo8dSETolEo7R71Vk1u8bnjau5yw4=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/flynn-archive/go-shlex v0.0.0-20150515145356-3f9db97f8568 h1:BMXYYRWTLOJKlh+lOBt6nUQgXAfB7oVIQt5cNreqSLI=
 github.com/flynn-archive/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:rZfgFAXFS/z/lEd6LJmf9HVZ1LkgYiHx5pHhV5DR16M=
 github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
-github.com/frankban/quicktest v1.14.3/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps=
-github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwVZI=
-github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
+github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
+github.com/go-kit/log v0.2.0/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-ozzo/ozzo-validation v0.0.0-20170913164239-85dcd8368eba h1:P0TvLfAFQ/hc8Q+VBsrgzGv52DxTjAu199VHbAI4LLQ=
-github.com/go-ozzo/ozzo-validation v0.0.0-20170913164239-85dcd8368eba/go.mod h1:gsEKFIVnabGBt6mXmxK0MoFy+cZoTJY6mu5Ll3LVLBU=
-github.com/go-playground/locales v0.12.1 h1:2FITxuFt/xuCNP1Acdhv62OzaCiviiE4kotfhkmOqEc=
-github.com/go-playground/locales v0.12.1/go.mod h1:IUMDtCfWo/w/mtMfIE/IG2K+Ey3ygWanZIBtBW0W2TM=
-github.com/go-playground/universal-translator v0.16.0 h1:X++omBR/4cE2MNg91AoC3rmGrCjJ8eAeUP/K/EKx4DM=
-github.com/go-playground/universal-translator v0.16.0/go.mod h1:1AnU7NaIRDWWzGEKwgtJRd2xk99HeFyHw3yid4rvQIY=
-github.com/go-redis/redis/v9 v9.0.0-beta.2 h1:ZSr84TsnQyKMAg8gnV+oawuQezeJR11/09THcWCQzr4=
-github.com/go-redis/redis/v9 v9.0.0-beta.2/go.mod h1:Bldcd/M/bm9HbnNPi/LUtYBSD8ttcZYBMupwMXhdU0o=
-github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
+github.com/go-ozzo/ozzo-validation v3.6.0+incompatible h1:msy24VGS42fKO9K1vLz82/GeYW1cILu7Nuuj1N3BBkE=
+github.com/go-ozzo/ozzo-validation v3.6.0+incompatible/go.mod h1:gsEKFIVnabGBt6mXmxK0MoFy+cZoTJY6mu5Ll3LVLBU=
+github.com/go-playground/locales v0.14.0 h1:u50s323jtVGugKlcYeyzC0etD1HifMjqmJqb8WugfUU=
+github.com/go-playground/locales v0.14.0/go.mod h1:sawfccIbzZTqEDETgFXqTho0QybSa7l++s0DH+LDiLs=
+github.com/go-playground/universal-translator v0.18.0 h1:82dyy6p4OuJq4/CByFNOn/jYrnRPArHwAcmLoJZxyho=
+github.com/go-playground/universal-translator v0.18.0/go.mod h1:UvRDBj+xPUEGrFYl+lu/H90nyDXpg0fqeB/AQUGNTVA=
+github.com/go-redis/redis/v9 v9.0.0-rc.1 h1:/+bS+yeUnanqAbuD3QwlejzQZ+4eqgfUtFTG4b+QnXs=
+github.com/go-redis/redis/v9 v9.0.0-rc.1/go.mod h1:8et+z03j0l8N+DvsVnclzjf3Dl/pFHgRk+2Ct1qw66A=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
-github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/go-test/deep v1.0.4/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
 github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v4 v4.4.2 h1:rcc4lwaZgFMCZ5jxF9ABolDcIHdBytAFgqFPbSJQAYs=
 github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
@@ -195,9 +168,6 @@ github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt
 github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
-github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
-github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -213,10 +183,8 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
 github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -230,10 +198,10 @@ github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
-github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-github/v31 v31.0.0 h1:JJUxlP9lFK+ziXKimTCprajMApV1ecWD4NB6CCb0plo=
 github.com/google/go-github/v31 v31.0.0/go.mod h1:NQPZol8/1sMoWYGN2yaALIBytu17gAWfhbweiEed3pM=
 github.com/google/go-github/v45 v45.2.0 h1:5oRLszbrkvxDDqBCNj2hjDZMKmvexaZ1xw/FCD+K3FI=
@@ -247,7 +215,6 @@ github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXi
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.2.1 h1:d8MncMlErDFTwQGBK1xhv026j9kqhvw1Qv9IbWT1VLQ=
-github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -258,98 +225,64 @@ github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.1.2-0.20200519141726-cb32006e483f h1:qa1wFcvZzVLbFVPdsdTsWL6k5IP6BEmFmd9SeahRQ5s=
-github.com/google/uuid v1.1.2-0.20200519141726-cb32006e483f/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.2.0 h1:y8Yozv7SZtlU//QXbezB6QkpuE6jMD2/gfzk4AftXjs=
+github.com/googleapis/enterprise-certificate-proxy v0.2.0/go.mod h1:8C0jb7/mgJe/9KK8Lm7X9ctZC2t60YyIpYEI16jx0Qg=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
-github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
-github.com/googleapis/gax-go/v2 v2.2.0/go.mod h1:as02EH8zWkzwUoLbBaFeQ+arQaj/OthfcblKl4IGNaM=
-github.com/googleapis/gax-go/v2 v2.3.0/go.mod h1:b8LNqSzNabLiUpXKkY7HAR5jr6bIT99EXz9pXxye9YM=
-github.com/googleapis/gax-go/v2 v2.4.0 h1:dS9eYAjhrE2RjmzYw2XAPvcXfmcQLtFEQWn0CR82awk=
-github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK9wbMD5+iXC6c=
+github.com/googleapis/gax-go/v2 v2.7.0 h1:IcsPKeInNvYi7eqSaDjiZqDDKu5rsmunY0Y1YupQSSQ=
+github.com/googleapis/gax-go/v2 v2.7.0/go.mod h1:TEop28CZZQ2y+c0VxMUmu1lV+fQx57QpBWsYpwqHJx8=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
 github.com/gorilla/css v1.0.0 h1:BQqNyPTi50JCFMTw/b67hByjMVXZRwGha6wxVGkeihY=
 github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c=
 github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
+github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
 github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hashicorp/consul/api v1.12.0/go.mod h1:6pVBMo0ebnYdt2S3H87XhekM/HHrUoTD2XXb/VrZVy0=
-github.com/hashicorp/consul/sdk v0.8.0/go.mod h1:GBvyrGALthsZObzUGsfgHZQDXjg4lOjagTIwIR1vPms=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-getter v1.6.2 h1:7jX7xcB+uVCliddZgeKyNxv0xoT7qL5KDtH7rU4IqIk=
 github.com/hashicorp/go-getter v1.6.2/go.mod h1:IZCrswsZPeWv9IkVnLElzRU/gz/QPi6pZHn4tv6vbwA=
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v0.12.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-hclog v1.2.0 h1:La19f8d7WIlm4ogzNHB0JGqs5AUDAZ2UfCY4sJXcJdM=
-github.com/hashicorp/go-hclog v1.2.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
-github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
-github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
 github.com/hashicorp/go-retryablehttp v0.7.1 h1:sUiuQAnLlbvmExtFQs72iFW/HXeUn8Z1aJLQ4LJJbTQ=
 github.com/hashicorp/go-retryablehttp v0.7.1/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
-github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
 github.com/hashicorp/go-safetemp v1.0.0 h1:2HR189eFNrjHQyENnQMMpCiBAsRxzbTMIgBhEyExpmo=
 github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoDHxNAB65b+Rj1I=
-github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
-github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
-github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.1.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
-github.com/hashicorp/hcl v0.0.0-20170504190234-a4b07c25de5f/go.mod h1:oZtUIOe8dh44I2q6ScRibXws4Ajl+d+nod3AaR9vL5w=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/hcl/v2 v2.0.0/go.mod h1:oVVDG71tEinNGYCxinCYadcmKU9bglqW9pV3txagJ90=
-github.com/hashicorp/hcl/v2 v2.6.0 h1:3krZOfGY6SziUXa6H9PJU6TyohHn7I+ARYnhbeNBz+o=
-github.com/hashicorp/hcl/v2 v2.6.0/go.mod h1:bQTN5mpo+jewjJgh8jr0JUguIi7qPHUF6yIfAEN3jqY=
-github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/mdns v1.0.4/go.mod h1:mtBihi+LeNXGtG8L9dX59gAEa12BDtBQSp4v/YAJqrc=
-github.com/hashicorp/memberlist v0.3.0/go.mod h1:MS2lj3INKhZjWNqd3N0m3J+Jxf3DAOnAH9VT3Sh9MUE=
-github.com/hashicorp/serf v0.9.6/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpTwn9UV4=
-github.com/hashicorp/serf v0.9.7/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpTwn9UV4=
-github.com/hashicorp/terraform-config-inspect v0.0.0-20200806211835-c481b8bfa41e h1:wIsEsIITggCC4FTO9PisDjy561UU7OPL6uTu7tnkHH8=
-github.com/hashicorp/terraform-config-inspect v0.0.0-20200806211835-c481b8bfa41e/go.mod h1:Z0Nnk4+3Cy89smEbrq+sl1bxc9198gIP4I7wcQF6Kqs=
-github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/huandu/xstrings v1.3.1 h1:4jgBlKK6tLKFvO8u5pmYjG91cqytmDCDvGh7ECVFfFs=
+github.com/hashicorp/hcl/v2 v2.15.0 h1:CPDXO6+uORPjKflkWCCwoWc9uRp+zSIPcCQ+BrxV7m8=
+github.com/hashicorp/hcl/v2 v2.15.0/go.mod h1:JRmR89jycNkrrqnMmvPDMd56n1rQJ2Q6KocSLCMCXng=
+github.com/hashicorp/terraform-config-inspect v0.0.0-20221020162138-81db043ad408 h1:dol/gV6vq/QBI1lGTxUEUGr8ixcs4SU79lgCoRMg3pU=
+github.com/hashicorp/terraform-config-inspect v0.0.0-20221020162138-81db043ad408/go.mod h1:EAaqp5h9PsUNr6NtgLj31w+ElcCEL+1Svw1Jw+MTVKU=
 github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.3.3 h1:/Gcsuc1x8JVbJ9/rlye4xZnVAbEkGauT8lbebqcQws4=
+github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/imdario/mergo v0.3.11 h1:3tnifQM4i+fbajXKBHXWEH+KvNHqojZ778UH75j3bGA=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
-github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
+github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
+github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc=
+github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
-github.com/jmespath/go-jmespath v0.3.0/go.mod h1:9QtRXoHjLGCJ5IBSaohpXITPlowMeeYCZ7fLUTSywik=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
@@ -357,84 +290,79 @@ github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.11.2 h1:MiK62aErc3gIiVEtyzKfeOHgW7atJb5g/KNX5m3c2nQ=
 github.com/klauspost/compress v1.11.2/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
+github.com/klauspost/compress v1.15.12 h1:YClS/PImqYbn+UILDnqxQCZ3RehC9N318SU3kElDUEM=
+github.com/klauspost/compress v1.15.12/go.mod h1:QPwzmACJjUTFsnSHH934V6woptycfrDDJnH7hvFVbGM=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/leodido/go-urn v1.2.0 h1:hpXL4XnriNwQ/ABnpepYM/1vCLWNDfUNts8dX3xTG6Y=
-github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
-github.com/lusis/slack-test v0.0.0-20190426140909-c40012f20018 h1:MNApn+Z+fIT4NPZopPfCc1obT6aY3SVM6DOctz1A9ZU=
-github.com/lusis/slack-test v0.0.0-20190426140909-c40012f20018/go.mod h1:sFlOUpQL1YcjhFVXhg1CG8ZASEs/Mf1oVb6H75JL/zg=
-github.com/m3db/prometheus_client_golang v0.8.1 h1:t7w/tcFws81JL1j5sqmpqcOyQOpH4RDOmIe3A3fdN3w=
-github.com/m3db/prometheus_client_golang v0.8.1/go.mod h1:8R/f1xYhXWq59KD/mbRqoBulXejss7vYtYzWmruNUwI=
-github.com/m3db/prometheus_client_model v0.1.0 h1:cg1+DiuyT6x8h9voibtarkH1KT6CmsewBSaBhe8wzLo=
-github.com/m3db/prometheus_client_model v0.1.0/go.mod h1:Qfsxn+LypxzF+lNhak7cF7k0zxK7uB/ynGYoj80zcD4=
-github.com/m3db/prometheus_common v0.1.0 h1:YJu6eCIV6MQlcwND24cRG/aRkZDX1jvYbsNNs1ZYr0w=
-github.com/m3db/prometheus_common v0.1.0/go.mod h1:EBmDQaMAy4B8i+qsg1wMXAelLNVbp49i/JOeVszQ/rs=
-github.com/m3db/prometheus_procfs v0.8.1 h1:LsxWzVELhDU9sLsZTaFLCeAwCn7bC7qecZcK4zobs/g=
+github.com/leodido/go-urn v1.2.1 h1:BqpAaACuzVSgi/VLzGZIobT2z4v53pjosyNd9Yv6n/w=
+github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
+github.com/m3db/prometheus_client_golang v0.9.0-pre1/go.mod h1:8R/f1xYhXWq59KD/mbRqoBulXejss7vYtYzWmruNUwI=
+github.com/m3db/prometheus_client_golang v1.12.5-0.20220603164556-514aad459573/go.mod h1:MeqtPbBp1E+3tgmtttxmGnfCWBY7TO6pV//6of0qSZs=
+github.com/m3db/prometheus_client_golang v1.12.5-0.20220603165239-04931ef271c6/go.mod h1:dAdsbJi18Ojkdapu5kjwmhDOFr5/y1yzE2IwjthkUeg=
+github.com/m3db/prometheus_client_golang v1.12.6/go.mod h1:ufdbllybhIqHdJ29pveDS1nb8vOWzCYR/ziHhlCa2Go=
+github.com/m3db/prometheus_client_golang v1.12.7/go.mod h1:1TrZ6IcZluZnYH6eXRi6Ovb877dHOY/I7+CfI6h3TCE=
+github.com/m3db/prometheus_client_golang v1.12.8 h1:DAE5sN2IH0FJZx5KvnuVksB147ac9Dt8gmi8h4A7VcU=
+github.com/m3db/prometheus_client_golang v1.12.8/go.mod h1:1TrZ6IcZluZnYH6eXRi6Ovb877dHOY/I7+CfI6h3TCE=
+github.com/m3db/prometheus_client_model v0.2.1 h1:XsdCsa4GZl8oSbdIhmp+9EvD1G8ZzvStkf7uhi8wfNs=
+github.com/m3db/prometheus_client_model v0.2.1/go.mod h1:Pi6e2aN58HDdgTT+1EsLoW0Qzb1Dqm5P6C2Esd36skk=
+github.com/m3db/prometheus_common v0.34.5-0.20220603164409-76eb9b921650/go.mod h1:MADWGTus+fO9f/xDPgXyLCB2dFN3w7EpnbaMAI5nxr0=
+github.com/m3db/prometheus_common v0.34.5-0.20220603164832-70f043edf99e/go.mod h1:Pf+7yPHChEsThLFaUB/ZD0/KxMLK+UYW/QVlWJ1uAyY=
+github.com/m3db/prometheus_common v0.34.5/go.mod h1:PlGkYJxacZY9hjtZh9SyjK+CR3aHh9nm1jcHfUUvojI=
+github.com/m3db/prometheus_common v0.34.6/go.mod h1:y0334xwXc0gsrWoQfffLgbmx9TTw2BkrrhBC7iz3zEs=
+github.com/m3db/prometheus_common v0.34.7 h1:QMABInp3m8ySuoY0gkSJ9rsjZmEemD8Fui7Ggj4z0rs=
+github.com/m3db/prometheus_common v0.34.7/go.mod h1:oQjNl5G6gyqrFlOiMKO911HUPgZQkmHsXrw0iBiuQJs=
 github.com/m3db/prometheus_procfs v0.8.1/go.mod h1:N8lv8fLh3U3koZx1Bnisj60GYUMDpWb09x1R+dmMOJo=
 github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
 github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
-github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
-github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
+github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/mcdafydd/go-azuredevops v0.12.1 h1:WxwLVyGuJ8oL7uWQp1/J6GefX1wMQQZUHWRGsrm+uE8=
 github.com/mcdafydd/go-azuredevops v0.12.1/go.mod h1:B4UDyn7WEj1/97f45j3VnzEfkWKe05+/dCcAPdOET4A=
-github.com/microcosm-cc/bluemonday v1.0.20 h1:flpzsq4KU3QIYAYGV/szUat7H+GPOXR0B2JU5A1Wp8Y=
-github.com/microcosm-cc/bluemonday v1.0.20/go.mod h1:yfBmMi8mxvaZut3Yytv+jTXRY8mxyjJ0/kQBTElld50=
-github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
-github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
-github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
-github.com/mitchellh/colorstring v0.0.0-20150917214807-8631ce90f286 h1:KHyL+3mQOF9sPfs26lsefckcFNDcIZtiACQiECzIUkw=
-github.com/mitchellh/colorstring v0.0.0-20150917214807-8631ce90f286/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
-github.com/mitchellh/copystructure v1.0.0 h1:Laisrj+bAB6b/yJwB5Bt3ITZhGJdqmxquMKeZ+mmkFQ=
+github.com/microcosm-cc/bluemonday v1.0.21 h1:dNH3e4PSyE4vNX+KlRGHT5KrSvjeUkoNPwEORjffHJg=
+github.com/microcosm-cc/bluemonday v1.0.21/go.mod h1:ytNkv4RrDrLJ2pqlsSI46O6IVXmZOBBD4SaJyDwwTkM=
+github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
+github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdIPrefOvVG1VZ96U0=
 github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
-github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/go-wordwrap v1.0.0 h1:6GlHJ/LTGMrIJbwgdqdl2eEH8o+Exx/0m8ir9Gns0u4=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
+github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8=
+github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
+github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/reflectwalk v1.0.0 h1:9D+8oIskB4VJBN5SFlmc27fSlIBZaov1Wpk/IfikLNY=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/moby/moby v20.10.18+incompatible h1:aAQ5lDb+SDrhVDnoMbR3kSzswd+41X34pex8VRJXvHg=
-github.com/moby/moby v20.10.18+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/moby/moby v20.10.21+incompatible h1:LfdCNzNpDYtOTtlO5wxLcUEk0nyM3KqPyeIyXVdvl/U=
+github.com/moby/moby v20.10.21+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
@@ -444,31 +372,15 @@ github.com/mohae/deepcopy v0.0.0-20170603005431-491d3605edfb h1:e+l77LJOEqXTIQih
 github.com/mohae/deepcopy v0.0.0-20170603005431-491d3605edfb/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/nlopes/slack v0.4.0 h1:OVnHm7lv5gGT5gkcHsZAyw++oHVFihbjWbL3UceUpiA=
-github.com/nlopes/slack v0.4.0/go.mod h1:jVI4BBK3lSktibKahxBF74txcK2vyvkza1z/+rRnVAM=
-github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
-github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
-github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
-github.com/onsi/ginkgo/v2 v2.1.4 h1:GNapqRSid3zijZ9H77KrgVG4/8KqiyRsxcSxe+7ApXY=
-github.com/onsi/ginkgo/v2 v2.1.4/go.mod h1:um6tUpWM/cxCK3/FK8BXqEiUMUwRgSM4JXG47RKZmLU=
-github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
-github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
-github.com/onsi/gomega v1.20.0 h1:8W0cWlwFkflGPLltQvLRB7ZVD5HuP6ng320w2IS245Q=
-github.com/onsi/gomega v1.20.0/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
-github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
-github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
+github.com/onsi/ginkgo/v2 v2.1.6 h1:Fx2POJZfKRQcM1pH49qSZiYeu319wji004qX+GDovrU=
+github.com/onsi/gomega v1.21.1 h1:OB/euWYIExnPBohllTicTHmGTrMaqJ67nIu80j0/uEM=
+github.com/onsi/gomega v1.21.1/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pelletier/go-toml/v2 v2.0.5 h1:ipoSadvV8oGUjnUbMub59IDPPwfxF694nG/jwbMiyQg=
-github.com/pelletier/go-toml/v2 v2.0.5/go.mod h1:OMHamSCAODeSsVrwwvcJOaoN0LIUIaFVNZzmWyNfXas=
+github.com/pelletier/go-toml/v2 v2.0.6 h1:nrzqCb7j9cDFj2coyLNLaZuJTLjWjlaz6nvTvIwycIU=
+github.com/pelletier/go-toml/v2 v2.0.6/go.mod h1:eumQOmlWiOPt5WriQQqoM5y18pDHwha2N+QD+EUNTek=
 github.com/petergtz/pegomock v2.9.0+incompatible h1:BKfb5XfkJfehe5T+O1xD4Zm26Sb9dnRj7tHxLYwUPiI=
 github.com/petergtz/pegomock v2.9.0+incompatible/go.mod h1:nuBLWZpVyv/fLo56qTwt/AUau7jgouO1h7bEvZCq82o=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -478,70 +390,68 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
-github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
+github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
+github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
+github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
+github.com/prometheus/common v0.34.0/go.mod h1:gB3sOl7P0TvJabZpLY5uQMpUqRCPPCyRLCZYc7JZTNE=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/prometheus/procfs v0.8.0 h1:ODq8ZFEaYeCaZOJlZZdJA2AbQR98dSHSM1KW/You5mo=
+github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
 github.com/remeh/sizedwaitgroup v1.0.0 h1:VNGGFwNo/R5+MJBf6yrsr110p0m4/OX4S3DCy7Kyl5E=
 github.com/remeh/sizedwaitgroup v1.0.0/go.mod h1:3j2R4OIe/SeS6YDhICBy22RWjJC5eNCJ1V+9+NVNYlo=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1 h1:/FiVV8dS/e+YqF2JvO3yXRFbBLTIuSDkuC7aBOAvL+k=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/sagikazarmark/crypt v0.6.0/go.mod h1:U8+INwJo3nBv1m6A/8OBXAq7Jnpspk5AxSgDyEQcea8=
-github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sergi/go-diff v1.0.0 h1:Kpca3qRNrduNnOQeazBd0ysaKrUJiIuISHxogkT9RPQ=
-github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
-github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/shurcooL/githubv4 v0.0.0-20191127044304-8f68eb5628d0 h1:T9uus1QvcPgeLShS30YOnnzk3r9Vvygp45muhlrufgY=
-github.com/shurcooL/githubv4 v0.0.0-20191127044304-8f68eb5628d0/go.mod h1:hAF0iLZy4td2EX+/8Tw+4nodhlMrwN3HupfaXj3zkGo=
-github.com/shurcooL/graphql v0.0.0-20181231061246-d48a9a75455f h1:tygelZueB1EtXkPI6mQ4o9DQ0+FKW41hTbunoXZCTqk=
-github.com/shurcooL/graphql v0.0.0-20181231061246-d48a9a75455f/go.mod h1:AuYgA5Kyo4c7HfUmvRGs/6rGlMMV/6B1bVnB9JxJEEg=
-github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
+github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
+github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/shurcooL/githubv4 v0.0.0-20221021030919-a134b1472cc7 h1:g0m1EUfoJCgI9ezonUedPJiloNaB6B0yJFgkoxOkT28=
+github.com/shurcooL/githubv4 v0.0.0-20221021030919-a134b1472cc7/go.mod h1:hAF0iLZy4td2EX+/8Tw+4nodhlMrwN3HupfaXj3zkGo=
+github.com/shurcooL/graphql v0.0.0-20220606043923-3cf50f8a0a29 h1:B1PEwpArrNp4dkQrfxh/abbBAOZBVp0ds+fBEOUOqOc=
+github.com/shurcooL/graphql v0.0.0-20220606043923-3cf50f8a0a29/go.mod h1:AuYgA5Kyo4c7HfUmvRGs/6rGlMMV/6B1bVnB9JxJEEg=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/spf13/afero v1.8.2 h1:xehSyVa0YnHWsJ49JFljMpg1HX19V6NDZ1fkm1Xznbo=
-github.com/spf13/afero v1.8.2/go.mod h1:CtAatgMJh6bJEIs48Ay/FOnkljP3WeGUG0MC1RfAqwo=
+github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
+github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/slack-go/slack v0.11.4 h1:ojSa7KlPm3PqY2AomX4VTxEsK5eci5JaxCjlzGV5zoM=
+github.com/slack-go/slack v0.11.4/go.mod h1:hlGi5oXA+Gt+yWTPP0plCdRKmjsDxecdHxYQdlMQKOw=
+github.com/spf13/afero v1.9.3 h1:41FoI0fD7OR7mGcKE/aOiLkGreyf8ifIOQmJANWogMk=
+github.com/spf13/afero v1.9.3/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
 github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
-github.com/spf13/cobra v0.0.0-20170905172051-b78744579491 h1:XOya2OGpG7Q4gS4MYHRoFSTlBGnZD40X+Kw2ikFQFXE=
-github.com/spf13/cobra v0.0.0-20170905172051-b78744579491/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/cobra v1.6.1 h1:o94oiPyS4KD1mPy2fmcYYHHfCxLqYjJOhGsCHFZtEzA=
+github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
 github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
-github.com/spf13/pflag v1.0.2/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.13.0 h1:BWSJ/M+f+3nmdz9bxB+bWX28kkALN2ok11D0rSo8EJU=
-github.com/spf13/viper v1.13.0/go.mod h1:Icm2xNL3/8uyh/wFuB1jI7TiTNKp8632Nwegu+zgdYw=
+github.com/spf13/viper v1.14.0 h1:Rg7d3Lo706X9tHsJMUjdiwMpHB7W8WnSVOssIY+JElU=
+github.com/spf13/viper v1.14.0/go.mod h1:WT//axPky3FdvXHzGw33dNdXXXfFQqmEalje+egj8As=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
@@ -549,67 +459,57 @@ github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.5/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
 github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
-github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/twmb/murmur3 v1.1.6 h1:mqrRot1BRxm+Yct+vavLMou2/iJt0tNVTTC0QoIjaZg=
 github.com/twmb/murmur3 v1.1.6/go.mod h1:Qq/R7NUyOfr65zD+6Q5IHKsJLwP7exErjN6lyyq3OSQ=
-github.com/uber-go/tally v3.4.3+incompatible h1:Oq25FXV8cWHPRo+EPeNdbN3LfuozC9mDK2/4vZ1k38U=
-github.com/uber-go/tally v3.4.3+incompatible/go.mod h1:YDTIBxdXyOU/sCWilKB4bgyufu1cEi0jdVnRdxvjnmU=
-github.com/ulikunitz/xz v0.5.8 h1:ERv8V6GKqVi23rgu5cj9pVfVzJbOqAY2Ntl88O6c2nQ=
+github.com/uber-go/tally v3.5.0+incompatible h1:2vIkqVrSaspifqcJh2yQjQqqpfavvmfj/ognDrBxuSg=
+github.com/uber-go/tally v3.5.0+incompatible/go.mod h1:YDTIBxdXyOU/sCWilKB4bgyufu1cEi0jdVnRdxvjnmU=
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/ulikunitz/xz v0.5.10 h1:t92gobL9l3HE202wg3rlk19F6X+JOxl9BBrCCMYEYd8=
+github.com/ulikunitz/xz v0.5.10/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/urfave/cli v1.22.10 h1:p8Fspmz3iTctJstry1PYS3HVdllxnEzTEsgIgtxTrCk=
 github.com/urfave/cli v1.22.10/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/negroni v1.0.0 h1:kIimOitoypq34K7TG7DUaJ9kq/N4Ofuwi1sjz0KipXc=
 github.com/urfave/negroni v1.0.0/go.mod h1:Meg73S6kFm/4PpbYdq35yYWoCZ9mS/YSx+lKnmiohz4=
-github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
-github.com/xanzy/go-gitlab v0.69.0 h1:sPci9xHzlX+lcJvPqNu3y3BQpePuR2R694Bal4AeyB8=
-github.com/xanzy/go-gitlab v0.69.0/go.mod h1:o4yExCtdaqlM8YGdDJWuZoBmfxBsmA9TPEjs9mx1UO4=
+github.com/warrensbox/terraform-switcher v0.1.1-0.20221027055942-201c8e92e997 h1:be5WC0FHdhimAhe2G3DPhduX117RM8qdTMYCMHDt4DM=
+github.com/warrensbox/terraform-switcher v0.1.1-0.20221027055942-201c8e92e997/go.mod h1:saryXNaL624mlulV138FP+HhVw7IpvETUXLS3nTvH1g=
+github.com/xanzy/go-gitlab v0.74.0 h1:Ha1cokbjn0PXy6B19t3W324dwM4AOT52fuHr7nERPrc=
+github.com/xanzy/go-gitlab v0.74.0/go.mod h1:d/a0vswScO7Agg1CZNz15Ic6SSvBG9vfw8egL99t4kA=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/gopher-lua v0.0.0-20210529063254-f4c35e4016d9 h1:k/gmLsJDWwWqbLCur2yWnJzwQEKRcAHXo6seXGuSwWw=
-github.com/yuin/gopher-lua v0.0.0-20210529063254-f4c35e4016d9/go.mod h1:E1AXubJBdNmFERAOucpDIxNzeGfLzg0mYh+UfMWdChA=
-github.com/zclconf/go-cty v1.1.0/go.mod h1:xnAOWiHeOqg2nWS62VtQ7pbOu17FtxJNW8RLEih+O3s=
-github.com/zclconf/go-cty v1.2.0/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q/N4PQ8=
-github.com/zclconf/go-cty v1.5.1 h1:oALUZX+aJeEBUe2a1+uD2+UTaYfEjnKFDEMRydkGvWE=
-github.com/zclconf/go-cty v1.5.1/go.mod h1:nHzOclRkoj++EU9ZjSrZvRG0BXIWt8c7loYc0qXAFGQ=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64 h1:5mLPGnFdSsevFRFc9q3yYbBkB6tsm4aCwwQV/j1JQAQ=
+github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
+github.com/zclconf/go-cty v1.12.1 h1:PcupnljUm9EIvbgSHQnHhUr3fO6oFmkOrvs2BAFNXXY=
+github.com/zclconf/go-cty v1.12.1/go.mod h1:s9IfD1LK5ccNMSWCVFCE2rJfHiZgi7JijgeWIMfhLvA=
 go.etcd.io/bbolt v1.3.6 h1:/ecaJf0sk1l4l6V4awd65v2C3ILy7MSj+s/x1ADCIMU=
 go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
-go.etcd.io/etcd/api/v3 v3.5.4/go.mod h1:5GB2vv4A4AOn3yk7MftYGHkUfGtDHnEraIjym4dYz5A=
-go.etcd.io/etcd/client/pkg/v3 v3.5.4/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
-go.etcd.io/etcd/client/v2 v2.305.4/go.mod h1:Ud+VUwIi9/uQHOMA+4ekToJ12lTxlv0zB/+DHwTGEbU=
-go.etcd.io/etcd/client/v3 v3.5.4/go.mod h1:ZaRkVgBZC+L+dLCjTcF1hRXpgZXQPOvnA/Ak/gq3kiY=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
-go.opencensus.io v0.23.0 h1:gqCw0LfLxScz8irSi8exQc7fyQ0fKQU/qnC/X8+V/1M=
-go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=
-go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
+go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.1.11 h1:wy28qYRKZgnJTxGxvye5/wgWr1EKjmUDGYox5mGlRlI=
-go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
-go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
+go.uber.org/multierr v1.8.0 h1:dg6GjLku4EH+249NNmoIciG9N/jURbDG+pFlTkhzIC8=
+go.uber.org/multierr v1.8.0/go.mod h1:7EAYxJLBy9rStEaz58O2t4Uvip6FSURkq8/ppBp95ak=
 go.uber.org/zap v1.23.0 h1:OjGQ5KQDEUawVHxNwQgPpiypGHOxo2mNZsOqTak4fFY=
 go.uber.org/zap v1.23.0/go.mod h1:D+nX8jyLsMHMYrln8A0rJjFt/T/9/bGgIhAqxv5URuY=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200403201458-baeed622b8d8/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -618,8 +518,8 @@ golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4 h1:kUhD7nTDoI3fVd9G4ORWrbV5NY0liEs/Jg2pv5f+bBA=
-golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.3.0 h1:a06MkbcxBrEFc0w0QIZWXrH/9cCX6KJyWbBOIwAn+7A=
+golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -632,6 +532,7 @@ golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EH
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -642,7 +543,6 @@ golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRu
 golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
@@ -653,11 +553,9 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -670,7 +568,6 @@ golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -681,7 +578,6 @@ golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
@@ -691,23 +587,14 @@ golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8=
-golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
-golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220412020605-290c469a71a5/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220520000938-2e3eb7b945c2/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b h1:ZmngSVLe/wycRns9MKikG9OWIEjGcGAkacif7oYQaUY=
-golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
+golang.org/x/net v0.2.0 h1:sZfSu1wtKLGlWI4ZZayP0ck9Y73K1ynO6gqzTdBVdPU=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190402181905-9f3314589c9a/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -718,18 +605,10 @@ golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5 h1:OSnWWcOd/CtWQC2cYSBgbTSJv3ciqd8r54ySIW2y3RE=
-golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
+golang.org/x/oauth2 v0.2.0 h1:GtQkldQ9m7yvzCL1V+LrYow3Khe0eJH0w7RbX/VbaIU=
+golang.org/x/oauth2 v0.2.0/go.mod h1:Cwn6afJ8jrQwYMxQDTpISoXmXW9I6qF6vDeuuoX3Ibs=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -740,12 +619,9 @@ golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220513210516-0976fa681c29 h1:w8s32wxx3sY+OjLlv9qltkLU5yvJzxjjgiHWLjdIcw4=
-golang.org/x/sync v0.0.0-20220513210516-0976fa681c29/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -754,26 +630,17 @@ golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502175342-a43fa875dd82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200124204421-9fbb57f87de9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -793,66 +660,48 @@ golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220517195934-5e4e11fc645e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 h1:WIoqL4EROvwiPdUtaip4VcDdpZ4kha7wBWZrbVKCIZg=
-golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0 h1:ljd4t30dBnAvMZaQCevtY0xLLD0A+bRZXbgLMLU1F/A=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0 h1:z85xZCsEl7bi/KwbNADeBYoOP0++7W1ipu+aGnpwzRM=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0 h1:BrVqGRd7+k1DiOgtnFvAkoQEWQvBc25ouMJM6429SFg=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20220411224347-583f2d630306 h1:+gHMid33q6pen7kv9xvT+JRinntgeXO2AeZVd0AWD3w=
-golang.org/x/time v0.0.0-20220411224347-583f2d630306/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.2.0 h1:52I/1L54xyEQAYdtcSuxtiT84KGYTBGXwayxmIpNJhE=
+golang.org/x/time v0.2.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
@@ -864,7 +713,6 @@ golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgw
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -889,7 +737,6 @@ golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
@@ -897,24 +744,16 @@ golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82u
 golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
-golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df h1:5Pf6pFKu98ODmgnpvkJ3kFUOQGGLIzLIkbzUHp47618=
-golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
 google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
@@ -934,27 +773,8 @@ google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz513
 google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
 google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
 google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
-google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU=
-google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94=
-google.golang.org/api v0.47.0/go.mod h1:Wbvgpq1HddcWVtzsVLyfLp8lDg6AA241LmgIL59tHXo=
-google.golang.org/api v0.48.0/go.mod h1:71Pr1vy+TAZRPkPs/xlCf5SsU8WjuAWv1Pfjbtukyy4=
-google.golang.org/api v0.50.0/go.mod h1:4bNT5pAuq5ji4SRZm+5QIkjny9JAyVD/3gaSihNefaw=
-google.golang.org/api v0.51.0/go.mod h1:t4HdrdoNgyN5cbEfm7Lum0lcLDLiise1F8qDKX00sOU=
-google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
-google.golang.org/api v0.55.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdrMgI=
-google.golang.org/api v0.59.0/go.mod h1:sT2boj7M9YJxZzgeZqXogmhfmRWDtPzT31xkieUbuZU=
-google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
-google.golang.org/api v0.63.0/go.mod h1:gs4ij2ffTRXwuzzgJl/56BdwJaA194ijkfn++9tDuPo=
-google.golang.org/api v0.67.0/go.mod h1:ShHKP8E60yPsKNw/w8w+VYaj9H6buA5UqDp8dhbQZ6g=
-google.golang.org/api v0.70.0/go.mod h1:Bs4ZM2HGifEvXwd50TtW70ovgJffJYw2oRCOFU/SkfA=
-google.golang.org/api v0.71.0/go.mod h1:4PyU6e6JogV1f9eA4voyrTY2batOLdgZ5qZ5HOCc4j8=
-google.golang.org/api v0.74.0/go.mod h1:ZpfMZOVRMywNyvJFeqL9HRWBgAuRfSjJFpe9QtRRyDs=
-google.golang.org/api v0.75.0/go.mod h1:pU9QmyHLnzlpar1Mjt4IbapUCy8J+6HD6GeELN69ljA=
-google.golang.org/api v0.78.0/go.mod h1:1Sg78yoMLOhlQTeF+ARBoytAcH1NNyyl390YMy6rKmw=
-google.golang.org/api v0.81.0 h1:o8WF5AvfidafWbFjsRyupxyEQJNUWxLZJCK5NXrxZZ8=
-google.golang.org/api v0.81.0/go.mod h1:FA6Mb/bZxj706H2j+j2d6mHEEaHBmbbWnkfvmorOCko=
+google.golang.org/api v0.103.0 h1:9yuVqlu2JCvcLg9p8S3fcFLZij8EPSyvODIY1rkMizQ=
+google.golang.org/api v0.103.0/go.mod h1:hGtW6nK1AC+d9si/UBhw8Xli+QMOf6xyNAyJw4qU9w0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -963,6 +783,7 @@ google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCID
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -985,7 +806,6 @@ google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfG
 google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
@@ -998,52 +818,27 @@ google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
-google.golang.org/genproto v0.0.0-20210513213006-bf773b8c8384/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
-google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210604141403-392c879c8b08/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210608205507-b6d2f5bf0d7d/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210624195500-8bfb893ecb84/go.mod h1:SzzZ/N+nwJDaO1kznhnlzqS8ocJICar6hYhVyhi++24=
-google.golang.org/genproto v0.0.0-20210713002101-d411969a0d9a/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
-google.golang.org/genproto v0.0.0-20210716133855-ce7ef5c701ea/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
-google.golang.org/genproto v0.0.0-20210728212813-7823e685a01f/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
-google.golang.org/genproto v0.0.0-20210805201207-89edb61ffb67/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
-google.golang.org/genproto v0.0.0-20210813162853-db860fec028c/go.mod h1:cFeNkxwySK631ADgubI+/XFU/xp8FD5KIVV4rj8UC5w=
-google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210903162649-d08c68adba83/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210909211513-a8c4777a87af/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210924002016-3dee208752a0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211008145708-270636b82663/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211028162531-8db9c33dc351/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211221195035-429b39de9b1c/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220126215142-9970aeb2e350/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220207164111-0872dc986b00/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220222213610-43724f9ea8cf/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220304144024-325a89244dc8/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220310185008-1973136f34c6/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220324131243-acbaeb5b85eb/go.mod h1:hAL49I2IFola2sVEjAn7MEwsja0xp51I0tlGAf9hz4E=
-google.golang.org/genproto v0.0.0-20220407144326-9054f6ed7bac/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220413183235-5e96e2839df9/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220414192740-2d67ff6cf2b4/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220429170224-98d788798c3e/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220505152158-f39f71e6c8f3/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/genproto v0.0.0-20220519153652-3a47de7e79bd h1:e0TwkXOdbnH/1x5rc5MZ/VYyiZ4v+RdVfrGMqEwT68I=
-google.golang.org/genproto v0.0.0-20220519153652-3a47de7e79bd/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/grpc v1.29.1 h1:EC2SB8S04d2r73uptxphDSUG+kTKVgjRPF+N3xpxRB4=
+google.golang.org/genproto v0.0.0-20221117204609-8f9c96812029 h1:zS8DNtiDX68/osEpazR86KM1vnDELdnRgpK6/fwlQTs=
+google.golang.org/genproto v0.0.0-20221117204609-8f9c96812029/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
+google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
+google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
+google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.50.1 h1:DS/BukOZWp8s6p4Dt/tOaJaTQyPyOoCcrjroHuCeLzY=
+google.golang.org/grpc v1.50.1/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1057,8 +852,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
+google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -1066,7 +861,6 @@ gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogR
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/cheggaaa/pb.v1 v1.0.27/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/go-playground/assert.v1 v1.2.1 h1:xoYuJVE7KT85PYWrN730RguIQO0ePzVRfFMXadIrXTM=
 gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8bDuhia5mkpMnE=
 gopkg.in/go-playground/validator.v9 v9.31.0 h1:bmXmP2RSNtFES+bn4uYuHT7iJFJv7Vj+an+ZQdDaD1M=
@@ -1074,10 +868,8 @@ gopkg.in/go-playground/validator.v9 v9.31.0/go.mod h1:+c9/zcJMFNgbLvly1L1V+PpxWd
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
-gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -1086,6 +878,7 @@ gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.3.0 h1:MfDY1b1/0xN1CyMlQDac0ziEy9zJQd9CXBRRDHw2jJo=
@@ -1100,4 +893,3 @@ honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
diff --git a/kustomize/bundle.yaml b/kustomize/bundle.yaml
index cc422b705b..0815e65ece 100644
--- a/kustomize/bundle.yaml
+++ b/kustomize/bundle.yaml
@@ -22,7 +22,7 @@ spec:
         fsGroup: 1000 # Atlantis group (1000) read/write access to volumes.
       containers:
       - name: atlantis
-        image: ghcr.io/runatlantis/atlantis:v0.20.0
+        image: ghcr.io/runatlantis/atlantis:v0.20.1
         env:
         - name: ATLANTIS_DATA_DIR
           value: /atlantis
diff --git a/main.go b/main.go
index a13104238f..357b05916d 100644
--- a/main.go
+++ b/main.go
@@ -24,7 +24,7 @@ import (
 	"github.com/spf13/viper"
 )
 
-const atlantisVersion = "0.20.0"
+const atlantisVersion = "0.20.1"
 
 func main() {
 	v := viper.New()
diff --git a/runatlantis.io/.vuepress/components/HomeCustom.vue b/runatlantis.io/.vuepress/components/HomeCustom.vue
index 27fe34e979..b4691cd0db 100644
--- a/runatlantis.io/.vuepress/components/HomeCustom.vue
+++ b/runatlantis.io/.vuepress/components/HomeCustom.vue
@@ -35,7 +35,7 @@
                   the Terraform plan output before it's applied.
                 </li>
                 <li><img class="checkmark" src="/checkmark.svg">Ensure that you
-                  apply changes before merging to master.
+                  apply changes before merging to main.
                 </li>
               </ul>
             </div>
diff --git a/runatlantis.io/.vuepress/config.js b/runatlantis.io/.vuepress/config.js
index cb0e9b17e8..57518fe1c3 100644
--- a/runatlantis.io/.vuepress/config.js
+++ b/runatlantis.io/.vuepress/config.js
@@ -26,6 +26,7 @@ module.exports = {
         ['meta', {name: 'google-site-verification', content: 'kTnsDBpHqtTNY8oscYxrQeeiNml2d2z-03Ct9wqeCeE' }]
     ],
     themeConfig: {
+        docsBranch: "main",
         activeHeaderLinks: false,
         algolia: {
           apiKey: '3b733dff1539ca3a210775860301fa86',
diff --git a/runatlantis.io/docs/access-credentials.md b/runatlantis.io/docs/access-credentials.md
index 594ca47e07..05d320b505 100644
--- a/runatlantis.io/docs/access-credentials.md
+++ b/runatlantis.io/docs/access-credentials.md
@@ -24,7 +24,7 @@ generate an access token. Read on for the instructions for your specific Git hos
 * [Azure DevOps](#azure-devops)
 
 ### GitHub user
-- Create a Personal Access Token by following: [https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-token)
+- Create a [Personal Access Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-fine-grained-personal-access-token)
 - Create the token with **repo** scope
 - Record the access token
 ::: warning
@@ -40,7 +40,7 @@ Available in Atlantis versions **newer** than 0.13.0.
 
 
 - Start Atlantis with fake github username and token (`atlantis server --gh-user fake --gh-token fake --repo-allowlist 'github.com/your-org/*' --atlantis-url https://$ATLANTIS_HOST`). If installing as an **Organization**, remember to add `--gh-org your-github-org` to this command.
-- Visit `https://$ATLANTIS_HOST/github-app/setup` and click on **Setup** to create the app on Github. You'll be redirected back to Atlantis
+- Visit `https://$ATLANTIS_HOST/github-app/setup` and click on **Setup** to create the app on GitHub. You'll be redirected back to Atlantis
 - A link to install your app, along with its secrets, will be shown on the screen. Record your app's credentials and install your app for your user/org by following said link.
 - Create a file with the contents of the GitHub App Key, e.g. `atlantis-app-key.pem`
 - Restart Atlantis with new flags: `atlantis server --gh-app-id <your id> --gh-app-key-file atlantis-app-key.pem --gh-webhook-secret <your secret> --write-git-creds --repo-allowlist 'github.com/your-org/*' --atlantis-url https://$ATLANTIS_HOST`.
@@ -51,6 +51,25 @@ Available in Atlantis versions **newer** than 0.13.0.
 Only a single installation per GitHub App is supported at the moment.
 :::
 
+#### Permissions
+
+GitHub App needs these permissions. These are automatically set when a GitHub app is created.
+
+::: tip NOTE
+Since v0.19.7, a new permission for `Administration` has been added. If you have already created a GitHub app, updating Atlantis to v0.19.7 will not automatically add this permission, so you will need to set it manually.
+:::
+
+| Type            | Access              | 
+| --------------- | ------------------- | 
+| Administration  | Read-only           | 
+| Checks          | Read and write      | 
+| Commit statuses | Read and write      | 
+| Contents        | Read and write      | 
+| Issues          | Read and write      | 
+| Metadata        | Read-only (default) | 
+| Pull requests   | Read and write      | 
+| Webhooks        | Read and write      | 
+
 ### GitLab
 - Follow: [https://docs.gitlab.com/ce/user/profile/personal_access_tokens.html#create-a-personal-access-token](https://docs.gitlab.com/ce/user/profile/personal_access_tokens.html#create-a-personal-access-token)
 - Create a token with **api** scope
@@ -70,6 +89,8 @@ Only a single installation per GitHub App is supported at the moment.
 - Give the token **Read** Project permissions and **Write** Pull request permissions
 - Click **Create** and record the access token
 
+  NOTE: Atlantis will send the token as a [Bearer Auth to the Bitbucket API](https://confluence.atlassian.com/bitbucketserver/http-access-tokens-939515499.html#HTTPaccesstokens-UsingHTTPaccesstokens) instead of using Basic Auth.
+
 ### Azure DevOps
 - Create a Personal access token by following [https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops)
 - Label the password "atlantis"
diff --git a/runatlantis.io/docs/apply-requirements.md b/runatlantis.io/docs/apply-requirements.md
index e3a779a9d9..4fa7edf3d7 100644
--- a/runatlantis.io/docs/apply-requirements.md
+++ b/runatlantis.io/docs/apply-requirements.md
@@ -103,7 +103,7 @@ If you set up Protected Branches then you can enforce:
 * Requiring certain status checks to be passing
 * Requiring certain people to have reviewed and approved the pull request
 * Requiring `CODEOWNERS` to have reviewed and approved the pull request
-* Requiring that the branch is up to date with `master`
+* Requiring that the branch is up to date with `main`
 
 See [https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches)
 for more details.
@@ -114,6 +114,10 @@ the Atlantis user needs to be part of that list in order for it to consider
 a pull request mergeable.
 :::
 
+::: warning
+If you set `atlantis/apply` to the mergeable requirement, use the `--gh-allow-mergeable-bypass-apply` flag or set the `ATLANTIS_GH_ALLOW_MERGEABLE_BYPASS_APPLY=true` environment variable. This flag and environment variable allow the mergeable check before executing `atlantis apply` to skip checking the status of `atlantis/apply`.
+:::
+
 #### GitLab
 For GitLab, a merge request will be merged if there are no conflicts, no unresolved discussions if it is a project requirement and if all necessary approvers have approved the pull request.
 
@@ -172,7 +176,7 @@ You can set the `undiverged` requirement by:
 #### Meaning
 The `merge` checkout strategy creates a temporary merge commit and runs the `plan` on the Atlantis local version of the PR
 source and destination branch. The local destination branch can become out of date since changes to the destination branch are not fetched
-if there are no changes to the source branch. `undiverged` enforces that Atlantis local version of master is up to date
+if there are no changes to the source branch. `undiverged` enforces that Atlantis local version of main is up to date
 with remote so that the state of the source during the `apply` is identical to that if you were to merge the PR at that
 time.
 
diff --git a/runatlantis.io/docs/checkout-strategy.md b/runatlantis.io/docs/checkout-strategy.md
index 01ffdbedc4..d58c875235 100644
--- a/runatlantis.io/docs/checkout-strategy.md
+++ b/runatlantis.io/docs/checkout-strategy.md
@@ -13,24 +13,24 @@ of the pull request.
 For example, given the following git history:
 ![Git History](./images/branch-strategy.png)
 
-If the pull request was asking to merge `branch` into `master`,
+If the pull request was asking to merge `branch` into `main`,
 Atlantis would check out `branch` at commit `C3`.
 
 ## Merge
 The problem with the `branch` strategy, is that if users push branches that are
-out of date with `master`, then their `terraform plan` could be deleting
-some resources that were configured in the master branch.
+out of date with `main`, then their `terraform plan` could be deleting
+some resources that were configured in the main branch.
 
 For example, in the above diagram if commits `C4` and `C5` have modified the
 terraform state and added new resources, then when Atlantis runs `terraform plan`
 at commit `C3`, because the code doesn't have the changes from `C4` and `C5`,
 Terraform will try to delete those resources.
 
-To fix this, users could merge `master` into their branch, *or* you can run
+To fix this, users could merge `main` into their branch, *or* you can run
 Atlantis with `--checkout-strategy=merge`. With this strategy, Atlantis will
 try to perform a merge locally by:
 
-* Checking out the destination branch of the pull request (ex. `master`)
+* Checking out the destination branch of the pull request (ex. `main`)
 * Locally performing a `git merge {source branch}`
 * Then running its Terraform commands
 
@@ -44,5 +44,5 @@ Atlantis doesn't actually commit this merge anywhere. It just uses it locally.
 
 :::warning
 Atlantis only performs this merge during the `terraform plan` phase. If another
-commit is pushed to `master` **after** Atlantis runs `plan`, nothing will happen.
+commit is pushed to `main` **after** Atlantis runs `plan`, nothing will happen.
 :::
diff --git a/runatlantis.io/docs/configuring-webhooks.md b/runatlantis.io/docs/configuring-webhooks.md
index 54e72f84f1..590b994e5b 100644
--- a/runatlantis.io/docs/configuring-webhooks.md
+++ b/runatlantis.io/docs/configuring-webhooks.md
@@ -18,7 +18,7 @@ If only some of the repos in your organization are to be managed by Atlantis, th
 may want to only install on specific repos for now.
 :::
 
-When authenticating as a Github App, Webhooks are automatically created and need no additional setup, beyond being installed to your organization/user account after creation. Refer to the [Github App setup](access-credentials.md#github-app) section for instructions on how to do so.
+When authenticating as a GitHub App, Webhooks are automatically created and need no additional setup, beyond being installed to your organization/user account after creation. Refer to the [GitHub App setup](access-credentials.md#github-app) section for instructions on how to do so.
 
 If you're installing on the organization, navigate to your organization's page and click **Settings**.
 If installing on a single repository, navigate to the repository home page and click **Settings**.
diff --git a/runatlantis.io/docs/custom-workflows.md b/runatlantis.io/docs/custom-workflows.md
index ae6cb49dec..b118816774 100644
--- a/runatlantis.io/docs/custom-workflows.md
+++ b/runatlantis.io/docs/custom-workflows.md
@@ -420,7 +420,8 @@ Or a custom command
 | run | string | none    | no       | Run a custom command |
 
 ::: tip Notes
-* `run` steps are executed with the following environment variables:
+* `run` steps in the main `workflow` are executed with the following environment variables:
+*  note: these variables are not available to `pre` or `post` workflows
   * `WORKSPACE` - The Terraform workspace used for this project, ex. `default`.
     * NOTE: if the step is executed before `init` then Atlantis won't have switched to this workspace yet.
   * `ATLANTIS_TERRAFORM_VERSION` - The version of Terraform used for this project, ex. `0.11.0`.
@@ -497,4 +498,3 @@ The name-value pairs in the result are added as environment variables if success
 * `multienv` `command`'s can use any of the built-in environment variables available
   to `run` commands. 
 :::
-
diff --git a/runatlantis.io/docs/locking.md b/runatlantis.io/docs/locking.md
index f3e32b8745..526d4f644a 100644
--- a/runatlantis.io/docs/locking.md
+++ b/runatlantis.io/docs/locking.md
@@ -16,14 +16,14 @@ Only the directory in the repo and Terraform workspace are locked, not the whole
 
 ## Why
 1. Because `atlantis apply` is being done before the pull request is merged, after
-an apply your `master` branch does not represent the most up to date version of your infrastructure
+an apply your `main` branch does not represent the most up to date version of your infrastructure
 anymore. With locking, you can ensure that no other changes will be made until the
 pull request is merged.
 
 ::: tip Why not apply on merge?
 Sometimes `terraform apply` fails. If the apply were to fail after the pull
 request was merged, you would need to create a new pull request to fix it.
-With locking + applying on the branch, you effectively mimic merging to master
+With locking + applying on the branch, you effectively mimic merging to main
 but with the added ability to re-plan/apply multiple times if things don't work.
 :::
 2. If there is already a `plan` in progress, other users won't see a plan that
diff --git a/runatlantis.io/docs/post-workflow-hooks.md b/runatlantis.io/docs/post-workflow-hooks.md
index 577b677541..16e043a68e 100644
--- a/runatlantis.io/docs/post-workflow-hooks.md
+++ b/runatlantis.io/docs/post-workflow-hooks.md
@@ -72,4 +72,6 @@ command](custom-workflows.html#custom-run-command).
   * `PULL_AUTHOR` - Username of the pull request author, ex. `acme-user`.
   * `DIR` - The absolute path to the root of the cloned repository.
   * `USER_NAME` - Username of the VCS user running command, ex. `acme-user`. During an autoplan, the user will be the Atlantis API user, ex. `atlantis`.
+  * `COMMENT_ARGS` - Any additional flags passed in the comment on the pull request. Flags are separated by commas and
+    every character is escaped, ex. `atlantis plan -- arg1 arg2` will result in `COMMENT_ARGS=\a\r\g\1,\a\r\g\2`.
 :::
diff --git a/runatlantis.io/docs/pre-workflow-hooks.md b/runatlantis.io/docs/pre-workflow-hooks.md
index 33dff00b3a..b3b410f156 100644
--- a/runatlantis.io/docs/pre-workflow-hooks.md
+++ b/runatlantis.io/docs/pre-workflow-hooks.md
@@ -56,5 +56,7 @@ command](custom-workflows.html#custom-run-command).
   * `PULL_AUTHOR` - Username of the pull request author, ex. `acme-user`.
   * `DIR` - The absolute path to the root of the cloned repository. 
   * `USER_NAME` - Username of the VCS user running command, ex. `acme-user`. During an autoplan, the user will be the Atlantis API user, ex. `atlantis`.
+  * `COMMENT_ARGS` - Any additional flags passed in the comment on the pull request. Flags are separated by commas and
+      every character is escaped, ex. `atlantis plan -- arg1 arg2` will result in `COMMENT_ARGS=\a\r\g\1,\a\r\g\2`.
 :::
 
diff --git a/runatlantis.io/docs/repo-level-atlantis-yaml.md b/runatlantis.io/docs/repo-level-atlantis-yaml.md
index 991cc06ee7..6ae9606bc6 100644
--- a/runatlantis.io/docs/repo-level-atlantis-yaml.md
+++ b/runatlantis.io/docs/repo-level-atlantis-yaml.md
@@ -51,6 +51,7 @@ parallel_plan: true
 parallel_apply: true
 projects:
 - name: my-project-name
+  branch: /main/
   dir: .
   workspace: default
   terraform_version: v0.11.0
@@ -78,6 +79,22 @@ allowed_regexp_prefixes:
 - staging/
 ```
 
+## Auto generate projects
+
+This is useful if you have many projects in a repository. This assumes the `default` workspace (or no workspace).
+
+Run this in the root of your repository. This will use gnu `grep` to search terraform files for an S3 backend (terraform dir), retrieve the directory path, retrieve the unique entries, and then use `yq` to return the YAML of a simple project dir setup which can then be modified to your liking.
+
+```sh
+grep -P 'backend[\s]+"s3"' **/*.tf |
+  rev | cut -d'/' -f2- | rev |
+  sort |
+  uniq |
+  while read d; do \
+    echo '[ {"dir": "'"$d"'", "autoplan": {"when_modified": ["**/*.tf.*"] }} ]' | yq -PM; \
+  done
+```
+
 ## Use Cases
 ### Disabling Autoplanning
 ```yaml
@@ -214,7 +231,7 @@ projects:
 ```
 With this config above, Atlantis runs planning/applying for project2 first, then for project1.
 Several projects can have same `execution_order_group`. Any order in one group isn't guaranteed.
-`parallel_plan` and `parallel_apply` respect these order groups, so parallel planning/applying works 
+`parallel_plan` and `parallel_apply` respect these order groups, so parallel planning/applying works
 in each group one by one.
 
 ### Custom Backend Config
@@ -242,6 +259,7 @@ allowed_regexp_prefixes:
 ### Project
 ```yaml
 name: myname
+branch: /mybranch/
 dir: mydir
 workspace: myworkspace
 execution_order_group: 0
@@ -255,7 +273,7 @@ workflow: myworkflow
 | Key                                    | Type                  | Default     | Required | Description                                                                                                                                                                                                                          |
 |----------------------------------------|-----------------------|-------------|----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | name                                   | string                | none        | maybe    | Required if there is more than one project with the same `dir` and `workspace`. This project name can be used with the `-p` flag.                                                                                                    |
-| dir                                    | string                | none        | **yes**  | The directory of this project relative to the repo root. For example if the project was under `./project1` then use `project1`. Use `.` to indicate the repo root.                                                                   |
+| branch                                 | string                | none        | no       | Regex matching projects by the base branch of pull request (the branch the pull request is getting merged into). Only projects that match the PR's branch will be considered. By default, all branches are matched.                  || dir                                    | string                | none        | **yes**  | The directory of this project relative to the repo root. For example if the project was under `./project1` then use `project1`. Use `.` to indicate the repo root.                                                                   |
 | workspace                              | string                | `"default"` | no       | The [Terraform workspace](https://www.terraform.io/docs/state/workspaces.html) for this project. Atlantis will switch to this workplace when planning/applying and will create it if it doesn't exist.                               |
 | execution_order_group                  | int                   | `0`         | no       | Index of execution order group. Projects will be sort by this field before planning/applying.                                                                                                                                        |
 | delete_source_branch_on_merge          | bool                  | `false`     | no       | Automatically deletes the source branch on merge.                                                                                                                                                                                    |
diff --git a/runatlantis.io/docs/security.md b/runatlantis.io/docs/security.md
index bed3b92495..489e313a9b 100644
--- a/runatlantis.io/docs/security.md
+++ b/runatlantis.io/docs/security.md
@@ -15,7 +15,7 @@ Atlantis could be exploited by
       }
     }
     ```
-* Running malicious custom build commands specified in an `atlantis.yaml` file. Atlantis uses the `atlantis.yaml` file from the pull request branch, **not** `master`.
+* Running malicious custom build commands specified in an `atlantis.yaml` file. Atlantis uses the `atlantis.yaml` file from the pull request branch, **not** `main`.
 * Someone adding `atlantis plan/apply` comments on your valid pull requests causing terraform to run when you don't want it to.
 
 ## Bitbucket Cloud (bitbucket.org)
diff --git a/runatlantis.io/docs/server-configuration.md b/runatlantis.io/docs/server-configuration.md
index c573be5398..92dee66822 100644
--- a/runatlantis.io/docs/server-configuration.md
+++ b/runatlantis.io/docs/server-configuration.md
@@ -134,6 +134,12 @@ Values are chosen in this order:
   * Autoplan when any `*.tf` files or `.yml` files in subfolder of `project1` is modified.
     * `--autoplan-file-list='**/*.tf,project2/**/*.yml'`
 
+### `--azuredevops-hostname`
+  ```bash
+  atlantis server --azuredevops-hostname="dev.azure.com"
+  ```
+  Azure DevOps hostname to support cloud and self hosted instances. Defaults to `dev.azure.com`.
+
 ### `--azuredevops-webhook-password`
   ```bash
   atlantis server --azuredevops-webhook-password="password123"
@@ -253,6 +259,12 @@ Values are chosen in this order:
   ```
   Disable atlantis auto planning
 
+### `--disable-markdown-folding`
+  ```bash
+  atlantis server --disable-markdown-folding
+  ```
+  Disable folding in markdown output.
+
 ### `--disable-repo-locking`
   ```bash
   atlantis server --disable-repo-locking
@@ -283,13 +295,13 @@ Values are chosen in this order:
   ```
   Enable Atlantis to format Terraform plan output into a markdown-diff friendly format for color-coding purposes.
 
-  Useful to enable for use with Github.
+  Useful to enable for use with GitHub.
 
 ### `--gh-hostname`
   ```bash
   atlantis server --gh-hostname="my.github.enterprise.com"
   ```
-  Hostname of your GitHub Enterprise installation. If using [Github.com](https://github.com),
+  Hostname of your GitHub Enterprise installation. If using [GitHub.com](https://github.com),
   don't set. Defaults to `github.com`.
 
 ### `--gh-token`
@@ -323,7 +335,7 @@ Values are chosen in this order:
   ```bash
   atlantis server --gh-org="myorgname"
   ```
-  GitHub organization name. Set to enable creating a private Github app for this organization.
+  GitHub organization name. Set to enable creating a private GitHub app for this organization.
 
 ### `--gh-app-id`
   ```bash
@@ -347,6 +359,12 @@ Values are chosen in this order:
   After which Atlantis will display your new app's credentials: your app's ID, its generated `--gh-webhook-secret` and the contents of the file for `--gh-app-key-file`. Update your Atlantis config accordingly, and restart the server.
   :::
 
+### `--gh-app-slug`
+  ```bash
+  atlantis server --gh-app-slug="myappslug"
+  ```
+  A slugged version of GitHub app name shown in pull requests comments, etc (not `Atlantis App` but something like `atlantis-app`). Atlantis uses the value of this parameter to identify the comments it has left on GitHub pull requests. This is used for functions such as `--hide-prev-plan-comments`.
+
 ### `--gh-app-key-file`
   ```bash
   atlantis server --gh-app-key-file="path/to/app-key.pem"
@@ -365,11 +383,16 @@ Values are chosen in this order:
 
 ### `--gh-team-allowlist`
   ```bash
-  atlantis server --gh-team-allowlist="myteam:plan, secteam:apply"
+  atlantis server --gh-team-allowlist="myteam:plan, secteam:apply, DevOps Team:apply"
   ```
   Comma-separated list of GitHub team name (not a slug) and permission pairs. By default, any team can plan and apply.
+  
+  ::: warning NOTE
+  You should use the Team name as the variable, not the slug, even if it has spaces or special characters.
+  i.e., "Engineering Team:plan, Infrastructure Team:apply"
+  :::
 
-- ### `--gh-allow-mergeable-bypass-apply`
+### `--gh-allow-mergeable-bypass-apply`
   ```bash
   atlantis server --gh-allow-mergeable-bypass-apply
   ```
@@ -438,6 +461,21 @@ Values are chosen in this order:
   ```
   Log level. Defaults to `info`.
 
+### `--markdown-template-overrides-dir`
+  ```bash
+  atlantis server --markdown-template-overrides-dir="path/to/templates/"
+  ```
+  Directory where Atlantis will read in overrides for markdown templates used to render comments on pull requests.
+  Markdown template overrides may be specified either in individual files, or all together in a single file. All template
+  override files _must_ have the `.tmpl` extension, otherwise they will not be parsed.
+
+  Markdown templates which may have overrides can be found [here](https://github.com/runatlantis/atlantis/tree/main/server/events/templates)
+
+  Please be mindful that settings like `--enable-diff-markdown-format` depend on logic defined in the templates. It is
+  possible to diverge from expected behavior, if care is not taken when overriding default templates.
+
+  Defaults to the atlantis home directory `/home/atlantis/.markdown_templates/` in `/$HOME/.markdown_templates`.
+
 ### `--parallel-pool-size`
   ```bash
   atlantis server --parallel-pool-size=100
@@ -450,6 +488,12 @@ Values are chosen in this order:
   ```
   Port to bind to. Defaults to `4141`.
 
+### `--quiet-policy-checks`
+  ```bash
+  atlantis server --quiet-policy-checks
+  ```
+  Exclude policy check comments from pull requests unless there's an actual error from conftest. This also excludes warnings. Defaults to `false`.
+
 ### `--redis-host`
   ```bash
   atlantis server --redis-host="localhost"
@@ -605,6 +649,7 @@ Values are chosen in this order:
 ### `--silence-whitelist-errors`
   <Badge text="Deprecated" type="warn"/>
   Deprecated for `--silence-allowlist-errors`.
+
 ### `--silence-allowlist-errors`
   ```bash
   atlantis server --silence-allowlist-errors
@@ -724,3 +769,27 @@ Values are chosen in this order:
   ::: warning SECURITY WARNING
   This does write secrets to disk and should only be enabled in a secure environment.
   :::
+
+### `--web-basic-auth`
+  ```bash
+  atlantis server --web-basic-auth
+  ```
+  Enable Basic Authentication on the Atlantis web service.
+
+### `--web-username`
+  ```bash
+  atlantis server --web-username="atlantis"
+  ```
+  Username used for Basic Authentication on the Atlantis web service. Defaults to `atlantis`.
+
+### `--web-password`
+  ```bash
+  atlantis server --web-password="atlantis"
+  ```
+  Password used for Basic Authentication on the Atlantis web service. Defaults to `atlantis`.
+
+### `--websocket-check-origin`
+  ```bash
+  atlantis server --websocket-check-origin
+  ```
+  Only allow websockets connection when they originate from the running Atlantis web server
diff --git a/runatlantis.io/docs/server-side-repo-config.md b/runatlantis.io/docs/server-side-repo-config.md
index 84f64ccda9..a54c8bd2ec 100644
--- a/runatlantis.io/docs/server-side-repo-config.md
+++ b/runatlantis.io/docs/server-side-repo-config.md
@@ -459,9 +459,10 @@ If you set a workflow with the key `default`, it will override this.
 
 ### Metrics
 
-| Key                    | Type              | Default | Required  | Description                              |
-|------------------------|-------------------|---------|-----------|------------------------------------------|
-| statsd                 | [Statsd](#statsd) | none    | no        | Statsd metrics provider                  |
+| Key                    | Type                      | Default | Required  | Description                              |
+|------------------------|---------------------------|---------|-----------|------------------------------------------|
+| statsd                 | [Statsd](#statsd)         | none    | no        | Statsd metrics provider                  |
+| prometheus             | [Prometheus](#prometheus) | none    | no        | Statsd metrics provider                  |
 
 ### Statsd
 
@@ -469,3 +470,9 @@ If you set a workflow with the key `default`, it will override this.
 | ------ | ------ | ------- | -------- | -------------------------------------- |
 | host   | string | none    | yes      | statsd host ip address                 |
 | port   | string | none    | yes      | statsd port                            |
+
+### Prometheus
+
+| Key      | Type   | Default | Required | Description                            |
+| -------- | ------ | ------- | -------- | -------------------------------------- |
+| endpoint | string | none    | yes      | path to metrics endpoint               |
diff --git a/runatlantis.io/docs/stats.md b/runatlantis.io/docs/stats.md
index 1717154489..b4f12c4b60 100644
--- a/runatlantis.io/docs/stats.md
+++ b/runatlantis.io/docs/stats.md
@@ -3,7 +3,7 @@
 Atlantis exposes a set of metrics for each of its operations including errors, successes, and latencies.
 
 ::: warning NOTE
-Only statsd is supported currently, but it should be relatively straightforward to add other providers such as prometheus.
+Currently Statsd and Prometheus is supported. See configuration below for details.
 :::
 
 ## Configuration
diff --git a/runatlantis.io/docs/webhook-secrets.md b/runatlantis.io/docs/webhook-secrets.md
index 719820ca0c..8b66ee8276 100644
--- a/runatlantis.io/docs/webhook-secrets.md
+++ b/runatlantis.io/docs/webhook-secrets.md
@@ -17,7 +17,7 @@ Azure DevOps uses Basic authentication for webhooks rather than webhook secrets.
 :::
 
 ::: tip NOTE
-An app-wide token is generated during [Github App setup](access-credentials.html#github-app). You can recover it by navigating to the [Github app settings page](https://github.com/settings/apps) and selecting "Edit" next to your Atlantis app's name. Token appears after clicking "Edit" under the Webhook header.
+An app-wide token is generated during [GitHub App setup](access-credentials.html#github-app). You can recover it by navigating to the [GitHub app settings page](https://github.com/settings/apps) and selecting "Edit" next to your Atlantis app's name. Token appears after clicking "Edit" under the Webhook header.
 :::
 
 ::: warning
diff --git a/runatlantis.io/guide/README.md b/runatlantis.io/guide/README.md
index a8e36beded..15472518b8 100644
--- a/runatlantis.io/guide/README.md
+++ b/runatlantis.io/guide/README.md
@@ -29,7 +29,7 @@ Check out the video below to see it in action:
 ### Increased visibility
 When everyone is executing Terraform on their own computers, it's hard to know the
 current state of your infrastructure:
-* Is what's in `master` deployed?
+* Is what's in `main` branch deployed?
 * Did someone forget to create a pull request for that latest change?
 * What was the output from that last `terraform apply`?
 
diff --git a/runatlantis.io/guide/testing-locally.md b/runatlantis.io/guide/testing-locally.md
index e55050f1a5..45c0346b23 100644
--- a/runatlantis.io/guide/testing-locally.md
+++ b/runatlantis.io/guide/testing-locally.md
@@ -147,7 +147,7 @@ you can use your own user. Here we'll create the access token that Atlantis uses
 set commit statuses.
 
 ### GitHub or GitHub Enterprise Access Token
-- follow [https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-token)
+- Create a [Personal Access Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-fine-grained-personal-access-token)
 - create a token with **repo** scope
 - set the token as an environment variable
 ```
diff --git a/scripts/e2e-deps.sh b/scripts/e2e-deps.sh
index 6791d918fb..e1759b9039 100755
--- a/scripts/e2e-deps.sh
+++ b/scripts/e2e-deps.sh
@@ -1,5 +1,8 @@
 #!/usr/bin/env bash
 
+# Exit immediately if a command returns a non-zero code
+set -e
+
 echo "Preparing to run e2e tests"
 if [ ! -f atlantis ]; then
     echo "atlantis binary not found. exiting...."
@@ -13,7 +16,7 @@ cd e2e/
 curl -LOk https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip
 unzip terraform_${TERRAFORM_VERSION}_linux_amd64.zip
 chmod +x terraform
-cp terraform /go/bin/
+cp terraform /home/circleci/go/bin
 # Download ngrok to create a tunnel to expose atlantis server
 wget https://bin.equinox.io/c/4VmDzA7iaHb/ngrok-stable-linux-amd64.zip
 unzip ngrok-stable-linux-amd64.zip 
@@ -21,4 +24,4 @@ chmod +x ngrok
 wget https://stedolan.github.io/jq/download/linux64/jq
 chmod +x jq
 # Copy github config file - replace with circleci user later
-cp .gitconfig ~/.gitconfig
\ No newline at end of file
+cp .gitconfig ~/.gitconfig
diff --git a/server/controllers/events/events_controller.go b/server/controllers/events/events_controller.go
index e6946b9f17..bfd9ab2f53 100644
--- a/server/controllers/events/events_controller.go
+++ b/server/controllers/events/events_controller.go
@@ -139,8 +139,9 @@ func (e *VCSEventsController) Post(w http.ResponseWriter, r *http.Request) {
 }
 
 type HTTPError struct {
-	err  error
-	code int
+	err        error
+	code       int
+	isSilenced bool
 }
 
 type HTTPResponse struct {
@@ -170,9 +171,11 @@ func (e *VCSEventsController) handleGithubPost(w http.ResponseWriter, r *http.Re
 	case *github.IssueCommentEvent:
 		resp = e.HandleGithubCommentEvent(event, githubReqID, logger)
 		scope = scope.SubScope(fmt.Sprintf("comment_%s", *event.Action))
+		scope = vcs.SetGitScopeTags(scope, event.GetRepo().GetFullName(), event.GetIssue().GetNumber())
 	case *github.PullRequestEvent:
 		resp = e.HandleGithubPullRequestEvent(logger, event, githubReqID)
 		scope = scope.SubScope(fmt.Sprintf("pr_%s", *event.Action))
+		scope = vcs.SetGitScopeTags(scope, event.GetRepo().GetFullName(), event.GetNumber())
 	default:
 		resp = HTTPResponse{
 			body: fmt.Sprintf("Ignoring unsupported event %s", githubReqID),
@@ -180,7 +183,9 @@ func (e *VCSEventsController) handleGithubPost(w http.ResponseWriter, r *http.Re
 	}
 
 	if resp.err.code != 0 {
-		logger.Err("error handling gh post code: %d err: %s", resp.err.code, resp.err.err.Error())
+		if !resp.err.isSilenced {
+			logger.Err("error handling gh post code: %d err: %s", resp.err.code, resp.err.err.Error())
+		}
 		scope.Counter(fmt.Sprintf("error_%d", resp.err.code)).Inc(1)
 		w.WriteHeader(resp.err.code)
 		fmt.Fprintln(w, resp.err.err.Error())
@@ -294,8 +299,9 @@ func (e *VCSEventsController) HandleGithubCommentEvent(event *github.IssueCommen
 		return HTTPResponse{
 			body: wrapped.Error(),
 			err: HTTPError{
-				code: http.StatusBadRequest,
-				err:  wrapped,
+				code:       http.StatusBadRequest,
+				err:        wrapped,
+				isSilenced: false,
 			},
 		}
 	}
@@ -401,8 +407,9 @@ func (e *VCSEventsController) HandleGithubPullRequestEvent(logger logging.Simple
 		return HTTPResponse{
 			body: wrapped.Error(),
 			err: HTTPError{
-				code: http.StatusBadRequest,
-				err:  wrapped,
+				code:       http.StatusBadRequest,
+				err:        wrapped,
+				isSilenced: false,
 			},
 		}
 	}
@@ -425,8 +432,9 @@ func (e *VCSEventsController) handlePullRequestEvent(logger logging.SimpleLoggin
 		return HTTPResponse{
 			body: err.Error(),
 			err: HTTPError{
-				code: http.StatusForbidden,
-				err:  err,
+				code:       http.StatusForbidden,
+				err:        err,
+				isSilenced: e.SilenceAllowlistErrors,
 			},
 		}
 	}
@@ -453,8 +461,9 @@ func (e *VCSEventsController) handlePullRequestEvent(logger logging.SimpleLoggin
 			return HTTPResponse{
 				body: err.Error(),
 				err: HTTPError{
-					code: http.StatusForbidden,
-					err:  err,
+					code:       http.StatusForbidden,
+					err:        err,
+					isSilenced: false,
 				},
 			}
 		}
@@ -538,11 +547,13 @@ func (e *VCSEventsController) handleCommentEvent(logger logging.SimpleLogging, b
 		e.commentNotAllowlisted(baseRepo, pullNum)
 
 		err := errors.New("Repo not allowlisted")
+
 		return HTTPResponse{
 			body: err.Error(),
 			err: HTTPError{
-				err:  err,
-				code: http.StatusForbidden,
+				err:        err,
+				code:       http.StatusForbidden,
+				isSilenced: e.SilenceAllowlistErrors,
 			},
 		}
 	}
diff --git a/server/controllers/events/events_controller_e2e_test.go b/server/controllers/events/events_controller_e2e_test.go
index 213b983d28..1f101fe2d2 100644
--- a/server/controllers/events/events_controller_e2e_test.go
+++ b/server/controllers/events/events_controller_e2e_test.go
@@ -41,7 +41,7 @@ import (
 	. "github.com/runatlantis/atlantis/testing"
 )
 
-const ConftestVersion = "0.25.0"
+const ConftestVersion = "0.35.0"
 
 var applyLocker locking.ApplyLocker
 var userConfig server.UserConfig
@@ -394,8 +394,7 @@ func TestGitHubWorkflow(t *testing.T) {
 
 			ctrl, vcsClient, githubGetter, atlantisWorkspace := setupE2E(t, c.RepoDir)
 			// Set the repo to be cloned through the testing backdoor.
-			repoDir, headSHA, cleanup := initializeRepo(t, c.RepoDir)
-			defer cleanup()
+			repoDir, headSHA := initializeRepo(t, c.RepoDir)
 			atlantisWorkspace.TestingOverrideHeadCloneURL = fmt.Sprintf("file://%s", repoDir)
 
 			// Setup test dependencies.
@@ -544,8 +543,7 @@ func TestSimlpleWorkflow_terraformLockFile(t *testing.T) {
 
 			ctrl, vcsClient, githubGetter, atlantisWorkspace := setupE2E(t, c.RepoDir)
 			// Set the repo to be cloned through the testing backdoor.
-			repoDir, headSHA, cleanup := initializeRepo(t, c.RepoDir)
-			defer cleanup()
+			repoDir, headSHA := initializeRepo(t, c.RepoDir)
 
 			oldLockFilePath, err := filepath.Abs(filepath.Join("testfixtures", "null_provider_lockfile_old_version"))
 			Ok(t, err)
@@ -653,6 +651,12 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
 		ExpAutomerge bool
 		// ExpAutoplan is true if we expect Atlantis to autoplan.
 		ExpAutoplan bool
+		// ExpQuietPolicyChecks is true if we expect Atlantis to exclude policy check output
+		// when there's no error
+		ExpQuietPolicyChecks bool
+		// ExpQuietPolicyCheckFailure is true when we expect Atlantis to post back policy check failures
+		// even when QuietPolicyChecks is enabled
+		ExpQuietPolicyCheckFailure bool
 		// ExpParallel is true if we expect Atlantis to run parallel plans or applies.
 		ExpParallel bool
 		// ExpReplies is a list of files containing the expected replies that
@@ -737,6 +741,38 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
 				{"exp-output-merge.txt"},
 			},
 		},
+		{
+			Description:          "successful policy checks with quiet flag enabled",
+			RepoDir:              "policy-checks-success-silent",
+			ModifiedFiles:        []string{"main.tf"},
+			ExpAutoplan:          true,
+			ExpQuietPolicyChecks: true,
+			Comments: []string{
+				"atlantis apply",
+			},
+			ExpReplies: [][]string{
+				{"exp-output-autoplan.txt"},
+				{"exp-output-apply.txt"},
+				{"exp-output-merge.txt"},
+			},
+		},
+		{
+			Description:                "failing policy checks with quiet flag enabled",
+			RepoDir:                    "policy-checks",
+			ModifiedFiles:              []string{"main.tf"},
+			ExpAutoplan:                true,
+			ExpQuietPolicyChecks:       true,
+			ExpQuietPolicyCheckFailure: true,
+			Comments: []string{
+				"atlantis apply",
+			},
+			ExpReplies: [][]string{
+				{"exp-output-autoplan.txt"},
+				{"exp-output-auto-policy-check.txt"},
+				{"exp-output-apply-failed.txt"},
+				{"exp-output-merge.txt"},
+			},
+		},
 	}
 
 	for _, c := range cases {
@@ -746,12 +782,12 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
 			// reset userConfig
 			userConfig = server.UserConfig{}
 			userConfig.EnablePolicyChecksFlag = true
+			userConfig.QuietPolicyChecks = c.ExpQuietPolicyChecks
 
 			ctrl, vcsClient, githubGetter, atlantisWorkspace := setupE2E(t, c.RepoDir)
 
 			// Set the repo to be cloned through the testing backdoor.
-			repoDir, headSHA, cleanup := initializeRepo(t, c.RepoDir)
-			defer cleanup()
+			repoDir, headSHA := initializeRepo(t, c.RepoDir)
 			atlantisWorkspace.TestingOverrideHeadCloneURL = fmt.Sprintf("file://%s", repoDir)
 
 			// Setup test dependencies.
@@ -805,6 +841,10 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
 				expNumReplies++
 			}
 
+			if c.ExpQuietPolicyChecks && !c.ExpQuietPolicyCheckFailure {
+				expNumReplies--
+			}
+
 			_, _, actReplies, _ := vcsClient.VerifyWasCalled(Times(expNumReplies)).CreateComment(AnyRepo(), AnyInt(), AnyString(), AnyString()).GetAllCapturedArguments()
 			Assert(t, len(c.ExpReplies) == len(actReplies), "missing expected replies, got %d but expected %d", len(actReplies), len(c.ExpReplies))
 			for i, expReply := range c.ExpReplies {
@@ -823,8 +863,7 @@ func TestGitHubWorkflowWithPolicyCheck(t *testing.T) {
 
 func setupE2E(t *testing.T, repoDir string) (events_controllers.VCSEventsController, *vcsmocks.MockClient, *mocks.MockGithubPullGetter, *events.FileWorkspace) {
 	allowForkPRs := false
-	dataDir, binDir, cacheDir, cleanup := mkSubDirs(t)
-	defer cleanup()
+	dataDir, binDir, cacheDir := mkSubDirs(t)
 
 	//env vars
 
@@ -993,7 +1032,7 @@ func setupE2E(t *testing.T, repoDir string) (events_controllers.VCSEventsControl
 	pullUpdater := &events.PullUpdater{
 		HidePrevPlanComments: false,
 		VCSClient:            e2eVCSClient,
-		MarkdownRenderer:     &events.MarkdownRenderer{},
+		MarkdownRenderer:     events.GetMarkdownRenderer(false, false, false, false, false, false, ""),
 	}
 
 	autoMerger := &events.AutoMerger{
@@ -1008,6 +1047,7 @@ func setupE2E(t *testing.T, repoDir string) (events_controllers.VCSEventsControl
 		projectCommandRunner,
 		parallelPoolSize,
 		false,
+		userConfig.QuietPolicyChecks,
 	)
 
 	planCommandRunner := events.NewPlanCommandRunner(
@@ -1194,7 +1234,7 @@ func GitHubPullRequestParsed(headSHA string) *github.PullRequest {
 				FullName: github.String("runatlantis/atlantis-tests"),
 				CloneURL: github.String("https://github.com/runatlantis/atlantis-tests.git"),
 			},
-			Ref: github.String("master"),
+			Ref: github.String("main"),
 		},
 		User: &github.User{
 			Login: github.String("atlantisbot"),
@@ -1215,11 +1255,11 @@ func absRepoPath(t *testing.T, repoDir string) string {
 // The purpose of this function is to create a real git repository with a branch
 // called 'branch' from the files under repoDir. This is so we can check in
 // those files normally to this repo without needing a .git directory.
-func initializeRepo(t *testing.T, repoDir string) (string, string, func()) {
+func initializeRepo(t *testing.T, repoDir string) (string, string) {
 	originRepo := absRepoPath(t, repoDir)
 
 	// Copy the files to the temp dir.
-	destDir, cleanup := TempDir(t)
+	destDir := t.TempDir()
 	runCmd(t, "", "cp", "-r", fmt.Sprintf("%s/.", originRepo), destDir)
 
 	// Initialize the git repo.
@@ -1235,7 +1275,7 @@ func initializeRepo(t *testing.T, repoDir string) (string, string, func()) {
 	headSHA := runCmd(t, destDir, "git", "rev-parse", "HEAD")
 	headSHA = strings.Trim(headSHA, "\n")
 
-	return destDir, headSHA, cleanup
+	return destDir, headSHA
 }
 
 func runCmd(t *testing.T, dir string, name string, args ...string) string {
@@ -1304,8 +1344,8 @@ func assertCommentEquals(t *testing.T, expReplies []string, act string, repoDir
 }
 
 // returns parent, bindir, cachedir, cleanup func
-func mkSubDirs(t *testing.T) (string, string, string, func()) {
-	tmp, cleanup := TempDir(t)
+func mkSubDirs(t *testing.T) (string, string, string) {
+	tmp := t.TempDir()
 	binDir := filepath.Join(tmp, "bin")
 	err := os.MkdirAll(binDir, 0700)
 	Ok(t, err)
@@ -1314,7 +1354,7 @@ func mkSubDirs(t *testing.T) (string, string, string, func()) {
 	err = os.MkdirAll(cachedir, 0700)
 	Ok(t, err)
 
-	return tmp, binDir, cachedir, cleanup
+	return tmp, binDir, cachedir
 }
 
 // Will fail test if conftest isn't in path and isn't version >= 0.25.0
@@ -1332,7 +1372,7 @@ func ensureRunningConftest(t *testing.T) {
 	versionOutput := string(versionOutBytes)
 	match := versionConftestRegex.FindStringSubmatch(versionOutput)
 	if len(match) <= 1 {
-		t.Logf("could not parse contest version from %s", versionOutput)
+		t.Logf("could not parse conftest version from %s", versionOutput)
 		t.FailNow()
 	}
 	localVersion, err := version.NewVersion(match[1])
@@ -1382,4 +1422,9 @@ func ensureRunning014(t *testing.T) {
 //		   => 0.11.10
 var versionRegex = regexp.MustCompile("Terraform v(.*?)(\\s.*)?\n")
 
-var versionConftestRegex = regexp.MustCompile("Version: (.*?)(\\s.*)?\n")
+/*
+ * Newer versions will return both Conftest and OPA
+ * Conftest: 0.35.0
+ * OPA: 0.45.0
+ */
+var versionConftestRegex = regexp.MustCompile("Conftest: (.*?)(\\s.*)?\n")
diff --git a/server/controllers/events/events_controller_test.go b/server/controllers/events/events_controller_test.go
index 92da51fe1c..84c5a32875 100644
--- a/server/controllers/events/events_controller_test.go
+++ b/server/controllers/events/events_controller_test.go
@@ -697,7 +697,7 @@ func TestPost_BBServerPullClosed(t *testing.T) {
 				HeadCommit: "2d9fb6b9a46eafb1dcef7b008d1a429d45ca742c",
 				URL:        "https://bbserver.com/projects/PROJ/repos/repository/pull-requests/10",
 				HeadBranch: "decline-me",
-				BaseBranch: "master",
+				BaseBranch: "main",
 				Author:     "admin",
 				State:      models.OpenPullState,
 				BaseRepo:   expRepo,
diff --git a/server/controllers/events/gitlab_request_parser_validator_test.go b/server/controllers/events/gitlab_request_parser_validator_test.go
index ae1269998c..ea3c43acd5 100644
--- a/server/controllers/events/gitlab_request_parser_validator_test.go
+++ b/server/controllers/events/gitlab_request_parser_validator_test.go
@@ -157,7 +157,7 @@ var mergeEventJSON = `{
     "namespace": "lkysow",
     "visibility_level": 20,
     "path_with_namespace": "lkysow/atlantis-example",
-    "default_branch": "master",
+    "default_branch": "main",
     "ci_config_path": null,
     "homepage": "https://gitlab.com/lkysow/atlantis-example",
     "url": "git@gitlab.com:lkysow/atlantis-example.git",
@@ -186,7 +186,7 @@ var mergeEventJSON = `{
     "source_branch": "patch-1",
     "source_project_id": 4580910,
     "state": "opened",
-    "target_branch": "master",
+    "target_branch": "main",
     "target_project_id": 4580910,
     "time_estimate": 0,
     "title": "Update main.tf",
@@ -204,7 +204,7 @@ var mergeEventJSON = `{
       "namespace": "sourceorg",
       "visibility_level": 20,
       "path_with_namespace": "sourceorg/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/sourceorg/atlantis-example",
       "url": "git@gitlab.com:sourceorg/atlantis-example.git",
@@ -222,7 +222,7 @@ var mergeEventJSON = `{
       "namespace": "lkysow",
       "visibility_level": 20,
       "path_with_namespace": "lkysow/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/lkysow/atlantis-example",
       "url": "git@gitlab.com:lkysow/atlantis-example.git",
@@ -286,7 +286,7 @@ var mergeEventJSON = `{
     },
     "target_branch": {
       "previous": null,
-      "current": "master"
+      "current": "main"
     },
     "target_project_id": {
       "previous": null,
@@ -333,7 +333,7 @@ var mergeCommentEventJSON = `{
     "namespace":"Gitlab Org",
     "visibility_level":10,
     "path_with_namespace":"gitlabhq/gitlab-test",
-    "default_branch":"master",
+    "default_branch":"main",
     "homepage":"http://example.com/gitlabhq/gitlab-test",
     "url":"https://example.com/gitlabhq/gitlab-test.git",
     "ssh_url":"git@example.com:gitlabhq/gitlab-test.git",
@@ -364,7 +364,7 @@ var mergeCommentEventJSON = `{
   "merge_request": {
     "id": 7,
     "target_branch": "markdown",
-    "source_branch": "master",
+    "source_branch": "main",
     "source_project_id": 5,
     "author_id": 8,
     "assignee_id": 28,
@@ -388,7 +388,7 @@ var mergeCommentEventJSON = `{
       "namespace":"Gitlab Org",
       "visibility_level":10,
       "path_with_namespace":"gitlab-org/gitlab-test",
-      "default_branch":"master",
+      "default_branch":"main",
       "homepage":"http://example.com/gitlab-org/gitlab-test",
       "url":"https://example.com/gitlab-org/gitlab-test.git",
       "ssh_url":"git@example.com:gitlab-org/gitlab-test.git",
@@ -405,7 +405,7 @@ var mergeCommentEventJSON = `{
       "namespace":"Gitlab Org",
       "visibility_level":10,
       "path_with_namespace":"gitlabhq/gitlab-test",
-      "default_branch":"master",
+      "default_branch":"main",
       "homepage":"http://example.com/gitlabhq/gitlab-test",
       "url":"https://example.com/gitlabhq/gitlab-test.git",
       "ssh_url":"git@example.com:gitlabhq/gitlab-test.git",
@@ -413,7 +413,7 @@ var mergeCommentEventJSON = `{
     },
     "last_commit": {
       "id": "562e173be03b8ff2efb05345d12df18815438a4b",
-      "message": "Merge branch 'another-branch' into 'master'\n\nCheck in this test\n",
+      "message": "Merge branch 'another-branch' into 'main'\n\nCheck in this test\n",
       "timestamp": "2002-10-02T10:00:00-05:00",
       "url": "http://example.com/gitlab-org/gitlab-test/commit/562e173be03b8ff2efb05345d12df18815438a4b",
       "author": {
@@ -449,7 +449,7 @@ var commitCommentEventJSON = `{
     "namespace":"GitlabHQ",
     "visibility_level":20,
     "path_with_namespace":"gitlabhq/gitlab-test",
-    "default_branch":"master",
+    "default_branch":"main",
     "homepage":"http://example.com/gitlabhq/gitlab-test",
     "url":"http://example.com/gitlabhq/gitlab-test.git",
     "ssh_url":"git@example.com:gitlabhq/gitlab-test.git",
diff --git a/server/controllers/events/testfixtures/bb-server-pull-deleted-event.json b/server/controllers/events/testfixtures/bb-server-pull-deleted-event.json
index 29f83137b1..d8a3507c31 100644
--- a/server/controllers/events/testfixtures/bb-server-pull-deleted-event.json
+++ b/server/controllers/events/testfixtures/bb-server-pull-deleted-event.json
@@ -42,8 +42,8 @@
       }
     },
     "toRef":{
-      "id":"refs/heads/master",
-      "displayId":"master",
+      "id":"refs/heads/main",
+      "displayId":"main",
       "latestCommit":"7e48f426f0a6e47c5b5e862c31be6ca965f82c9c",
       "repository":{
         "slug":"repository",
diff --git a/server/controllers/events/testfixtures/githubIssueCommentEvent.json b/server/controllers/events/testfixtures/githubIssueCommentEvent.json
index a15f67ed4a..6f85548207 100644
--- a/server/controllers/events/testfixtures/githubIssueCommentEvent.json
+++ b/server/controllers/events/testfixtures/githubIssueCommentEvent.json
@@ -182,7 +182,7 @@
     "forks": 0,
     "open_issues": 2,
     "watchers": 0,
-    "default_branch": "master"
+    "default_branch": "main"
   },
   "sender": {
     "login": "runatlantis",
@@ -204,4 +204,4 @@
     "type": "User",
     "site_admin": false
   }
-}
\ No newline at end of file
+}
diff --git a/server/controllers/events/testfixtures/githubIssueCommentEvent_notAllowlisted.json b/server/controllers/events/testfixtures/githubIssueCommentEvent_notAllowlisted.json
index 0a71381c49..0e61cf6fdc 100644
--- a/server/controllers/events/testfixtures/githubIssueCommentEvent_notAllowlisted.json
+++ b/server/controllers/events/testfixtures/githubIssueCommentEvent_notAllowlisted.json
@@ -158,7 +158,7 @@
     "forks": 0,
     "open_issues": 2,
     "watchers": 0,
-    "default_branch": "master"
+    "default_branch": "main"
   },
   "sender": {
     "login": "baxterthehacker",
@@ -179,4 +179,4 @@
     "type": "User",
     "site_admin": false
   }
-}
\ No newline at end of file
+}
diff --git a/server/controllers/events/testfixtures/githubPullRequestClosedEvent.json b/server/controllers/events/testfixtures/githubPullRequestClosedEvent.json
index cc281a8d7a..2cb9a014b6 100644
--- a/server/controllers/events/testfixtures/githubPullRequestClosedEvent.json
+++ b/server/controllers/events/testfixtures/githubPullRequestClosedEvent.json
@@ -179,12 +179,12 @@
         "forks": 0,
         "open_issues": 1,
         "watchers": 0,
-        "default_branch": "master"
+        "default_branch": "main"
       }
     },
     "base": {
-      "label": "runatlantis:master",
-      "ref": "master",
+      "label": "runatlantis:main",
+      "ref": "main",
       "sha": "f59a822e83b3cd193142c7624ea635a5d7894388",
       "user": {
         "login": "runatlantis",
@@ -303,7 +303,7 @@
         "forks": 0,
         "open_issues": 1,
         "watchers": 0,
-        "default_branch": "master"
+        "default_branch": "main"
       }
     },
     "_links": {
@@ -443,7 +443,7 @@
     "forks": 0,
     "open_issues": 1,
     "watchers": 0,
-    "default_branch": "master"
+    "default_branch": "main"
   },
   "sender": {
     "login": "runatlantis",
@@ -465,4 +465,4 @@
     "type": "User",
     "site_admin": false
   }
-}
\ No newline at end of file
+}
diff --git a/server/controllers/events/testfixtures/githubPullRequestOpenedEvent.json b/server/controllers/events/testfixtures/githubPullRequestOpenedEvent.json
index 03ee106b5e..a2ea2c7d21 100644
--- a/server/controllers/events/testfixtures/githubPullRequestOpenedEvent.json
+++ b/server/controllers/events/testfixtures/githubPullRequestOpenedEvent.json
@@ -179,12 +179,12 @@
         "forks": 0,
         "open_issues": 2,
         "watchers": 0,
-        "default_branch": "master"
+        "default_branch": "main"
       }
     },
     "base": {
-      "label": "runatlantis:master",
-      "ref": "master",
+      "label": "runatlantis:main",
+      "ref": "main",
       "sha": "f59a822e83b3cd193142c7624ea635a5d7894388",
       "user": {
         "login": "runatlantis",
@@ -303,7 +303,7 @@
         "forks": 0,
         "open_issues": 2,
         "watchers": 0,
-        "default_branch": "master"
+        "default_branch": "main"
       }
     },
     "_links": {
@@ -443,7 +443,7 @@
     "forks": 0,
     "open_issues": 2,
     "watchers": 0,
-    "default_branch": "master"
+    "default_branch": "main"
   },
   "sender": {
     "login": "runatlantis",
@@ -465,4 +465,4 @@
     "type": "User",
     "site_admin": false
   }
-}
\ No newline at end of file
+}
diff --git a/server/controllers/events/testfixtures/gitlabMergeCommentEvent_notAllowlisted.json b/server/controllers/events/testfixtures/gitlabMergeCommentEvent_notAllowlisted.json
index aa364d214f..98312f9930 100644
--- a/server/controllers/events/testfixtures/gitlabMergeCommentEvent_notAllowlisted.json
+++ b/server/controllers/events/testfixtures/gitlabMergeCommentEvent_notAllowlisted.json
@@ -17,7 +17,7 @@
     "namespace":"Gitlab Org",
     "visibility_level":10,
     "path_with_namespace":"gitlabhq/gitlab-test",
-    "default_branch":"master",
+    "default_branch":"main",
     "homepage":"http://example.com/gitlabhq/gitlab-test",
     "url":"https://example.com/gitlabhq/gitlab-test.git",
     "ssh_url":"git@example.com:gitlabhq/gitlab-test.git",
@@ -48,7 +48,7 @@
   "merge_request": {
     "id": 7,
     "target_branch": "markdown",
-    "source_branch": "master",
+    "source_branch": "main",
     "source_project_id": 5,
     "author_id": 8,
     "assignee_id": 28,
@@ -72,7 +72,7 @@
       "namespace":"Gitlab Org",
       "visibility_level":10,
       "path_with_namespace":"gitlab-org/gitlab-test",
-      "default_branch":"master",
+      "default_branch":"main",
       "homepage":"http://example.com/gitlab-org/gitlab-test",
       "url":"https://example.com/gitlab-org/gitlab-test.git",
       "ssh_url":"git@example.com:gitlab-org/gitlab-test.git",
@@ -89,7 +89,7 @@
       "namespace":"Gitlab Org",
       "visibility_level":10,
       "path_with_namespace":"gitlabhq/gitlab-test",
-      "default_branch":"master",
+      "default_branch":"main",
       "homepage":"http://example.com/gitlabhq/gitlab-test",
       "url":"https://example.com/gitlabhq/gitlab-test.git",
       "ssh_url":"git@example.com:gitlabhq/gitlab-test.git",
@@ -97,7 +97,7 @@
     },
     "last_commit": {
       "id": "562e173be03b8ff2efb05345d12df18815438a4b",
-      "message": "Merge branch 'another-branch' into 'master'\n\nCheck in this test\n",
+      "message": "Merge branch 'another-branch' into 'main'\n\nCheck in this test\n",
       "timestamp": "2002-10-02T10:00:00-05:00",
       "url": "http://example.com/gitlab-org/gitlab-test/commit/562e173be03b8ff2efb05345d12df18815438a4b",
       "author": {
@@ -112,4 +112,4 @@
       "avatar_url": "http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=40\u0026d=identicon"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/server/controllers/events/testfixtures/gitlabMergeCommentEvent_shouldIgnore.json b/server/controllers/events/testfixtures/gitlabMergeCommentEvent_shouldIgnore.json
index d92bc4d45e..8b7548e544 100644
--- a/server/controllers/events/testfixtures/gitlabMergeCommentEvent_shouldIgnore.json
+++ b/server/controllers/events/testfixtures/gitlabMergeCommentEvent_shouldIgnore.json
@@ -17,7 +17,7 @@
     "namespace":"Gitlab Org",
     "visibility_level":10,
     "path_with_namespace":"gitlabhq/gitlab-test",
-    "default_branch":"master",
+    "default_branch":"main",
     "homepage":"http://example.com/gitlabhq/gitlab-test",
     "url":"https://example.com/gitlabhq/gitlab-test.git",
     "ssh_url":"git@example.com:gitlabhq/gitlab-test.git",
@@ -48,7 +48,7 @@
   "merge_request": {
     "id": 7,
     "target_branch": "markdown",
-    "source_branch": "master",
+    "source_branch": "main",
     "source_project_id": 5,
     "author_id": 8,
     "assignee_id": 28,
@@ -72,7 +72,7 @@
       "namespace":"Gitlab Org",
       "visibility_level":10,
       "path_with_namespace":"gitlab-org/gitlab-test",
-      "default_branch":"master",
+      "default_branch":"main",
       "homepage":"http://example.com/gitlab-org/gitlab-test",
       "url":"https://example.com/gitlab-org/gitlab-test.git",
       "ssh_url":"git@example.com:gitlab-org/gitlab-test.git",
@@ -89,7 +89,7 @@
       "namespace":"Gitlab Org",
       "visibility_level":10,
       "path_with_namespace":"gitlabhq/gitlab-test",
-      "default_branch":"master",
+      "default_branch":"main",
       "homepage":"http://example.com/gitlabhq/gitlab-test",
       "url":"https://example.com/gitlabhq/gitlab-test.git",
       "ssh_url":"git@example.com:gitlabhq/gitlab-test.git",
@@ -97,7 +97,7 @@
     },
     "last_commit": {
       "id": "562e173be03b8ff2efb05345d12df18815438a4b",
-      "message": "Merge branch 'another-branch' into 'master'\n\nCheck in this test\n",
+      "message": "Merge branch 'another-branch' into 'main'\n\nCheck in this test\n",
       "timestamp": "2002-10-02T10:00:00-05:00",
       "url": "http://example.com/gitlab-org/gitlab-test/commit/562e173be03b8ff2efb05345d12df18815438a4b",
       "author": {
@@ -112,4 +112,4 @@
       "avatar_url": "http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=40\u0026d=identicon"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/atlantis.yaml b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/atlantis.yaml
new file mode 100644
index 0000000000..8435733cd2
--- /dev/null
+++ b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/atlantis.yaml
@@ -0,0 +1,4 @@
+version: 3
+projects:
+- dir: .
+  workspace: default
diff --git a/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/exp-output-apply.txt b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/exp-output-apply.txt
new file mode 100644
index 0000000000..9de07e2f3d
--- /dev/null
+++ b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/exp-output-apply.txt
@@ -0,0 +1,12 @@
+Ran Apply for dir: `.` workspace: `default`
+
+```diff
+
+Apply complete! Resources: 0 added, 0 changed, 0 destroyed.
+
+Outputs:
+
+workspace = "default"
+
+```
+
diff --git a/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/exp-output-autoplan.txt b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/exp-output-autoplan.txt
new file mode 100644
index 0000000000..99281c779d
--- /dev/null
+++ b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/exp-output-autoplan.txt
@@ -0,0 +1,23 @@
+Ran Plan for dir: `.` workspace: `default`
+
+```diff
+
+Changes to Outputs:
++ workspace = "default"
+
+You can apply this plan to save these new output values to the Terraform
+state, without changing any real infrastructure.
+
+```
+
+* :arrow_forward: To **apply** this plan, comment:
+    * `atlantis apply -d .`
+* :put_litter_in_its_place: To **delete** this plan click [here](lock-url)
+* :repeat: To **plan** this project again, comment:
+    * `atlantis plan -d .`
+
+---
+* :fast_forward: To **apply** all unapplied plans from this pull request, comment:
+    * `atlantis apply`
+* :put_litter_in_its_place: To delete all plans and locks for the PR, comment:
+    * `atlantis unlock`
diff --git a/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/exp-output-merge.txt b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/exp-output-merge.txt
new file mode 100644
index 0000000000..872c5ee40c
--- /dev/null
+++ b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/exp-output-merge.txt
@@ -0,0 +1,3 @@
+Locks and plans deleted for the projects and workspaces modified in this pull request:
+
+- dir: `.` workspace: `default`
diff --git a/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/main.tf b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/main.tf
new file mode 100644
index 0000000000..23701278b9
--- /dev/null
+++ b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/main.tf
@@ -0,0 +1,3 @@
+output "workspace" {
+  value = terraform.workspace
+}
diff --git a/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/policies/policy.rego b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/policies/policy.rego
new file mode 100644
index 0000000000..126c2e4591
--- /dev/null
+++ b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/policies/policy.rego
@@ -0,0 +1,28 @@
+package main
+
+import input as tfplan
+
+deny[reason] {
+	num_deletes.null_resource > 0
+	reason := "WARNING: Null Resource creation is prohibited."
+}
+
+resource_types = {"null_resource"}
+
+resources[resource_type] = all {
+	some resource_type
+	resource_types[resource_type]
+	all := [name |
+		name := tfplan.resource_changes[_]
+		name.type == resource_type
+	]
+}
+
+# number of deletions of resources of a given type
+num_deletes[resource_type] = num {
+	some resource_type
+	resource_types[resource_type]
+	all := resources[resource_type]
+	deletions := [res | res := all[_]; res.change.actions[_] == "create"]
+	num := count(deletions)
+}
diff --git a/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/repos.yaml b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/repos.yaml
new file mode 100644
index 0000000000..32434be4e3
--- /dev/null
+++ b/server/controllers/events/testfixtures/test-repos/policy-checks-success-silent/repos.yaml
@@ -0,0 +1,12 @@
+repos:
+- id: /.*/
+  apply_requirements: [approved]
+policies:
+  owners:
+    users:
+      - runatlantis
+  policy_sets:
+    - name: test_policy
+      path: policies/policy.rego
+      source: local
+        
diff --git a/server/controllers/locks_controller_test.go b/server/controllers/locks_controller_test.go
index 38a5ad7d06..a4a3d7b438 100644
--- a/server/controllers/locks_controller_test.go
+++ b/server/controllers/locks_controller_test.go
@@ -299,8 +299,7 @@ func TestDeleteLock_UpdateProjectStatus(t *testing.T) {
 		},
 	}, nil, nil)
 	var backend locking.Backend
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	backend, err := db.New(tmp)
 	Ok(t, err)
 	// Seed the DB with a successful plan for that project (that is later discarded).
@@ -354,8 +353,7 @@ func TestDeleteLock_CommentFailed(t *testing.T) {
 	workingDir := mocks2.NewMockWorkingDir()
 	workingDirLocker := events.NewDefaultWorkingDirLocker()
 	var backend locking.Backend
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	backend, err := db.New(tmp)
 	Ok(t, err)
 	When(cp.CreateComment(AnyRepo(), AnyInt(), AnyString(), AnyString())).ThenReturn(errors.New("err"))
@@ -382,8 +380,7 @@ func TestDeleteLock_CommentSuccess(t *testing.T) {
 	workingDir := mocks2.NewMockWorkingDir()
 	workingDirLocker := events.NewDefaultWorkingDirLocker()
 	var backend locking.Backend
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	backend, err := db.New(tmp)
 	Ok(t, err)
 	pull := models.PullRequest{
diff --git a/server/controllers/templates/web_templates.go b/server/controllers/templates/web_templates.go
index 27a5dabcaf..2692a8e674 100644
--- a/server/controllers/templates/web_templates.go
+++ b/server/controllers/templates/web_templates.go
@@ -454,7 +454,7 @@ var ProjectJobsTemplate = template.Must(template.New("blank.html.tmpl").Parse(`
       <div id="terminal"></div>
     </section>
   </div>
-  <footer>
+  <footer>Initializing...
   </footer>
 
     <script src="{{ .CleanedBasePath }}/static/js/jquery-3.5.1.min.js"></script>
@@ -463,12 +463,23 @@ var ProjectJobsTemplate = template.Must(template.New("blank.html.tmpl").Parse(`
     <script src="{{ .CleanedBasePath }}/static/js/xterm-addon-fit-0.4.0.js"></script>
 
     <script>
+      function updateTerminalStatus(msg) {
+          document.getElementsByTagName("footer")[0].innerText = msg;
+      }
       var term = new Terminal({scrollback: 15000});
       var socket = new WebSocket(
         (document.location.protocol === "http:" ? "ws://" : "wss://") +
         document.location.host +
         document.location.pathname +
         "/ws");
+
+      socket.onopen = function(event) {
+        updateTerminalStatus("Running...");
+      };
+      socket.onclose = function(event) {
+        updateTerminalStatus("Done");
+      };
+
       window.addEventListener("unload", function(event) {
         websocket.close();
       })
diff --git a/server/controllers/websocket/mux.go b/server/controllers/websocket/mux.go
index 8288df3212..e0924a2e52 100644
--- a/server/controllers/websocket/mux.go
+++ b/server/controllers/websocket/mux.go
@@ -31,9 +31,19 @@ type Multiplexor struct {
 	registry     PartitionRegistry
 }
 
-func NewMultiplexor(log logging.SimpleLogging, keyGenerator PartitionKeyGenerator, registry PartitionRegistry) *Multiplexor {
-	upgrader := websocket.Upgrader{}
-	upgrader.CheckOrigin = func(r *http.Request) bool { return true }
+func checkOriginFunc(checkOrigin bool) func(r *http.Request) bool {
+	if checkOrigin {
+		return nil // use Gorilla websocket's checkSameOrigin
+	}
+	return func(r *http.Request) bool {
+		return true
+	}
+}
+
+func NewMultiplexor(log logging.SimpleLogging, keyGenerator PartitionKeyGenerator, registry PartitionRegistry, checkOrigin bool) *Multiplexor {
+	upgrader := websocket.Upgrader{
+		CheckOrigin: checkOriginFunc(checkOrigin),
+	}
 	return &Multiplexor{
 		writer: &Writer{
 			upgrader: upgrader,
diff --git a/server/controllers/websocket/mux_test.go b/server/controllers/websocket/mux_test.go
new file mode 100644
index 0000000000..baddfb2196
--- /dev/null
+++ b/server/controllers/websocket/mux_test.go
@@ -0,0 +1,61 @@
+package websocket
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/gorilla/websocket"
+)
+
+func wsHandler(t *testing.T, checkOrigin bool) http.HandlerFunc {
+	upgrader := websocket.Upgrader{
+		CheckOrigin: checkOriginFunc(checkOrigin),
+	}
+	return func(w http.ResponseWriter, r *http.Request) {
+		c, err := upgrader.Upgrade(w, r, nil)
+		if err != nil {
+			t.Log("upgrade:", err)
+			return
+		}
+		defer c.Close()
+	}
+}
+
+func TestCheckOriginFunc(t *testing.T) {
+
+	tests := []struct {
+		name        string
+		checkOrigin bool
+		origin      string
+		host        string
+		wantErr     bool
+	}{
+		{"same origin", true, "http://example.com/", "example.com", false},
+		{"same origin with port", true, "http://example.com:8080/", "example.com:8080", false},
+		{"fail with different origin", true, "http://example.net/", "example.com", true},
+		{"success with same origin without check", false, "http://example.com/", "example.com", false},
+		{"success with different origin without check", false, "http://example.net/", "example.com", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := httptest.NewServer(wsHandler(t, tt.checkOrigin))
+			u, _ := url.Parse(s.URL)
+			u.Path = "/"
+			u.Scheme = "ws"
+			header := http.Header{
+				"Origin": []string{tt.origin},
+				"Host":   []string{tt.host},
+			}
+			c, _, err := websocket.DefaultDialer.Dial(u.String(), header)
+			if err == nil {
+				defer c.Close()
+			}
+			if (err != nil) != tt.wantErr {
+				t.Errorf("websocket dial error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+
+}
diff --git a/server/controllers/websocket/writer.go b/server/controllers/websocket/writer.go
index 89eb3b6dbe..1b862d628d 100644
--- a/server/controllers/websocket/writer.go
+++ b/server/controllers/websocket/writer.go
@@ -8,8 +8,10 @@ import (
 	"github.com/runatlantis/atlantis/server/logging"
 )
 
-func NewWriter(log logging.SimpleLogging) *Writer {
-	upgrader := websocket.Upgrader{}
+func NewWriter(log logging.SimpleLogging, checkOrigin bool) *Writer {
+	upgrader := websocket.Upgrader{
+		CheckOrigin: checkOriginFunc(checkOrigin),
+	}
 	upgrader.CheckOrigin = func(r *http.Request) bool { return true }
 	return &Writer{
 		upgrader: upgrader,
diff --git a/server/core/config/parser_validator.go b/server/core/config/parser_validator.go
index b5989baa95..4e23c1d4f8 100644
--- a/server/core/config/parser_validator.go
+++ b/server/core/config/parser_validator.go
@@ -43,7 +43,7 @@ func (p *ParserValidator) HasRepoCfg(absRepoDir string) (bool, error) {
 // ParseRepoCfg returns the parsed and validated atlantis.yaml config for the
 // repo at absRepoDir.
 // If there was no config file, it will return an os.IsNotExist(error).
-func (p *ParserValidator) ParseRepoCfg(absRepoDir string, globalCfg valid.GlobalCfg, repoID string) (valid.RepoCfg, error) {
+func (p *ParserValidator) ParseRepoCfg(absRepoDir string, globalCfg valid.GlobalCfg, repoID string, branch string) (valid.RepoCfg, error) {
 	configFile := p.repoCfgPath(absRepoDir, AtlantisYAMLFilename)
 	configData, err := os.ReadFile(configFile) // nolint: gosec
 
@@ -55,10 +55,10 @@ func (p *ParserValidator) ParseRepoCfg(absRepoDir string, globalCfg valid.Global
 		// able to detect if it's a NotExist err.
 		return valid.RepoCfg{}, err
 	}
-	return p.ParseRepoCfgData(configData, globalCfg, repoID)
+	return p.ParseRepoCfgData(configData, globalCfg, repoID, branch)
 }
 
-func (p *ParserValidator) ParseRepoCfgData(repoCfgData []byte, globalCfg valid.GlobalCfg, repoID string) (valid.RepoCfg, error) {
+func (p *ParserValidator) ParseRepoCfgData(repoCfgData []byte, globalCfg valid.GlobalCfg, repoID string, branch string) (valid.RepoCfg, error) {
 	var rawConfig raw.RepoCfg
 	if err := yaml.UnmarshalStrict(repoCfgData, &rawConfig); err != nil {
 		return valid.RepoCfg{}, err
@@ -72,6 +72,21 @@ func (p *ParserValidator) ParseRepoCfgData(repoCfgData []byte, globalCfg valid.G
 
 	validConfig := rawConfig.ToValid()
 
+	// Filter the repo config's projects based on pull request's branch. Only
+	// keep projects that either:
+	//
+	//   - Have no branch regex defined at all (i.e. match all branches), or
+	//   - Those that have branch regex matching the PR's base branch.
+	//
+	i := 0
+	for _, p := range validConfig.Projects {
+		if branch == "" || p.BranchRegex == nil || p.BranchRegex.Match([]byte(branch)) {
+			validConfig.Projects[i] = p
+			i++
+		}
+	}
+	validConfig.Projects = validConfig.Projects[:i]
+
 	// We do the project name validation after we get the valid config because
 	// we need the defaults of dir and workspace to be populated.
 	if err := p.validateProjectNames(validConfig); err != nil {
diff --git a/server/core/config/parser_validator_test.go b/server/core/config/parser_validator_test.go
index 9fa0912fb0..c9cdec788c 100644
--- a/server/core/config/parser_validator_test.go
+++ b/server/core/config/parser_validator_test.go
@@ -31,8 +31,7 @@ func TestHasRepoCfg_DirDoesNotExist(t *testing.T) {
 }
 
 func TestHasRepoCfg_FileDoesNotExist(t *testing.T) {
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 	r := config.ParserValidator{}
 	exists, err := r.HasRepoCfg(tmpDir)
 	Ok(t, err)
@@ -40,8 +39,7 @@ func TestHasRepoCfg_FileDoesNotExist(t *testing.T) {
 }
 
 func TestHasRepoCfg_InvalidFileExtension(t *testing.T) {
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 	_, err := os.Create(filepath.Join(tmpDir, "atlantis.yml"))
 	Ok(t, err)
 
@@ -52,26 +50,24 @@ func TestHasRepoCfg_InvalidFileExtension(t *testing.T) {
 
 func TestParseRepoCfg_DirDoesNotExist(t *testing.T) {
 	r := config.ParserValidator{}
-	_, err := r.ParseRepoCfg("/not/exist", globalCfg, "")
+	_, err := r.ParseRepoCfg("/not/exist", globalCfg, "", "")
 	Assert(t, os.IsNotExist(err), "exp not exist err")
 }
 
 func TestParseRepoCfg_FileDoesNotExist(t *testing.T) {
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 	r := config.ParserValidator{}
-	_, err := r.ParseRepoCfg(tmpDir, globalCfg, "")
+	_, err := r.ParseRepoCfg(tmpDir, globalCfg, "", "")
 	Assert(t, os.IsNotExist(err), "exp not exist err")
 }
 
 func TestParseRepoCfg_BadPermissions(t *testing.T) {
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 	err := os.WriteFile(filepath.Join(tmpDir, "atlantis.yaml"), nil, 0000)
 	Ok(t, err)
 
 	r := config.ParserValidator{}
-	_, err = r.ParseRepoCfg(tmpDir, globalCfg, "")
+	_, err = r.ParseRepoCfg(tmpDir, globalCfg, "", "")
 	ErrContains(t, "unable to read atlantis.yaml file: ", err)
 }
 
@@ -96,8 +92,7 @@ func TestParseCfgs_InvalidYAML(t *testing.T) {
 		},
 	}
 
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 
 	for _, c := range cases {
 		t.Run(c.description, func(t *testing.T) {
@@ -105,7 +100,7 @@ func TestParseCfgs_InvalidYAML(t *testing.T) {
 			err := os.WriteFile(confPath, []byte(c.input), 0600)
 			Ok(t, err)
 			r := config.ParserValidator{}
-			_, err = r.ParseRepoCfg(tmpDir, globalCfg, "")
+			_, err = r.ParseRepoCfg(tmpDir, globalCfg, "", "")
 			ErrContains(t, c.expErr, err)
 			globalCfgArgs := valid.GlobalCfgArgs{
 				AllowRepoCfg:  false,
@@ -1062,8 +1057,7 @@ workflows:
 		},
 	}
 
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 
 	for _, c := range cases {
 		t.Run(c.description, func(t *testing.T) {
@@ -1071,7 +1065,7 @@ workflows:
 			Ok(t, err)
 
 			r := config.ParserValidator{}
-			act, err := r.ParseRepoCfg(tmpDir, globalCfg, "")
+			act, err := r.ParseRepoCfg(tmpDir, globalCfg, "", "")
 			if c.expErr != "" {
 				ErrEquals(t, c.expErr, err)
 				return
@@ -1085,8 +1079,7 @@ workflows:
 // Test that we fail if the global validation fails. We test global validation
 // more completely in GlobalCfg.ValidateRepoCfg().
 func TestParseRepoCfg_GlobalValidation(t *testing.T) {
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 
 	repoCfg := `
 version: 3
@@ -1106,7 +1099,7 @@ workflows:
 		UnDivergedReq: false,
 	}
 
-	_, err = r.ParseRepoCfg(tmpDir, valid.NewGlobalCfgFromArgs(globalCfgArgs), "repo_id")
+	_, err = r.ParseRepoCfg(tmpDir, valid.NewGlobalCfgFromArgs(globalCfgArgs), "repo_id", "branch")
 	ErrEquals(t, "repo config not allowed to set 'workflow' key: server-side config needs 'allowed_overrides: [workflow]'", err)
 }
 
@@ -1482,8 +1475,7 @@ workflows:
 	for name, c := range cases {
 		t.Run(name, func(t *testing.T) {
 			r := config.ParserValidator{}
-			tmp, cleanup := TempDir(t)
-			defer cleanup()
+			tmp := t.TempDir()
 			path := filepath.Join(tmp, "conf.yaml")
 			Ok(t, os.WriteFile(path, []byte(c.input), 0600))
 
@@ -1732,10 +1724,8 @@ func TestParseRepoCfg_V2ShellParsing(t *testing.T) {
 
 	for _, c := range cases {
 		t.Run(c.in, func(t *testing.T) {
-			v2Dir, cleanup2 := TempDir(t)
-			defer cleanup2()
-			v3Dir, cleanup3 := TempDir(t)
-			defer cleanup3()
+			v2Dir := t.TempDir()
+			v3Dir := t.TempDir()
 			v2Path := filepath.Join(v2Dir, "atlantis.yaml")
 			v3Path := filepath.Join(v3Dir, "atlantis.yaml")
 			cfg := fmt.Sprintf(`workflows:
@@ -1756,7 +1746,7 @@ func TestParseRepoCfg_V2ShellParsing(t *testing.T) {
 				ApprovedReq:   false,
 				UnDivergedReq: false,
 			}
-			v2Cfg, err := p.ParseRepoCfg(v2Dir, valid.NewGlobalCfgFromArgs(globalCfgArgs), "")
+			v2Cfg, err := p.ParseRepoCfg(v2Dir, valid.NewGlobalCfgFromArgs(globalCfgArgs), "", "")
 			if c.expV2Err != "" {
 				ErrEquals(t, c.expV2Err, err)
 			} else {
@@ -1770,7 +1760,7 @@ func TestParseRepoCfg_V2ShellParsing(t *testing.T) {
 				ApprovedReq:   false,
 				UnDivergedReq: false,
 			}
-			v3Cfg, err := p.ParseRepoCfg(v3Dir, valid.NewGlobalCfgFromArgs(globalCfgArgs), "")
+			v3Cfg, err := p.ParseRepoCfg(v3Dir, valid.NewGlobalCfgFromArgs(globalCfgArgs), "", "")
 			Ok(t, err)
 			Equals(t, c.in, v3Cfg.Workflows["custom"].Plan.Steps[0].RunCommand)
 			Equals(t, c.in, v3Cfg.Workflows["custom"].Apply.Steps[0].RunCommand)
diff --git a/server/core/config/raw/global_cfg.go b/server/core/config/raw/global_cfg.go
index 260b10c028..980596daf1 100644
--- a/server/core/config/raw/global_cfg.go
+++ b/server/core/config/raw/global_cfg.go
@@ -159,10 +159,14 @@ func (r Repo) Validate() error {
 
 	branchValid := func(value interface{}) error {
 		branch := value.(string)
-		if !r.HasRegexBranch() {
+		if branch == "" {
 			return nil
 		}
-		_, err := regexp.Compile(branch[1 : len(branch)-1])
+		if !strings.HasPrefix(branch, "/") || !strings.HasSuffix(branch, "/") {
+			return errors.New("regex must begin and end with a slash '/'")
+		}
+		withoutSlashes := branch[1 : len(branch)-1]
+		_, err := regexp.Compile(withoutSlashes)
 		return errors.Wrapf(err, "parsing: %s", branch)
 	}
 
diff --git a/server/core/config/raw/project.go b/server/core/config/raw/project.go
index 13a0a1d4ce..cf2422f046 100644
--- a/server/core/config/raw/project.go
+++ b/server/core/config/raw/project.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net/url"
 	"path/filepath"
+	"regexp"
 	"strings"
 
 	validation "github.com/go-ozzo/ozzo-validation"
@@ -21,6 +22,7 @@ const (
 
 type Project struct {
 	Name                      *string   `yaml:"name,omitempty"`
+	Branch                    *string   `yaml:"branch,omitempty"`
 	Dir                       *string   `yaml:"dir,omitempty"`
 	Workspace                 *string   `yaml:"workspace,omitempty"`
 	Workflow                  *string   `yaml:"workflow,omitempty"`
@@ -52,11 +54,27 @@ func (p Project) Validate() error {
 		}
 		return nil
 	}
+
+	branchValid := func(value interface{}) error {
+		strPtr := value.(*string)
+		if strPtr == nil {
+			return nil
+		}
+		branch := *strPtr
+		if !strings.HasPrefix(branch, "/") || !strings.HasSuffix(branch, "/") {
+			return errors.New("regex must begin and end with a slash '/'")
+		}
+		withoutSlashes := branch[1 : len(branch)-1]
+		_, err := regexp.Compile(withoutSlashes)
+		return errors.Wrapf(err, "parsing: %s", branch)
+	}
+
 	return validation.ValidateStruct(&p,
 		validation.Field(&p.Dir, validation.Required, validation.By(hasDotDot)),
 		validation.Field(&p.ApplyRequirements, validation.By(validApplyReq)),
 		validation.Field(&p.TerraformVersion, validation.By(VersionValidator)),
 		validation.Field(&p.Name, validation.By(validName)),
+		validation.Field(&p.Branch, validation.By(branchValid)),
 	)
 }
 
@@ -68,6 +86,13 @@ func (p Project) ToValid() valid.Project {
 	cleanedDir := filepath.Clean("./" + *p.Dir)
 	v.Dir = cleanedDir
 
+	if p.Branch != nil {
+		branch := *p.Branch
+		withoutSlashes := branch[1 : len(branch)-1]
+		// Safe to use MustCompile because we test it in Validate().
+		v.BranchRegex = regexp.MustCompile(withoutSlashes)
+	}
+
 	if p.Workspace == nil || *p.Workspace == "" {
 		v.Workspace = DefaultWorkspace
 	} else {
diff --git a/server/core/config/raw/project_test.go b/server/core/config/raw/project_test.go
index 7b63d3b505..1698a35678 100644
--- a/server/core/config/raw/project_test.go
+++ b/server/core/config/raw/project_test.go
@@ -28,12 +28,14 @@ func TestProject_UnmarshalYAML(t *testing.T) {
 				Autoplan:          nil,
 				ApplyRequirements: nil,
 				Name:              nil,
+				Branch:            nil,
 			},
 		},
 		{
 			description: "all fields set including mergeable apply requirement",
 			input: `
 name: myname
+branch: mybranch
 dir: mydir
 workspace: workspace
 workflow: workflow
@@ -46,6 +48,7 @@ apply_requirements:
 execution_order_group: 10`,
 			exp: raw.Project{
 				Name:             String("myname"),
+				Branch:           String("mybranch"),
 				Dir:              String("mydir"),
 				Workspace:        String("workspace"),
 				Workflow:         String("workflow"),
@@ -97,6 +100,22 @@ func TestProject_Validate(t *testing.T) {
 			},
 			expErr: "dir: cannot contain '..'.",
 		},
+		{
+			description: "not a regexp for branch",
+			input: raw.Project{
+				Branch: String("text"),
+				Dir:    String("."),
+			},
+			expErr: "branch: regex must begin and end with a slash '/'.",
+		},
+		{
+			description: "invalid regexp for branch",
+			input: raw.Project{
+				Branch: String("/(text/"),
+				Dir:    String("."),
+			},
+			expErr: "branch: parsing: /(text/: error parsing regexp: missing closing ): `(text`.",
+		},
 		{
 			description: "apply reqs with unsupported",
 			input: raw.Project{
@@ -261,6 +280,7 @@ func TestProject_ToValid(t *testing.T) {
 			},
 			exp: valid.Project{
 				Dir:              ".",
+				BranchRegex:      nil,
 				Workspace:        "default",
 				WorkflowName:     nil,
 				TerraformVersion: nil,
diff --git a/server/core/config/valid/global_cfg_test.go b/server/core/config/valid/global_cfg_test.go
index 07a7228723..e9bce44fb6 100644
--- a/server/core/config/valid/global_cfg_test.go
+++ b/server/core/config/valid/global_cfg_test.go
@@ -656,8 +656,7 @@ policies:
 	}
 	for name, c := range cases {
 		t.Run(name, func(t *testing.T) {
-			tmp, cleanup := TempDir(t)
-			defer cleanup()
+			tmp := t.TempDir()
 			var global valid.GlobalCfg
 			if c.gCfg != "" {
 				path := filepath.Join(tmp, "config.yaml")
@@ -857,8 +856,7 @@ repos:
 	}
 	for name, c := range cases {
 		t.Run(name, func(t *testing.T) {
-			tmp, cleanup := TempDir(t)
-			defer cleanup()
+			tmp := t.TempDir()
 			var global valid.GlobalCfg
 			if c.gCfg != "" {
 				path := filepath.Join(tmp, "config.yaml")
@@ -917,7 +915,7 @@ func TestRepo_BranchMatches(t *testing.T) {
 	Equals(t, false, (valid.Repo{BranchRegex: regexp.MustCompile("^main$")}).BranchMatches("foo-main"))
 	Equals(t, false, (valid.Repo{BranchRegex: regexp.MustCompile("^main$")}).BranchMatches("main-foo"))
 	Equals(t, true, (valid.Repo{BranchRegex: regexp.MustCompile("(main|master)")}).BranchMatches("main"))
-	Equals(t, true, (valid.Repo{BranchRegex: regexp.MustCompile("(main|master)")}).BranchMatches("master"))
+	Equals(t, true, (valid.Repo{BranchRegex: regexp.MustCompile("(main|master)")}).BranchMatches("main"))
 	Equals(t, true, (valid.Repo{BranchRegex: regexp.MustCompile("release")}).BranchMatches("release-stage"))
 	Equals(t, false, (valid.Repo{BranchRegex: regexp.MustCompile("release")}).BranchMatches("main"))
 }
@@ -935,7 +933,7 @@ func TestGlobalCfg_MatchingRepo(t *testing.T) {
 	}
 	repo2 := valid.Repo{
 		ID:                "github.com/owner/repo",
-		BranchRegex:       regexp.MustCompile("^master$"),
+		BranchRegex:       regexp.MustCompile("^main$"),
 		ApplyRequirements: []string{"approved", "mergeable"},
 	}
 
diff --git a/server/core/config/valid/repo_cfg.go b/server/core/config/valid/repo_cfg.go
index eab85c1fb3..f645fa9fbd 100644
--- a/server/core/config/valid/repo_cfg.go
+++ b/server/core/config/valid/repo_cfg.go
@@ -119,6 +119,7 @@ func (r RepoCfg) ValidateWorkspaceAllowed(repoRelDir string, workspace string) e
 
 type Project struct {
 	Dir                       string
+	BranchRegex               *regexp.Regexp
 	Workspace                 string
 	Name                      *string
 	WorkflowName              *string
diff --git a/server/core/db/boltdb_test.go b/server/core/db/boltdb_test.go
index 0151cb861c..08af9ccec3 100644
--- a/server/core/db/boltdb_test.go
+++ b/server/core/db/boltdb_test.go
@@ -586,8 +586,7 @@ func TestGetLock(t *testing.T) {
 
 // Test we can create a status and then getCommandLock it.
 func TestPullStatus_UpdateGet(t *testing.T) {
-	b, cleanup := newTestDB2(t)
-	defer cleanup()
+	b := newTestDB2(t)
 
 	pull := models.PullRequest{
 		Num:        1,
@@ -637,8 +636,7 @@ func TestPullStatus_UpdateGet(t *testing.T) {
 // Test we can create a status, delete it, and then we shouldn't be able to getCommandLock
 // it.
 func TestPullStatus_UpdateDeleteGet(t *testing.T) {
-	b, cleanup := newTestDB2(t)
-	defer cleanup()
+	b := newTestDB2(t)
 
 	pull := models.PullRequest{
 		Num:        1,
@@ -683,8 +681,7 @@ func TestPullStatus_UpdateDeleteGet(t *testing.T) {
 // pull status, and when we getCommandLock all the project statuses, that specific project
 // should be updated.
 func TestPullStatus_UpdateProject(t *testing.T) {
-	b, cleanup := newTestDB2(t)
-	defer cleanup()
+	b := newTestDB2(t)
 
 	pull := models.PullRequest{
 		Num:        1,
@@ -747,8 +744,7 @@ func TestPullStatus_UpdateProject(t *testing.T) {
 // Test that if we update an existing pull status and our new status is for a
 // different HeadSHA, that we just overwrite the old status.
 func TestPullStatus_UpdateNewCommit(t *testing.T) {
-	b, cleanup := newTestDB2(t)
-	defer cleanup()
+	b := newTestDB2(t)
 
 	pull := models.PullRequest{
 		Num:        1,
@@ -810,8 +806,7 @@ func TestPullStatus_UpdateNewCommit(t *testing.T) {
 // Test that if we update an existing pull status and our new status is for a
 // the same commit, that we merge the statuses.
 func TestPullStatus_UpdateMerge(t *testing.T) {
-	b, cleanup := newTestDB2(t)
-	defer cleanup()
+	b := newTestDB2(t)
 
 	pull := models.PullRequest{
 		Num:        1,
@@ -953,13 +948,11 @@ func newTestDB() (*bolt.DB, *db.BoltDB) {
 	return boltDB, b
 }
 
-func newTestDB2(t *testing.T) (*db.BoltDB, func()) {
-	tmp, cleanup := TempDir(t)
+func newTestDB2(t *testing.T) *db.BoltDB {
+	tmp := t.TempDir()
 	boltDB, err := db.New(tmp)
 	Ok(t, err)
-	return boltDB, func() {
-		cleanup()
-	}
+	return boltDB
 }
 
 func cleanupDB(db *bolt.DB) {
diff --git a/server/core/runtime/apply_step_runner_test.go b/server/core/runtime/apply_step_runner_test.go
index 2aac757cb2..8dd06efc19 100644
--- a/server/core/runtime/apply_step_runner_test.go
+++ b/server/core/runtime/apply_step_runner_test.go
@@ -36,8 +36,7 @@ func TestRun_NoDir(t *testing.T) {
 }
 
 func TestRun_NoPlanFile(t *testing.T) {
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 	o := runtime.ApplyStepRunner{
 		TerraformExecutor: nil,
 	}
@@ -49,8 +48,7 @@ func TestRun_NoPlanFile(t *testing.T) {
 }
 
 func TestRun_Success(t *testing.T) {
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 	planPath := filepath.Join(tmpDir, "workspace.tfplan")
 	err := os.WriteFile(planPath, nil, 0600)
 	logger := logging.NewNoopLogger(t)
@@ -80,8 +78,7 @@ func TestRun_Success(t *testing.T) {
 
 func TestRun_AppliesCorrectProjectPlan(t *testing.T) {
 	// When running for a project, the planfile has a different name.
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 	planPath := filepath.Join(tmpDir, "projectname-default.tfplan")
 	err := os.WriteFile(planPath, nil, 0600)
 
@@ -112,8 +109,7 @@ func TestRun_AppliesCorrectProjectPlan(t *testing.T) {
 }
 
 func TestRun_UsesConfiguredTFVersion(t *testing.T) {
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 	planPath := filepath.Join(tmpDir, "workspace.tfplan")
 	err := os.WriteFile(planPath, nil, 0600)
 	Ok(t, err)
@@ -199,8 +195,7 @@ func TestRun_UsingTarget(t *testing.T) {
 		descrip := fmt.Sprintf("comments flags: %s extra args: %s",
 			strings.Join(c.commentFlags, ", "), strings.Join(c.extraArgs, ", "))
 		t.Run(descrip, func(t *testing.T) {
-			tmpDir, cleanup := TempDir(t)
-			defer cleanup()
+			tmpDir := t.TempDir()
 			planPath := filepath.Join(tmpDir, "workspace.tfplan")
 			err := os.WriteFile(planPath, nil, 0600)
 			Ok(t, err)
@@ -227,8 +222,7 @@ func TestRun_UsingTarget(t *testing.T) {
 
 // Test that apply works for remote applies.
 func TestRun_RemoteApply_Success(t *testing.T) {
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 	planPath := filepath.Join(tmpDir, "workspace.tfplan")
 	planFileContents := `
 An execution plan has been generated and is shown below.
@@ -285,8 +279,7 @@ Apply complete! Resources: 0 added, 0 changed, 1 destroyed.
 
 // Test that if the plan is different, we error out.
 func TestRun_RemoteApply_PlanChanged(t *testing.T) {
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 	planPath := filepath.Join(tmpDir, "workspace.tfplan")
 	planFileContents := `
 An execution plan has been generated and is shown below.
diff --git a/server/core/runtime/common/common_test.go b/server/core/runtime/common/common_test.go
index 137c66ceb8..c265bb9eb1 100644
--- a/server/core/runtime/common/common_test.go
+++ b/server/core/runtime/common/common_test.go
@@ -98,8 +98,8 @@ func runCmd(t *testing.T, dir string, name string, args ...string) string {
 	return string(cpOut)
 }
 
-func initRepo(t *testing.T) (string, func()) {
-	repoDir, cleanup := TempDir(t)
+func initRepo(t *testing.T) string {
+	repoDir := t.TempDir()
 	runCmd(t, repoDir, "git", "init")
 	runCmd(t, repoDir, "touch", ".gitkeep")
 	runCmd(t, repoDir, "git", "add", ".gitkeep")
@@ -108,13 +108,12 @@ func initRepo(t *testing.T) (string, func()) {
 	runCmd(t, repoDir, "git", "config", "--local", "commit.gpgsign", "false")
 	runCmd(t, repoDir, "git", "commit", "-m", "initial commit")
 	runCmd(t, repoDir, "git", "branch", "branch")
-	return repoDir, cleanup
+	return repoDir
 }
 
 func TestIsFileTracked(t *testing.T) {
 	// Initialize the git repo.
-	repoDir, cleanup := initRepo(t)
-	defer cleanup()
+	repoDir := initRepo(t)
 
 	// file1 should not be tracked
 	tracked, err := IsFileTracked(repoDir, "file1")
diff --git a/server/core/runtime/env_step_runner_test.go b/server/core/runtime/env_step_runner_test.go
index 1bf1d872ba..3f1f46fdf0 100644
--- a/server/core/runtime/env_step_runner_test.go
+++ b/server/core/runtime/env_step_runner_test.go
@@ -52,8 +52,7 @@ func TestEnvStepRunner_Run(t *testing.T) {
 	}
 	for _, c := range cases {
 		t.Run(c.Command, func(t *testing.T) {
-			tmpDir, cleanup := TempDir(t)
-			defer cleanup()
+			tmpDir := t.TempDir()
 			ctx := command.ProjectContext{
 				BaseRepo: models.Repo{
 					Name:  "basename",
@@ -66,7 +65,7 @@ func TestEnvStepRunner_Run(t *testing.T) {
 				Pull: models.PullRequest{
 					Num:        2,
 					HeadBranch: "add-feat",
-					BaseBranch: "master",
+					BaseBranch: "main",
 					Author:     "acme",
 				},
 				User: models.User{
diff --git a/server/core/runtime/init_step_runner_test.go b/server/core/runtime/init_step_runner_test.go
index e3c486a308..69e2938766 100644
--- a/server/core/runtime/init_step_runner_test.go
+++ b/server/core/runtime/init_step_runner_test.go
@@ -103,8 +103,7 @@ func TestRun_ShowInitOutputOnError(t *testing.T) {
 
 func TestRun_InitOmitsUpgradeFlagIfLockFileTracked(t *testing.T) {
 	// Initialize the git repo.
-	repoDir, cleanup := initRepo(t)
-	defer cleanup()
+	repoDir := initRepo(t)
 
 	lockFilePath := filepath.Join(repoDir, ".terraform.lock.hcl")
 	err := os.WriteFile(lockFilePath, nil, 0600)
@@ -141,8 +140,7 @@ func TestRun_InitOmitsUpgradeFlagIfLockFileTracked(t *testing.T) {
 }
 
 func TestRun_InitKeepsUpgradeFlagIfLockFileNotPresent(t *testing.T) {
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 
 	RegisterMockTestingT(t)
 	terraform := mocks.NewMockClient()
@@ -171,8 +169,7 @@ func TestRun_InitKeepsUpgradeFlagIfLockFileNotPresent(t *testing.T) {
 }
 
 func TestRun_InitKeepUpgradeFlagIfLockFilePresentAndTFLessThanPoint14(t *testing.T) {
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 	lockFilePath := filepath.Join(tmpDir, ".terraform.lock.hcl")
 	err := os.WriteFile(lockFilePath, nil, 0600)
 	Ok(t, err)
@@ -274,8 +271,7 @@ func TestRun_InitExtraArgsDeDupe(t *testing.T) {
 
 func TestRun_InitDeletesLockFileIfPresentAndNotTracked(t *testing.T) {
 	// Initialize the git repo.
-	repoDir, cleanup := initRepo(t)
-	defer cleanup()
+	repoDir := initRepo(t)
 
 	lockFilePath := filepath.Join(repoDir, ".terraform.lock.hcl")
 	err := os.WriteFile(lockFilePath, nil, 0600)
@@ -318,8 +314,8 @@ func runCmd(t *testing.T, dir string, name string, args ...string) string {
 	return string(cpOut)
 }
 
-func initRepo(t *testing.T) (string, func()) {
-	repoDir, cleanup := TempDir(t)
+func initRepo(t *testing.T) string {
+	repoDir := t.TempDir()
 	runCmd(t, repoDir, "git", "init")
 	runCmd(t, repoDir, "touch", ".gitkeep")
 	runCmd(t, repoDir, "git", "add", ".gitkeep")
@@ -328,5 +324,5 @@ func initRepo(t *testing.T) (string, func()) {
 	runCmd(t, repoDir, "git", "config", "--local", "commit.gpgsign", "false")
 	runCmd(t, repoDir, "git", "commit", "-m", "initial commit")
 	runCmd(t, repoDir, "git", "branch", "branch")
-	return repoDir, cleanup
+	return repoDir
 }
diff --git a/server/core/runtime/multienv_step_runner_test.go b/server/core/runtime/multienv_step_runner_test.go
index 40711e1a55..edb3420b3d 100644
--- a/server/core/runtime/multienv_step_runner_test.go
+++ b/server/core/runtime/multienv_step_runner_test.go
@@ -53,8 +53,7 @@ func TestMultiEnvStepRunner_Run(t *testing.T) {
 	}
 	for _, c := range cases {
 		t.Run(c.Command, func(t *testing.T) {
-			tmpDir, cleanup := TempDir(t)
-			defer cleanup()
+			tmpDir := t.TempDir()
 			ctx := command.ProjectContext{
 				BaseRepo: models.Repo{
 					Name:  "basename",
@@ -67,7 +66,7 @@ func TestMultiEnvStepRunner_Run(t *testing.T) {
 				Pull: models.PullRequest{
 					Num:        2,
 					HeadBranch: "add-feat",
-					BaseBranch: "master",
+					BaseBranch: "main",
 					Author:     "acme",
 				},
 				User: models.User{
diff --git a/server/core/runtime/plan_step_runner_test.go b/server/core/runtime/plan_step_runner_test.go
index e8fb35f538..36e3268fe0 100644
--- a/server/core/runtime/plan_step_runner_test.go
+++ b/server/core/runtime/plan_step_runner_test.go
@@ -378,8 +378,7 @@ func TestRun_AddsEnvVarFile(t *testing.T) {
 	terraform := mocks.NewMockClient()
 
 	// Create the env/workspace.tfvars file.
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 	err := os.MkdirAll(filepath.Join(tmpDir, "env"), 0700)
 	Ok(t, err)
 	envVarsFile := filepath.Join(tmpDir, "env/workspace.tfvars")
@@ -732,8 +731,7 @@ locally at this time.
 				AsyncTFExec:         asyncTf,
 				CommitStatusUpdater: updater,
 			}
-			absProjectPath, cleanup := TempDir(t)
-			defer cleanup()
+			absProjectPath := t.TempDir()
 
 			// First, terraform workspace gets run.
 			When(terraform.RunCommandWithVersion(
diff --git a/server/core/runtime/plan_type_step_runner_delegate_test.go b/server/core/runtime/plan_type_step_runner_delegate_test.go
index 6645fd9958..b48f89e42b 100644
--- a/server/core/runtime/plan_type_step_runner_delegate_test.go
+++ b/server/core/runtime/plan_type_step_runner_delegate_test.go
@@ -41,8 +41,7 @@ func TestRunDelegate(t *testing.T) {
 	tfVersion, _ := version.NewVersion("0.12.0")
 
 	t.Run("Remote Runner Success", func(t *testing.T) {
-		tmpDir, cleanup := TempDir(t)
-		defer cleanup()
+		tmpDir := t.TempDir()
 		planPath := filepath.Join(tmpDir, "workspace.tfplan")
 		err := os.WriteFile(planPath, []byte("Atlantis: this plan was created by remote ops\n"+planFileContents), 0600)
 		Ok(t, err)
@@ -70,8 +69,7 @@ func TestRunDelegate(t *testing.T) {
 	})
 
 	t.Run("Remote Runner Failure", func(t *testing.T) {
-		tmpDir, cleanup := TempDir(t)
-		defer cleanup()
+		tmpDir := t.TempDir()
 		planPath := filepath.Join(tmpDir, "workspace.tfplan")
 		err := os.WriteFile(planPath, []byte("Atlantis: this plan was created by remote ops\n"+planFileContents), 0600)
 		Ok(t, err)
@@ -99,8 +97,7 @@ func TestRunDelegate(t *testing.T) {
 	})
 
 	t.Run("Local Runner Success", func(t *testing.T) {
-		tmpDir, cleanup := TempDir(t)
-		defer cleanup()
+		tmpDir := t.TempDir()
 		planPath := filepath.Join(tmpDir, "workspace.tfplan")
 		err := os.WriteFile(planPath, []byte(planFileContents), 0600)
 		Ok(t, err)
@@ -128,8 +125,7 @@ func TestRunDelegate(t *testing.T) {
 	})
 
 	t.Run("Local Runner Failure", func(t *testing.T) {
-		tmpDir, cleanup := TempDir(t)
-		defer cleanup()
+		tmpDir := t.TempDir()
 		planPath := filepath.Join(tmpDir, "workspace.tfplan")
 		err := os.WriteFile(planPath, []byte(planFileContents), 0600)
 		Ok(t, err)
diff --git a/server/core/runtime/policy/conftest_client.go b/server/core/runtime/policy/conftest_client.go
index 6731983766..08a5ee297a 100644
--- a/server/core/runtime/policy/conftest_client.go
+++ b/server/core/runtime/policy/conftest_client.go
@@ -15,6 +15,8 @@ import (
 	"github.com/runatlantis/atlantis/server/core/terraform"
 	"github.com/runatlantis/atlantis/server/events/command"
 	"github.com/runatlantis/atlantis/server/logging"
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
 )
 
 const (
@@ -107,7 +109,7 @@ func (c ConfTestVersionDownloader) downloadConfTestVersion(v *version.Version, d
 	versionURLPrefix := fmt.Sprintf("%s%s", conftestDownloadURLPrefix, v.Original())
 
 	// download binary in addition to checksum file
-	binURL := fmt.Sprintf("%s/conftest_%s_%s_%s.tar.gz", versionURLPrefix, v.Original(), strings.Title(runtime.GOOS), conftestArch)
+	binURL := fmt.Sprintf("%s/conftest_%s_%s_%s.tar.gz", versionURLPrefix, v.Original(), cases.Title(language.English).String(runtime.GOOS), conftestArch)
 	checksumURL := fmt.Sprintf("%s/checksums.txt", versionURLPrefix)
 
 	// underlying implementation uses go-getter so the URL is formatted as such.
diff --git a/server/core/runtime/policy/conftest_client_test.go b/server/core/runtime/policy/conftest_client_test.go
index 5251fcc631..d90af16c49 100644
--- a/server/core/runtime/policy/conftest_client_test.go
+++ b/server/core/runtime/policy/conftest_client_test.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"path/filepath"
 	"runtime"
-	"strings"
 	"testing"
 
 	"github.com/hashicorp/go-version"
@@ -18,6 +17,9 @@ import (
 	"github.com/runatlantis/atlantis/server/events/command"
 	"github.com/runatlantis/atlantis/server/logging"
 	. "github.com/runatlantis/atlantis/testing"
+
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
 )
 
 func TestConfTestVersionDownloader(t *testing.T) {
@@ -25,7 +27,7 @@ func TestConfTestVersionDownloader(t *testing.T) {
 	version, _ := version.NewVersion("0.25.0")
 	destPath := "some/path"
 
-	fullURL := fmt.Sprintf("https://github.com/open-policy-agent/conftest/releases/download/v0.25.0/conftest_0.25.0_%s_x86_64.tar.gz?checksum=file:https://github.com/open-policy-agent/conftest/releases/download/v0.25.0/checksums.txt", strings.Title(runtime.GOOS))
+	fullURL := fmt.Sprintf("https://github.com/open-policy-agent/conftest/releases/download/v0.25.0/conftest_0.25.0_%s_x86_64.tar.gz?checksum=file:https://github.com/open-policy-agent/conftest/releases/download/v0.25.0/checksums.txt", cases.Title(language.English).String(runtime.GOOS))
 
 	RegisterMockTestingT(t)
 
diff --git a/server/core/runtime/post_workflow_hook_runner.go b/server/core/runtime/post_workflow_hook_runner.go
index 8f2df1d2db..11e1db429f 100644
--- a/server/core/runtime/post_workflow_hook_runner.go
+++ b/server/core/runtime/post_workflow_hook_runner.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"strings"
 
 	"github.com/runatlantis/atlantis/server/events/models"
 )
@@ -24,6 +25,7 @@ func (wh DefaultPostWorkflowHookRunner) Run(ctx models.WorkflowHookCommandContex
 		"BASE_BRANCH_NAME": ctx.Pull.BaseBranch,
 		"BASE_REPO_NAME":   ctx.BaseRepo.Name,
 		"BASE_REPO_OWNER":  ctx.BaseRepo.Owner,
+		"COMMENT_ARGS":     strings.Join(ctx.EscapedCommentArgs, ","),
 		"DIR":              path,
 		"HEAD_BRANCH_NAME": ctx.Pull.HeadBranch,
 		"HEAD_COMMIT":      ctx.Pull.HeadCommit,
diff --git a/server/core/runtime/post_workflow_hook_runner_test.go b/server/core/runtime/post_workflow_hook_runner_test.go
index 32a17a7702..dfa741d6d1 100644
--- a/server/core/runtime/post_workflow_hook_runner_test.go
+++ b/server/core/runtime/post_workflow_hook_runner_test.go
@@ -50,7 +50,7 @@ func TestPostWorkflowHookRunner_Run(t *testing.T) {
 		},
 		{
 			Command: "echo base_repo_name=$BASE_REPO_NAME base_repo_owner=$BASE_REPO_OWNER head_repo_name=$HEAD_REPO_NAME head_repo_owner=$HEAD_REPO_OWNER head_branch_name=$HEAD_BRANCH_NAME head_commit=$HEAD_COMMIT base_branch_name=$BASE_BRANCH_NAME pull_num=$PULL_NUM pull_author=$PULL_AUTHOR",
-			ExpOut:  "base_repo_name=basename base_repo_owner=baseowner head_repo_name=headname head_repo_owner=headowner head_branch_name=add-feat head_commit=12345abcdef base_branch_name=master pull_num=2 pull_author=acme\n",
+			ExpOut:  "base_repo_name=basename base_repo_owner=baseowner head_repo_name=headname head_repo_owner=headowner head_branch_name=add-feat head_commit=12345abcdef base_branch_name=main pull_num=2 pull_author=acme\n",
 		},
 		{
 			Command: "echo user_name=$USER_NAME",
@@ -69,11 +69,10 @@ func TestPostWorkflowHookRunner_Run(t *testing.T) {
 			ThenReturn(nil)
 
 		logger := logging.NewNoopLogger(t)
+		tmpDir := t.TempDir()
 
 		r := runtime.DefaultPostWorkflowHookRunner{}
 		t.Run(c.Command, func(t *testing.T) {
-			tmpDir, cleanup := TempDir(t)
-			defer cleanup()
 			ctx := models.WorkflowHookCommandContext{
 				BaseRepo: models.Repo{
 					Name:  "basename",
@@ -87,7 +86,7 @@ func TestPostWorkflowHookRunner_Run(t *testing.T) {
 					Num:        2,
 					HeadBranch: "add-feat",
 					HeadCommit: "12345abcdef",
-					BaseBranch: "master",
+					BaseBranch: "main",
 					Author:     "acme",
 				},
 				User: models.User{
diff --git a/server/core/runtime/pre_workflow_hook_runner.go b/server/core/runtime/pre_workflow_hook_runner.go
index d3004c84eb..60520cfcff 100644
--- a/server/core/runtime/pre_workflow_hook_runner.go
+++ b/server/core/runtime/pre_workflow_hook_runner.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"strings"
 
 	"github.com/runatlantis/atlantis/server/events/models"
 )
@@ -24,6 +25,7 @@ func (wh DefaultPreWorkflowHookRunner) Run(ctx models.WorkflowHookCommandContext
 		"BASE_BRANCH_NAME": ctx.Pull.BaseBranch,
 		"BASE_REPO_NAME":   ctx.BaseRepo.Name,
 		"BASE_REPO_OWNER":  ctx.BaseRepo.Owner,
+		"COMMENT_ARGS":     strings.Join(ctx.EscapedCommentArgs, ","),
 		"DIR":              path,
 		"HEAD_BRANCH_NAME": ctx.Pull.HeadBranch,
 		"HEAD_COMMIT":      ctx.Pull.HeadCommit,
diff --git a/server/core/runtime/pre_workflow_hook_runner_test.go b/server/core/runtime/pre_workflow_hook_runner_test.go
index 701cf7397b..b98b09059d 100644
--- a/server/core/runtime/pre_workflow_hook_runner_test.go
+++ b/server/core/runtime/pre_workflow_hook_runner_test.go
@@ -50,7 +50,7 @@ func TestPreWorkflowHookRunner_Run(t *testing.T) {
 		},
 		{
 			Command: "echo base_repo_name=$BASE_REPO_NAME base_repo_owner=$BASE_REPO_OWNER head_repo_name=$HEAD_REPO_NAME head_repo_owner=$HEAD_REPO_OWNER head_branch_name=$HEAD_BRANCH_NAME head_commit=$HEAD_COMMIT base_branch_name=$BASE_BRANCH_NAME pull_num=$PULL_NUM pull_author=$PULL_AUTHOR",
-			ExpOut:  "base_repo_name=basename base_repo_owner=baseowner head_repo_name=headname head_repo_owner=headowner head_branch_name=add-feat head_commit=12345abcdef base_branch_name=master pull_num=2 pull_author=acme\n",
+			ExpOut:  "base_repo_name=basename base_repo_owner=baseowner head_repo_name=headname head_repo_owner=headowner head_branch_name=add-feat head_commit=12345abcdef base_branch_name=main pull_num=2 pull_author=acme\n",
 		},
 		{
 			Command: "echo user_name=$USER_NAME",
@@ -69,11 +69,10 @@ func TestPreWorkflowHookRunner_Run(t *testing.T) {
 			ThenReturn(nil)
 
 		logger := logging.NewNoopLogger(t)
+		tmpDir := t.TempDir()
 
 		r := runtime.DefaultPreWorkflowHookRunner{}
 		t.Run(c.Command, func(t *testing.T) {
-			tmpDir, cleanup := TempDir(t)
-			defer cleanup()
 			ctx := models.WorkflowHookCommandContext{
 				BaseRepo: models.Repo{
 					Name:  "basename",
@@ -87,7 +86,7 @@ func TestPreWorkflowHookRunner_Run(t *testing.T) {
 					Num:        2,
 					HeadBranch: "add-feat",
 					HeadCommit: "12345abcdef",
-					BaseBranch: "master",
+					BaseBranch: "main",
 					Author:     "acme",
 				},
 				User: models.User{
diff --git a/server/core/runtime/run_step_runner_test.go b/server/core/runtime/run_step_runner_test.go
index d6e235dcfc..f553d5fff6 100644
--- a/server/core/runtime/run_step_runner_test.go
+++ b/server/core/runtime/run_step_runner_test.go
@@ -72,7 +72,7 @@ func TestRunStepRunner_Run(t *testing.T) {
 		},
 		{
 			Command: "echo base_repo_name=$BASE_REPO_NAME base_repo_owner=$BASE_REPO_OWNER head_repo_name=$HEAD_REPO_NAME head_repo_owner=$HEAD_REPO_OWNER head_branch_name=$HEAD_BRANCH_NAME head_commit=$HEAD_COMMIT base_branch_name=$BASE_BRANCH_NAME pull_num=$PULL_NUM pull_author=$PULL_AUTHOR repo_rel_dir=$REPO_REL_DIR",
-			ExpOut:  "base_repo_name=basename base_repo_owner=baseowner head_repo_name=headname head_repo_owner=headowner head_branch_name=add-feat head_commit=12345abcdef base_branch_name=master pull_num=2 pull_author=acme repo_rel_dir=mydir\n",
+			ExpOut:  "base_repo_name=basename base_repo_owner=baseowner head_repo_name=headname head_repo_owner=headowner head_branch_name=add-feat head_commit=12345abcdef base_branch_name=main pull_num=2 pull_author=acme repo_rel_dir=mydir\n",
 		},
 		{
 			Command: "echo user_name=$USER_NAME",
@@ -110,6 +110,7 @@ func TestRunStepRunner_Run(t *testing.T) {
 
 		logger := logging.NewNoopLogger(t)
 		projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
+		tmpDir := t.TempDir()
 
 		r := runtime.RunStepRunner{
 			TerraformExecutor:       terraform,
@@ -118,8 +119,6 @@ func TestRunStepRunner_Run(t *testing.T) {
 			ProjectCmdOutputHandler: projectCmdOutputHandler,
 		}
 		t.Run(c.Command, func(t *testing.T) {
-			tmpDir, cleanup := TempDir(t)
-			defer cleanup()
 			ctx := command.ProjectContext{
 				BaseRepo: models.Repo{
 					Name:  "basename",
@@ -133,7 +132,7 @@ func TestRunStepRunner_Run(t *testing.T) {
 					Num:        2,
 					HeadBranch: "add-feat",
 					HeadCommit: "12345abcdef",
-					BaseBranch: "master",
+					BaseBranch: "main",
 					Author:     "acme",
 				},
 				User: models.User{
diff --git a/server/core/runtime/show_step_runner_test.go b/server/core/runtime/show_step_runner_test.go
index 8d2909733e..63fa47aece 100644
--- a/server/core/runtime/show_step_runner_test.go
+++ b/server/core/runtime/show_step_runner_test.go
@@ -17,7 +17,7 @@ import (
 
 func TestShowStepRunnner(t *testing.T) {
 	logger := logging.NewNoopLogger(t)
-	path, _ := os.MkdirTemp("", "")
+	path := t.TempDir()
 	resultPath := filepath.Join(path, "test-default.json")
 	envs := map[string]string{"key": "val"}
 	tfVersion, _ := version.NewVersion("0.12")
diff --git a/server/core/runtime/version_step_runner_test.go b/server/core/runtime/version_step_runner_test.go
index ea20cf45e2..5ae56b59a5 100644
--- a/server/core/runtime/version_step_runner_test.go
+++ b/server/core/runtime/version_step_runner_test.go
@@ -35,8 +35,7 @@ func TestRunVersionStep(t *testing.T) {
 
 	terraform := mocks.NewMockClient()
 	tfVersion, _ := version.NewVersion("0.15.0")
-	tmpDir, cleanup := TempDir(t)
-	defer cleanup()
+	tmpDir := t.TempDir()
 
 	s := &VersionStepRunner{
 		TerraformExecutor: terraform,
diff --git a/server/core/terraform/terraform_client_internal_test.go b/server/core/terraform/terraform_client_internal_test.go
index 647ee48e06..dc9f0b9956 100644
--- a/server/core/terraform/terraform_client_internal_test.go
+++ b/server/core/terraform/terraform_client_internal_test.go
@@ -18,8 +18,7 @@ import (
 
 // Test that we write the file as expected
 func TestGenerateRCFile_WritesFile(t *testing.T) {
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 
 	err := generateRCFile("token", "hostname", tmp)
 	Ok(t, err)
@@ -35,8 +34,7 @@ func TestGenerateRCFile_WritesFile(t *testing.T) {
 // Test that if the file already exists and its contents will be modified if
 // we write our config that we error out.
 func TestGenerateRCFile_WillNotOverwrite(t *testing.T) {
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 
 	rcFile := filepath.Join(tmp, ".terraformrc")
 	err := os.WriteFile(rcFile, []byte("contents"), 0600)
@@ -50,8 +48,7 @@ func TestGenerateRCFile_WillNotOverwrite(t *testing.T) {
 // Test that if the file already exists and its contents will NOT be modified if
 // we write our config that we don't error.
 func TestGenerateRCFile_NoErrIfContentsSame(t *testing.T) {
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 
 	rcFile := filepath.Join(tmp, ".terraformrc")
 	contents := `credentials "app.terraform.io" {
@@ -67,8 +64,7 @@ func TestGenerateRCFile_NoErrIfContentsSame(t *testing.T) {
 // Test that if we can't read the existing file to see if the contents will be
 // the same that we just error out.
 func TestGenerateRCFile_ErrIfCannotRead(t *testing.T) {
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 
 	rcFile := filepath.Join(tmp, ".terraformrc")
 	err := os.WriteFile(rcFile, []byte("can't see me!"), 0000)
@@ -91,7 +87,7 @@ func TestGenerateRCFile_ErrIfCannotWrite(t *testing.T) {
 func TestDefaultClient_RunCommandWithVersion_EnvVars(t *testing.T) {
 	v, err := version.NewVersion("0.11.11")
 	Ok(t, err)
-	tmp, cleanup := TempDir(t)
+	tmp := t.TempDir()
 	logger := logging.NewNoopLogger(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
 
@@ -106,7 +102,6 @@ func TestDefaultClient_RunCommandWithVersion_EnvVars(t *testing.T) {
 			Num: 2,
 		},
 	}
-	defer cleanup()
 	client := &DefaultClient{
 		defaultVersion:          v,
 		terraformPluginCacheDir: tmp,
@@ -133,7 +128,7 @@ func TestDefaultClient_RunCommandWithVersion_EnvVars(t *testing.T) {
 func TestDefaultClient_RunCommandWithVersion_Error(t *testing.T) {
 	v, err := version.NewVersion("0.11.11")
 	Ok(t, err)
-	tmp, cleanup := TempDir(t)
+	tmp := t.TempDir()
 	logger := logging.NewNoopLogger(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
 
@@ -153,7 +148,6 @@ func TestDefaultClient_RunCommandWithVersion_Error(t *testing.T) {
 			Name:     "repo",
 		},
 	}
-	defer cleanup()
 	client := &DefaultClient{
 		defaultVersion:          v,
 		terraformPluginCacheDir: tmp,
@@ -176,7 +170,7 @@ func TestDefaultClient_RunCommandWithVersion_Error(t *testing.T) {
 func TestDefaultClient_RunCommandAsync_Success(t *testing.T) {
 	v, err := version.NewVersion("0.11.11")
 	Ok(t, err)
-	tmp, cleanup := TempDir(t)
+	tmp := t.TempDir()
 	logger := logging.NewNoopLogger(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
 
@@ -196,7 +190,6 @@ func TestDefaultClient_RunCommandAsync_Success(t *testing.T) {
 			Name:     "repo",
 		},
 	}
-	defer cleanup()
 	client := &DefaultClient{
 		defaultVersion:          v,
 		terraformPluginCacheDir: tmp,
@@ -223,7 +216,7 @@ func TestDefaultClient_RunCommandAsync_Success(t *testing.T) {
 func TestDefaultClient_RunCommandAsync_BigOutput(t *testing.T) {
 	v, err := version.NewVersion("0.11.11")
 	Ok(t, err)
-	tmp, cleanup := TempDir(t)
+	tmp := t.TempDir()
 	logger := logging.NewNoopLogger(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
 
@@ -243,7 +236,6 @@ func TestDefaultClient_RunCommandAsync_BigOutput(t *testing.T) {
 			Name:     "repo",
 		},
 	}
-	defer cleanup()
 	client := &DefaultClient{
 		defaultVersion:          v,
 		terraformPluginCacheDir: tmp,
@@ -271,7 +263,7 @@ func TestDefaultClient_RunCommandAsync_BigOutput(t *testing.T) {
 func TestDefaultClient_RunCommandAsync_StderrOutput(t *testing.T) {
 	v, err := version.NewVersion("0.11.11")
 	Ok(t, err)
-	tmp, cleanup := TempDir(t)
+	tmp := t.TempDir()
 	logger := logging.NewNoopLogger(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
 
@@ -291,7 +283,6 @@ func TestDefaultClient_RunCommandAsync_StderrOutput(t *testing.T) {
 			Name:     "repo",
 		},
 	}
-	defer cleanup()
 	client := &DefaultClient{
 		defaultVersion:          v,
 		terraformPluginCacheDir: tmp,
@@ -308,7 +299,7 @@ func TestDefaultClient_RunCommandAsync_StderrOutput(t *testing.T) {
 func TestDefaultClient_RunCommandAsync_ExitOne(t *testing.T) {
 	v, err := version.NewVersion("0.11.11")
 	Ok(t, err)
-	tmp, cleanup := TempDir(t)
+	tmp := t.TempDir()
 	logger := logging.NewNoopLogger(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
 
@@ -328,7 +319,6 @@ func TestDefaultClient_RunCommandAsync_ExitOne(t *testing.T) {
 			Name:     "repo",
 		},
 	}
-	defer cleanup()
 	client := &DefaultClient{
 		defaultVersion:          v,
 		terraformPluginCacheDir: tmp,
@@ -346,7 +336,7 @@ func TestDefaultClient_RunCommandAsync_ExitOne(t *testing.T) {
 func TestDefaultClient_RunCommandAsync_Input(t *testing.T) {
 	v, err := version.NewVersion("0.11.11")
 	Ok(t, err)
-	tmp, cleanup := TempDir(t)
+	tmp := t.TempDir()
 	logger := logging.NewNoopLogger(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
 
@@ -366,7 +356,6 @@ func TestDefaultClient_RunCommandAsync_Input(t *testing.T) {
 			Name:     "repo",
 		},
 	}
-	defer cleanup()
 	client := &DefaultClient{
 		defaultVersion:          v,
 		terraformPluginCacheDir: tmp,
diff --git a/server/core/terraform/terraform_client_test.go b/server/core/terraform/terraform_client_test.go
index 54c022f635..3466f3a83a 100644
--- a/server/core/terraform/terraform_client_test.go
+++ b/server/core/terraform/terraform_client_test.go
@@ -60,14 +60,13 @@ func TestNewClient_LocalTFOnly(t *testing.T) {
 Your version of Terraform is out of date! The latest version
 is 0.11.13. You can update by downloading from www.terraform.io/downloads.html
 `
-	tmp, binDir, cacheDir, cleanup := mkSubDirs(t)
+	tmp, binDir, cacheDir := mkSubDirs(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
 	ctx := command.ProjectContext{
 		Log:        logging.NewNoopLogger(t),
 		Workspace:  "default",
 		RepoRelDir: ".",
 	}
-	defer cleanup()
 
 	logger := logging.NewNoopLogger(t)
 
@@ -97,14 +96,13 @@ Your version of Terraform is out of date! The latest version
 is 0.11.13. You can update by downloading from www.terraform.io/downloads.html
 `
 	logger := logging.NewNoopLogger(t)
-	tmp, binDir, cacheDir, cleanup := mkSubDirs(t)
+	tmp, binDir, cacheDir := mkSubDirs(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
 	ctx := command.ProjectContext{
 		Log:        logging.NewNoopLogger(t),
 		Workspace:  "default",
 		RepoRelDir: ".",
 	}
-	defer cleanup()
 
 	// We're testing this by adding our own "fake" terraform binary to path that
 	// outputs what would normally come from terraform version.
@@ -127,9 +125,8 @@ is 0.11.13. You can update by downloading from www.terraform.io/downloads.html
 // that we error.
 func TestNewClient_NoTF(t *testing.T) {
 	logger := logging.NewNoopLogger(t)
-	tmp, binDir, cacheDir, cleanup := mkSubDirs(t)
+	tmp, binDir, cacheDir := mkSubDirs(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
-	defer cleanup()
 
 	// Set PATH to only include our empty directory.
 	defer tempSetEnv(t, "PATH", tmp)()
@@ -143,14 +140,13 @@ func TestNewClient_NoTF(t *testing.T) {
 func TestNewClient_DefaultTFFlagInPath(t *testing.T) {
 	fakeBinOut := "Terraform v0.11.10\n"
 	logger := logging.NewNoopLogger(t)
-	tmp, binDir, cacheDir, cleanup := mkSubDirs(t)
+	tmp, binDir, cacheDir := mkSubDirs(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
 	ctx := command.ProjectContext{
 		Log:        logging.NewNoopLogger(t),
 		Workspace:  "default",
 		RepoRelDir: ".",
 	}
-	defer cleanup()
 
 	// We're testing this by adding our own "fake" terraform binary to path that
 	// outputs what would normally come from terraform version.
@@ -173,14 +169,13 @@ func TestNewClient_DefaultTFFlagInPath(t *testing.T) {
 // bin dir that we use it.
 func TestNewClient_DefaultTFFlagInBinDir(t *testing.T) {
 	fakeBinOut := "Terraform v0.11.10\n"
-	tmp, binDir, cacheDir, cleanup := mkSubDirs(t)
+	tmp, binDir, cacheDir := mkSubDirs(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
 	ctx := command.ProjectContext{
 		Log:        logging.NewNoopLogger(t),
 		Workspace:  "default",
 		RepoRelDir: ".",
 	}
-	defer cleanup()
 
 	// Add our fake binary to {datadir}/bin/terraform{version}.
 	err := os.WriteFile(filepath.Join(binDir, "terraform0.11.10"), []byte(fmt.Sprintf("#!/bin/sh\necho '%s'", fakeBinOut)), 0700) // #nosec G306
@@ -202,14 +197,13 @@ func TestNewClient_DefaultTFFlagInBinDir(t *testing.T) {
 func TestNewClient_DefaultTFFlagDownload(t *testing.T) {
 	RegisterMockTestingT(t)
 	logger := logging.NewNoopLogger(t)
-	tmp, binDir, cacheDir, cleanup := mkSubDirs(t)
+	tmp, binDir, cacheDir := mkSubDirs(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
 	ctx := command.ProjectContext{
 		Log:        logging.NewNoopLogger(t),
 		Workspace:  "default",
 		RepoRelDir: ".",
 	}
-	defer cleanup()
 
 	// Set PATH to empty so there's no TF available.
 	orig := os.Getenv("PATH")
@@ -244,9 +238,8 @@ func TestNewClient_DefaultTFFlagDownload(t *testing.T) {
 // Test that we get an error if the terraform version flag is malformed.
 func TestNewClient_BadVersion(t *testing.T) {
 	logger := logging.NewNoopLogger(t)
-	_, binDir, cacheDir, cleanup := mkSubDirs(t)
+	_, binDir, cacheDir := mkSubDirs(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
-	defer cleanup()
 	_, err := terraform.NewClient(logger, binDir, cacheDir, "", "", "malformed", cmd.DefaultTFVersionFlag, cmd.DefaultTFDownloadURL, nil, true, projectCmdOutputHandler)
 	ErrEquals(t, "Malformed version: malformed", err)
 }
@@ -255,14 +248,13 @@ func TestNewClient_BadVersion(t *testing.T) {
 func TestRunCommandWithVersion_DLsTF(t *testing.T) {
 	logger := logging.NewNoopLogger(t)
 	RegisterMockTestingT(t)
-	tmp, binDir, cacheDir, cleanup := mkSubDirs(t)
+	tmp, binDir, cacheDir := mkSubDirs(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
 	ctx := command.ProjectContext{
 		Log:        logging.NewNoopLogger(t),
 		Workspace:  "default",
 		RepoRelDir: ".",
 	}
-	defer cleanup()
 
 	mockDownloader := mocks.NewMockDownloader()
 	// Set up our mock downloader to write a fake tf binary when it's called.
@@ -294,9 +286,8 @@ func TestRunCommandWithVersion_DLsTF(t *testing.T) {
 func TestEnsureVersion_downloaded(t *testing.T) {
 	logger := logging.NewNoopLogger(t)
 	RegisterMockTestingT(t)
-	tmp, binDir, cacheDir, cleanup := mkSubDirs(t)
+	tmp, binDir, cacheDir := mkSubDirs(t)
 	projectCmdOutputHandler := jobmocks.NewMockProjectCommandOutputHandler()
-	defer cleanup()
 
 	mockDownloader := mocks.NewMockDownloader()
 
@@ -329,9 +320,9 @@ func tempSetEnv(t *testing.T, key string, value string) func() {
 	return func() { os.Setenv(key, orig) }
 }
 
-// returns parent, bindir, cachedir, cleanup func
-func mkSubDirs(t *testing.T) (string, string, string, func()) {
-	tmp, cleanup := TempDir(t)
+// returns parent, bindir, cachedir
+func mkSubDirs(t *testing.T) (string, string, string) {
+	tmp := t.TempDir()
 	binDir := filepath.Join(tmp, "bin")
 	err := os.MkdirAll(binDir, 0700)
 	Ok(t, err)
@@ -340,5 +331,5 @@ func mkSubDirs(t *testing.T) (string, string, string, func()) {
 	err = os.MkdirAll(cachedir, 0700)
 	Ok(t, err)
 
-	return tmp, binDir, cachedir, cleanup
+	return tmp, binDir, cachedir
 }
diff --git a/server/events/command/name.go b/server/events/command/name.go
index cd31e66a29..9194102da6 100644
--- a/server/events/command/name.go
+++ b/server/events/command/name.go
@@ -1,6 +1,11 @@
 package command
 
-import "strings"
+import (
+	"strings"
+
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
+)
 
 // Name is which command to run.
 type Name int
@@ -26,7 +31,7 @@ const (
 // TitleString returns the string representation in title form.
 // ie. policy_check becomes Policy Check
 func (c Name) TitleString() string {
-	return strings.Title(strings.ReplaceAll(strings.ToLower(c.String()), "_", " "))
+	return cases.Title(language.English).String(strings.ReplaceAll(strings.ToLower(c.String()), "_", " "))
 }
 
 // String returns the string representation of c.
diff --git a/server/events/command/project_context.go b/server/events/command/project_context.go
index d8c9310b0c..cbd7cae9a1 100644
--- a/server/events/command/project_context.go
+++ b/server/events/command/project_context.go
@@ -2,6 +2,7 @@ package command
 
 import (
 	"fmt"
+	"strconv"
 	"strings"
 
 	"github.com/hashicorp/go-version"
@@ -93,10 +94,20 @@ type ProjectContext struct {
 	ExecutionOrderGroup int
 }
 
-// SetScope sets the scope of the stats object field. Note: we deliberately set this on the value
-// instead of a pointer since we want scopes to mirror our function stack
-func (p ProjectContext) SetScope(scope string) {
-	p.Scope = p.Scope.SubScope(scope) //nolint
+// SetScopeTags adds ProjectContext tags to a new returned scope.
+func (p ProjectContext) SetScopeTags(scope tally.Scope) tally.Scope {
+	v := ""
+	if p.TerraformVersion != nil {
+		v = p.TerraformVersion.String()
+	}
+	return scope.Tagged(map[string]string{
+		"base_repo":         p.BaseRepo.FullName,
+		"pr_number":         strconv.Itoa(p.Pull.Num),
+		"project":           p.ProjectName,
+		"project_path":      p.RepoRelDir,
+		"terraform_version": v,
+		"workspace":         p.Workspace,
+	})
 }
 
 // GetShowResultFileName returns the filename (not the path) to store the tf show result
diff --git a/server/events/command_runner.go b/server/events/command_runner.go
index 0bdf0ba88d..19eb0232a4 100644
--- a/server/events/command_runner.go
+++ b/server/events/command_runner.go
@@ -163,7 +163,7 @@ func (c *DefaultCommandRunner) RunAutoplanCommand(baseRepo models.Repo, headRepo
 		return
 	}
 
-	err = c.PreWorkflowHooksCommandRunner.RunPreHooks(ctx)
+	err = c.PreWorkflowHooksCommandRunner.RunPreHooks(ctx, nil)
 
 	if err != nil {
 		ctx.Log.Err("Error running pre-workflow hooks %s. Proceeding with %s command.", err, command.Plan)
@@ -173,7 +173,7 @@ func (c *DefaultCommandRunner) RunAutoplanCommand(baseRepo models.Repo, headRepo
 
 	autoPlanRunner.Run(ctx, nil)
 
-	err = c.PostWorkflowHooksCommandRunner.RunPostHooks(ctx)
+	err = c.PostWorkflowHooksCommandRunner.RunPostHooks(ctx, nil)
 
 	if err != nil {
 		ctx.Log.Err("Error running post-workflow hooks %s.", err)
@@ -285,7 +285,7 @@ func (c *DefaultCommandRunner) RunCommentCommand(baseRepo models.Repo, maybeHead
 		return
 	}
 
-	err = c.PreWorkflowHooksCommandRunner.RunPreHooks(ctx)
+	err = c.PreWorkflowHooksCommandRunner.RunPreHooks(ctx, cmd)
 
 	if err != nil {
 		ctx.Log.Err("Error running pre-workflow hooks %s. Proceeding with %s command.", err, cmd.Name.String())
@@ -295,7 +295,7 @@ func (c *DefaultCommandRunner) RunCommentCommand(baseRepo models.Repo, maybeHead
 
 	cmdRunner.Run(ctx, cmd)
 
-	err = c.PostWorkflowHooksCommandRunner.RunPostHooks(ctx)
+	err = c.PostWorkflowHooksCommandRunner.RunPostHooks(ctx, cmd)
 
 	if err != nil {
 		ctx.Log.Err("Error running post-workflow hooks %s.", err)
diff --git a/server/events/command_runner_test.go b/server/events/command_runner_test.go
index 4c5f875a22..0604864189 100644
--- a/server/events/command_runner_test.go
+++ b/server/events/command_runner_test.go
@@ -32,7 +32,6 @@ import (
 	lockingmocks "github.com/runatlantis/atlantis/server/core/locking/mocks"
 	"github.com/runatlantis/atlantis/server/events"
 	"github.com/runatlantis/atlantis/server/events/mocks"
-	eventmocks "github.com/runatlantis/atlantis/server/events/mocks"
 	"github.com/runatlantis/atlantis/server/events/mocks/matchers"
 	"github.com/runatlantis/atlantis/server/events/models"
 	"github.com/runatlantis/atlantis/server/events/models/fixtures"
@@ -82,13 +81,12 @@ func setup(t *testing.T) *vcsmocks.MockClient {
 	workingDir = mocks.NewMockWorkingDir()
 	pendingPlanFinder = mocks.NewMockPendingPlanFinder()
 	commitUpdater = mocks.NewMockCommitStatusUpdater()
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	defaultBoltDB, err := db.New(tmp)
 	Ok(t, err)
 
 	drainer = &events.Drainer{}
-	deleteLockCommand = eventmocks.NewMockDeleteLockCommand()
+	deleteLockCommand = mocks.NewMockDeleteLockCommand()
 	applyLockChecker = lockingmocks.NewMockApplyLockChecker()
 	lockingLocker = lockingmocks.NewMockLocker()
 
@@ -99,7 +97,7 @@ func setup(t *testing.T) *vcsmocks.MockClient {
 	pullUpdater = &events.PullUpdater{
 		HidePrevPlanComments: false,
 		VCSClient:            vcsClient,
-		MarkdownRenderer:     &events.MarkdownRenderer{},
+		MarkdownRenderer:     events.GetMarkdownRenderer(false, false, false, false, false, false, ""),
 	}
 
 	autoMerger = &events.AutoMerger{
@@ -117,6 +115,7 @@ func setup(t *testing.T) *vcsmocks.MockClient {
 		projectCommandRunner,
 		parallelPoolSize,
 		false,
+		false,
 	)
 
 	planCommandRunner = events.NewPlanCommandRunner(
@@ -192,11 +191,11 @@ func setup(t *testing.T) *vcsmocks.MockClient {
 
 	preWorkflowHooksCommandRunner = mocks.NewMockPreWorkflowHooksCommandRunner()
 
-	When(preWorkflowHooksCommandRunner.RunPreHooks(matchers.AnyPtrToEventsCommandContext())).ThenReturn(nil)
+	When(preWorkflowHooksCommandRunner.RunPreHooks(matchers.AnyPtrToEventsCommandContext(), matchers.AnyPtrToEventsCommentCommand())).ThenReturn(nil)
 
 	postWorkflowHooksCommandRunner = mocks.NewMockPostWorkflowHooksCommandRunner()
 
-	When(postWorkflowHooksCommandRunner.RunPostHooks(matchers.AnyPtrToEventsCommandContext())).ThenReturn(nil)
+	When(postWorkflowHooksCommandRunner.RunPostHooks(matchers.AnyPtrToEventsCommandContext(), matchers.AnyPtrToEventsCommentCommand())).ThenReturn(nil)
 
 	globalCfg := valid.NewGlobalCfgFromArgs(valid.GlobalCfgArgs{})
 	scope, _, _ := metrics.NewLoggingScope(logger, "atlantis")
@@ -534,8 +533,7 @@ func TestRunUnlockCommandFail_VCSComment(t *testing.T) {
 
 func TestRunAutoplanCommand_DeletePlans(t *testing.T) {
 	setup(t)
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	boltDB, err := db.New(tmp)
 	Ok(t, err)
 	dbUpdater.Backend = boltDB
@@ -562,8 +560,7 @@ func TestRunAutoplanCommand_DeletePlans(t *testing.T) {
 
 func TestRunGenericPlanCommand_DeletePlans(t *testing.T) {
 	setup(t)
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	boltDB, err := db.New(tmp)
 	Ok(t, err)
 	dbUpdater.Backend = boltDB
@@ -585,8 +582,7 @@ func TestRunGenericPlanCommand_DeletePlans(t *testing.T) {
 
 func TestRunSpecificPlanCommandDoesnt_DeletePlans(t *testing.T) {
 	setup(t)
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	boltDB, err := db.New(tmp)
 	Ok(t, err)
 	dbUpdater.Backend = boltDB
@@ -605,8 +601,7 @@ func TestRunSpecificPlanCommandDoesnt_DeletePlans(t *testing.T) {
 // we delete the plans.
 func TestRunAutoplanCommandWithError_DeletePlans(t *testing.T) {
 	setup(t)
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	boltDB, err := db.New(tmp)
 	Ok(t, err)
 	dbUpdater.Backend = boltDB
@@ -653,8 +648,7 @@ func TestRunAutoplanCommandWithError_DeletePlans(t *testing.T) {
 func TestFailedApprovalCreatesFailedStatusUpdate(t *testing.T) {
 	t.Log("if \"atlantis approve_policies\" is run by non policy owner policy check status fails.")
 	setup(t)
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	boltDB, err := db.New(tmp)
 	Ok(t, err)
 	dbUpdater.Backend = boltDB
@@ -699,8 +693,7 @@ func TestFailedApprovalCreatesFailedStatusUpdate(t *testing.T) {
 func TestApprovedPoliciesUpdateFailedPolicyStatus(t *testing.T) {
 	t.Log("if \"atlantis approve_policies\" is run by policy owner all policy checks are approved.")
 	setup(t)
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	boltDB, err := db.New(tmp)
 	Ok(t, err)
 	dbUpdater.Backend = boltDB
@@ -755,8 +748,7 @@ func TestApprovedPoliciesUpdateFailedPolicyStatus(t *testing.T) {
 func TestApplyMergeablityWhenPolicyCheckFails(t *testing.T) {
 	t.Log("if \"atlantis apply\" is run with failing policy check then apply is not performed")
 	setup(t)
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	boltDB, err := db.New(tmp)
 	Ok(t, err)
 	dbUpdater.Backend = boltDB
@@ -834,8 +826,7 @@ func TestRunApply_DiscardedProjects(t *testing.T) {
 	vcsClient := setup(t)
 	autoMerger.GlobalAutomerge = true
 	defer func() { autoMerger.GlobalAutomerge = false }()
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	boltDB, err := db.New(tmp)
 	Ok(t, err)
 	dbUpdater.Backend = boltDB
diff --git a/server/events/commit_status_updater.go b/server/events/commit_status_updater.go
index e193a0c70b..dc8a07f239 100644
--- a/server/events/commit_status_updater.go
+++ b/server/events/commit_status_updater.go
@@ -15,11 +15,12 @@ package events
 
 import (
 	"fmt"
-	"strings"
 
 	"github.com/runatlantis/atlantis/server/events/command"
 	"github.com/runatlantis/atlantis/server/events/models"
 	"github.com/runatlantis/atlantis/server/events/vcs"
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
 )
 
 //go:generate pegomock generate -m --use-experimental-model-gen --package mocks -o mocks/mock_commit_status_updater.go CommitStatusUpdater
@@ -56,7 +57,7 @@ func (d *DefaultCommitStatusUpdater) UpdateCombined(repo models.Repo, pull model
 	case models.SuccessCommitStatus:
 		descripWords = "succeeded."
 	}
-	descrip := fmt.Sprintf("%s %s", strings.Title(cmdName.String()), descripWords)
+	descrip := fmt.Sprintf("%s %s", cases.Title(language.English).String(cmdName.String()), descripWords)
 	return d.Client.UpdateStatus(repo, pull, status, src, descrip, "")
 }
 
@@ -92,6 +93,6 @@ func (d *DefaultCommitStatusUpdater) UpdateProject(ctx command.ProjectContext, c
 		descripWords = "succeeded."
 	}
 
-	descrip := fmt.Sprintf("%s %s", strings.Title(cmdName.String()), descripWords)
+	descrip := fmt.Sprintf("%s %s", cases.Title(language.English).String(cmdName.String()), descripWords)
 	return d.Client.UpdateStatus(ctx.BaseRepo, ctx.Pull, status, src, descrip, url)
 }
diff --git a/server/events/delete_lock_command_test.go b/server/events/delete_lock_command_test.go
index 9fdc00ad6f..669eb05e1b 100644
--- a/server/events/delete_lock_command_test.go
+++ b/server/events/delete_lock_command_test.go
@@ -72,8 +72,7 @@ func TestDeleteLock_Success(t *testing.T) {
 			RepoFullName: "owner/repo",
 		},
 	}, &models.ProjectLock{}, nil)
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	db, err := db.New(tmp)
 	Ok(t, err)
 	dlc := events.DefaultDeleteLockCommand{
diff --git a/server/events/event_parser.go b/server/events/event_parser.go
index 194e5344c8..3d8dc6550a 100644
--- a/server/events/event_parser.go
+++ b/server/events/event_parser.go
@@ -923,10 +923,8 @@ func (e *EventParser) ParseAzureDevopsRepo(adRepo *azuredevops.GitRepository) (m
 
 		if strings.Contains(uri.Host, "visualstudio.com") {
 			owner = strings.Split(uri.Host, ".")[0]
-		} else if strings.Contains(uri.Host, "dev.azure.com") {
-			owner = strings.Split(uri.Path, "/")[1]
 		} else {
-			owner = strings.Split(uri.Path, "/")[1] // to support owner for self hosted
+			owner = strings.Split(uri.Path, "/")[1]
 		}
 	}
 
diff --git a/server/events/event_parser_test.go b/server/events/event_parser_test.go
index b6312a6594..09de53d548 100644
--- a/server/events/event_parser_test.go
+++ b/server/events/event_parser_test.go
@@ -360,7 +360,7 @@ func TestParseGitlabMergeEvent(t *testing.T) {
 		Num:        12,
 		HeadCommit: "d2eae324ca26242abca45d7b49d582cddb2a4f15",
 		HeadBranch: "patch-1",
-		BaseBranch: "master",
+		BaseBranch: "main",
 		State:      models.OpenPullState,
 		BaseRepo:   expBaseRepo,
 	}, pull)
@@ -440,7 +440,7 @@ func TestParseGitlabMergeEvent_Subgroup(t *testing.T) {
 		Num:        2,
 		HeadCommit: "901d9770ef1a6862e2a73ec1bacc73590abb9aff",
 		HeadBranch: "patch",
-		BaseBranch: "master",
+		BaseBranch: "main",
 		State:      models.OpenPullState,
 		BaseRepo:   expBaseRepo,
 	}, pull)
@@ -583,7 +583,7 @@ func TestParseGitlabMergeRequest(t *testing.T) {
 		Num:        8,
 		HeadCommit: "0b4ac85ea3063ad5f2974d10cd68dd1f937aaac2",
 		HeadBranch: "abc",
-		BaseBranch: "master",
+		BaseBranch: "main",
 		State:      models.OpenPullState,
 		BaseRepo:   repo,
 	}, pull)
@@ -622,7 +622,7 @@ func TestParseGitlabMergeRequest_Subgroup(t *testing.T) {
 		Num:        2,
 		HeadCommit: "901d9770ef1a6862e2a73ec1bacc73590abb9aff",
 		HeadBranch: "patch",
-		BaseBranch: "master",
+		BaseBranch: "main",
 		State:      models.OpenPullState,
 		BaseRepo:   repo,
 	}, pull)
@@ -847,7 +847,7 @@ func TestParseBitbucketCloudCommentEvent_ValidEvent(t *testing.T) {
 		HeadCommit: "e0624da46d3a",
 		URL:        "https://bitbucket.org/lkysow/atlantis-example/pull-requests/2",
 		HeadBranch: "lkysow/maintf-edited-online-with-bitbucket-1532029690581",
-		BaseBranch: "master",
+		BaseBranch: "main",
 		Author:     "557058:dc3817de-68b5-45cd-b81c-5c39d2560090",
 		State:      models.ClosedPullState,
 		BaseRepo:   expBaseRepo,
@@ -933,7 +933,7 @@ func TestParseBitbucketCloudPullEvent_ValidEvent(t *testing.T) {
 		HeadCommit: "1e69a602caef",
 		URL:        "https://bitbucket.org/lkysow/atlantis-example/pull-requests/16",
 		HeadBranch: "Luke/maintf-edited-online-with-bitbucket-1560433073473",
-		BaseBranch: "master",
+		BaseBranch: "main",
 		Author:     "557058:dc3817de-68b5-45cd-b81c-5c39d2560090",
 		State:      models.OpenPullState,
 		BaseRepo:   expBaseRepo,
@@ -1063,7 +1063,7 @@ func TestParseBitbucketServerCommentEvent_ValidEvent(t *testing.T) {
 		HeadCommit: "bfb1af1ba9c2a2fa84cd61af67e6e1b60a22e060",
 		URL:        "http://mycorp.com:7490/projects/AT/repos/atlantis-example/pull-requests/1",
 		HeadBranch: "branch",
-		BaseBranch: "master",
+		BaseBranch: "main",
 		Author:     "lkysow",
 		State:      models.OpenPullState,
 		BaseRepo:   expBaseRepo,
@@ -1145,7 +1145,7 @@ func TestParseBitbucketServerPullEvent_ValidEvent(t *testing.T) {
 		HeadCommit: "86a574157f5a2dadaf595b9f06c70fdfdd039912",
 		URL:        "http://mycorp.com:7490/projects/AT/repos/atlantis-example/pull-requests/2",
 		HeadBranch: "branch",
-		BaseBranch: "master",
+		BaseBranch: "main",
 		Author:     "lkysow",
 		State:      models.ClosedPullState,
 		BaseRepo:   expBaseRepo,
diff --git a/server/events/git_cred_writer.go b/server/events/git_cred_writer.go
index b8e83facb9..945dfcecb2 100644
--- a/server/events/git_cred_writer.go
+++ b/server/events/git_cred_writer.go
@@ -18,7 +18,7 @@ import (
 func WriteGitCreds(gitUser string, gitToken string, gitHostname string, home string, logger logging.SimpleLogging, ghAccessToken bool) error {
 	const credsFilename = ".git-credentials"
 	credsFile := filepath.Join(home, credsFilename)
-	credsFileContentsPattern := `https://%s:%s@%s`
+	credsFileContentsPattern := `https://%s:%s@%s` // nolint: gosec
 	config := fmt.Sprintf(credsFileContentsPattern, gitUser, gitToken, gitHostname)
 
 	// If the file doesn't exist, write it.
diff --git a/server/events/git_cred_writer_test.go b/server/events/git_cred_writer_test.go
index 9d9583abbb..c87637b037 100644
--- a/server/events/git_cred_writer_test.go
+++ b/server/events/git_cred_writer_test.go
@@ -16,8 +16,7 @@ var logger logging.SimpleLogging
 
 // Test that we write the file as expected
 func TestWriteGitCreds_WriteFile(t *testing.T) {
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 
 	err := events.WriteGitCreds("user", "token", "hostname", tmp, logger, false)
 	Ok(t, err)
@@ -32,8 +31,7 @@ func TestWriteGitCreds_WriteFile(t *testing.T) {
 // Test that if the file already exists and it doesn't have the line we would
 // have written, we write it.
 func TestWriteGitCreds_Appends(t *testing.T) {
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 
 	credsFile := filepath.Join(tmp, ".git-credentials")
 	err := os.WriteFile(credsFile, []byte("contents"), 0600)
@@ -51,8 +49,7 @@ func TestWriteGitCreds_Appends(t *testing.T) {
 // Test that if the file already exists and it already has the line expected
 // we do nothing.
 func TestWriteGitCreds_NoModification(t *testing.T) {
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 
 	credsFile := filepath.Join(tmp, ".git-credentials")
 	contents := "line1\nhttps://user:token@hostname\nline2"
@@ -68,8 +65,7 @@ func TestWriteGitCreds_NoModification(t *testing.T) {
 
 // Test that the github app credentials get replaced.
 func TestWriteGitCreds_ReplaceApp(t *testing.T) {
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 
 	credsFile := filepath.Join(tmp, ".git-credentials")
 	contents := "line1\nhttps://x-access-token:v1.87dddddddddddddddd@github.com\nline2"
@@ -86,8 +82,7 @@ func TestWriteGitCreds_ReplaceApp(t *testing.T) {
 
 // Test that the github app credentials get updated when cred file is empty.
 func TestWriteGitCreds_AppendApp(t *testing.T) {
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 
 	credsFile := filepath.Join(tmp, ".git-credentials")
 	contents := ""
@@ -105,8 +100,7 @@ func TestWriteGitCreds_AppendApp(t *testing.T) {
 // Test that if we can't read the existing file to see if the contents will be
 // the same that we just error out.
 func TestWriteGitCreds_ErrIfCannotRead(t *testing.T) {
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 
 	credsFile := filepath.Join(tmp, ".git-credentials")
 	err := os.WriteFile(credsFile, []byte("can't see me!"), 0000)
@@ -119,7 +113,7 @@ func TestWriteGitCreds_ErrIfCannotRead(t *testing.T) {
 
 // Test that if we can't write, we error out.
 func TestWriteGitCreds_ErrIfCannotWrite(t *testing.T) {
-	credsFile := "/this/dir/does/not/exist/.git-credentials"
+	credsFile := "/this/dir/does/not/exist/.git-credentials" // nolint: gosec
 	expErr := fmt.Sprintf("writing generated .git-credentials file with user, token and hostname to %s: open %s: no such file or directory", credsFile, credsFile)
 	actErr := events.WriteGitCreds("user", "token", "hostname", "/this/dir/does/not/exist", logger, false)
 	ErrEquals(t, expErr, actErr)
@@ -127,8 +121,7 @@ func TestWriteGitCreds_ErrIfCannotWrite(t *testing.T) {
 
 // Test that git is actually configured to use the credentials
 func TestWriteGitCreds_ConfigureGitCredentialHelper(t *testing.T) {
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 
 	err := events.WriteGitCreds("user", "token", "hostname", tmp, logger, false)
 	Ok(t, err)
@@ -141,8 +134,7 @@ func TestWriteGitCreds_ConfigureGitCredentialHelper(t *testing.T) {
 
 // Test that git is configured to use https instead of ssh
 func TestWriteGitCreds_ConfigureGitUrlOverride(t *testing.T) {
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 
 	err := events.WriteGitCreds("user", "token", "hostname", tmp, logger, false)
 	Ok(t, err)
diff --git a/server/events/github_app_working_dir_test.go b/server/events/github_app_working_dir_test.go
index 46f6bac5bd..6ea3434e3d 100644
--- a/server/events/github_app_working_dir_test.go
+++ b/server/events/github_app_working_dir_test.go
@@ -18,12 +18,10 @@ import (
 // Test that if we don't have any existing files, we check out the repo with a github app.
 func TestClone_GithubAppNoneExisting(t *testing.T) {
 	// Initialize the git repo.
-	repoDir, cleanup := initRepo(t)
-	defer cleanup()
+	repoDir := initRepo(t)
 	expCommit := runCmd(t, repoDir, "git", "rev-parse", "HEAD")
 
-	dataDir, cleanup2 := TempDir(t)
-	defer cleanup2()
+	dataDir := t.TempDir()
 
 	wd := &events.FileWorkspace{
 		DataDir:                     dataDir,
diff --git a/server/events/instrumented_project_command_runner.go b/server/events/instrumented_project_command_runner.go
index a3cedbf6f0..ba82953a60 100644
--- a/server/events/instrumented_project_command_runner.go
+++ b/server/events/instrumented_project_command_runner.go
@@ -24,9 +24,8 @@ func (p *InstrumentedProjectCommandRunner) Apply(ctx command.ProjectContext) com
 func RunAndEmitStats(commandName string, ctx command.ProjectContext, execute func(ctx command.ProjectContext) command.ProjectResult) command.ProjectResult {
 
 	// ensures we are differentiating between project level command and overall command
-	ctx.SetScope("project")
-
-	scope := ctx.Scope
+	scope := ctx.Scope.SubScope("project")
+	scope = ctx.SetScopeTags(scope)
 	logger := ctx.Log
 
 	executionTime := scope.Timer(metrics.ExecutionTimeMetric).Start()
diff --git a/server/events/markdown_renderer.go b/server/events/markdown_renderer.go
index c9605004cf..621d88be0f 100644
--- a/server/events/markdown_renderer.go
+++ b/server/events/markdown_renderer.go
@@ -15,6 +15,7 @@ package events
 
 import (
 	"bytes"
+	"embed"
 	"fmt"
 	"strings"
 	"text/template"
@@ -22,6 +23,8 @@ import (
 	"github.com/Masterminds/sprig/v3"
 	"github.com/runatlantis/atlantis/server/events/command"
 	"github.com/runatlantis/atlantis/server/events/models"
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
 )
 
 var (
@@ -33,6 +36,9 @@ var (
 	// maxUnwrappedLines is the maximum number of lines the Terraform output
 	// can be before we wrap it in an expandable template.
 	maxUnwrappedLines = 12
+
+	//go:embed templates/*
+	templatesFS embed.FS
 )
 
 // MarkdownRenderer renders responses as markdown.
@@ -46,6 +52,7 @@ type MarkdownRenderer struct {
 	DisableMarkdownFolding   bool
 	DisableRepoLocking       bool
 	EnableDiffMarkdownFormat bool
+	MarkdownTemplates        *template.Template
 }
 
 // commonData is data that all responses have.
@@ -89,6 +96,7 @@ type planSuccessData struct {
 
 type policyCheckSuccessData struct {
 	models.PolicyCheckSuccess
+	PolicyCheckSummary string
 }
 
 type projectResultTmplData struct {
@@ -98,10 +106,37 @@ type projectResultTmplData struct {
 	Rendered    string
 }
 
+// Initialize templates
+func GetMarkdownRenderer(
+	GitlabSupportsCommonMark bool,
+	DisableApplyAll bool,
+	DisableApply bool,
+	DisableMarkdownFolding bool,
+	DisableRepoLocking bool,
+	EnableDiffMarkdownFormat bool,
+	MarkdownTemplateOverridesDir string,
+) *MarkdownRenderer {
+	var templates *template.Template
+	templates, _ = template.New("").Funcs(sprig.TxtFuncMap()).ParseFS(templatesFS, "templates/*.tmpl")
+	if overrides, err := templates.ParseGlob(fmt.Sprintf("%s/*.tmpl", MarkdownTemplateOverridesDir)); err == nil {
+		// doesn't override if templates directory doesn't exist
+		templates = overrides
+	}
+	return &MarkdownRenderer{
+		GitlabSupportsCommonMark: GitlabSupportsCommonMark,
+		DisableApplyAll:          DisableApplyAll,
+		DisableMarkdownFolding:   DisableMarkdownFolding,
+		DisableApply:             DisableApply,
+		DisableRepoLocking:       DisableRepoLocking,
+		EnableDiffMarkdownFormat: EnableDiffMarkdownFormat,
+		MarkdownTemplates:        templates,
+	}
+}
+
 // Render formats the data into a markdown string.
 // nolint: interfacer
 func (m *MarkdownRenderer) Render(res command.Result, cmdName command.Name, log string, verbose bool, vcsHost models.VCSHostType) string {
-	commandStr := strings.Title(strings.Replace(cmdName.String(), "_", " ", -1))
+	commandStr := cases.Title(language.English).String(strings.Replace(cmdName.String(), "_", " ", -1))
 	common := commonData{
 		Command:                  commandStr,
 		Verbose:                  verbose,
@@ -112,11 +147,14 @@ func (m *MarkdownRenderer) Render(res command.Result, cmdName command.Name, log
 		DisableRepoLocking:       m.DisableRepoLocking,
 		EnableDiffMarkdownFormat: m.EnableDiffMarkdownFormat,
 	}
+
+	templates := m.MarkdownTemplates
+
 	if res.Error != nil {
-		return m.renderTemplate(unwrappedErrWithLogTmpl, errData{res.Error.Error(), common})
+		return m.renderTemplate(templates.Lookup("unwrappedErrWithLog"), errData{res.Error.Error(), common})
 	}
 	if res.Failure != "" {
-		return m.renderTemplate(failureWithLogTmpl, failureData{res.Failure, common})
+		return m.renderTemplate(templates.Lookup("failureWithLog"), failureData{res.Failure, common})
 	}
 	return m.renderProjectResults(res.ProjectResults, common, vcsHost)
 }
@@ -127,6 +165,8 @@ func (m *MarkdownRenderer) renderProjectResults(results []command.ProjectResult,
 	numPolicyCheckSuccesses := 0
 	numVersionSuccesses := 0
 
+	templates := m.MarkdownTemplates
+
 	for _, result := range results {
 		resultData := projectResultTmplData{
 			Workspace:   result.Workspace,
@@ -134,9 +174,9 @@ func (m *MarkdownRenderer) renderProjectResults(results []command.ProjectResult,
 			ProjectName: result.ProjectName,
 		}
 		if result.Error != nil {
-			tmpl := unwrappedErrTmpl
+			tmpl := templates.Lookup("unwrappedErr")
 			if m.shouldUseWrappedTmpl(vcsHost, result.Error.Error()) {
-				tmpl = wrappedErrTmpl
+				tmpl = templates.Lookup("wrappedErr")
 			}
 			resultData.Rendered = m.renderTemplate(tmpl, struct {
 				Command string
@@ -146,7 +186,7 @@ func (m *MarkdownRenderer) renderProjectResults(results []command.ProjectResult,
 				Error:   result.Error.Error(),
 			})
 		} else if result.Failure != "" {
-			resultData.Rendered = m.renderTemplate(failureTmpl, struct {
+			resultData.Rendered = m.renderTemplate(templates.Lookup("failure"), struct {
 				Command string
 				Failure string
 			}{
@@ -155,29 +195,29 @@ func (m *MarkdownRenderer) renderProjectResults(results []command.ProjectResult,
 			})
 		} else if result.PlanSuccess != nil {
 			if m.shouldUseWrappedTmpl(vcsHost, result.PlanSuccess.TerraformOutput) {
-				resultData.Rendered = m.renderTemplate(planSuccessWrappedTmpl, planSuccessData{PlanSuccess: *result.PlanSuccess, PlanSummary: result.PlanSuccess.Summary(), PlanWasDeleted: common.PlansDeleted, DisableApply: common.DisableApply, DisableRepoLocking: common.DisableRepoLocking, EnableDiffMarkdownFormat: common.EnableDiffMarkdownFormat})
+				resultData.Rendered = m.renderTemplate(templates.Lookup("planSuccessWrapped"), planSuccessData{PlanSuccess: *result.PlanSuccess, PlanSummary: result.PlanSuccess.Summary(), PlanWasDeleted: common.PlansDeleted, DisableApply: common.DisableApply, DisableRepoLocking: common.DisableRepoLocking, EnableDiffMarkdownFormat: common.EnableDiffMarkdownFormat})
 			} else {
-				resultData.Rendered = m.renderTemplate(planSuccessUnwrappedTmpl, planSuccessData{PlanSuccess: *result.PlanSuccess, PlanWasDeleted: common.PlansDeleted, DisableApply: common.DisableApply, DisableRepoLocking: common.DisableRepoLocking, EnableDiffMarkdownFormat: common.EnableDiffMarkdownFormat})
+				resultData.Rendered = m.renderTemplate(templates.Lookup("planSuccessUnwrapped"), planSuccessData{PlanSuccess: *result.PlanSuccess, PlanWasDeleted: common.PlansDeleted, DisableApply: common.DisableApply, DisableRepoLocking: common.DisableRepoLocking, EnableDiffMarkdownFormat: common.EnableDiffMarkdownFormat})
 			}
 			numPlanSuccesses++
 		} else if result.PolicyCheckSuccess != nil {
 			if m.shouldUseWrappedTmpl(vcsHost, result.PolicyCheckSuccess.PolicyCheckOutput) {
-				resultData.Rendered = m.renderTemplate(policyCheckSuccessWrappedTmpl, policyCheckSuccessData{PolicyCheckSuccess: *result.PolicyCheckSuccess})
+				resultData.Rendered = m.renderTemplate(templates.Lookup("policyCheckSuccessWrapped"), policyCheckSuccessData{PolicyCheckSuccess: *result.PolicyCheckSuccess, PolicyCheckSummary: result.PolicyCheckSuccess.Summary()})
 			} else {
-				resultData.Rendered = m.renderTemplate(policyCheckSuccessUnwrappedTmpl, policyCheckSuccessData{PolicyCheckSuccess: *result.PolicyCheckSuccess})
+				resultData.Rendered = m.renderTemplate(templates.Lookup("policyCheckSuccessUnwrapped"), policyCheckSuccessData{PolicyCheckSuccess: *result.PolicyCheckSuccess})
 			}
 			numPolicyCheckSuccesses++
 		} else if result.ApplySuccess != "" {
 			if m.shouldUseWrappedTmpl(vcsHost, result.ApplySuccess) {
-				resultData.Rendered = m.renderTemplate(applyWrappedSuccessTmpl, struct{ Output string }{result.ApplySuccess})
+				resultData.Rendered = m.renderTemplate(templates.Lookup("applyWrappedSuccess"), struct{ Output string }{result.ApplySuccess})
 			} else {
-				resultData.Rendered = m.renderTemplate(applyUnwrappedSuccessTmpl, struct{ Output string }{result.ApplySuccess})
+				resultData.Rendered = m.renderTemplate(templates.Lookup("applyUnwrappedSuccess"), struct{ Output string }{result.ApplySuccess})
 			}
 		} else if result.VersionSuccess != "" {
 			if m.shouldUseWrappedTmpl(vcsHost, result.VersionSuccess) {
-				resultData.Rendered = m.renderTemplate(versionWrappedSuccessTmpl, struct{ Output string }{result.VersionSuccess})
+				resultData.Rendered = m.renderTemplate(templates.Lookup("versionWrappedSuccess"), struct{ Output string }{result.VersionSuccess})
 			} else {
-				resultData.Rendered = m.renderTemplate(versionUnwrappedSuccessTmpl, struct{ Output string }{result.VersionSuccess})
+				resultData.Rendered = m.renderTemplate(templates.Lookup("versionUnwrappedSuccess"), struct{ Output string }{result.VersionSuccess})
 			}
 			numVersionSuccesses++
 		} else {
@@ -189,28 +229,28 @@ func (m *MarkdownRenderer) renderProjectResults(results []command.ProjectResult,
 	var tmpl *template.Template
 	switch {
 	case len(resultsTmplData) == 1 && common.Command == planCommandTitle && numPlanSuccesses > 0:
-		tmpl = singleProjectPlanSuccessTmpl
+		tmpl = templates.Lookup("singleProjectPlanSuccess")
 	case len(resultsTmplData) == 1 && common.Command == planCommandTitle && numPlanSuccesses == 0:
-		tmpl = singleProjectPlanUnsuccessfulTmpl
+		tmpl = templates.Lookup("singleProjectPlanUnsuccessful")
 	case len(resultsTmplData) == 1 && common.Command == policyCheckCommandTitle && numPolicyCheckSuccesses > 0:
-		tmpl = singleProjectPlanSuccessTmpl
+		tmpl = templates.Lookup("singleProjectPlanSuccess")
 	case len(resultsTmplData) == 1 && common.Command == policyCheckCommandTitle && numPolicyCheckSuccesses == 0:
-		tmpl = singleProjectPlanUnsuccessfulTmpl
+		tmpl = templates.Lookup("singleProjectPlanUnsuccessful")
 	case len(resultsTmplData) == 1 && common.Command == versionCommandTitle && numVersionSuccesses > 0:
-		tmpl = singleProjectVersionSuccessTmpl
+		tmpl = templates.Lookup("singleProjectVersionSuccess")
 	case len(resultsTmplData) == 1 && common.Command == versionCommandTitle && numVersionSuccesses == 0:
-		tmpl = singleProjectVersionUnsuccessfulTmpl
+		tmpl = templates.Lookup("singleProjectVersionUnsuccessful")
 	case len(resultsTmplData) == 1 && common.Command == applyCommandTitle:
-		tmpl = singleProjectApplyTmpl
+		tmpl = templates.Lookup("singleProjectApply")
 	case common.Command == planCommandTitle,
 		common.Command == policyCheckCommandTitle:
-		tmpl = multiProjectPlanTmpl
+		tmpl = templates.Lookup("multiProjectPlan")
 	case common.Command == approvePoliciesCommandTitle:
-		tmpl = approveAllProjectsTmpl
+		tmpl = templates.Lookup("approveAllProjects")
 	case common.Command == applyCommandTitle:
-		tmpl = multiProjectApplyTmpl
+		tmpl = templates.Lookup("multiProjectApply")
 	case common.Command == versionCommandTitle:
-		tmpl = multiProjectVersionTmpl
+		tmpl = templates.Lookup("multiProjectVersion")
 	default:
 		return "no template matched–this is a bug"
 	}
@@ -245,146 +285,3 @@ func (m *MarkdownRenderer) renderTemplate(tmpl *template.Template, data interfac
 	}
 	return buf.String()
 }
-
-// todo: refactor to remove duplication #refactor
-var singleProjectApplyTmpl = template.Must(template.New("").Parse(
-	"{{$result := index .Results 0}}Ran {{.Command}} for {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`\n\n{{$result.Rendered}}\n" + logTmpl))
-var singleProjectPlanSuccessTmpl = template.Must(template.New("").Parse(
-	"{{$result := index .Results 0}}Ran {{.Command}} for {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`\n\n{{$result.Rendered}}\n" +
-		"\n" +
-		"{{ if ne .DisableApplyAll true  }}---\n" +
-		"* :fast_forward: To **apply** all unapplied plans from this pull request, comment:\n" +
-		"    * `atlantis apply`\n" +
-		"* :put_litter_in_its_place: To delete all plans and locks for the PR, comment:\n" +
-		"    * `atlantis unlock`{{ end }}" + logTmpl))
-var singleProjectPlanUnsuccessfulTmpl = template.Must(template.New("").Parse(
-	"{{$result := index .Results 0}}Ran {{.Command}} for dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`\n\n" +
-		"{{$result.Rendered}}\n" + logTmpl))
-var singleProjectVersionSuccessTmpl = template.Must(template.New("").Parse(
-	"{{$result := index .Results 0}}Ran {{.Command}} for {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`\n\n{{$result.Rendered}}\n" + logTmpl))
-var singleProjectVersionUnsuccessfulTmpl = template.Must(template.New("").Parse(
-	"{{$result := index .Results 0}}Ran {{.Command}} for dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`\n\n{{$result.Rendered}}\n" + logTmpl))
-var approveAllProjectsTmpl = template.Must(template.New("").Funcs(sprig.TxtFuncMap()).Parse(
-	"Approved Policies for {{ len .Results }} projects:\n\n" +
-		"{{ range $result := .Results }}" +
-		"1. {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`\n" +
-		"{{end}}\n" + logTmpl))
-var multiProjectPlanTmpl = template.Must(template.New("").Funcs(sprig.TxtFuncMap()).Parse(
-	"Ran {{.Command}} for {{ len .Results }} projects:\n\n" +
-		"{{ range $result := .Results }}" +
-		"1. {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`\n" +
-		"{{end}}\n" +
-		"{{ $disableApplyAll := .DisableApplyAll }}{{ range $i, $result := .Results }}" +
-		"### {{add $i 1}}. {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`\n" +
-		"{{$result.Rendered}}\n\n" +
-		"{{ if ne $disableApplyAll true }}---\n{{end}}{{end}}{{ if ne .DisableApplyAll true }}{{ if and (gt (len .Results) 0) (not .PlansDeleted) }}* :fast_forward: To **apply** all unapplied plans from this pull request, comment:\n" +
-		"    * `atlantis apply`\n" +
-		"* :put_litter_in_its_place: To delete all plans and locks for the PR, comment:\n" +
-		"    * `atlantis unlock`" +
-		"{{end}}{{end}}" +
-		logTmpl))
-var multiProjectApplyTmpl = template.Must(template.New("").Funcs(sprig.TxtFuncMap()).Parse(
-	"Ran {{.Command}} for {{ len .Results }} projects:\n\n" +
-		"{{ range $result := .Results }}" +
-		"1. {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`\n" +
-		"{{end}}\n" +
-		"{{ range $i, $result := .Results }}" +
-		"### {{add $i 1}}. {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`\n" +
-		"{{$result.Rendered}}\n\n" +
-		"---\n{{end}}" +
-		logTmpl))
-var multiProjectVersionTmpl = template.Must(template.New("").Funcs(sprig.TxtFuncMap()).Parse(
-	"Ran {{.Command}} for {{ len .Results }} projects:\n\n" +
-		"{{ range $result := .Results }}" +
-		"1. {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`\n" +
-		"{{end}}\n" +
-		"{{ range $i, $result := .Results }}" +
-		"### {{add $i 1}}. {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`\n" +
-		"{{$result.Rendered}}\n\n" +
-		"---\n{{end}}" +
-		logTmpl))
-var planSuccessUnwrappedTmpl = template.Must(template.New("").Parse(
-	"```diff\n" +
-		"{{ if .EnableDiffMarkdownFormat }}{{.DiffMarkdownFormattedTerraformOutput}}{{else}}{{.TerraformOutput}}{{end}}\n" +
-		"```\n\n" + planNextSteps +
-		"{{ if .HasDiverged }}\n\n:warning: The branch we're merging into is ahead, it is recommended to pull new commits first.{{end}}"))
-
-var planSuccessWrappedTmpl = template.Must(template.New("").Parse(
-	"<details><summary>Show Output</summary>\n\n" +
-		"```diff\n" +
-		"{{ if .EnableDiffMarkdownFormat }}{{.DiffMarkdownFormattedTerraformOutput}}{{else}}{{.TerraformOutput}}{{end}}\n" +
-		"```\n\n" +
-		planNextSteps + "\n" +
-		"</details>" + "\n" +
-		"{{.PlanSummary}}" +
-		"{{ if .HasDiverged }}\n\n:warning: The branch we're merging into is ahead, it is recommended to pull new commits first.{{end}}"))
-
-var policyCheckSuccessUnwrappedTmpl = template.Must(template.New("").Parse(
-	"```diff\n" +
-		"{{.PolicyCheckOutput}}\n" +
-		"```\n\n" + policyCheckNextSteps +
-		"{{ if .HasDiverged }}\n\n:warning: The branch we're merging into is ahead, it is recommended to pull new commits first.{{end}}"))
-
-var policyCheckSuccessWrappedTmpl = template.Must(template.New("").Parse(
-	"<details><summary>Show Output</summary>\n\n" +
-		"```diff\n" +
-		"{{.PolicyCheckOutput}}\n" +
-		"```\n\n" +
-		policyCheckNextSteps + "\n" +
-		"</details>" +
-		"{{ if .HasDiverged }}\n\n:warning: The branch we're merging into is ahead, it is recommended to pull new commits first.{{end}}"))
-
-// policyCheckNextSteps are instructions appended after successful plans as to what
-// to do next.
-var policyCheckNextSteps = "* :arrow_forward: To **apply** this plan, comment:\n" +
-	"    * `{{.ApplyCmd}}`\n" +
-	"* :put_litter_in_its_place: To **delete** this plan click [here]({{.LockURL}})\n" +
-	"* :repeat: To re-run policies **plan** this project again by commenting:\n" +
-	"    * `{{.RePlanCmd}}`"
-
-// planNextSteps are instructions appended after successful plans as to what
-// to do next.
-var planNextSteps = "{{ if .PlanWasDeleted }}This plan was not saved because one or more projects failed and automerge requires all plans pass.{{ else }}" +
-	"{{ if not .DisableApply }}* :arrow_forward: To **apply** this plan, comment:\n" +
-	"    * `{{.ApplyCmd}}`\n{{end}}" +
-	"{{ if not .DisableRepoLocking }}* :put_litter_in_its_place: To **delete** this plan click [here]({{.LockURL}})\n{{end}}" +
-	"* :repeat: To **plan** this project again, comment:\n" +
-	"    * `{{.RePlanCmd}}`{{end}}"
-var applyUnwrappedSuccessTmpl = template.Must(template.New("").Parse(
-	"```diff\n" +
-		"{{.Output}}\n" +
-		"```"))
-var applyWrappedSuccessTmpl = template.Must(template.New("").Parse(
-	"<details><summary>Show Output</summary>\n\n" +
-		"```diff\n" +
-		"{{.Output}}\n" +
-		"```\n" +
-		"</details>"))
-var versionUnwrappedSuccessTmpl = template.Must(template.New("").Parse("```\n{{.Output}}```"))
-var versionWrappedSuccessTmpl = template.Must(template.New("").Parse(
-	"<details><summary>Show Output</summary>\n\n" +
-		"```\n" +
-		"{{.Output}}" +
-		"```\n" +
-		"</details>"))
-var unwrappedErrTmplText = "**{{.Command}} Error**\n" +
-	"```\n" +
-	"{{.Error}}\n" +
-	"```" +
-	"{{ if eq .Command \"Policy Check\" }}" +
-	"\n* :heavy_check_mark: To **approve** failing policies an authorized approver can comment:\n" +
-	"    * `atlantis approve_policies`\n" +
-	"* :repeat: Or, address the policy failure by modifying the codebase and re-planning.\n" +
-	"{{ end }}"
-var wrappedErrTmplText = "**{{.Command}} Error**\n" +
-	"<details><summary>Show Output</summary>\n\n" +
-	"```\n" +
-	"{{.Error}}\n" +
-	"```\n</details>"
-var unwrappedErrTmpl = template.Must(template.New("").Parse(unwrappedErrTmplText))
-var unwrappedErrWithLogTmpl = template.Must(template.New("").Parse(unwrappedErrTmplText + logTmpl))
-var wrappedErrTmpl = template.Must(template.New("").Parse(wrappedErrTmplText))
-var failureTmplText = "**{{.Command}} Failed**: {{.Failure}}"
-var failureTmpl = template.Must(template.New("").Parse(failureTmplText))
-var failureWithLogTmpl = template.Must(template.New("").Parse(failureTmplText + logTmpl))
-var logTmpl = "{{if .Verbose}}\n<details><summary>Log</summary>\n  <p>\n\n```\n{{.Log}}```\n</p></details>{{end}}\n"
diff --git a/server/events/markdown_renderer_test.go b/server/events/markdown_renderer_test.go
index 44d64ddcba..855423a75e 100644
--- a/server/events/markdown_renderer_test.go
+++ b/server/events/markdown_renderer_test.go
@@ -16,6 +16,7 @@ package events_test
 import (
 	"errors"
 	"fmt"
+	"os"
 	"strings"
 	"testing"
 
@@ -56,7 +57,7 @@ func TestRenderErr(t *testing.T) {
 		},
 	}
 
-	r := events.MarkdownRenderer{}
+	r := events.GetMarkdownRenderer(false, false, false, false, false, false, "")
 	for _, c := range cases {
 		res := command.Result{
 			Error: c.Error,
@@ -101,7 +102,7 @@ func TestRenderFailure(t *testing.T) {
 		},
 	}
 
-	r := events.MarkdownRenderer{}
+	r := events.GetMarkdownRenderer(false, false, false, false, false, false, "")
 	for _, c := range cases {
 		res := command.Result{
 			Failure: c.Failure,
@@ -120,7 +121,7 @@ func TestRenderFailure(t *testing.T) {
 }
 
 func TestRenderErrAndFailure(t *testing.T) {
-	r := events.MarkdownRenderer{}
+	r := events.GetMarkdownRenderer(false, false, false, false, false, false, "")
 	res := command.Result{
 		Error:   errors.New("error"),
 		Failure: "failure",
@@ -180,7 +181,7 @@ $$$
 `,
 		},
 		{
-			"single successful plan with master ahead",
+			"single successful plan with main ahead",
 			command.Plan,
 			[]command.ProjectResult{
 				{
@@ -750,7 +751,7 @@ $$$
 		},
 	}
 
-	r := events.MarkdownRenderer{}
+	r := events.GetMarkdownRenderer(false, false, false, false, false, false, "")
 	for _, c := range cases {
 		t.Run(c.Description, func(t *testing.T) {
 			res := command.Result{
@@ -901,9 +902,15 @@ $$$
 `,
 		},
 	}
-	r := events.MarkdownRenderer{
-		DisableApplyAll: true,
-	}
+	r := events.GetMarkdownRenderer(
+		false, // GitlabSupportsCommonMark
+		true,  // DisableApplyAll
+		false, // DisableApply
+		false, // DisableMarkdownFolding
+		false, // DisableRepoLocking
+		false, // EnableDiffMarkdownFormat
+		"",    // MarkdownTemplateOverridesDir
+	)
 	for _, c := range cases {
 		t.Run(c.Description, func(t *testing.T) {
 			res := command.Result{
@@ -1046,10 +1053,16 @@ $$$
 `,
 		},
 	}
-	r := events.MarkdownRenderer{
-		DisableApplyAll: true,
-		DisableApply:    true,
-	}
+
+	r := events.GetMarkdownRenderer(
+		false, // GitlabSupportsCommonMark
+		true,  // DisableApplyAll
+		true,  // DisableApply
+		false, // DisableMarkdownFolding
+		false, // DisableRepoLocking
+		false, // EnableDiffMarkdownFormat
+		"",    // MarkdownTemplateOverridesDir
+	)
 	for _, c := range cases {
 		t.Run(c.Description, func(t *testing.T) {
 			res := command.Result{
@@ -1070,11 +1083,54 @@ $$$
 	}
 }
 
+// Run policy check with a custom template to validate custom template rendering.
+func TestRenderCustomPolicyCheckTemplate_DisableApplyAll(t *testing.T) {
+	tmpDir := t.TempDir()
+	filePath := fmt.Sprintf("%s/templates.tmpl", tmpDir)
+	_, err := os.Create(filePath)
+	Ok(t, err)
+	err = os.WriteFile(filePath, []byte("{{ define \"policyCheckSuccessUnwrapped\" -}}somecustometext{{- end}}\n"), 0600)
+	Ok(t, err)
+	r := events.GetMarkdownRenderer(
+		false,  // GitlabSupportsCommonMark
+		true,   // DisableApplyAll
+		true,   // DisableApply
+		false,  // DisableMarkdownFolding
+		false,  // DisableRepoLocking
+		false,  // EnableDiffMarkdownFormat
+		tmpDir, // MarkdownTemplateOverridesDir
+	)
+
+	rendered := r.Render(command.Result{
+		ProjectResults: []command.ProjectResult{
+			{
+				Workspace:  "workspace",
+				RepoRelDir: "path",
+				PolicyCheckSuccess: &models.PolicyCheckSuccess{
+					PolicyCheckOutput: "4 tests, 4 passed, 0 warnings, 0 failures, 0 exceptions",
+					LockURL:           "lock-url",
+					ApplyCmd:          "atlantis apply -d path -w workspace",
+					RePlanCmd:         "atlantis plan -d path -w workspace",
+				},
+			},
+		},
+	}, command.PolicyCheck, "log", false, models.Github)
+	fmt.Println(rendered)
+	Equals(t, rendered, "Ran Policy Check for dir: `path` workspace: `workspace`\n\nsomecustometext\n\n\n")
+
+}
+
 // Test that if folding is disabled that it's not used.
 func TestRenderProjectResults_DisableFolding(t *testing.T) {
-	mr := events.MarkdownRenderer{
-		DisableMarkdownFolding: true,
-	}
+	mr := events.GetMarkdownRenderer(
+		false, // GitlabSupportsCommonMark
+		false, // DisableApplyAll
+		false, // DisableApply
+		true,  // DisableMarkdownFolding
+		false, // DisableRepoLocking
+		false, // EnableDiffMarkdownFormat
+		"",    // MarkdownTemplateOverridesDir
+	)
 
 	rendered := mr.Render(command.Result{
 		ProjectResults: []command.ProjectResult{
@@ -1156,9 +1212,15 @@ func TestRenderProjectResults_WrappedErr(t *testing.T) {
 	for _, c := range cases {
 		t.Run(fmt.Sprintf("%s_%v", c.VCSHost.String(), c.ShouldWrap),
 			func(t *testing.T) {
-				mr := events.MarkdownRenderer{
-					GitlabSupportsCommonMark: c.GitlabCommonMarkSupport,
-				}
+				mr := events.GetMarkdownRenderer(
+					c.GitlabCommonMarkSupport, // GitlabSupportsCommonMark
+					false,                     // DisableApplyAll
+					false,                     // DisableApply
+					false,                     // DisableMarkdownFolding
+					false,                     // DisableRepoLocking
+					false,                     // EnableDiffMarkdownFormat
+					"",                        // MarkdownTemplateOverridesDir
+				)
 
 				rendered := mr.Render(command.Result{
 					ProjectResults: []command.ProjectResult{
@@ -1268,9 +1330,15 @@ func TestRenderProjectResults_WrapSingleProject(t *testing.T) {
 		for _, cmd := range []command.Name{command.Plan, command.Apply} {
 			t.Run(fmt.Sprintf("%s_%s_%v", c.VCSHost.String(), cmd.String(), c.ShouldWrap),
 				func(t *testing.T) {
-					mr := events.MarkdownRenderer{
-						GitlabSupportsCommonMark: c.GitlabCommonMarkSupport,
-					}
+					mr := events.GetMarkdownRenderer(
+						c.GitlabCommonMarkSupport, // GitlabSupportsCommonMark
+						false,                     // DisableApplyAll
+						false,                     // DisableApply
+						false,                     // DisableMarkdownFolding
+						false,                     // DisableRepoLocking
+						false,                     // EnableDiffMarkdownFormat
+						"",                        // MarkdownTemplateOverridesDir
+					)
 					var pr command.ProjectResult
 					switch cmd {
 					case command.Plan:
@@ -1373,7 +1441,15 @@ $$$
 }
 
 func TestRenderProjectResults_MultiProjectApplyWrapped(t *testing.T) {
-	mr := events.MarkdownRenderer{}
+	mr := events.GetMarkdownRenderer(
+		false, // GitlabSupportsCommonMark
+		false, // DisableApplyAll
+		false, // DisableApply
+		false, // DisableMarkdownFolding
+		false, // DisableRepoLocking
+		false, // EnableDiffMarkdownFormat
+		"",    // MarkdownTemplateOverridesDir
+	)
 	tfOut := strings.Repeat("line\n", 13)
 	rendered := mr.Render(command.Result{
 		ProjectResults: []command.ProjectResult{
@@ -1419,7 +1495,15 @@ $$$
 }
 
 func TestRenderProjectResults_MultiProjectPlanWrapped(t *testing.T) {
-	mr := events.MarkdownRenderer{}
+	mr := events.GetMarkdownRenderer(
+		false, // GitlabSupportsCommonMark
+		false, // DisableApplyAll
+		false, // DisableApply
+		false, // DisableMarkdownFolding
+		false, // DisableRepoLocking
+		false, // EnableDiffMarkdownFormat
+		"",    // MarkdownTemplateOverridesDir
+	)
 	tfOut := strings.Repeat("line\n", 13) + "Plan: 1 to add, 0 to change, 0 to destroy."
 	rendered := mr.Render(command.Result{
 		ProjectResults: []command.ProjectResult{
@@ -1592,7 +1676,15 @@ This plan was not saved because one or more projects failed and automerge requir
 
 	for name, c := range cases {
 		t.Run(name, func(t *testing.T) {
-			mr := events.MarkdownRenderer{}
+			mr := events.GetMarkdownRenderer(
+				false, // GitlabSupportsCommonMark
+				false, // DisableApplyAll
+				false, // DisableApply
+				false, // DisableMarkdownFolding
+				false, // DisableRepoLocking
+				false, // EnableDiffMarkdownFormat
+				"",    // MarkdownTemplateOverridesDir
+			)
 			rendered := mr.Render(c.cr, command.Plan, "log", false, models.Github)
 			expWithBackticks := strings.Replace(c.exp, "$", "`", -1)
 			Equals(t, expWithBackticks, rendered)
@@ -1651,7 +1743,7 @@ $$$
 `,
 		},
 		{
-			"single successful plan with master ahead",
+			"single successful plan with main ahead",
 			command.Plan,
 			[]command.ProjectResult{
 				{
@@ -2052,7 +2144,15 @@ $$$
 		},
 	}
 
-	r := events.MarkdownRenderer{}
+	r := events.GetMarkdownRenderer(
+		false, // GitlabSupportsCommonMark
+		false, // DisableApplyAll
+		false, // DisableApply
+		false, // DisableMarkdownFolding
+		false, // DisableRepoLocking
+		false, // EnableDiffMarkdownFormat
+		"",    // MarkdownTemplateOverridesDir
+	)
 	r.DisableRepoLocking = true
 	for _, c := range cases {
 		t.Run(c.Description, func(t *testing.T) {
@@ -2222,7 +2322,41 @@ Terraform will perform the following actions:
       ]
     }
 
-Plan: 1 to add, 1 to change, 1 to destroy.
+# aws_api_gateway_rest_api.rest_api will be updated in-place
+~ resource "aws_api_gateway_rest_api" "rest_api" {
+    ~ body                         = <<-EOT
+          openapi: 3.0.0
+          security:
+            - SomeAuth: []
+          paths:
+            /someEndpoint:
+              get:
+        -       operationId: someOperation
+        +       operationId: someOperation2
+                responses:
+                  204:
+                    description: Empty response.
+          components:
+            schemas:
+              SomeEnum:
+                type: string
+                enum:
+                  - value1
+                  - value2
+            securitySchemes:
+              SomeAuth:
+                type: apiKey
+                in: header
+                name: Authorization
+      EOT
+      id                           = "4i5suz5c4l"
+      name                         = "test"
+      tags                         = {}
+      # (9 unchanged attributes hidden)
+      # (1 unchanged block hidden)
+  }
+
+Plan: 1 to add, 2 to change, 1 to destroy.
 `
 	cases := []struct {
 		Description    string
@@ -2399,7 +2533,41 @@ Terraform will perform the following actions:
       ]
     }
 
-Plan: 1 to add, 1 to change, 1 to destroy.
+# aws_api_gateway_rest_api.rest_api will be updated in-place
+! resource "aws_api_gateway_rest_api" "rest_api" {
+!     body                         = <<-EOT
+          openapi: 3.0.0
+          security:
+            - SomeAuth: []
+          paths:
+            /someEndpoint:
+              get:
+-               operationId: someOperation
++               operationId: someOperation2
+                responses:
+                  204:
+                    description: Empty response.
+          components:
+            schemas:
+              SomeEnum:
+                type: string
+                enum:
+                  - value1
+                  - value2
+            securitySchemes:
+              SomeAuth:
+                type: apiKey
+                in: header
+                name: Authorization
+      EOT
+      id                           = "4i5suz5c4l"
+      name                         = "test"
+      tags                         = {}
+      # (9 unchanged attributes hidden)
+      # (1 unchanged block hidden)
+  }
+
+Plan: 1 to add, 2 to change, 1 to destroy.
 
 $$$
 
@@ -2407,17 +2575,22 @@ $$$
 * :repeat: To **plan** this project again, comment:
     * $atlantis plan -d path -w workspace$
 </details>
-Plan: 1 to add, 1 to change, 1 to destroy.
+Plan: 1 to add, 2 to change, 1 to destroy.
 
 
 `,
 		},
 	}
-	r := events.MarkdownRenderer{
-		DisableApplyAll:          true,
-		DisableApply:             true,
-		EnableDiffMarkdownFormat: true,
-	}
+	r := events.GetMarkdownRenderer(
+		false, // GitlabSupportsCommonMark
+		true,  // DisableApplyAll
+		true,  // DisableApply
+		false, // DisableMarkdownFolding
+		false, // DisableRepoLocking
+		true,  // EnableDiffMarkdownFormat
+		"",    // MarkdownTemplateOverridesDir
+	)
+
 	for _, c := range cases {
 		t.Run(c.Description, func(t *testing.T) {
 			res := command.Result{
diff --git a/server/events/mocks/mock_post_workflows_hooks_command_runner.go b/server/events/mocks/mock_post_workflows_hooks_command_runner.go
index 9ff923e419..8bfcde7ac2 100644
--- a/server/events/mocks/mock_post_workflows_hooks_command_runner.go
+++ b/server/events/mocks/mock_post_workflows_hooks_command_runner.go
@@ -8,7 +8,8 @@ import (
 	"time"
 
 	pegomock "github.com/petergtz/pegomock"
-	"github.com/runatlantis/atlantis/server/events/command"
+	events "github.com/runatlantis/atlantis/server/events"
+	command "github.com/runatlantis/atlantis/server/events/command"
 )
 
 type MockPostWorkflowHooksCommandRunner struct {
@@ -28,11 +29,11 @@ func (mock *MockPostWorkflowHooksCommandRunner) SetFailHandler(fh pegomock.FailH
 }
 func (mock *MockPostWorkflowHooksCommandRunner) FailHandler() pegomock.FailHandler { return mock.fail }
 
-func (mock *MockPostWorkflowHooksCommandRunner) RunPostHooks(ctx *command.Context) error {
+func (mock *MockPostWorkflowHooksCommandRunner) RunPostHooks(ctx *command.Context, cmd *events.CommentCommand) error {
 	if mock == nil {
 		panic("mock must not be nil. Use myMock := NewMockPostWorkflowHooksCommandRunner().")
 	}
-	params := []pegomock.Param{ctx}
+	params := []pegomock.Param{ctx, cmd}
 	result := pegomock.GetGenericMockFrom(mock).Invoke("RunPostHooks", params, []reflect.Type{reflect.TypeOf((*error)(nil)).Elem()})
 	var ret0 error
 	if len(result) != 0 {
@@ -80,8 +81,8 @@ type VerifierMockPostWorkflowHooksCommandRunner struct {
 	timeout                time.Duration
 }
 
-func (verifier *VerifierMockPostWorkflowHooksCommandRunner) RunPostHooks(ctx *command.Context) *MockPostWorkflowHooksCommandRunner_RunPostHooks_OngoingVerification {
-	params := []pegomock.Param{ctx}
+func (verifier *VerifierMockPostWorkflowHooksCommandRunner) RunPostHooks(ctx *command.Context, cmd *events.CommentCommand) *MockPostWorkflowHooksCommandRunner_RunPostHooks_OngoingVerification {
+	params := []pegomock.Param{ctx, cmd}
 	methodInvocations := pegomock.GetGenericMockFrom(verifier.mock).Verify(verifier.inOrderContext, verifier.invocationCountMatcher, "RunPostHooks", params, verifier.timeout)
 	return &MockPostWorkflowHooksCommandRunner_RunPostHooks_OngoingVerification{mock: verifier.mock, methodInvocations: methodInvocations}
 }
@@ -91,18 +92,22 @@ type MockPostWorkflowHooksCommandRunner_RunPostHooks_OngoingVerification struct
 	methodInvocations []pegomock.MethodInvocation
 }
 
-func (c *MockPostWorkflowHooksCommandRunner_RunPostHooks_OngoingVerification) GetCapturedArguments() *command.Context {
-	ctx := c.GetAllCapturedArguments()
-	return ctx[len(ctx)-1]
+func (c *MockPostWorkflowHooksCommandRunner_RunPostHooks_OngoingVerification) GetCapturedArguments() (*command.Context, *events.CommentCommand) {
+	ctx, cmd := c.GetAllCapturedArguments()
+	return ctx[len(ctx)-1], cmd[len(cmd)-1]
 }
 
-func (c *MockPostWorkflowHooksCommandRunner_RunPostHooks_OngoingVerification) GetAllCapturedArguments() (_param0 []*command.Context) {
+func (c *MockPostWorkflowHooksCommandRunner_RunPostHooks_OngoingVerification) GetAllCapturedArguments() (_param0 []*command.Context, _param1 []*events.CommentCommand) {
 	params := pegomock.GetGenericMockFrom(c.mock).GetInvocationParams(c.methodInvocations)
 	if len(params) > 0 {
 		_param0 = make([]*command.Context, len(c.methodInvocations))
 		for u, param := range params[0] {
 			_param0[u] = param.(*command.Context)
 		}
+		_param1 = make([]*events.CommentCommand, len(c.methodInvocations))
+		for u, param := range params[1] {
+			_param1[u] = param.(*events.CommentCommand)
+		}
 	}
 	return
 }
diff --git a/server/events/mocks/mock_pre_workflows_hooks_command_runner.go b/server/events/mocks/mock_pre_workflows_hooks_command_runner.go
index 9c3cb33167..22599a02e3 100644
--- a/server/events/mocks/mock_pre_workflows_hooks_command_runner.go
+++ b/server/events/mocks/mock_pre_workflows_hooks_command_runner.go
@@ -8,6 +8,7 @@ import (
 	"time"
 
 	pegomock "github.com/petergtz/pegomock"
+	events "github.com/runatlantis/atlantis/server/events"
 	command "github.com/runatlantis/atlantis/server/events/command"
 )
 
@@ -28,11 +29,11 @@ func (mock *MockPreWorkflowHooksCommandRunner) SetFailHandler(fh pegomock.FailHa
 }
 func (mock *MockPreWorkflowHooksCommandRunner) FailHandler() pegomock.FailHandler { return mock.fail }
 
-func (mock *MockPreWorkflowHooksCommandRunner) RunPreHooks(ctx *command.Context) error {
+func (mock *MockPreWorkflowHooksCommandRunner) RunPreHooks(ctx *command.Context, cmd *events.CommentCommand) error {
 	if mock == nil {
 		panic("mock must not be nil. Use myMock := NewMockPreWorkflowHooksCommandRunner().")
 	}
-	params := []pegomock.Param{ctx}
+	params := []pegomock.Param{ctx, cmd}
 	result := pegomock.GetGenericMockFrom(mock).Invoke("RunPreHooks", params, []reflect.Type{reflect.TypeOf((*error)(nil)).Elem()})
 	var ret0 error
 	if len(result) != 0 {
@@ -80,8 +81,8 @@ type VerifierMockPreWorkflowHooksCommandRunner struct {
 	timeout                time.Duration
 }
 
-func (verifier *VerifierMockPreWorkflowHooksCommandRunner) RunPreHooks(ctx *command.Context) *MockPreWorkflowHooksCommandRunner_RunPreHooks_OngoingVerification {
-	params := []pegomock.Param{ctx}
+func (verifier *VerifierMockPreWorkflowHooksCommandRunner) RunPreHooks(ctx *command.Context, cmd *events.CommentCommand) *MockPreWorkflowHooksCommandRunner_RunPreHooks_OngoingVerification {
+	params := []pegomock.Param{ctx, cmd}
 	methodInvocations := pegomock.GetGenericMockFrom(verifier.mock).Verify(verifier.inOrderContext, verifier.invocationCountMatcher, "RunPreHooks", params, verifier.timeout)
 	return &MockPreWorkflowHooksCommandRunner_RunPreHooks_OngoingVerification{mock: verifier.mock, methodInvocations: methodInvocations}
 }
@@ -91,18 +92,22 @@ type MockPreWorkflowHooksCommandRunner_RunPreHooks_OngoingVerification struct {
 	methodInvocations []pegomock.MethodInvocation
 }
 
-func (c *MockPreWorkflowHooksCommandRunner_RunPreHooks_OngoingVerification) GetCapturedArguments() *command.Context {
-	ctx := c.GetAllCapturedArguments()
-	return ctx[len(ctx)-1]
+func (c *MockPreWorkflowHooksCommandRunner_RunPreHooks_OngoingVerification) GetCapturedArguments() (*command.Context, *events.CommentCommand) {
+	ctx, cmd := c.GetAllCapturedArguments()
+	return ctx[len(ctx)-1], cmd[len(cmd)-1]
 }
 
-func (c *MockPreWorkflowHooksCommandRunner_RunPreHooks_OngoingVerification) GetAllCapturedArguments() (_param0 []*command.Context) {
+func (c *MockPreWorkflowHooksCommandRunner_RunPreHooks_OngoingVerification) GetAllCapturedArguments() (_param0 []*command.Context, _param1 []*events.CommentCommand) {
 	params := pegomock.GetGenericMockFrom(c.mock).GetInvocationParams(c.methodInvocations)
 	if len(params) > 0 {
 		_param0 = make([]*command.Context, len(c.methodInvocations))
 		for u, param := range params[0] {
 			_param0[u] = param.(*command.Context)
 		}
+		_param1 = make([]*events.CommentCommand, len(c.methodInvocations))
+		for u, param := range params[1] {
+			_param1[u] = param.(*events.CommentCommand)
+		}
 	}
 	return
 }
diff --git a/server/events/models/models.go b/server/events/models/models.go
index 9db5751fb8..077a36bceb 100644
--- a/server/events/models/models.go
+++ b/server/events/models/models.go
@@ -384,7 +384,7 @@ func (p *PlanSuccess) Summary() string {
 
 // DiffMarkdownFormattedTerraformOutput formats the Terraform output to match diff markdown format
 func (p PlanSuccess) DiffMarkdownFormattedTerraformOutput() string {
-	diffKeywordRegex := regexp.MustCompile(`(?m)^( +)([-+~]\s)(.*)(\s=\s|\s->\s|<<|\{|\(known after apply\)|\[)(.*)`)
+	diffKeywordRegex := regexp.MustCompile(`(?m)^( +)([-+~]\s)(.*)(\s=\s|\s->\s|<<|\{|\(known after apply\)| {2,}[^ ]+:.*)(.*)`)
 	diffListRegex := regexp.MustCompile(`(?m)^( +)([-+~]\s)(".*",)`)
 	diffTildeRegex := regexp.MustCompile(`(?m)^~`)
 
@@ -411,6 +411,17 @@ type PolicyCheckSuccess struct {
 	HasDiverged bool
 }
 
+// Summary extracts one line summary of policy check.
+func (p *PolicyCheckSuccess) Summary() string {
+	note := ""
+
+	r := regexp.MustCompile(`\d+ tests, \d+ passed, \d+ warnings, \d+ failures, \d+ exceptions`)
+	if match := r.FindString(p.PolicyCheckOutput); match != "" {
+		return note + match
+	}
+	return note
+}
+
 type VersionSuccess struct {
 	VersionOutput string
 }
@@ -510,6 +521,11 @@ type WorkflowHookCommandContext struct {
 	User User
 	// Verbose is true when the user would like verbose output.
 	Verbose bool
+	// EscapedCommentArgs are the extra arguments that were added to the atlantis
+	// command, ex. atlantis plan -- -target=resource. We then escape them
+	// by adding a \ before each character so that they can be used within
+	// sh -c safely, i.e. sh -c "terraform plan $(touch bad)".
+	EscapedCommentArgs []string
 }
 
 type EnqueueStatusType int
diff --git a/server/events/models/models_test.go b/server/events/models/models_test.go
index 7aea621b28..1ebd555ea1 100644
--- a/server/events/models/models_test.go
+++ b/server/events/models/models_test.go
@@ -354,6 +354,17 @@ func TestAzureDevopsSplitRepoFullName(t *testing.T) {
 		})
 	}
 }
+
+func TestPolicyCheckSuccess_Summary(t *testing.T) {
+	pcs := models.PolicyCheckSuccess{
+		PolicyCheckOutput: `WARN - <redacted plan file> - main - example main package
+
+20 tests, 19 passed, 1 warnings, 0 failures, 0 exceptions`,
+	}
+
+	Equals(t, "20 tests, 19 passed, 1 warnings, 0 failures, 0 exceptions", pcs.Summary())
+}
+
 func TestPullStatus_StatusCount(t *testing.T) {
 	ps := models.PullStatus{
 		Projects: []models.ProjectStatus{
diff --git a/server/events/pending_plan_finder_test.go b/server/events/pending_plan_finder_test.go
index 7393e571fb..1d7027c2bb 100644
--- a/server/events/pending_plan_finder_test.go
+++ b/server/events/pending_plan_finder_test.go
@@ -185,8 +185,7 @@ func TestPendingPlanFinder_Find(t *testing.T) {
 	pf := &events.DefaultPendingPlanFinder{}
 	for _, c := range cases {
 		t.Run(c.description, func(t *testing.T) {
-			tmpDir, cleanup := DirStructure(t, c.files)
-			defer cleanup()
+			tmpDir := DirStructure(t, c.files)
 
 			// Create a git repo in each workspace directory.
 			for dirname, contents := range c.files {
@@ -212,12 +211,11 @@ func TestPendingPlanFinder_Find(t *testing.T) {
 
 // If a planfile is checked in to git, we shouldn't use it.
 func TestPendingPlanFinder_FindPlanCheckedIn(t *testing.T) {
-	tmpDir, cleanup := DirStructure(t, map[string]interface{}{
+	tmpDir := DirStructure(t, map[string]interface{}{
 		"default": map[string]interface{}{
 			"default.tfplan": nil,
 		},
 	})
-	defer cleanup()
 
 	// Add that file to git.
 	repoDir := filepath.Join(tmpDir, "default")
@@ -247,9 +245,7 @@ func TestPendingPlanFinder_DeletePlans(t *testing.T) {
 			},
 		},
 	}
-	tmp, cleanup := DirStructure(t,
-		files)
-	defer cleanup()
+	tmp := DirStructure(t, files)
 
 	// Create a git repo in each workspace directory.
 	for dirname, contents := range files {
diff --git a/server/events/plan_command_runner.go b/server/events/plan_command_runner.go
index 0624f593d1..9dcfb43865 100644
--- a/server/events/plan_command_runner.go
+++ b/server/events/plan_command_runner.go
@@ -206,7 +206,7 @@ func (p *PlanCommandRunner) run(ctx *command.Context, cmd *CommentCommand) {
 	// Only run commands in parallel if enabled
 	var result command.Result
 	if p.isParallelEnabled(projectCmds) {
-		ctx.Log.Info("Running applies in parallel")
+		ctx.Log.Info("Running plans in parallel")
 		result = runProjectCmdsParallelGroups(projectCmds, p.prjCmdRunner.Plan, p.parallelPoolSize)
 	} else {
 		result = runProjectCmds(projectCmds, p.prjCmdRunner.Plan)
diff --git a/server/events/policy_check_command_runner.go b/server/events/policy_check_command_runner.go
index f82470b923..c0283aae3e 100644
--- a/server/events/policy_check_command_runner.go
+++ b/server/events/policy_check_command_runner.go
@@ -12,6 +12,7 @@ func NewPolicyCheckCommandRunner(
 	projectCommandRunner ProjectPolicyCheckCommandRunner,
 	parallelPoolSize int,
 	silenceVCSStatusNoProjects bool,
+	quietPolicyChecks bool,
 ) *PolicyCheckCommandRunner {
 	return &PolicyCheckCommandRunner{
 		dbUpdater:                  dbUpdater,
@@ -20,6 +21,7 @@ func NewPolicyCheckCommandRunner(
 		prjCmdRunner:               projectCommandRunner,
 		parallelPoolSize:           parallelPoolSize,
 		silenceVCSStatusNoProjects: silenceVCSStatusNoProjects,
+		quietPolicyChecks:          quietPolicyChecks,
 	}
 }
 
@@ -32,6 +34,7 @@ type PolicyCheckCommandRunner struct {
 	// SilenceVCSStatusNoProjects is whether any plan should set commit status if no projects
 	// are found
 	silenceVCSStatusNoProjects bool
+	quietPolicyChecks          bool
 }
 
 func (p *PolicyCheckCommandRunner) Run(ctx *command.Context, cmds []command.ProjectContext) {
@@ -62,7 +65,10 @@ func (p *PolicyCheckCommandRunner) Run(ctx *command.Context, cmds []command.Proj
 		result = runProjectCmds(cmds, p.prjCmdRunner.PolicyCheck)
 	}
 
-	p.pullUpdater.updatePull(ctx, PolicyCheckCommand{}, result)
+	// Quiet policy checks unless there's an error
+	if result.HasErrors() || !p.quietPolicyChecks {
+		p.pullUpdater.updatePull(ctx, PolicyCheckCommand{}, result)
+	}
 
 	pullStatus, err := p.dbUpdater.updateDB(ctx, ctx.Pull, result.ProjectResults)
 	if err != nil {
diff --git a/server/events/post_workflow_hooks_command_runner.go b/server/events/post_workflow_hooks_command_runner.go
index 83c520cfdc..3be4a99273 100644
--- a/server/events/post_workflow_hooks_command_runner.go
+++ b/server/events/post_workflow_hooks_command_runner.go
@@ -11,7 +11,7 @@ import (
 //go:generate pegomock generate -m --use-experimental-model-gen --package mocks -o mocks/mock_post_workflows_hooks_command_runner.go PostWorkflowHooksCommandRunner
 
 type PostWorkflowHooksCommandRunner interface {
-	RunPostHooks(ctx *command.Context) error
+	RunPostHooks(ctx *command.Context, cmd *CommentCommand) error
 }
 
 // DefaultPostWorkflowHooksCommandRunner is the first step when processing a workflow hook commands.
@@ -25,7 +25,7 @@ type DefaultPostWorkflowHooksCommandRunner struct {
 
 // RunPostHooks runs post_workflow_hooks after a plan/apply has completed
 func (w *DefaultPostWorkflowHooksCommandRunner) RunPostHooks(
-	ctx *command.Context,
+	ctx *command.Context, cmd *CommentCommand,
 ) error {
 	pull := ctx.Pull
 	baseRepo := pull.BaseRepo
@@ -59,14 +59,20 @@ func (w *DefaultPostWorkflowHooksCommandRunner) RunPostHooks(
 		return err
 	}
 
+	var escapedArgs []string
+	if cmd != nil {
+		escapedArgs = escapeArgs(cmd.Flags)
+	}
+
 	err = w.runHooks(
 		models.WorkflowHookCommandContext{
-			BaseRepo: baseRepo,
-			HeadRepo: headRepo,
-			Log:      log,
-			Pull:     pull,
-			User:     user,
-			Verbose:  false,
+			BaseRepo:           baseRepo,
+			HeadRepo:           headRepo,
+			Log:                log,
+			Pull:               pull,
+			User:               user,
+			Verbose:            false,
+			EscapedCommentArgs: escapedArgs,
 		},
 		postWorkflowHooks, repoDir)
 
diff --git a/server/events/post_workflow_hooks_command_runner_test.go b/server/events/post_workflow_hooks_command_runner_test.go
index a7ba9d8e4c..717b4de3e5 100644
--- a/server/events/post_workflow_hooks_command_runner_test.go
+++ b/server/events/post_workflow_hooks_command_runner_test.go
@@ -94,7 +94,7 @@ func TestRunPostHooks_Clone(t *testing.T) {
 		When(postWhWorkingDir.Clone(log, fixtures.GithubRepo, newPull, events.DefaultWorkspace)).ThenReturn(repoDir, false, nil)
 		When(whPostWorkflowHookRunner.Run(pCtx, testHook.RunCommand, repoDir)).ThenReturn(result, nil)
 
-		err := postWh.RunPostHooks(ctx)
+		err := postWh.RunPostHooks(ctx, nil)
 
 		Ok(t, err)
 		whPostWorkflowHookRunner.VerifyWasCalledOnce().Run(pCtx, testHook.RunCommand, repoDir)
@@ -121,7 +121,7 @@ func TestRunPostHooks_Clone(t *testing.T) {
 
 		postWh.GlobalCfg = globalCfg
 
-		err := postWh.RunPostHooks(ctx)
+		err := postWh.RunPostHooks(ctx, nil)
 
 		Ok(t, err)
 
@@ -147,7 +147,7 @@ func TestRunPostHooks_Clone(t *testing.T) {
 
 		When(postWhWorkingDirLocker.TryLock(fixtures.GithubRepo.FullName, newPull.Num, events.DefaultWorkspace, events.DefaultRepoRelDir)).ThenReturn(func() {}, errors.New("some error"))
 
-		err := postWh.RunPostHooks(ctx)
+		err := postWh.RunPostHooks(ctx, nil)
 
 		Assert(t, err != nil, "error not nil")
 		postWhWorkingDir.VerifyWasCalled(Never()).Clone(log, fixtures.GithubRepo, newPull, events.DefaultWorkspace)
@@ -178,7 +178,7 @@ func TestRunPostHooks_Clone(t *testing.T) {
 		When(postWhWorkingDirLocker.TryLock(fixtures.GithubRepo.FullName, newPull.Num, events.DefaultWorkspace, events.DefaultRepoRelDir)).ThenReturn(unlockFn, nil)
 		When(postWhWorkingDir.Clone(log, fixtures.GithubRepo, newPull, events.DefaultWorkspace)).ThenReturn(repoDir, false, errors.New("some error"))
 
-		err := postWh.RunPostHooks(ctx)
+		err := postWh.RunPostHooks(ctx, nil)
 
 		Assert(t, err != nil, "error not nil")
 
@@ -211,9 +211,48 @@ func TestRunPostHooks_Clone(t *testing.T) {
 		When(postWhWorkingDir.Clone(log, fixtures.GithubRepo, newPull, events.DefaultWorkspace)).ThenReturn(repoDir, false, nil)
 		When(whPostWorkflowHookRunner.Run(pCtx, testHook.RunCommand, repoDir)).ThenReturn(result, errors.New("some error"))
 
-		err := postWh.RunPostHooks(ctx)
+		err := postWh.RunPostHooks(ctx, nil)
 
 		Assert(t, err != nil, "error not nil")
 		Assert(t, *unlockCalled == true, "unlock function called")
 	})
+
+	t.Run("comment args passed to webhooks", func(t *testing.T) {
+		postWorkflowHooksSetup(t)
+
+		unlockCalled := newBool(false)
+		unlockFn := func() {
+			unlockCalled = newBool(true)
+		}
+
+		globalCfg := valid.GlobalCfg{
+			Repos: []valid.Repo{
+				{
+					ID: fixtures.GithubRepo.ID(),
+					PostWorkflowHooks: []*valid.WorkflowHook{
+						&testHook,
+					},
+				},
+			},
+		}
+
+		cmd := &events.CommentCommand{
+			Flags: []string{"comment", "args"},
+		}
+
+		expectedCtx := pCtx
+		expectedCtx.EscapedCommentArgs = []string{"\\c\\o\\m\\m\\e\\n\\t", "\\a\\r\\g\\s"}
+
+		postWh.GlobalCfg = globalCfg
+
+		When(postWhWorkingDirLocker.TryLock(fixtures.GithubRepo.FullName, newPull.Num, events.DefaultWorkspace, events.DefaultRepoRelDir)).ThenReturn(unlockFn, nil)
+		When(postWhWorkingDir.Clone(log, fixtures.GithubRepo, newPull, events.DefaultWorkspace)).ThenReturn(repoDir, false, nil)
+		When(whPostWorkflowHookRunner.Run(pCtx, testHook.RunCommand, repoDir)).ThenReturn(result, nil)
+
+		err := postWh.RunPostHooks(ctx, cmd)
+
+		Ok(t, err)
+		whPostWorkflowHookRunner.VerifyWasCalledOnce().Run(expectedCtx, testHook.RunCommand, repoDir)
+		Assert(t, *unlockCalled == true, "unlock function called")
+	})
 }
diff --git a/server/events/pre_workflow_hooks_command_runner.go b/server/events/pre_workflow_hooks_command_runner.go
index 370703d68b..b5664bde0b 100644
--- a/server/events/pre_workflow_hooks_command_runner.go
+++ b/server/events/pre_workflow_hooks_command_runner.go
@@ -11,7 +11,7 @@ import (
 //go:generate pegomock generate -m --use-experimental-model-gen --package mocks -o mocks/mock_pre_workflows_hooks_command_runner.go PreWorkflowHooksCommandRunner
 
 type PreWorkflowHooksCommandRunner interface {
-	RunPreHooks(ctx *command.Context) error
+	RunPreHooks(ctx *command.Context, cmd *CommentCommand) error
 }
 
 // DefaultPreWorkflowHooksCommandRunner is the first step when processing a workflow hook commands.
@@ -24,9 +24,7 @@ type DefaultPreWorkflowHooksCommandRunner struct {
 }
 
 // RunPreHooks runs pre_workflow_hooks when PR is opened or updated.
-func (w *DefaultPreWorkflowHooksCommandRunner) RunPreHooks(
-	ctx *command.Context,
-) error {
+func (w *DefaultPreWorkflowHooksCommandRunner) RunPreHooks(ctx *command.Context, cmd *CommentCommand) error {
 	pull := ctx.Pull
 	baseRepo := pull.BaseRepo
 	headRepo := ctx.HeadRepo
@@ -59,14 +57,20 @@ func (w *DefaultPreWorkflowHooksCommandRunner) RunPreHooks(
 		return err
 	}
 
+	var escapedArgs []string
+	if cmd != nil {
+		escapedArgs = escapeArgs(cmd.Flags)
+	}
+
 	err = w.runHooks(
 		models.WorkflowHookCommandContext{
-			BaseRepo: baseRepo,
-			HeadRepo: headRepo,
-			Log:      log,
-			Pull:     pull,
-			User:     user,
-			Verbose:  false,
+			BaseRepo:           baseRepo,
+			HeadRepo:           headRepo,
+			Log:                log,
+			Pull:               pull,
+			User:               user,
+			Verbose:            false,
+			EscapedCommentArgs: escapedArgs,
 		},
 		preWorkflowHooks, repoDir)
 
diff --git a/server/events/pre_workflow_hooks_command_runner_test.go b/server/events/pre_workflow_hooks_command_runner_test.go
index 6b77b3257d..13034e50a3 100644
--- a/server/events/pre_workflow_hooks_command_runner_test.go
+++ b/server/events/pre_workflow_hooks_command_runner_test.go
@@ -97,7 +97,7 @@ func TestRunPreHooks_Clone(t *testing.T) {
 		When(preWhWorkingDir.Clone(log, fixtures.GithubRepo, newPull, events.DefaultWorkspace)).ThenReturn(repoDir, false, nil)
 		When(whPreWorkflowHookRunner.Run(pCtx, testHook.RunCommand, repoDir)).ThenReturn(result, nil)
 
-		err := preWh.RunPreHooks(ctx)
+		err := preWh.RunPreHooks(ctx, nil)
 
 		Ok(t, err)
 		whPreWorkflowHookRunner.VerifyWasCalledOnce().Run(pCtx, testHook.RunCommand, repoDir)
@@ -124,7 +124,7 @@ func TestRunPreHooks_Clone(t *testing.T) {
 
 		preWh.GlobalCfg = globalCfg
 
-		err := preWh.RunPreHooks(ctx)
+		err := preWh.RunPreHooks(ctx, nil)
 
 		Ok(t, err)
 
@@ -150,7 +150,7 @@ func TestRunPreHooks_Clone(t *testing.T) {
 
 		When(preWhWorkingDirLocker.TryLock(fixtures.GithubRepo.FullName, newPull.Num, events.DefaultWorkspace, events.DefaultRepoRelDir)).ThenReturn(func() {}, errors.New("some error"))
 
-		err := preWh.RunPreHooks(ctx)
+		err := preWh.RunPreHooks(ctx, nil)
 
 		Assert(t, err != nil, "error not nil")
 		preWhWorkingDir.VerifyWasCalled(Never()).Clone(log, fixtures.GithubRepo, newPull, events.DefaultWorkspace)
@@ -181,7 +181,7 @@ func TestRunPreHooks_Clone(t *testing.T) {
 		When(preWhWorkingDirLocker.TryLock(fixtures.GithubRepo.FullName, newPull.Num, events.DefaultWorkspace, events.DefaultRepoRelDir)).ThenReturn(unlockFn, nil)
 		When(preWhWorkingDir.Clone(log, fixtures.GithubRepo, newPull, events.DefaultWorkspace)).ThenReturn(repoDir, false, errors.New("some error"))
 
-		err := preWh.RunPreHooks(ctx)
+		err := preWh.RunPreHooks(ctx, nil)
 
 		Assert(t, err != nil, "error not nil")
 
@@ -214,9 +214,48 @@ func TestRunPreHooks_Clone(t *testing.T) {
 		When(preWhWorkingDir.Clone(log, fixtures.GithubRepo, newPull, events.DefaultWorkspace)).ThenReturn(repoDir, false, nil)
 		When(whPreWorkflowHookRunner.Run(pCtx, testHook.RunCommand, repoDir)).ThenReturn(result, errors.New("some error"))
 
-		err := preWh.RunPreHooks(ctx)
+		err := preWh.RunPreHooks(ctx, nil)
 
 		Assert(t, err != nil, "error not nil")
 		Assert(t, *unlockCalled == true, "unlock function called")
 	})
+
+	t.Run("comment args passed to webhooks", func(t *testing.T) {
+		preWorkflowHooksSetup(t)
+
+		var unlockCalled = newBool(false)
+		unlockFn := func() {
+			unlockCalled = newBool(true)
+		}
+
+		globalCfg := valid.GlobalCfg{
+			Repos: []valid.Repo{
+				{
+					ID: fixtures.GithubRepo.ID(),
+					PreWorkflowHooks: []*valid.WorkflowHook{
+						&testHook,
+					},
+				},
+			},
+		}
+
+		cmd := &events.CommentCommand{
+			Flags: []string{"comment", "args"},
+		}
+
+		expectedCtx := pCtx
+		expectedCtx.EscapedCommentArgs = []string{"\\c\\o\\m\\m\\e\\n\\t", "\\a\\r\\g\\s"}
+
+		preWh.GlobalCfg = globalCfg
+
+		When(preWhWorkingDirLocker.TryLock(fixtures.GithubRepo.FullName, newPull.Num, events.DefaultWorkspace, events.DefaultRepoRelDir)).ThenReturn(unlockFn, nil)
+		When(preWhWorkingDir.Clone(log, fixtures.GithubRepo, newPull, events.DefaultWorkspace)).ThenReturn(repoDir, false, nil)
+		When(whPreWorkflowHookRunner.Run(pCtx, testHook.RunCommand, repoDir)).ThenReturn(result, nil)
+
+		err := preWh.RunPreHooks(ctx, cmd)
+
+		Ok(t, err)
+		whPreWorkflowHookRunner.VerifyWasCalledOnce().Run(expectedCtx, testHook.RunCommand, repoDir)
+		Assert(t, *unlockCalled == true, "unlock function called")
+	})
 }
diff --git a/server/events/project_command_builder.go b/server/events/project_command_builder.go
index ed5c576bbe..a8af5669e7 100644
--- a/server/events/project_command_builder.go
+++ b/server/events/project_command_builder.go
@@ -225,7 +225,7 @@ func (p *DefaultProjectCommandBuilder) buildPlanAllCommands(ctx *command.Context
 		}
 
 		if hasRepoCfg {
-			repoCfg, err := p.ParserValidator.ParseRepoCfgData(repoCfgData, p.GlobalCfg, ctx.Pull.BaseRepo.ID())
+			repoCfg, err := p.ParserValidator.ParseRepoCfgData(repoCfgData, p.GlobalCfg, ctx.Pull.BaseRepo.ID(), ctx.Pull.BaseBranch)
 			if err != nil {
 				return nil, errors.Wrapf(err, "parsing %s", config.AtlantisYAMLFilename)
 			}
@@ -272,7 +272,7 @@ func (p *DefaultProjectCommandBuilder) buildPlanAllCommands(ctx *command.Context
 	if hasRepoCfg {
 		// If there's a repo cfg then we'll use it to figure out which projects
 		// should be planed.
-		repoCfg, err := p.ParserValidator.ParseRepoCfg(repoDir, p.GlobalCfg, ctx.Pull.BaseRepo.ID())
+		repoCfg, err := p.ParserValidator.ParseRepoCfg(repoDir, p.GlobalCfg, ctx.Pull.BaseRepo.ID(), ctx.Pull.BaseBranch)
 		if err != nil {
 			return nil, errors.Wrapf(err, "parsing %s", config.AtlantisYAMLFilename)
 		}
@@ -401,7 +401,7 @@ func (p *DefaultProjectCommandBuilder) getCfg(ctx *command.Context, projectName
 	}
 
 	var repoConfig valid.RepoCfg
-	repoConfig, err = p.ParserValidator.ParseRepoCfg(repoDir, p.GlobalCfg, ctx.Pull.BaseRepo.ID())
+	repoConfig, err = p.ParserValidator.ParseRepoCfg(repoDir, p.GlobalCfg, ctx.Pull.BaseRepo.ID(), ctx.Pull.BaseBranch)
 	if err != nil {
 		return
 	}
diff --git a/server/events/project_command_builder_internal_test.go b/server/events/project_command_builder_internal_test.go
index a8a0dc8473..cd83042216 100644
--- a/server/events/project_command_builder_internal_test.go
+++ b/server/events/project_command_builder_internal_test.go
@@ -579,7 +579,7 @@ projects:
 
 	for name, c := range cases {
 		t.Run(name, func(t *testing.T) {
-			tmp, cleanup := DirStructure(t, map[string]interface{}{
+			tmp := DirStructure(t, map[string]interface{}{
 				"project1": map[string]interface{}{
 					"main.tf": nil,
 				},
@@ -589,7 +589,6 @@ projects:
 					},
 				},
 			})
-			defer cleanup()
 
 			workingDir := NewMockWorkingDir()
 			When(workingDir.Clone(matchers.AnyPtrToLoggingSimpleLogger(), matchers.AnyModelsRepo(), matchers.AnyModelsPullRequest(), AnyString())).ThenReturn(tmp, false, nil)
@@ -784,7 +783,7 @@ projects:
 
 	for name, c := range cases {
 		t.Run(name, func(t *testing.T) {
-			tmp, cleanup := DirStructure(t, map[string]interface{}{
+			tmp := DirStructure(t, map[string]interface{}{
 				"project1": map[string]interface{}{
 					"main.tf": nil,
 				},
@@ -794,7 +793,6 @@ projects:
 					},
 				},
 			})
-			defer cleanup()
 
 			workingDir := NewMockWorkingDir()
 			When(workingDir.Clone(logging_matchers.AnyPtrToLoggingSimpleLogger(), matchers.AnyModelsRepo(), matchers.AnyModelsPullRequest(), AnyString())).ThenReturn(tmp, false, nil)
@@ -1009,7 +1007,7 @@ workflows:
 
 	for name, c := range cases {
 		t.Run(name, func(t *testing.T) {
-			tmp, cleanup := DirStructure(t, map[string]interface{}{
+			tmp := DirStructure(t, map[string]interface{}{
 				"project1": map[string]interface{}{
 					"main.tf": nil,
 				},
@@ -1019,7 +1017,6 @@ workflows:
 					},
 				},
 			})
-			defer cleanup()
 
 			workingDir := NewMockWorkingDir()
 			When(workingDir.Clone(matchers.AnyPtrToLoggingSimpleLogger(), matchers.AnyModelsRepo(), matchers.AnyModelsPullRequest(), AnyString())).ThenReturn(tmp, false, nil)
diff --git a/server/events/project_command_builder_test.go b/server/events/project_command_builder_test.go
index a28aa97b93..12bb03aad5 100644
--- a/server/events/project_command_builder_test.go
+++ b/server/events/project_command_builder_test.go
@@ -125,10 +125,9 @@ projects:
 	for _, c := range cases {
 		t.Run(c.Description, func(t *testing.T) {
 			RegisterMockTestingT(t)
-			tmpDir, cleanup := DirStructure(t, map[string]interface{}{
+			tmpDir := DirStructure(t, map[string]interface{}{
 				"main.tf": nil,
 			})
-			defer cleanup()
 
 			workingDir := mocks.NewMockWorkingDir()
 			When(workingDir.Clone(matchers.AnyPtrToLoggingSimpleLogger(), matchers.AnyModelsRepo(), matchers.AnyModelsPullRequest(), AnyString())).ThenReturn(tmpDir, false, nil)
@@ -392,10 +391,9 @@ projects:
 		for _, cmdName := range []command.Name{command.Plan, command.Apply} {
 			t.Run(c.Description+"_"+cmdName.String(), func(t *testing.T) {
 				RegisterMockTestingT(t)
-				tmpDir, cleanup := DirStructure(t, map[string]interface{}{
+				tmpDir := DirStructure(t, map[string]interface{}{
 					"main.tf": nil,
 				})
-				defer cleanup()
 
 				workingDir := mocks.NewMockWorkingDir()
 				When(workingDir.Clone(matchers.AnyPtrToLoggingSimpleLogger(), matchers.AnyModelsRepo(), matchers.AnyModelsPullRequest(), AnyString())).ThenReturn(tmpDir, false, nil)
@@ -549,8 +547,7 @@ projects:
 	for name, c := range cases {
 		t.Run(name, func(t *testing.T) {
 			RegisterMockTestingT(t)
-			tmpDir, cleanup := DirStructure(t, c.DirStructure)
-			defer cleanup()
+			tmpDir := DirStructure(t, c.DirStructure)
 
 			workingDir := mocks.NewMockWorkingDir()
 			When(workingDir.Clone(matchers.AnyPtrToLoggingSimpleLogger(), matchers.AnyModelsRepo(), matchers.AnyModelsPullRequest(), AnyString())).ThenReturn(tmpDir, false, nil)
@@ -616,7 +613,7 @@ projects:
 // In this case we should apply all outstanding plans.
 func TestDefaultProjectCommandBuilder_BuildMultiApply(t *testing.T) {
 	RegisterMockTestingT(t)
-	tmpDir, cleanup := DirStructure(t, map[string]interface{}{
+	tmpDir := DirStructure(t, map[string]interface{}{
 		"workspace1": map[string]interface{}{
 			"project1": map[string]interface{}{
 				"main.tf":          nil,
@@ -638,7 +635,6 @@ func TestDefaultProjectCommandBuilder_BuildMultiApply(t *testing.T) {
 			},
 		},
 	})
-	defer cleanup()
 	// Initialize git repos in each workspace so that the .tfplan files get
 	// picked up.
 	runCmd(t, filepath.Join(tmpDir, "workspace1"), "git", "init")
@@ -708,12 +704,11 @@ func TestDefaultProjectCommandBuilder_WrongWorkspaceName(t *testing.T) {
 	RegisterMockTestingT(t)
 	workingDir := mocks.NewMockWorkingDir()
 
-	tmpDir, cleanup := DirStructure(t, map[string]interface{}{
+	tmpDir := DirStructure(t, map[string]interface{}{
 		"pulldir": map[string]interface{}{
 			"notconfigured": map[string]interface{}{},
 		},
 	})
-	defer cleanup()
 	repoDir := filepath.Join(tmpDir, "pulldir/notconfigured")
 
 	yamlCfg := `version: 3
@@ -806,10 +801,9 @@ func TestDefaultProjectCommandBuilder_EscapeArgs(t *testing.T) {
 	for _, c := range cases {
 		t.Run(strings.Join(c.ExtraArgs, " "), func(t *testing.T) {
 			RegisterMockTestingT(t)
-			tmpDir, cleanup := DirStructure(t, map[string]interface{}{
+			tmpDir := DirStructure(t, map[string]interface{}{
 				"main.tf": nil,
 			})
-			defer cleanup()
 
 			workingDir := mocks.NewMockWorkingDir()
 			When(workingDir.Clone(matchers.AnyPtrToLoggingSimpleLogger(), matchers.AnyModelsRepo(), matchers.AnyModelsPullRequest(), AnyString())).ThenReturn(tmpDir, false, nil)
@@ -867,6 +861,7 @@ func TestDefaultProjectCommandBuilder_TerraformVersion(t *testing.T) {
 	// If terraform configuration is used, result should be `0.12.8`.
 	// If project configuration is used, result should be `0.12.6`.
 	// If default is to be used, result should be `nil`.
+
 	baseVersionConfig := `
 terraform {
   required_version = "%s0.12.8"
@@ -881,7 +876,29 @@ projects:
 `
 
 	exactSymbols := []string{"", "="}
-	nonExactSymbols := []string{">", ">=", "<", "<=", "~="}
+	// Depending on when the tests are run, the > and >= matching versions will have to be increased.
+	// It's probably not worth testing the terraform-switcher version here so we only test <, <=, and ~>.
+	// One way to test this in the future is to mock tfswitcher.GetTFList() to return the highest
+	// version of 1.3.5.
+	// nonExactSymbols := []string{">", ">=", "<", "<=", "~>"}
+	nonExactSymbols := []string{"<", "<=", "~>"}
+	nonExactVersions := map[string]map[string][]int{
+		// ">": {
+		// 	"project1": {1, 3, 5},
+		// },
+		// ">=": {
+		// 	"project1": {1, 3, 5},
+		// },
+		"<": {
+			"project1": {0, 12, 7},
+		},
+		"<=": {
+			"project1": {0, 12, 8},
+		},
+		"~>": {
+			"project1": {0, 12, 31},
+		},
+	}
 
 	type testCase struct {
 		DirStructure  map[string]interface{}
@@ -914,9 +931,7 @@ projects:
 				},
 			},
 			ModifiedFiles: []string{"project1/main.tf"},
-			Exp: map[string][]int{
-				"project1": nil,
-			},
+			Exp:           nonExactVersions[nonExactSymbol],
 		}
 	}
 
@@ -982,9 +997,8 @@ projects:
 		t.Run(name, func(t *testing.T) {
 			RegisterMockTestingT(t)
 
-			tmpDir, cleanup := DirStructure(t, testCase.DirStructure)
+			tmpDir := DirStructure(t, testCase.DirStructure)
 
-			defer cleanup()
 			vcsClient := vcsmocks.NewMockClient()
 			When(vcsClient.GetModifiedFiles(matchers.AnyModelsRepo(), matchers.AnyModelsPullRequest())).ThenReturn(testCase.ModifiedFiles, nil)
 
@@ -1110,10 +1124,9 @@ projects:
 
 func TestDefaultProjectCommandBuilder_WithPolicyCheckEnabled_BuildAutoplanCommand(t *testing.T) {
 	RegisterMockTestingT(t)
-	tmpDir, cleanup := DirStructure(t, map[string]interface{}{
+	tmpDir := DirStructure(t, map[string]interface{}{
 		"main.tf": nil,
 	})
-	defer cleanup()
 
 	logger := logging.NewNoopLogger(t)
 	scope, _, _ := metrics.NewLoggingScope(logger, "atlantis")
@@ -1170,7 +1183,7 @@ func TestDefaultProjectCommandBuilder_WithPolicyCheckEnabled_BuildAutoplanComman
 // Test building version command for multiple projects
 func TestDefaultProjectCommandBuilder_BuildVersionCommand(t *testing.T) {
 	RegisterMockTestingT(t)
-	tmpDir, cleanup := DirStructure(t, map[string]interface{}{
+	tmpDir := DirStructure(t, map[string]interface{}{
 		"workspace1": map[string]interface{}{
 			"project1": map[string]interface{}{
 				"main.tf":          nil,
@@ -1192,7 +1205,6 @@ func TestDefaultProjectCommandBuilder_BuildVersionCommand(t *testing.T) {
 			},
 		},
 	})
-	defer cleanup()
 	// Initialize git repos in each workspace so that the .tfplan files get
 	// picked up.
 	runCmd(t, filepath.Join(tmpDir, "workspace1"), "git", "init")
diff --git a/server/events/project_command_context_builder.go b/server/events/project_command_context_builder.go
index c15a1e920d..956d7f539f 100644
--- a/server/events/project_command_context_builder.go
+++ b/server/events/project_command_context_builder.go
@@ -2,17 +2,22 @@ package events
 
 import (
 	"path/filepath"
-	"regexp"
+	"sort"
 
+	"github.com/Masterminds/semver"
 	"github.com/google/uuid"
 	"github.com/hashicorp/go-version"
+
 	"github.com/hashicorp/terraform-config-inspect/tfconfig"
 	"github.com/runatlantis/atlantis/server/core/config/valid"
 	"github.com/runatlantis/atlantis/server/events/command"
 	"github.com/runatlantis/atlantis/server/events/models"
 	"github.com/uber-go/tally"
+	lib "github.com/warrensbox/terraform-switcher/lib"
 )
 
+var mirrorURL = "https://releases.hashicorp.com/terraform"
+
 func NewProjectCommandContextBuilder(policyCheckEnabled bool, commentBuilder CommentBuilder, scope tally.Scope) ProjectCommandContextBuilder {
 	projectCommandContextBuilder := &DefaultProjectCommandContextBuilder{
 		CommentBuilder: commentBuilder,
@@ -73,7 +78,7 @@ func (cb *CommandScopedStatsProjectCommandContextBuilder) BuildProjectContext(
 		// specifically use the command name in the context instead of the arg
 		// since we can return multiple commands worth of contexts for a given command name arg
 		// to effectively pipeline them.
-		cmd.SetScope(cmd.CommandName.String())
+		cmd.Scope = cmd.SetScopeTags(cmd.Scope)
 		projectCmds = append(projectCmds, cmd)
 	}
 
@@ -287,7 +292,6 @@ func getTfVersion(ctx *command.Context, absProjDir string) *version.Version {
 	module, diags := tfconfig.LoadModule(absProjDir)
 	if diags.HasErrors() {
 		ctx.Log.Err("trying to detect required version: %s", diags.Error())
-		return nil
 	}
 
 	if len(module.RequiredCore) != 1 {
@@ -295,21 +299,36 @@ func getTfVersion(ctx *command.Context, absProjDir string) *version.Version {
 		return nil
 	}
 	requiredVersionSetting := module.RequiredCore[0]
+	ctx.Log.Debug("found required_version setting of %q", requiredVersionSetting)
 
-	// We allow `= x.y.z`, `=x.y.z` or `x.y.z` where `x`, `y` and `z` are integers.
-	re := regexp.MustCompile(`^=?\s*([^\s]+)\s*$`)
-	matched := re.FindStringSubmatch(requiredVersionSetting)
-	if len(matched) == 0 {
-		ctx.Log.Debug("did not specify exact version in terraform configuration, found %q", requiredVersionSetting)
-		return nil
+	tflist, _ := lib.GetTFList(mirrorURL, true)
+	constrains, _ := semver.NewConstraint(requiredVersionSetting)
+	versions := make([]*semver.Version, len(tflist))
+
+	for i, tfvals := range tflist {
+		version, err := semver.NewVersion(tfvals) //NewVersion parses a given version and returns an instance of Version or an error if unable to parse the version.
+		if err == nil {
+			versions[i] = version
+		}
 	}
-	ctx.Log.Debug("found required_version setting of %q", requiredVersionSetting)
-	version, err := version.NewVersion(matched[1])
-	if err != nil {
-		ctx.Log.Debug(err.Error())
+
+	if len(versions) == 0 {
+		ctx.Log.Debug("did not specify exact valid version in terraform configuration, found %q", requiredVersionSetting)
 		return nil
 	}
 
-	ctx.Log.Info("detected module requires version: %q", version.String())
-	return version
+	sort.Sort(sort.Reverse(semver.Collection(versions)))
+
+	for _, element := range versions {
+		if constrains.Check(element) { // Validate a version against a constraint
+			tfversionStr := element.String()
+			if lib.ValidVersionFormat(tfversionStr) { //check if version format is correct
+				tfversion, _ := version.NewVersion(tfversionStr)
+				ctx.Log.Info("detected module requires version: %s", tfversionStr)
+				return tfversion
+			}
+		}
+	}
+	ctx.Log.Debug("could not match any valid terraform version with %q", requiredVersionSetting)
+	return nil
 }
diff --git a/server/events/project_command_runner_test.go b/server/events/project_command_runner_test.go
index 6c75f3beea..96f4b17c6e 100644
--- a/server/events/project_command_runner_test.go
+++ b/server/events/project_command_runner_test.go
@@ -27,7 +27,6 @@ import (
 	"github.com/runatlantis/atlantis/server/events"
 	"github.com/runatlantis/atlantis/server/events/command"
 	"github.com/runatlantis/atlantis/server/events/mocks"
-	eventmocks "github.com/runatlantis/atlantis/server/events/mocks"
 	"github.com/runatlantis/atlantis/server/events/mocks/matchers"
 	"github.com/runatlantis/atlantis/server/events/models"
 	jobmocks "github.com/runatlantis/atlantis/server/jobs/mocks"
@@ -62,8 +61,7 @@ func TestDefaultProjectCommandRunner_Plan(t *testing.T) {
 		AggregateApplyRequirements: mockApplyReqHandler,
 	}
 
-	repoDir, cleanup := TempDir(t)
-	defer cleanup()
+	repoDir := t.TempDir()
 	When(mockWorkingDir.Clone(
 		matchers.AnyPtrToLoggingSimpleLogger(),
 		matchers.AnyModelsRepo(),
@@ -190,8 +188,8 @@ func TestProjectOutputWrapper(t *testing.T) {
 			var prjResult command.ProjectResult
 			var expCommitStatus models.CommitStatus
 
-			mockJobURLSetter := eventmocks.NewMockJobURLSetter()
-			mockJobMessageSender := eventmocks.NewMockJobMessageSender()
+			mockJobURLSetter := mocks.NewMockJobURLSetter()
+			mockJobMessageSender := mocks.NewMockJobMessageSender()
 			mockProjectCommandRunner := mocks.NewMockProjectCommandRunner()
 
 			runner := &events.ProjectOutputWrapper{
@@ -269,8 +267,7 @@ func TestDefaultProjectCommandRunner_ApplyNotApproved(t *testing.T) {
 	ctx := command.ProjectContext{
 		ApplyRequirements: []string{"approved"},
 	}
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	When(mockWorkingDir.GetWorkingDir(ctx.BaseRepo, ctx.Pull, ctx.Workspace)).ThenReturn(tmp, nil)
 
 	res := runner.Apply(ctx)
@@ -294,8 +291,7 @@ func TestDefaultProjectCommandRunner_ApplyNotMergeable(t *testing.T) {
 		},
 		ApplyRequirements: []string{"mergeable"},
 	}
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	When(mockWorkingDir.GetWorkingDir(ctx.BaseRepo, ctx.Pull, ctx.Workspace)).ThenReturn(tmp, nil)
 
 	res := runner.Apply(ctx)
@@ -316,8 +312,7 @@ func TestDefaultProjectCommandRunner_ApplyDiverged(t *testing.T) {
 	ctx := command.ProjectContext{
 		ApplyRequirements: []string{"undiverged"},
 	}
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	When(mockWorkingDir.GetWorkingDir(ctx.BaseRepo, ctx.Pull, ctx.Workspace)).ThenReturn(tmp, nil)
 
 	res := runner.Apply(ctx)
@@ -431,8 +426,7 @@ func TestDefaultProjectCommandRunner_Apply(t *testing.T) {
 				WorkingDirLocker:           events.NewDefaultWorkingDirLocker(),
 				AggregateApplyRequirements: applyReqHandler,
 			}
-			repoDir, cleanup := TempDir(t)
-			defer cleanup()
+			repoDir := t.TempDir()
 			When(mockWorkingDir.GetWorkingDir(
 				matchers.AnyModelsRepo(),
 				matchers.AnyModelsPullRequest(),
@@ -503,8 +497,7 @@ func TestDefaultProjectCommandRunner_ApplyRunStepFailure(t *testing.T) {
 		AggregateApplyRequirements: applyReqHandler,
 		Webhooks:                   mockSender,
 	}
-	repoDir, cleanup := TempDir(t)
-	defer cleanup()
+	repoDir := t.TempDir()
 	When(mockWorkingDir.GetWorkingDir(
 		matchers.AnyModelsRepo(),
 		matchers.AnyModelsPullRequest(),
@@ -560,8 +553,7 @@ func TestDefaultProjectCommandRunner_RunEnvSteps(t *testing.T) {
 		WorkingDirLocker: events.NewDefaultWorkingDirLocker(),
 	}
 
-	repoDir, cleanup := TempDir(t)
-	defer cleanup()
+	repoDir := t.TempDir()
 	When(mockWorkingDir.Clone(
 		matchers.AnyPtrToLoggingSimpleLogger(),
 		matchers.AnyModelsRepo(),
diff --git a/server/events/project_finder.go b/server/events/project_finder.go
index 3ce66f62d1..fed2d7eba0 100644
--- a/server/events/project_finder.go
+++ b/server/events/project_finder.go
@@ -15,7 +15,6 @@ package events
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path"
 	"path/filepath"
@@ -75,7 +74,7 @@ var cloudBlockSchema = &hcl.BodySchema{
 
 func (p *DefaultProjectFinder) DetermineWorkspaceFromHCL(log logging.SimpleLogging, absRepoDir string) (string, error) {
 	log.Info("looking for Terraform Cloud workspace from configuration in %q", absRepoDir)
-	infos, err := ioutil.ReadDir(absRepoDir)
+	infos, err := os.ReadDir(absRepoDir)
 	if err != nil {
 		return "", err
 	}
diff --git a/server/events/project_finder_test.go b/server/events/project_finder_test.go
index a82ccbfaf9..f26e12451a 100644
--- a/server/events/project_finder_test.go
+++ b/server/events/project_finder_test.go
@@ -44,10 +44,8 @@ func setupTmpRepos(t *testing.T) {
 	//   terraform.tfstate.backup
 	//   modules/
 	//     main.tf
-	var err error
-	nestedModules1, err = os.MkdirTemp("", "")
-	Ok(t, err)
-	err = os.MkdirAll(filepath.Join(nestedModules1, "project1/modules"), 0700)
+	nestedModules1 = t.TempDir()
+	err := os.MkdirAll(filepath.Join(nestedModules1, "project1/modules"), 0700)
 	Ok(t, err)
 	files := []string{
 		"non-tf",
@@ -77,8 +75,7 @@ func setupTmpRepos(t *testing.T) {
 	//    main.tf
 	//  project2/
 	//    main.tf
-	topLevelModules, err = os.MkdirTemp("", "")
-	Ok(t, err)
+	topLevelModules = t.TempDir()
 	for _, path := range []string{"modules", "project1", "project2"} {
 		err = os.MkdirAll(filepath.Join(topLevelModules, path), 0700)
 		Ok(t, err)
@@ -92,8 +89,7 @@ func setupTmpRepos(t *testing.T) {
 	//   staging.tfvars
 	//   production.tfvars
 	//   global-env-config.auto.tfvars.json
-	envDir, err = os.MkdirTemp("", "")
-	Ok(t, err)
+	envDir = t.TempDir()
 	err = os.MkdirAll(filepath.Join(envDir, "env"), 0700)
 	Ok(t, err)
 	_, err = os.Create(filepath.Join(envDir, "env/staging.tfvars"))
@@ -337,7 +333,7 @@ func TestDefaultProjectFinder_DetermineProjectsViaConfig(t *testing.T) {
 	// modules/
 	//   module/
 	//	  main.tf
-	tmpDir, cleanup := DirStructure(t, map[string]interface{}{
+	tmpDir := DirStructure(t, map[string]interface{}{
 		"main.tf": nil,
 		"project1": map[string]interface{}{
 			"main.tf":               nil,
@@ -353,7 +349,6 @@ func TestDefaultProjectFinder_DetermineProjectsViaConfig(t *testing.T) {
 			},
 		},
 	})
-	defer cleanup()
 
 	cases := []struct {
 		description  string
diff --git a/server/events/pull_closed_executor_test.go b/server/events/pull_closed_executor_test.go
index 2662eaa24f..32a2d34454 100644
--- a/server/events/pull_closed_executor_test.go
+++ b/server/events/pull_closed_executor_test.go
@@ -40,8 +40,7 @@ func TestCleanUpPullWorkspaceErr(t *testing.T) {
 	t.Log("when workspace.Delete returns an error, we return it")
 	RegisterMockTestingT(t)
 	w := mocks.NewMockWorkingDir()
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	db, err := db.New(tmp)
 	Ok(t, err)
 	pce := events.PullClosedExecutor{
@@ -60,8 +59,7 @@ func TestCleanUpPullUnlockErr(t *testing.T) {
 	RegisterMockTestingT(t)
 	w := mocks.NewMockWorkingDir()
 	l := lockmocks.NewMockLocker()
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	db, err := db.New(tmp)
 	Ok(t, err)
 	pce := events.PullClosedExecutor{
@@ -82,8 +80,7 @@ func TestCleanUpPullNoLocks(t *testing.T) {
 	w := mocks.NewMockWorkingDir()
 	l := lockmocks.NewMockLocker()
 	cp := vcsmocks.NewMockClient()
-	tmp, cleanup := TempDir(t)
-	defer cleanup()
+	tmp := t.TempDir()
 	db, err := db.New(tmp)
 	Ok(t, err)
 	pce := events.PullClosedExecutor{
@@ -168,8 +165,7 @@ func TestCleanUpPullComments(t *testing.T) {
 			w := mocks.NewMockWorkingDir()
 			cp := vcsmocks.NewMockClient()
 			l := lockmocks.NewMockLocker()
-			tmp, cleanup := TempDir(t)
-			defer cleanup()
+			tmp := t.TempDir()
 			db, err := db.New(tmp)
 			Ok(t, err)
 			pce := events.PullClosedExecutor{
diff --git a/server/events/repo_branch_test.go b/server/events/repo_branch_test.go
new file mode 100644
index 0000000000..88cb02aea1
--- /dev/null
+++ b/server/events/repo_branch_test.go
@@ -0,0 +1,91 @@
+package events
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/runatlantis/atlantis/server/core/config"
+	"github.com/runatlantis/atlantis/server/core/config/valid"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRepoBranch(t *testing.T) {
+	globalYAML := `repos:
+  - id: github.com/foo/bar
+    branch: /release/.*/
+    apply_requirements: [approved, mergeable]
+    allowed_overrides: [workflow]
+    allowed_workflows: [development, production]
+    allow_custom_workflows: true
+workflows:
+  development:
+    plan:
+      steps:
+        - run: 'echo "Executing test workflow: terraform plan in ..."'
+        - init:
+            extra_args: ["-upgrade"]
+        - plan
+    apply:
+      steps:
+        - run: 'echo "Executing test workflow: terraform apply in ..."'
+        - apply
+  production:
+    plan:
+      steps:
+        - run: 'echo "Executing production workflow: terraform plan in ..."'
+        - init:
+            extra_args: ["-upgrade"]
+        - plan
+    apply:
+      steps:
+        - run: 'echo "Executing production workflow: terraform apply in ..."'
+        - apply
+`
+
+	repoYAML := `version: 3
+projects:
+  - name: development
+    branch: /main/
+    dir: terraform/development
+    workflow: development
+    autoplan:
+      when_modified:
+        - "**/*"
+  - name: production
+    branch: /production/
+    dir: terraform/production
+    workflow: production
+    autoplan:
+      when_modified:
+        - "**/*"
+`
+
+	tmp := t.TempDir()
+
+	globalYAMLPath := filepath.Join(tmp, "config.yaml")
+	err := os.WriteFile(globalYAMLPath, []byte(globalYAML), 0600)
+	require.NoError(t, err)
+
+	globalCfgArgs := valid.GlobalCfgArgs{
+		AllowRepoCfg:  false,
+		MergeableReq:  false,
+		ApprovedReq:   false,
+		UnDivergedReq: false,
+	}
+
+	parser := &config.ParserValidator{}
+	global, err := parser.ParseGlobalCfg(globalYAMLPath, valid.NewGlobalCfgFromArgs(globalCfgArgs))
+	require.NoError(t, err)
+
+	repoYAMLPath := filepath.Join(tmp, "atlantis.yaml")
+	err = os.WriteFile(repoYAMLPath, []byte(repoYAML), 0600)
+	require.NoError(t, err)
+
+	repo, err := parser.ParseRepoCfg(tmp, global, "github.com/foo/bar", "main")
+	require.NoError(t, err)
+
+	require.Equal(t, 1, len(repo.Projects))
+
+	t.Logf("Projects: %+v", repo.Projects)
+}
diff --git a/server/events/templates/apply_unwrapped_success.tmpl b/server/events/templates/apply_unwrapped_success.tmpl
new file mode 100644
index 0000000000..30a894b231
--- /dev/null
+++ b/server/events/templates/apply_unwrapped_success.tmpl
@@ -0,0 +1,5 @@
+{{ define "applyUnwrappedSuccess" -}}
+```diff
+{{.Output}}
+```
+{{- end }}
diff --git a/server/events/templates/apply_wrapped_success.tmpl b/server/events/templates/apply_wrapped_success.tmpl
new file mode 100644
index 0000000000..c5d16a3cd5
--- /dev/null
+++ b/server/events/templates/apply_wrapped_success.tmpl
@@ -0,0 +1,6 @@
+{{ define "applyWrappedSuccess" -}}
+<details><summary>Show Output</summary>
+
+{{ template "applyUnwrappedSuccess" . }}
+</details>
+{{- end }}
diff --git a/server/events/templates/approve_all_projects.tmpl b/server/events/templates/approve_all_projects.tmpl
new file mode 100644
index 0000000000..8ce1d2d953
--- /dev/null
+++ b/server/events/templates/approve_all_projects.tmpl
@@ -0,0 +1,7 @@
+{{ define "approveAllProjects" -}}
+Approved Policies for {{ len .Results }} projects:
+
+{{ range $result := .Results }}1. {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`
+{{end}}
+{{ template "log" . }}
+{{ end }}
diff --git a/server/events/templates/diverged.tmpl b/server/events/templates/diverged.tmpl
new file mode 100644
index 0000000000..092f5d8a60
--- /dev/null
+++ b/server/events/templates/diverged.tmpl
@@ -0,0 +1,5 @@
+{{ define "diverged" -}}
+{{ if .HasDiverged }}
+
+:warning: The branch we're merging into is ahead, it is recommended to pull new commits first.{{end}}
+{{- end }}
diff --git a/server/events/templates/failure.tmpl b/server/events/templates/failure.tmpl
new file mode 100644
index 0000000000..ea7078066f
--- /dev/null
+++ b/server/events/templates/failure.tmpl
@@ -0,0 +1,3 @@
+{{ define "failure" -}}
+**{{.Command}} Failed**: {{.Failure}}
+{{- end }}
diff --git a/server/events/templates/failure_with_log.tmpl b/server/events/templates/failure_with_log.tmpl
new file mode 100644
index 0000000000..371be01a12
--- /dev/null
+++ b/server/events/templates/failure_with_log.tmpl
@@ -0,0 +1,3 @@
+{{ define "failureWithLog" -}}
+{{ template "failure" . }}{{ template "log" . }}
+{{ end }}
diff --git a/server/events/templates/log.tmpl b/server/events/templates/log.tmpl
new file mode 100644
index 0000000000..4dbb97c7a8
--- /dev/null
+++ b/server/events/templates/log.tmpl
@@ -0,0 +1,9 @@
+{{ define "log" -}}
+{{if .Verbose}}
+<details><summary>Log</summary>
+  <p>
+
+```
+{{.Log}}```
+</p></details>{{end}}
+{{- end }}
diff --git a/server/events/templates/multi_project_apply.tmpl b/server/events/templates/multi_project_apply.tmpl
new file mode 100644
index 0000000000..ff17c53df8
--- /dev/null
+++ b/server/events/templates/multi_project_apply.tmpl
@@ -0,0 +1,8 @@
+{{ define "multiProjectApply" -}}
+{{ template "multiProjectHeader" . }}
+{{ range $i, $result := .Results }}### {{add $i 1}}. {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`
+{{$result.Rendered}}
+
+---
+{{end}}{{ template "log" . }}
+{{ end }}
diff --git a/server/events/templates/multi_project_header.tmpl b/server/events/templates/multi_project_header.tmpl
new file mode 100644
index 0000000000..66d0f39745
--- /dev/null
+++ b/server/events/templates/multi_project_header.tmpl
@@ -0,0 +1,6 @@
+{{ define "multiProjectHeader" -}}
+Ran {{.Command}} for {{ len .Results }} projects:
+
+{{ range $result := .Results }}1. {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`
+{{end}}
+{{- end }}
diff --git a/server/events/templates/multi_project_plan.tmpl b/server/events/templates/multi_project_plan.tmpl
new file mode 100644
index 0000000000..9ee33c590f
--- /dev/null
+++ b/server/events/templates/multi_project_plan.tmpl
@@ -0,0 +1,11 @@
+{{ define "multiProjectPlan" -}}
+{{ template "multiProjectHeader" . }}
+{{ $disableApplyAll := .DisableApplyAll }}{{ range $i, $result := .Results }}### {{add $i 1}}. {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`
+{{$result.Rendered}}
+
+{{ if ne $disableApplyAll true }}---
+{{end}}{{end}}{{ if ne .DisableApplyAll true }}{{ if and (gt (len .Results) 0) (not .PlansDeleted) }}* :fast_forward: To **apply** all unapplied plans from this pull request, comment:
+    * `atlantis apply`
+* :put_litter_in_its_place: To delete all plans and locks for the PR, comment:
+    * `atlantis unlock`{{end}}{{end}}{{ template "log" . }}
+{{ end }}
diff --git a/server/events/templates/multi_project_version.tmpl b/server/events/templates/multi_project_version.tmpl
new file mode 100644
index 0000000000..f8557b5244
--- /dev/null
+++ b/server/events/templates/multi_project_version.tmpl
@@ -0,0 +1,3 @@
+{{ define "multiProjectVersion" -}}
+{{ template "multiProjectApply" . }}
+{{- end }}
diff --git a/server/events/templates/plan_success_unwrapped.tmpl b/server/events/templates/plan_success_unwrapped.tmpl
new file mode 100644
index 0000000000..2514334053
--- /dev/null
+++ b/server/events/templates/plan_success_unwrapped.tmpl
@@ -0,0 +1,11 @@
+{{ define "planSuccessUnwrapped" -}}
+```diff
+{{ if .EnableDiffMarkdownFormat }}{{.DiffMarkdownFormattedTerraformOutput}}{{else}}{{.TerraformOutput}}{{end}}
+```
+
+{{ if .PlanWasDeleted }}This plan was not saved because one or more projects failed and automerge requires all plans pass.{{ else }}{{ if not .DisableApply }}* :arrow_forward: To **apply** this plan, comment:
+    * `{{.ApplyCmd}}`
+{{end}}{{ if not .DisableRepoLocking }}* :put_litter_in_its_place: To **delete** this plan click [here]({{.LockURL}})
+{{end}}* :repeat: To **plan** this project again, comment:
+    * `{{.RePlanCmd}}`{{end}}{{ template "diverged" . }}
+{{- end }}
diff --git a/server/events/templates/plan_success_wrapped.tmpl b/server/events/templates/plan_success_wrapped.tmpl
new file mode 100644
index 0000000000..23df190f5e
--- /dev/null
+++ b/server/events/templates/plan_success_wrapped.tmpl
@@ -0,0 +1,15 @@
+{{ define "planSuccessWrapped" -}}
+<details><summary>Show Output</summary>
+
+```diff
+{{ if .EnableDiffMarkdownFormat }}{{.DiffMarkdownFormattedTerraformOutput}}{{else}}{{.TerraformOutput}}{{end}}
+```
+
+{{ if .PlanWasDeleted }}This plan was not saved because one or more projects failed and automerge requires all plans pass.{{ else }}{{ if not .DisableApply }}* :arrow_forward: To **apply** this plan, comment:
+    * `{{.ApplyCmd}}`
+{{end}}{{ if not .DisableRepoLocking }}* :put_litter_in_its_place: To **delete** this plan click [here]({{.LockURL}})
+{{end}}* :repeat: To **plan** this project again, comment:
+    * `{{.RePlanCmd}}`{{end}}
+</details>
+{{.PlanSummary}}{{ template "diverged" . }}
+{{- end }}
diff --git a/server/events/templates/policy_check_success_unwrapped.tmpl b/server/events/templates/policy_check_success_unwrapped.tmpl
new file mode 100644
index 0000000000..34fa9757ac
--- /dev/null
+++ b/server/events/templates/policy_check_success_unwrapped.tmpl
@@ -0,0 +1,11 @@
+{{ define "policyCheckSuccessUnwrapped" -}}
+```diff
+{{.PolicyCheckOutput}}
+```
+
+* :arrow_forward: To **apply** this plan, comment:
+    * `{{.ApplyCmd}}`
+* :put_litter_in_its_place: To **delete** this plan click [here]({{.LockURL}})
+* :repeat: To re-run policies **plan** this project again by commenting:
+    * `{{.RePlanCmd}}`{{ template "diverged" . }}
+{{- end }}
diff --git a/server/events/templates/policy_check_success_wrapped.tmpl b/server/events/templates/policy_check_success_wrapped.tmpl
new file mode 100644
index 0000000000..0066a385c0
--- /dev/null
+++ b/server/events/templates/policy_check_success_wrapped.tmpl
@@ -0,0 +1,14 @@
+{{ define "policyCheckSuccessWrapped" -}}
+<details><summary>Show Output</summary>
+
+```diff
+{{.PolicyCheckOutput}}
+```
+
+* :arrow_forward: To **apply** this plan, comment:
+    * `{{.ApplyCmd}}`
+* :put_litter_in_its_place: To **delete** this plan click [here]({{.LockURL}})
+* :repeat: To re-run policies **plan** this project again by commenting:
+    * `{{.RePlanCmd}}`
+</details>{{ template "diverged" . }}
+{{- end }}
diff --git a/server/events/templates/single_project_apply.tmpl b/server/events/templates/single_project_apply.tmpl
new file mode 100644
index 0000000000..da5174a0b5
--- /dev/null
+++ b/server/events/templates/single_project_apply.tmpl
@@ -0,0 +1,6 @@
+{{ define "singleProjectApply" -}}
+{{$result := index .Results 0}}Ran {{.Command}} for {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`
+
+{{$result.Rendered}}
+{{ template "log" . }}
+{{ end }}
diff --git a/server/events/templates/single_project_plan_success.tmpl b/server/events/templates/single_project_plan_success.tmpl
new file mode 100644
index 0000000000..08c1624037
--- /dev/null
+++ b/server/events/templates/single_project_plan_success.tmpl
@@ -0,0 +1,11 @@
+{{ define "singleProjectPlanSuccess" -}}
+{{$result := index .Results 0}}Ran {{.Command}} for {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`
+
+{{$result.Rendered}}
+
+{{ if ne .DisableApplyAll true  }}---
+* :fast_forward: To **apply** all unapplied plans from this pull request, comment:
+    * `atlantis apply`
+* :put_litter_in_its_place: To delete all plans and locks for the PR, comment:
+    * `atlantis unlock`{{ end }}{{ template "log" . }}
+{{ end }}
diff --git a/server/events/templates/single_project_plan_unsuccessful.tmpl b/server/events/templates/single_project_plan_unsuccessful.tmpl
new file mode 100644
index 0000000000..96157d9507
--- /dev/null
+++ b/server/events/templates/single_project_plan_unsuccessful.tmpl
@@ -0,0 +1,6 @@
+{{ define "singleProjectPlanUnsuccessful" -}}
+{{$result := index .Results 0}}Ran {{.Command}} for dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`
+
+{{$result.Rendered}}
+{{ template "log" . }}
+{{ end }}
diff --git a/server/events/templates/single_project_version_success.tmpl b/server/events/templates/single_project_version_success.tmpl
new file mode 100644
index 0000000000..201cde63b5
--- /dev/null
+++ b/server/events/templates/single_project_version_success.tmpl
@@ -0,0 +1,6 @@
+{{ define "singleProjectVersionSuccess" -}}
+{{$result := index .Results 0}}Ran {{.Command}} for {{ if $result.ProjectName }}project: `{{$result.ProjectName}}` {{ end }}dir: `{{$result.RepoRelDir}}` workspace: `{{$result.Workspace}}`
+
+{{$result.Rendered}}
+{{ template "log" . }}
+{{ end }}
diff --git a/server/events/templates/single_project_version_unsuccessful.tmpl b/server/events/templates/single_project_version_unsuccessful.tmpl
new file mode 100644
index 0000000000..69985b3316
--- /dev/null
+++ b/server/events/templates/single_project_version_unsuccessful.tmpl
@@ -0,0 +1,3 @@
+{{ define "singleProjectVersionUnsuccessful" -}}
+{{ template "singleProjectPlanUnsuccessful" . }}
+{{- end }}
diff --git a/server/events/templates/unwrapped_err.tmpl b/server/events/templates/unwrapped_err.tmpl
new file mode 100644
index 0000000000..3d732e4ae6
--- /dev/null
+++ b/server/events/templates/unwrapped_err.tmpl
@@ -0,0 +1,10 @@
+{{ define "unwrappedErr" -}}
+**{{.Command}} Error**
+```
+{{.Error}}
+```{{ if eq .Command "Policy Check" }}
+* :heavy_check_mark: To **approve** failing policies an authorized approver can comment:
+    * `atlantis approve_policies`
+* :repeat: Or, address the policy failure by modifying the codebase and re-planning.
+{{ end }}
+{{- end }}
diff --git a/server/events/templates/unwrapped_err_with_log.tmpl b/server/events/templates/unwrapped_err_with_log.tmpl
new file mode 100644
index 0000000000..b27533a540
--- /dev/null
+++ b/server/events/templates/unwrapped_err_with_log.tmpl
@@ -0,0 +1,3 @@
+{{ define "unwrappedErrWithLog" -}}
+{{ template "unwrappedErr" . }}{{ template "log" . }}
+{{ end }}
diff --git a/server/events/templates/version_unwrapped_success.tmpl b/server/events/templates/version_unwrapped_success.tmpl
new file mode 100644
index 0000000000..efcb6e5009
--- /dev/null
+++ b/server/events/templates/version_unwrapped_success.tmpl
@@ -0,0 +1,5 @@
+{{ define "versionUnwrappedSuccess" -}}
+```
+{{.Output}}
+```
+{{ end }}
diff --git a/server/events/templates/version_wrapped_success.tmpl b/server/events/templates/version_wrapped_success.tmpl
new file mode 100644
index 0000000000..84371ce1c2
--- /dev/null
+++ b/server/events/templates/version_wrapped_success.tmpl
@@ -0,0 +1,6 @@
+{{ define "versionWrappedSuccess" -}}
+<details><summary>Show Output</summary>
+
+{{ template "versionUnwrappedSuccess" . }}
+</details>
+{{- end }}
diff --git a/server/events/templates/wrapped_err.tmpl b/server/events/templates/wrapped_err.tmpl
new file mode 100644
index 0000000000..39050b92dd
--- /dev/null
+++ b/server/events/templates/wrapped_err.tmpl
@@ -0,0 +1,9 @@
+{{ define "wrappedErr" -}}
+**{{.Command}} Error**
+<details><summary>Show Output</summary>
+
+```
+{{.Error}}
+```
+</details>
+{{- end }}
diff --git a/server/events/testdata/bitbucket-cloud-comment-event.json b/server/events/testdata/bitbucket-cloud-comment-event.json
index cd71dc4eb7..f33f8f962b 100644
--- a/server/events/testdata/bitbucket-cloud-comment-event.json
+++ b/server/events/testdata/bitbucket-cloud-comment-event.json
@@ -99,7 +99,7 @@
         }
       },
       "branch": {
-        "name": "master"
+        "name": "main"
       },
       "repository": {
         "full_name": "lkysow/atlantis-example",
diff --git a/server/events/testdata/bitbucket-cloud-pull-event-created.json b/server/events/testdata/bitbucket-cloud-pull-event-created.json
index f8de61cc43..9dc2550a3c 100644
--- a/server/events/testdata/bitbucket-cloud-pull-event-created.json
+++ b/server/events/testdata/bitbucket-cloud-pull-event-created.json
@@ -83,7 +83,7 @@
         "uuid": "{94189367-116b-436a-9f77-2314b97a6067}"
       },
       "branch": {
-        "name": "master"
+        "name": "main"
       }
     },
     "created_on": "2019-06-13T13:37:58.036928+00:00",
diff --git a/server/events/testdata/bitbucket-cloud-pull-event-fulfilled.json b/server/events/testdata/bitbucket-cloud-pull-event-fulfilled.json
index aac36ec2a1..417a034bfa 100644
--- a/server/events/testdata/bitbucket-cloud-pull-event-fulfilled.json
+++ b/server/events/testdata/bitbucket-cloud-pull-event-fulfilled.json
@@ -83,7 +83,7 @@
         "uuid": "{94189367-116b-436a-9f77-2314b97a6067}"
       },
       "branch": {
-        "name": "master"
+        "name": "main"
       }
     },
     "created_on": "2019-06-13T13:37:58.036928+00:00",
diff --git a/server/events/testdata/bitbucket-cloud-pull-event-rejected.json b/server/events/testdata/bitbucket-cloud-pull-event-rejected.json
index 23399af6df..adc5b9d89d 100644
--- a/server/events/testdata/bitbucket-cloud-pull-event-rejected.json
+++ b/server/events/testdata/bitbucket-cloud-pull-event-rejected.json
@@ -83,7 +83,7 @@
         "uuid": "{94189367-116b-436a-9f77-2314b97a6067}"
       },
       "branch": {
-        "name": "master"
+        "name": "main"
       }
     },
     "created_on": "2019-02-12T16:54:45.891127+00:00",
diff --git a/server/events/testdata/bitbucket-cloud-pull-event-updated.json b/server/events/testdata/bitbucket-cloud-pull-event-updated.json
index f75d6dcc40..4c65a01daf 100644
--- a/server/events/testdata/bitbucket-cloud-pull-event-updated.json
+++ b/server/events/testdata/bitbucket-cloud-pull-event-updated.json
@@ -48,7 +48,7 @@
         }
       },
       "branch": {
-        "name": "master"
+        "name": "main"
       },
       "repository": {
         "full_name": "lkysow/atlantis-example",
@@ -209,4 +209,4 @@
     "is_private": false,
     "uuid": "{94189367-116b-436a-9f77-2314b97a6067}"
   }
-}
\ No newline at end of file
+}
diff --git a/server/events/testdata/bitbucket-server-comment-event.json b/server/events/testdata/bitbucket-server-comment-event.json
index dc5fae6d91..2621b60540 100644
--- a/server/events/testdata/bitbucket-server-comment-event.json
+++ b/server/events/testdata/bitbucket-server-comment-event.json
@@ -42,8 +42,8 @@
       }
     },
     "toRef": {
-      "id": "refs/heads/master",
-      "displayId": "master",
+      "id": "refs/heads/main",
+      "displayId": "main",
       "latestCommit": "3d1f26bc1c8eeb5ad94e247c92072717b9de6aa0",
       "repository": {
         "slug": "atlantis-example",
@@ -102,4 +102,4 @@
     "comments": [],
     "tasks": []
   }
-}
\ No newline at end of file
+}
diff --git a/server/events/testdata/bitbucket-server-get-pull.json b/server/events/testdata/bitbucket-server-get-pull.json
index c713635884..91623b6cd4 100644
--- a/server/events/testdata/bitbucket-server-get-pull.json
+++ b/server/events/testdata/bitbucket-server-get-pull.json
@@ -54,8 +54,8 @@
     }
   },
   "toRef": {
-    "id": "refs/heads/master",
-    "displayId": "master",
+    "id": "refs/heads/main",
+    "displayId": "main",
     "latestCommit": "bbc7b2a29344646ec8605be9603a0aa625a627ef",
     "repository": {
       "slug": "atlantis-example",
@@ -153,4 +153,4 @@
       }
     ]
   }
-}
\ No newline at end of file
+}
diff --git a/server/events/testdata/bitbucket-server-pull-event-created.json b/server/events/testdata/bitbucket-server-pull-event-created.json
index 1292c0a0db..e644b08c33 100644
--- a/server/events/testdata/bitbucket-server-pull-event-created.json
+++ b/server/events/testdata/bitbucket-server-pull-event-created.json
@@ -42,8 +42,8 @@
       }
     },
     "toRef": {
-      "id": "refs/heads/master",
-      "displayId": "master",
+      "id": "refs/heads/main",
+      "displayId": "main",
       "latestCommit": "3d1f26bc1c8eeb5ad94e247c92072717b9de6aa0",
       "repository": {
         "slug": "atlantis-example",
@@ -81,4 +81,4 @@
     "reviewers": [],
     "participants": []
   }
-}
\ No newline at end of file
+}
diff --git a/server/events/testdata/bitbucket-server-pull-event-declined.json b/server/events/testdata/bitbucket-server-pull-event-declined.json
index 2ed88b9a93..b4505e37ab 100644
--- a/server/events/testdata/bitbucket-server-pull-event-declined.json
+++ b/server/events/testdata/bitbucket-server-pull-event-declined.json
@@ -43,8 +43,8 @@
       }
     },
     "toRef": {
-      "id": "refs/heads/master",
-      "displayId": "master",
+      "id": "refs/heads/main",
+      "displayId": "main",
       "latestCommit": "120cff6e1452086c90689c810c15b534381ba61b",
       "repository": {
         "slug": "atlantis-example",
diff --git a/server/events/testdata/bitbucket-server-pull-event-merged.json b/server/events/testdata/bitbucket-server-pull-event-merged.json
index ed22810b1a..4e1f5e05fd 100644
--- a/server/events/testdata/bitbucket-server-pull-event-merged.json
+++ b/server/events/testdata/bitbucket-server-pull-event-merged.json
@@ -60,8 +60,8 @@
       }
     },
     "toRef": {
-      "id": "refs/heads/master",
-      "displayId": "master",
+      "id": "refs/heads/main",
+      "displayId": "main",
       "latestCommit": "120cff6e1452086c90689c810c15b534381ba61b",
       "repository": {
         "slug": "atlantis-example",
diff --git a/server/events/testdata/gitlab-get-merge-request-subgroup.json b/server/events/testdata/gitlab-get-merge-request-subgroup.json
index c1e4639fa5..92414666b9 100644
--- a/server/events/testdata/gitlab-get-merge-request-subgroup.json
+++ b/server/events/testdata/gitlab-get-merge-request-subgroup.json
@@ -7,7 +7,7 @@
   "state": "opened",
   "created_at": "2018-08-22T06:14:20.946Z",
   "updated_at": "2018-08-22T06:14:20.946Z",
-  "target_branch": "master",
+  "target_branch": "main",
   "source_branch": "patch",
   "upvotes": 0,
   "downvotes": 0,
@@ -63,4 +63,4 @@
     "start_sha": "cdf3f0f8aad6abc3c4700ad6e28936a2278a309b"
   },
   "approvals_before_merge": null
-}
\ No newline at end of file
+}
diff --git a/server/events/testdata/gitlab-get-merge-request.json b/server/events/testdata/gitlab-get-merge-request.json
index f7506ec04a..b804860415 100644
--- a/server/events/testdata/gitlab-get-merge-request.json
+++ b/server/events/testdata/gitlab-get-merge-request.json
@@ -7,7 +7,7 @@
   "state":"opened",
   "created_at":"2017-11-13T19:33:42.704Z",
   "updated_at":"2017-11-13T23:35:26.200Z",
-  "target_branch":"master",
+  "target_branch":"main",
   "source_branch":"abc",
   "upvotes":0,
   "downvotes":0,
@@ -44,4 +44,4 @@
     "human_time_estimate":null,
     "human_total_time_spent":null
   }
-}
\ No newline at end of file
+}
diff --git a/server/events/testdata/gitlab-merge-request-comment-event-subgroup.json b/server/events/testdata/gitlab-merge-request-comment-event-subgroup.json
index 9bd6e6d392..3116caf3ce 100644
--- a/server/events/testdata/gitlab-merge-request-comment-event-subgroup.json
+++ b/server/events/testdata/gitlab-merge-request-comment-event-subgroup.json
@@ -18,7 +18,7 @@
     "namespace": "sub-subgroup",
     "visibility_level": 20,
     "path_with_namespace": "lkysow-test/subgroup/sub-subgroup/atlantis-example",
-    "default_branch": "master",
+    "default_branch": "main",
     "ci_config_path": null,
     "homepage": "https://gitlab.com/lkysow-test/subgroup/sub-subgroup/atlantis-example",
     "url": "git@gitlab.com:lkysow-test/subgroup/sub-subgroup/atlantis-example.git",
@@ -79,7 +79,7 @@
     "source_branch": "patch",
     "source_project_id": 7804027,
     "state": "opened",
-    "target_branch": "master",
+    "target_branch": "main",
     "target_project_id": 7804027,
     "time_estimate": 0,
     "title": "Update main.tf",
@@ -97,7 +97,7 @@
       "namespace": "sub-subgroup",
       "visibility_level": 20,
       "path_with_namespace": "lkysow-test/subgroup/sub-subgroup/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/lkysow-test/subgroup/sub-subgroup/atlantis-example",
       "url": "git@gitlab.com:lkysow-test/subgroup/sub-subgroup/atlantis-example.git",
@@ -115,7 +115,7 @@
       "namespace": "sub-subgroup",
       "visibility_level": 20,
       "path_with_namespace": "lkysow-test/subgroup/sub-subgroup/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/lkysow-test/subgroup/sub-subgroup/atlantis-example",
       "url": "git@gitlab.com:lkysow-test/subgroup/sub-subgroup/atlantis-example.git",
@@ -137,4 +137,4 @@
     "human_total_time_spent": null,
     "human_time_estimate": null
   }
-}
\ No newline at end of file
+}
diff --git a/server/events/testdata/gitlab-merge-request-comment-event.json b/server/events/testdata/gitlab-merge-request-comment-event.json
index d92bc4d45e..8b7548e544 100644
--- a/server/events/testdata/gitlab-merge-request-comment-event.json
+++ b/server/events/testdata/gitlab-merge-request-comment-event.json
@@ -17,7 +17,7 @@
     "namespace":"Gitlab Org",
     "visibility_level":10,
     "path_with_namespace":"gitlabhq/gitlab-test",
-    "default_branch":"master",
+    "default_branch":"main",
     "homepage":"http://example.com/gitlabhq/gitlab-test",
     "url":"https://example.com/gitlabhq/gitlab-test.git",
     "ssh_url":"git@example.com:gitlabhq/gitlab-test.git",
@@ -48,7 +48,7 @@
   "merge_request": {
     "id": 7,
     "target_branch": "markdown",
-    "source_branch": "master",
+    "source_branch": "main",
     "source_project_id": 5,
     "author_id": 8,
     "assignee_id": 28,
@@ -72,7 +72,7 @@
       "namespace":"Gitlab Org",
       "visibility_level":10,
       "path_with_namespace":"gitlab-org/gitlab-test",
-      "default_branch":"master",
+      "default_branch":"main",
       "homepage":"http://example.com/gitlab-org/gitlab-test",
       "url":"https://example.com/gitlab-org/gitlab-test.git",
       "ssh_url":"git@example.com:gitlab-org/gitlab-test.git",
@@ -89,7 +89,7 @@
       "namespace":"Gitlab Org",
       "visibility_level":10,
       "path_with_namespace":"gitlabhq/gitlab-test",
-      "default_branch":"master",
+      "default_branch":"main",
       "homepage":"http://example.com/gitlabhq/gitlab-test",
       "url":"https://example.com/gitlabhq/gitlab-test.git",
       "ssh_url":"git@example.com:gitlabhq/gitlab-test.git",
@@ -97,7 +97,7 @@
     },
     "last_commit": {
       "id": "562e173be03b8ff2efb05345d12df18815438a4b",
-      "message": "Merge branch 'another-branch' into 'master'\n\nCheck in this test\n",
+      "message": "Merge branch 'another-branch' into 'main'\n\nCheck in this test\n",
       "timestamp": "2002-10-02T10:00:00-05:00",
       "url": "http://example.com/gitlab-org/gitlab-test/commit/562e173be03b8ff2efb05345d12df18815438a4b",
       "author": {
@@ -112,4 +112,4 @@
       "avatar_url": "http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=40\u0026d=identicon"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/server/events/testdata/gitlab-merge-request-event-subgroup.json b/server/events/testdata/gitlab-merge-request-event-subgroup.json
index 9b768471ab..c730c20568 100644
--- a/server/events/testdata/gitlab-merge-request-event-subgroup.json
+++ b/server/events/testdata/gitlab-merge-request-event-subgroup.json
@@ -17,7 +17,7 @@
     "namespace": "sub-subgroup",
     "visibility_level": 20,
     "path_with_namespace": "lkysow-test/subgroup/sub-subgroup/atlantis-example",
-    "default_branch": "master",
+    "default_branch": "main",
     "ci_config_path": null,
     "homepage": "https://gitlab.com/lkysow-test/subgroup/sub-subgroup/atlantis-example",
     "url": "git@gitlab.com:lkysow-test/subgroup/sub-subgroup/atlantis-example.git",
@@ -46,7 +46,7 @@
     "source_branch": "patch",
     "source_project_id": 7804027,
     "state": "opened",
-    "target_branch": "master",
+    "target_branch": "main",
     "target_project_id": 7804027,
     "time_estimate": 0,
     "title": "Update main.tf",
@@ -64,7 +64,7 @@
       "namespace": "sub-subgroup",
       "visibility_level": 20,
       "path_with_namespace": "lkysow-test/subgroup/sub-subgroup/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/lkysow-test/subgroup/sub-subgroup/atlantis-example",
       "url": "git@gitlab.com:lkysow-test/subgroup/sub-subgroup/atlantis-example.git",
@@ -82,7 +82,7 @@
       "namespace": "sub-subgroup",
       "visibility_level": 20,
       "path_with_namespace": "lkysow-test/subgroup/sub-subgroup/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/lkysow-test/subgroup/sub-subgroup/atlantis-example",
       "url": "git@gitlab.com:lkysow-test/subgroup/sub-subgroup/atlantis-example.git",
diff --git a/server/events/testdata/gitlab-merge-request-event-update-assignee.json b/server/events/testdata/gitlab-merge-request-event-update-assignee.json
index 1b506a4ea8..06b63ddd40 100644
--- a/server/events/testdata/gitlab-merge-request-event-update-assignee.json
+++ b/server/events/testdata/gitlab-merge-request-event-update-assignee.json
@@ -18,7 +18,7 @@
     "namespace": "Quan Hoang",
     "visibility_level": 0,
     "path_with_namespace": "quan.hoang/atlantis-example",
-    "default_branch": "master",
+    "default_branch": "main",
     "ci_config_path": null,
     "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
     "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -47,7 +47,7 @@
     "source_branch": "get-event-payload",
     "source_project_id": 910,
     "state_id": 1,
-    "target_branch": "master",
+    "target_branch": "main",
     "target_project_id": 910,
     "time_estimate": 0,
     "title": "Add new file",
@@ -65,7 +65,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -83,7 +83,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
diff --git a/server/events/testdata/gitlab-merge-request-event-update-description.json b/server/events/testdata/gitlab-merge-request-event-update-description.json
index 021d8c3a2c..d5e703198f 100644
--- a/server/events/testdata/gitlab-merge-request-event-update-description.json
+++ b/server/events/testdata/gitlab-merge-request-event-update-description.json
@@ -18,7 +18,7 @@
     "namespace": "Quan Hoang",
     "visibility_level": 0,
     "path_with_namespace": "quan.hoang/atlantis-example",
-    "default_branch": "master",
+    "default_branch": "main",
     "ci_config_path": null,
     "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
     "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -47,7 +47,7 @@
     "source_branch": "get-event-payload",
     "source_project_id": 910,
     "state_id": 1,
-    "target_branch": "master",
+    "target_branch": "main",
     "target_project_id": 910,
     "time_estimate": 0,
     "title": "Add new file",
@@ -65,7 +65,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -83,7 +83,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
diff --git a/server/events/testdata/gitlab-merge-request-event-update-labels.json b/server/events/testdata/gitlab-merge-request-event-update-labels.json
index b374961afd..d1607661d7 100644
--- a/server/events/testdata/gitlab-merge-request-event-update-labels.json
+++ b/server/events/testdata/gitlab-merge-request-event-update-labels.json
@@ -18,7 +18,7 @@
     "namespace": "Quan Hoang",
     "visibility_level": 0,
     "path_with_namespace": "quan.hoang/atlantis-example",
-    "default_branch": "master",
+    "default_branch": "main",
     "ci_config_path": null,
     "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
     "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -47,7 +47,7 @@
     "source_branch": "get-event-payload",
     "source_project_id": 910,
     "state_id": 1,
-    "target_branch": "master",
+    "target_branch": "main",
     "target_project_id": 910,
     "time_estimate": 0,
     "title": "Add new file",
@@ -65,7 +65,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -83,7 +83,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
diff --git a/server/events/testdata/gitlab-merge-request-event-update-mixed.json b/server/events/testdata/gitlab-merge-request-event-update-mixed.json
index e04e82ff0e..aa517171ff 100644
--- a/server/events/testdata/gitlab-merge-request-event-update-mixed.json
+++ b/server/events/testdata/gitlab-merge-request-event-update-mixed.json
@@ -18,7 +18,7 @@
     "namespace": "Quan Hoang",
     "visibility_level": 0,
     "path_with_namespace": "quan.hoang/atlantis-example",
-    "default_branch": "master",
+    "default_branch": "main",
     "ci_config_path": null,
     "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
     "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -47,7 +47,7 @@
     "source_branch": "get-event-payload",
     "source_project_id": 910,
     "state_id": 1,
-    "target_branch": "master",
+    "target_branch": "main",
     "target_project_id": 910,
     "time_estimate": 0,
     "title": "Add new file (another time)",
@@ -65,7 +65,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -83,7 +83,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
diff --git a/server/events/testdata/gitlab-merge-request-event-update-new-commit.json b/server/events/testdata/gitlab-merge-request-event-update-new-commit.json
index 0ac9facfe0..11c26b6e1f 100644
--- a/server/events/testdata/gitlab-merge-request-event-update-new-commit.json
+++ b/server/events/testdata/gitlab-merge-request-event-update-new-commit.json
@@ -18,7 +18,7 @@
     "namespace": "Quan Hoang",
     "visibility_level": 0,
     "path_with_namespace": "quan.hoang/atlantis-example",
-    "default_branch": "master",
+    "default_branch": "main",
     "ci_config_path": null,
     "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
     "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -47,7 +47,7 @@
     "source_branch": "get-event-payload",
     "source_project_id": 910,
     "state_id": 1,
-    "target_branch": "master",
+    "target_branch": "main",
     "target_project_id": 910,
     "time_estimate": 0,
     "title": "Add new file (another time)",
@@ -65,7 +65,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -83,7 +83,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
diff --git a/server/events/testdata/gitlab-merge-request-event-update-target-branch.json b/server/events/testdata/gitlab-merge-request-event-update-target-branch.json
index aae672f4ea..3ddd7a0947 100644
--- a/server/events/testdata/gitlab-merge-request-event-update-target-branch.json
+++ b/server/events/testdata/gitlab-merge-request-event-update-target-branch.json
@@ -18,7 +18,7 @@
     "namespace": "Quan Hoang",
     "visibility_level": 0,
     "path_with_namespace": "quan.hoang/atlantis-example",
-    "default_branch": "master",
+    "default_branch": "main",
     "ci_config_path": null,
     "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
     "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -65,7 +65,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -83,7 +83,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
diff --git a/server/events/testdata/gitlab-merge-request-event-update-title.json b/server/events/testdata/gitlab-merge-request-event-update-title.json
index f352bfaa46..3ad15fa89f 100644
--- a/server/events/testdata/gitlab-merge-request-event-update-title.json
+++ b/server/events/testdata/gitlab-merge-request-event-update-title.json
@@ -18,7 +18,7 @@
     "namespace": "Quan Hoang",
     "visibility_level": 0,
     "path_with_namespace": "quan.hoang/atlantis-example",
-    "default_branch": "master",
+    "default_branch": "main",
     "ci_config_path": null,
     "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
     "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -47,7 +47,7 @@
     "source_branch": "get-event-payload",
     "source_project_id": 910,
     "state_id": 1,
-    "target_branch": "master",
+    "target_branch": "main",
     "target_project_id": 910,
     "time_estimate": 0,
     "title": "Add new file",
@@ -65,7 +65,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
@@ -83,7 +83,7 @@
       "namespace": "Quan Hoang",
       "visibility_level": 0,
       "path_with_namespace": "quan.hoang/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/quan.hoang/atlantis-example",
       "url": "git@gitlab.com:quan.hoang/atlantis-example.git",
diff --git a/server/events/testdata/gitlab-merge-request-event.json b/server/events/testdata/gitlab-merge-request-event.json
index 8c27cfd34a..60be8d9726 100644
--- a/server/events/testdata/gitlab-merge-request-event.json
+++ b/server/events/testdata/gitlab-merge-request-event.json
@@ -17,7 +17,7 @@
     "namespace": "lkysow",
     "visibility_level": 20,
     "path_with_namespace": "lkysow/atlantis-example",
-    "default_branch": "master",
+    "default_branch": "main",
     "ci_config_path": null,
     "homepage": "https://gitlab.com/lkysow/atlantis-example",
     "url": "git@gitlab.com:lkysow/atlantis-example.git",
@@ -46,7 +46,7 @@
     "source_branch": "patch-1",
     "source_project_id": 4580910,
     "state": "opened",
-    "target_branch": "master",
+    "target_branch": "main",
     "target_project_id": 4580910,
     "time_estimate": 0,
     "title": "Update main.tf",
@@ -64,7 +64,7 @@
       "namespace": "sourceorg",
       "visibility_level": 20,
       "path_with_namespace": "sourceorg/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/sourceorg/atlantis-example",
       "url": "git@gitlab.com:sourceorg/atlantis-example.git",
@@ -82,7 +82,7 @@
       "namespace": "lkysow",
       "visibility_level": 20,
       "path_with_namespace": "lkysow/atlantis-example",
-      "default_branch": "master",
+      "default_branch": "main",
       "ci_config_path": null,
       "homepage": "https://gitlab.com/lkysow/atlantis-example",
       "url": "git@gitlab.com:lkysow/atlantis-example.git",
@@ -146,7 +146,7 @@
     },
     "target_branch": {
       "previous": null,
-      "current": "master"
+      "current": "main"
     },
     "target_project_id": {
       "previous": null,
diff --git a/server/events/vcs/azuredevops_client.go b/server/events/vcs/azuredevops_client.go
index c8aaa52b26..72aaf0ccdb 100644
--- a/server/events/vcs/azuredevops_client.go
+++ b/server/events/vcs/azuredevops_client.go
@@ -306,7 +306,7 @@ func (g *AzureDevopsClient) MergePull(pull models.PullRequest, pullOptions model
 		return fmt.Errorf("the user %s is not found in the organization %s", g.UserName, owner)
 	}
 
-	imageURL := "https://github.com/runatlantis/atlantis/raw/master/runatlantis.io/.vuepress/public/hero.png"
+	imageURL := "https://github.com/runatlantis/atlantis/raw/main/runatlantis.io/.vuepress/public/hero.png"
 	id := azuredevops.IdentityRef{
 		Descriptor: &descriptor,
 		ID:         userID,
diff --git a/server/events/vcs/bitbucketcloud/testdata/pull-approved-by-author.json b/server/events/vcs/bitbucketcloud/testdata/pull-approved-by-author.json
index ae0fc85812..7930cbb0bc 100644
--- a/server/events/vcs/bitbucketcloud/testdata/pull-approved-by-author.json
+++ b/server/events/vcs/bitbucketcloud/testdata/pull-approved-by-author.json
@@ -82,7 +82,7 @@
       "uuid": "{94189367-116b-436a-9f77-2314b97a6067}"
     },
     "branch": {
-      "name": "master"
+      "name": "main"
     }
   },
   "created_on": "2019-02-12T16:48:04.251028+00:00",
diff --git a/server/events/vcs/bitbucketcloud/testdata/pull-approved-multiple.json b/server/events/vcs/bitbucketcloud/testdata/pull-approved-multiple.json
index 97e819dac3..5adbea01cf 100644
--- a/server/events/vcs/bitbucketcloud/testdata/pull-approved-multiple.json
+++ b/server/events/vcs/bitbucketcloud/testdata/pull-approved-multiple.json
@@ -82,7 +82,7 @@
       "uuid": "{94189367-116b-436a-9f77-2314b97a6067}"
     },
     "branch": {
-      "name": "master"
+      "name": "main"
     }
   },
   "created_on": "2019-02-12T16:48:04.251028+00:00",
diff --git a/server/events/vcs/bitbucketcloud/testdata/pull-approved.json b/server/events/vcs/bitbucketcloud/testdata/pull-approved.json
index 9829217dc6..281103dfd8 100644
--- a/server/events/vcs/bitbucketcloud/testdata/pull-approved.json
+++ b/server/events/vcs/bitbucketcloud/testdata/pull-approved.json
@@ -82,7 +82,7 @@
       "uuid": "{94189367-116b-436a-9f77-2314b97a6067}"
     },
     "branch": {
-      "name": "master"
+      "name": "main"
     }
   },
   "created_on": "2019-02-12T16:48:04.251028+00:00",
diff --git a/server/events/vcs/bitbucketcloud/testdata/pull-unapproved.json b/server/events/vcs/bitbucketcloud/testdata/pull-unapproved.json
index 8db3811f76..3439b7cde4 100644
--- a/server/events/vcs/bitbucketcloud/testdata/pull-unapproved.json
+++ b/server/events/vcs/bitbucketcloud/testdata/pull-unapproved.json
@@ -82,7 +82,7 @@
       "uuid": "{94189367-116b-436a-9f77-2314b97a6067}"
     },
     "branch": {
-      "name": "master"
+      "name": "main"
     }
   },
   "created_on": "2019-02-12T16:48:04.251028+00:00",
diff --git a/server/events/vcs/bitbucketserver/client.go b/server/events/vcs/bitbucketserver/client.go
index 7449234187..88ba703272 100644
--- a/server/events/vcs/bitbucketserver/client.go
+++ b/server/events/vcs/bitbucketserver/client.go
@@ -300,7 +300,11 @@ func (b *Client) prepRequest(method string, path string, body io.Reader) (*http.
 	if err != nil {
 		return nil, err
 	}
-	req.SetBasicAuth(b.Username, b.Password)
+
+	// Personal access tokens can be sent as basic auth or bearer
+	bearer := "Bearer " + b.Password
+	req.Header.Add("Authorization", bearer)
+
 	if body != nil {
 		req.Header.Add("Content-Type", "application/json")
 	}
diff --git a/server/events/vcs/bitbucketserver/request_validation_test.go b/server/events/vcs/bitbucketserver/request_validation_test.go
index 9b9d5228a4..4e418c3d0a 100644
--- a/server/events/vcs/bitbucketserver/request_validation_test.go
+++ b/server/events/vcs/bitbucketserver/request_validation_test.go
@@ -16,7 +16,7 @@ func TestValidateSignature(t *testing.T) {
 }
 
 func TestValidateSignature_Invalid(t *testing.T) {
-	body := `"eventKey":"pr:comment:added","date":"2018-07-24T15:10:05+0200","actor":{"name":"lkysow","emailAddress":"lkysow@gmail.com","id":1,"displayName":"Luke Kysow","active":true,"slug":"lkysow","type":"NORMAL"},"pullRequest":{"id":5,"version":0,"title":"another.tf edited online with Bitbucket","state":"OPEN","open":true,"closed":false,"createdDate":1532365427513,"updatedDate":1532365427513,"fromRef":{"id":"refs/heads/lkysow/anothertf-1532365422773","displayId":"lkysow/anothertf-1532365422773","latestCommit":"b52b8e254e956654dcdb394d0ccba9199f420427","repository":{"slug":"atlantis-example","id":1,"name":"atlantis-example","scmId":"git","state":"AVAILABLE","statusMessage":"Available","forkable":true,"project":{"key":"AT","id":1,"name":"atlantis","public":false,"type":"NORMAL"},"public":false}},"toRef":{"id":"refs/heads/master","displayId":"master","latestCommit":"0a338874369017deba7c22e99e6000932724282f","repository":{"slug":"atlantis-example","id":1,"name":"atlantis-example","scmId":"git","state":"AVAILABLE","statusMessage":"Available","forkable":true,"project":{"key":"AT","id":1,"name":"atlantis","public":false,"type":"NORMAL"},"public":false}},"locked":false,"author":{"user":{"name":"lkysow","emailAddress":"lkysow@gmail.com","id":1,"displayName":"Luke Kysow","active":true,"slug":"lkysow","type":"NORMAL"},"role":"AUTHOR","approved":false,"status":"UNAPPROVED"},"reviewers":[],"participants":[]},"comment":{"properties":{"repositoryId":1},"id":65,"version":0,"text":"comment","author":{"name":"lkysow","emailAddress":"lkysow@gmail.com","id":1,"displayName":"Luke Kysow","active":true,"slug":"lkysow","type":"NORMAL"},"createdDate":1532437805137,"updatedDate":1532437805137,"comments":[],"tasks":[]}}`
+	body := `"eventKey":"pr:comment:added","date":"2018-07-24T15:10:05+0200","actor":{"name":"lkysow","emailAddress":"lkysow@gmail.com","id":1,"displayName":"Luke Kysow","active":true,"slug":"lkysow","type":"NORMAL"},"pullRequest":{"id":5,"version":0,"title":"another.tf edited online with Bitbucket","state":"OPEN","open":true,"closed":false,"createdDate":1532365427513,"updatedDate":1532365427513,"fromRef":{"id":"refs/heads/lkysow/anothertf-1532365422773","displayId":"lkysow/anothertf-1532365422773","latestCommit":"b52b8e254e956654dcdb394d0ccba9199f420427","repository":{"slug":"atlantis-example","id":1,"name":"atlantis-example","scmId":"git","state":"AVAILABLE","statusMessage":"Available","forkable":true,"project":{"key":"AT","id":1,"name":"atlantis","public":false,"type":"NORMAL"},"public":false}},"toRef":{"id":"refs/heads/main","displayId":"main","latestCommit":"0a338874369017deba7c22e99e6000932724282f","repository":{"slug":"atlantis-example","id":1,"name":"atlantis-example","scmId":"git","state":"AVAILABLE","statusMessage":"Available","forkable":true,"project":{"key":"AT","id":1,"name":"atlantis","public":false,"type":"NORMAL"},"public":false}},"locked":false,"author":{"user":{"name":"lkysow","emailAddress":"lkysow@gmail.com","id":1,"displayName":"Luke Kysow","active":true,"slug":"lkysow","type":"NORMAL"},"role":"AUTHOR","approved":false,"status":"UNAPPROVED"},"reviewers":[],"participants":[]},"comment":{"properties":{"repositoryId":1},"id":65,"version":0,"text":"comment","author":{"name":"lkysow","emailAddress":"lkysow@gmail.com","id":1,"displayName":"Luke Kysow","active":true,"slug":"lkysow","type":"NORMAL"},"createdDate":1532437805137,"updatedDate":1532437805137,"comments":[],"tasks":[]}}`
 	secret := "mysecret"
 	sig := `sha256=ed11f92d1565a4de586727fe8260558277d58009e8957a79eb4749a7009ce083`
 	err := bitbucketserver.ValidateSignature([]byte(body), sig, []byte(secret))
diff --git a/server/events/vcs/bitbucketserver/testdata/pull-request.json b/server/events/vcs/bitbucketserver/testdata/pull-request.json
index 2f816b7eec..ee83effcf9 100644
--- a/server/events/vcs/bitbucketserver/testdata/pull-request.json
+++ b/server/events/vcs/bitbucketserver/testdata/pull-request.json
@@ -55,8 +55,8 @@
     }
   },
   "toRef": {
-    "id": "refs/heads/master",
-    "displayId": "master",
+    "id": "refs/heads/main",
+    "displayId": "main",
     "latestCommit": "59e03b9cc44e16e20741e328faaac26e377c07bf",
     "repository": {
       "slug": "example",
diff --git a/server/events/vcs/fixtures/fixtures.go b/server/events/vcs/fixtures/fixtures.go
index 5d02277f06..a6e9d2b20b 100644
--- a/server/events/vcs/fixtures/fixtures.go
+++ b/server/events/vcs/fixtures/fixtures.go
@@ -113,7 +113,7 @@ var ADPullCompleted = azuredevops.GitPullRequest{
 }
 
 var ADRepo = azuredevops.GitRepository{
-	DefaultBranch: azuredevops.String("refs/heads/master"),
+	DefaultBranch: azuredevops.String("refs/heads/main"),
 	Name:          azuredevops.String("repo"),
 	ParentRepository: &azuredevops.GitRepositoryRef{
 		Name: azuredevops.String("owner"),
@@ -279,7 +279,7 @@ var ADSelfPullCompleted = azuredevops.GitPullRequest{
 }
 
 var ADSelfRepo = azuredevops.GitRepository{
-	DefaultBranch: azuredevops.String("refs/heads/master"),
+	DefaultBranch: azuredevops.String("refs/heads/main"),
 	Name:          azuredevops.String("repo"),
 	ParentRepository: &azuredevops.GitRepositoryRef{
 		Name: azuredevops.String("owner"),
@@ -582,7 +582,7 @@ var githubAppTokenJSON = `{
 			"stargazers_count":  80,
 			"watchers_count":    80,
 			"size":              108,
-			"default_branch":    "master",
+			"default_branch":    "main",
 			"open_issues_count": 0,
 			"is_template":       true,
 			"topics": [
diff --git a/server/events/vcs/fixtures/github-commit-check-suites.json b/server/events/vcs/fixtures/github-commit-check-suites.json
index 55f3ac972e..017aee7e01 100644
--- a/server/events/vcs/fixtures/github-commit-check-suites.json
+++ b/server/events/vcs/fixtures/github-commit-check-suites.json
@@ -26,7 +26,7 @@
                         }
                     },
                     "base": {
-                        "ref": "master",
+                        "ref": "main",
                         "sha": "6f5744874b33ceb6a5c91edc91085991dbd1f61a",
                         "repo": {
                             "id": 474926944,
diff --git a/server/events/vcs/fixtures/github-pull-request.json b/server/events/vcs/fixtures/github-pull-request.json
index a0846cc499..6b37a00686 100644
--- a/server/events/vcs/fixtures/github-pull-request.json
+++ b/server/events/vcs/fixtures/github-pull-request.json
@@ -290,7 +290,7 @@
       "stargazers_count": 80,
       "watchers_count": 80,
       "size": 108,
-      "default_branch": "master",
+      "default_branch": "main",
       "open_issues_count": 0,
       "topics": [
         "octocat",
@@ -320,8 +320,8 @@
     }
   },
   "base": {
-    "label": "master",
-    "ref": "master",
+    "label": "main",
+    "ref": "main",
     "sha": "6dcb09b5b57875f334f61aebed695e2e4193db5e",
     "user": {
       "login": "octocat",
@@ -420,7 +420,7 @@
       "stargazers_count": 80,
       "watchers_count": 80,
       "size": 108,
-      "default_branch": "master",
+      "default_branch": "main",
       "open_issues_count": 0,
       "topics": [
         "octocat",
diff --git a/server/events/vcs/fixtures/github-repo.json b/server/events/vcs/fixtures/github-repo.json
index 3012d24771..21999374bb 100644
--- a/server/events/vcs/fixtures/github-repo.json
+++ b/server/events/vcs/fixtures/github-repo.json
@@ -89,7 +89,7 @@
   "forks": 0,
   "open_issues": 1,
   "watchers": 0,
-  "default_branch": "master",
+  "default_branch": "main",
   "permissions": {
     "admin": true,
     "push": true,
diff --git a/server/events/vcs/github_client_test.go b/server/events/vcs/github_client_test.go
index ee447bf88b..77e50dd85e 100644
--- a/server/events/vcs/github_client_test.go
+++ b/server/events/vcs/github_client_test.go
@@ -702,7 +702,7 @@ func TestGithubClient_PullIsMergeableWithAllowMergeableBypassApply(t *testing.T)
 						w.Write([]byte(commitJSON)) // nolint: errcheck
 					case "/api/graphql":
 						w.Write([]byte(reviewDecision)) // nolint: errcheck
-					case "/api/v3/repos/owner/repo/branches/master/protection":
+					case "/api/v3/repos/owner/repo/branches/main/protection":
 						w.Write([]byte(branchProtectionJSON)) // nolint: errcheck
 					case "/api/v3/repos/owner/repo/commits/new-topic/check-suites":
 						w.Write([]byte(checkSuites)) // nolint: errcheck
diff --git a/server/events/vcs/github_credentials.go b/server/events/vcs/github_credentials.go
index d70376c14d..ef64cbce7b 100644
--- a/server/events/vcs/github_credentials.go
+++ b/server/events/vcs/github_credentials.go
@@ -108,7 +108,7 @@ func (c *GithubAppCredentials) GetUser() (string, error) {
 	}
 	// Currently there is no way to get the bot's login info, so this is a
 	// hack until Github exposes that.
-	return fmt.Sprintf("%s[bot]", app.GetName()), nil
+	return fmt.Sprintf("%s[bot]", app.GetSlug()), nil
 }
 
 // GetToken returns a fresh installation token.
diff --git a/server/events/vcs/github_credentials_test.go b/server/events/vcs/github_credentials_test.go
index 08b3de6171..1150194d06 100644
--- a/server/events/vcs/github_credentials_test.go
+++ b/server/events/vcs/github_credentials_test.go
@@ -30,7 +30,7 @@ func TestGithubClient_GetUser_AppSlug(t *testing.T) {
 	user, err := appCreds.GetUser()
 	Ok(t, err)
 
-	Assert(t, user == "Octocat App[bot]", "user should not empty")
+	Assert(t, user == "octoapp[bot]", "user should not be empty")
 }
 
 func TestGithubClient_AppAuthentication(t *testing.T) {
diff --git a/server/events/vcs/gitlab_client.go b/server/events/vcs/gitlab_client.go
index feeacc3573..26eb93f223 100644
--- a/server/events/vcs/gitlab_client.go
+++ b/server/events/vcs/gitlab_client.go
@@ -249,6 +249,7 @@ func (g *GitlabClient) UpdateStatus(repo models.Repo, pull models.PullRequest, s
 		Context:     gitlab.String(src),
 		Description: gitlab.String(description),
 		TargetURL:   &url,
+		Ref:         gitlab.String(pull.HeadBranch),
 	})
 	return err
 }
diff --git a/server/events/vcs/gitlab_client_test.go b/server/events/vcs/gitlab_client_test.go
index cd16009d0e..bbc6ace218 100644
--- a/server/events/vcs/gitlab_client_test.go
+++ b/server/events/vcs/gitlab_client_test.go
@@ -212,7 +212,7 @@ func TestGitlabClient_UpdateStatus(t *testing.T) {
 
 						body, err := io.ReadAll(r.Body)
 						Ok(t, err)
-						exp := fmt.Sprintf(`{"state":"%s","context":"src","target_url":"https://google.com","description":"description"}`, c.expState)
+						exp := fmt.Sprintf(`{"state":"%s","ref":"test","context":"src","target_url":"https://google.com","description":"description"}`, c.expState)
 						Equals(t, exp, string(body))
 						defer r.Body.Close()  // nolint: errcheck
 						w.Write([]byte("{}")) // nolint: errcheck
@@ -241,6 +241,7 @@ func TestGitlabClient_UpdateStatus(t *testing.T) {
 				Num:        1,
 				BaseRepo:   repo,
 				HeadCommit: "sha",
+				HeadBranch: "test",
 			}, c.status, "src", "description", "https://google.com")
 			Ok(t, err)
 			Assert(t, gotRequest, "expected to get the request")
diff --git a/server/events/vcs/instrumented_client.go b/server/events/vcs/instrumented_client.go
index d52d13bc89..6e8c4e6d60 100644
--- a/server/events/vcs/instrumented_client.go
+++ b/server/events/vcs/instrumented_client.go
@@ -53,6 +53,7 @@ type InstrumentedGithubClient struct {
 
 func (c *InstrumentedGithubClient) GetPullRequest(repo models.Repo, pullNum int) (*github.PullRequest, error) {
 	scope := c.StatsScope.SubScope("get_pull_request")
+	scope = SetGitScopeTags(scope, repo.FullName, pullNum)
 	logger := c.Logger.WithHistory([]interface{}{
 		"repository", fmt.Sprintf("%s/%s", repo.Owner, repo.Name),
 		"pull-num", strconv.Itoa(pullNum),
@@ -85,6 +86,7 @@ type InstrumentedClient struct {
 
 func (c *InstrumentedClient) GetModifiedFiles(repo models.Repo, pull models.PullRequest) ([]string, error) {
 	scope := c.StatsScope.SubScope("get_modified_files")
+	scope = SetGitScopeTags(scope, repo.FullName, pull.Num)
 	logger := c.Logger.WithHistory(fmtLogSrc(repo, pull.Num)...)
 
 	executionTime := scope.Timer(metrics.ExecutionTimeMetric).Start()
@@ -107,6 +109,7 @@ func (c *InstrumentedClient) GetModifiedFiles(repo models.Repo, pull models.Pull
 }
 func (c *InstrumentedClient) CreateComment(repo models.Repo, pullNum int, comment string, command string) error {
 	scope := c.StatsScope.SubScope("create_comment")
+	scope = SetGitScopeTags(scope, repo.FullName, pullNum)
 	logger := c.Logger.WithHistory(fmtLogSrc(repo, pullNum)...)
 
 	executionTime := scope.Timer(metrics.ExecutionTimeMetric).Start()
@@ -126,6 +129,7 @@ func (c *InstrumentedClient) CreateComment(repo models.Repo, pullNum int, commen
 }
 func (c *InstrumentedClient) HidePrevCommandComments(repo models.Repo, pullNum int, command string) error {
 	scope := c.StatsScope.SubScope("hide_prev_plan_comments")
+	scope = SetGitScopeTags(scope, repo.FullName, pullNum)
 	logger := c.Logger.WithHistory(fmtLogSrc(repo, pullNum)...)
 
 	executionTime := scope.Timer(metrics.ExecutionTimeMetric).Start()
@@ -146,6 +150,7 @@ func (c *InstrumentedClient) HidePrevCommandComments(repo models.Repo, pullNum i
 }
 func (c *InstrumentedClient) PullIsApproved(repo models.Repo, pull models.PullRequest) (models.ApprovalStatus, error) {
 	scope := c.StatsScope.SubScope("pull_is_approved")
+	scope = SetGitScopeTags(scope, repo.FullName, pull.Num)
 	logger := c.Logger.WithHistory(fmtLogSrc(repo, pull.Num)...)
 
 	executionTime := scope.Timer(metrics.ExecutionTimeMetric).Start()
@@ -168,6 +173,7 @@ func (c *InstrumentedClient) PullIsApproved(repo models.Repo, pull models.PullRe
 }
 func (c *InstrumentedClient) PullIsMergeable(repo models.Repo, pull models.PullRequest, vcsstatusname string) (bool, error) {
 	scope := c.StatsScope.SubScope("pull_is_mergeable")
+	scope = SetGitScopeTags(scope, repo.FullName, pull.Num)
 	logger := c.Logger.WithHistory(fmtLogSrc(repo, pull.Num)...)
 
 	executionTime := scope.Timer(metrics.ExecutionTimeMetric).Start()
@@ -190,6 +196,7 @@ func (c *InstrumentedClient) PullIsMergeable(repo models.Repo, pull models.PullR
 
 func (c *InstrumentedClient) UpdateStatus(repo models.Repo, pull models.PullRequest, state models.CommitStatus, src string, description string, url string) error {
 	scope := c.StatsScope.SubScope("update_status")
+	scope = SetGitScopeTags(scope, repo.FullName, pull.Num)
 	logger := c.Logger.WithHistory(fmtLogSrc(repo, pull.Num)...)
 
 	executionTime := scope.Timer(metrics.ExecutionTimeMetric).Start()
@@ -210,6 +217,7 @@ func (c *InstrumentedClient) UpdateStatus(repo models.Repo, pull models.PullRequ
 }
 func (c *InstrumentedClient) MergePull(pull models.PullRequest, pullOptions models.PullRequestOptions) error {
 	scope := c.StatsScope.SubScope("merge_pull")
+	scope = SetGitScopeTags(scope, pull.BaseRepo.FullName, pull.Num)
 	logger := c.Logger.WithHistory("pull-num", pull.Num)
 
 	executionTime := scope.Timer(metrics.ExecutionTimeMetric).Start()
@@ -235,3 +243,10 @@ func fmtLogSrc(repo models.Repo, pullNum int) []interface{} {
 		"pull-num", strconv.Itoa(pullNum),
 	}
 }
+
+func SetGitScopeTags(scope tally.Scope, repoFullName string, pullNum int) tally.Scope {
+	return scope.Tagged(map[string]string{
+		"base_repo": repoFullName,
+		"pr_number": strconv.Itoa(pullNum),
+	})
+}
diff --git a/server/events/webhooks/mocks/matchers/applyresult.go b/server/events/webhooks/mocks/matchers/applyresult.go
new file mode 100644
index 0000000000..abe805e2c3
--- /dev/null
+++ b/server/events/webhooks/mocks/matchers/applyresult.go
@@ -0,0 +1,32 @@
+// Code generated by pegomock. DO NOT EDIT.
+package matchers
+
+import (
+	"github.com/petergtz/pegomock"
+	"reflect"
+	"github.com/runatlantis/atlantis/server/events/webhooks"
+)
+
+func AnyApplyResult() webhooks.ApplyResult {
+	pegomock.RegisterMatcher(pegomock.NewAnyMatcher(reflect.TypeOf((*(webhooks.ApplyResult))(nil)).Elem()))
+	var nullValue webhooks.ApplyResult
+	return nullValue
+}
+
+func EqApplyResult(value webhooks.ApplyResult) webhooks.ApplyResult {
+	pegomock.RegisterMatcher(&pegomock.EqMatcher{Value: value})
+	var nullValue webhooks.ApplyResult
+	return nullValue
+}
+
+func NotEqApplyResult(value webhooks.ApplyResult) webhooks.ApplyResult {
+	pegomock.RegisterMatcher(&pegomock.NotEqMatcher{Value: value})
+	var nullValue webhooks.ApplyResult
+	return nullValue
+}
+
+func ApplyResultThat(matcher pegomock.ArgumentMatcher) webhooks.ApplyResult {
+	pegomock.RegisterMatcher(matcher)
+	var nullValue webhooks.ApplyResult
+	return nullValue
+}
diff --git a/server/events/webhooks/mocks/matchers/ptr_to_slack_authtestresponse.go b/server/events/webhooks/mocks/matchers/ptr_to_slack_authtestresponse.go
index 958bfd2eb4..e72dd126ea 100644
--- a/server/events/webhooks/mocks/matchers/ptr_to_slack_authtestresponse.go
+++ b/server/events/webhooks/mocks/matchers/ptr_to_slack_authtestresponse.go
@@ -2,11 +2,10 @@
 package matchers
 
 import (
-	"reflect"
-
 	"github.com/petergtz/pegomock"
+	"reflect"
 
-	slack "github.com/nlopes/slack"
+	slack "github.com/slack-go/slack"
 )
 
 func AnyPtrToSlackAuthTestResponse() *slack.AuthTestResponse {
diff --git a/server/events/webhooks/mocks/matchers/ptr_to_slack_getconversationsparameters.go b/server/events/webhooks/mocks/matchers/ptr_to_slack_getconversationsparameters.go
index 54831bd3d4..bb28620ee6 100644
--- a/server/events/webhooks/mocks/matchers/ptr_to_slack_getconversationsparameters.go
+++ b/server/events/webhooks/mocks/matchers/ptr_to_slack_getconversationsparameters.go
@@ -2,11 +2,10 @@
 package matchers
 
 import (
-	"reflect"
-
 	"github.com/petergtz/pegomock"
+	"reflect"
 
-	slack "github.com/nlopes/slack"
+	slack "github.com/slack-go/slack"
 )
 
 func AnyPtrToSlackGetConversationsParameters() *slack.GetConversationsParameters {
diff --git a/server/events/webhooks/mocks/matchers/slack_msgoption.go b/server/events/webhooks/mocks/matchers/slack_msgoption.go
new file mode 100644
index 0000000000..07da475122
--- /dev/null
+++ b/server/events/webhooks/mocks/matchers/slack_msgoption.go
@@ -0,0 +1,33 @@
+// Code generated by pegomock. DO NOT EDIT.
+package matchers
+
+import (
+	"github.com/petergtz/pegomock"
+	"reflect"
+
+	slack "github.com/slack-go/slack"
+)
+
+func AnySlackMsgOption() slack.MsgOption {
+	pegomock.RegisterMatcher(pegomock.NewAnyMatcher(reflect.TypeOf((*(slack.MsgOption))(nil)).Elem()))
+	var nullValue slack.MsgOption
+	return nullValue
+}
+
+func EqSlackMsgOption(value slack.MsgOption) slack.MsgOption {
+	pegomock.RegisterMatcher(&pegomock.EqMatcher{Value: value})
+	var nullValue slack.MsgOption
+	return nullValue
+}
+
+func NotEqSlackMsgOption(value slack.MsgOption) slack.MsgOption {
+	pegomock.RegisterMatcher(&pegomock.NotEqMatcher{Value: value})
+	var nullValue slack.MsgOption
+	return nullValue
+}
+
+func SlackMsgOptionThat(matcher pegomock.ArgumentMatcher) slack.MsgOption {
+	pegomock.RegisterMatcher(matcher)
+	var nullValue slack.MsgOption
+	return nullValue
+}
diff --git a/server/events/webhooks/mocks/matchers/slack_postmessageparameters.go b/server/events/webhooks/mocks/matchers/slack_postmessageparameters.go
index e5ae68a619..8921c115aa 100644
--- a/server/events/webhooks/mocks/matchers/slack_postmessageparameters.go
+++ b/server/events/webhooks/mocks/matchers/slack_postmessageparameters.go
@@ -6,7 +6,7 @@ import (
 
 	"github.com/petergtz/pegomock"
 
-	slack "github.com/nlopes/slack"
+	slack "github.com/slack-go/slack"
 )
 
 func AnySlackPostMessageParameters() slack.PostMessageParameters {
diff --git a/server/events/webhooks/mocks/matchers/slice_of_slack_channel.go b/server/events/webhooks/mocks/matchers/slice_of_slack_channel.go
index 37ab8bf1eb..f74467c9bf 100644
--- a/server/events/webhooks/mocks/matchers/slice_of_slack_channel.go
+++ b/server/events/webhooks/mocks/matchers/slice_of_slack_channel.go
@@ -2,11 +2,10 @@
 package matchers
 
 import (
-	"reflect"
-
 	"github.com/petergtz/pegomock"
+	"reflect"
 
-	slack "github.com/nlopes/slack"
+	slack "github.com/slack-go/slack"
 )
 
 func AnySliceOfSlackChannel() []slack.Channel {
diff --git a/server/events/webhooks/mocks/mock_slack_client.go b/server/events/webhooks/mocks/mock_slack_client.go
index 825d3387d2..1e96692ede 100644
--- a/server/events/webhooks/mocks/mock_slack_client.go
+++ b/server/events/webhooks/mocks/mock_slack_client.go
@@ -1,13 +1,12 @@
 // Code generated by pegomock. DO NOT EDIT.
-// Source: github.com/runatlantis/atlantis/server/events/webhooks (interfaces: SlackClient)
+// Source: slack_client.go
 
 package mocks
 
 import (
+	pegomock "github.com/petergtz/pegomock"
 	"reflect"
 	"time"
-
-	pegomock "github.com/petergtz/pegomock"
 	webhooks "github.com/runatlantis/atlantis/server/events/webhooks"
 )
 
diff --git a/server/events/webhooks/mocks/mock_underlying_slack_client.go b/server/events/webhooks/mocks/mock_underlying_slack_client.go
index db558eae87..27dfa46e4a 100644
--- a/server/events/webhooks/mocks/mock_underlying_slack_client.go
+++ b/server/events/webhooks/mocks/mock_underlying_slack_client.go
@@ -7,7 +7,7 @@ import (
 	"reflect"
 	"time"
 
-	slack "github.com/nlopes/slack"
+	slack "github.com/slack-go/slack"
 	pegomock "github.com/petergtz/pegomock"
 )
 
@@ -68,11 +68,14 @@ func (mock *MockUnderlyingSlackClient) GetConversations(conversationParams *slac
 	return ret0, ret1, ret2
 }
 
-func (mock *MockUnderlyingSlackClient) PostMessage(channel string, text string, parameters slack.PostMessageParameters) (string, string, error) {
+func (mock *MockUnderlyingSlackClient) PostMessage(channelID string, options ...slack.MsgOption) (string, string, error) {
 	if mock == nil {
 		panic("mock must not be nil. Use myMock := NewMockUnderlyingSlackClient().")
 	}
-	params := []pegomock.Param{channel, text, parameters}
+	params := []pegomock.Param{channelID}
+	for _, param := range options {
+		params = append(params, param)
+	}
 	result := pegomock.GetGenericMockFrom(mock).Invoke("PostMessage", params, []reflect.Type{reflect.TypeOf((*string)(nil)).Elem(), reflect.TypeOf((*string)(nil)).Elem(), reflect.TypeOf((*error)(nil)).Elem()})
 	var ret0 string
 	var ret1 string
@@ -172,8 +175,11 @@ func (c *MockUnderlyingSlackClient_GetConversations_OngoingVerification) GetAllC
 	return
 }
 
-func (verifier *VerifierMockUnderlyingSlackClient) PostMessage(channel string, text string, parameters slack.PostMessageParameters) *MockUnderlyingSlackClient_PostMessage_OngoingVerification {
-	params := []pegomock.Param{channel, text, parameters}
+func (verifier *VerifierMockUnderlyingSlackClient) PostMessage(channelID string, options ...slack.MsgOption) *MockUnderlyingSlackClient_PostMessage_OngoingVerification {
+	params := []pegomock.Param{channelID}
+	for _, param := range options {
+		params = append(params, param)
+	}
 	methodInvocations := pegomock.GetGenericMockFrom(verifier.mock).Verify(verifier.inOrderContext, verifier.invocationCountMatcher, "PostMessage", params, verifier.timeout)
 	return &MockUnderlyingSlackClient_PostMessage_OngoingVerification{mock: verifier.mock, methodInvocations: methodInvocations}
 }
@@ -183,25 +189,26 @@ type MockUnderlyingSlackClient_PostMessage_OngoingVerification struct {
 	methodInvocations []pegomock.MethodInvocation
 }
 
-func (c *MockUnderlyingSlackClient_PostMessage_OngoingVerification) GetCapturedArguments() (string, string, slack.PostMessageParameters) {
-	channel, text, parameters := c.GetAllCapturedArguments()
-	return channel[len(channel)-1], text[len(text)-1], parameters[len(parameters)-1]
+func (c *MockUnderlyingSlackClient_PostMessage_OngoingVerification) GetCapturedArguments() (string, []slack.MsgOption) {
+	channelID, options := c.GetAllCapturedArguments()
+	return channelID[len(channelID)-1], options[len(options)-1]
 }
 
-func (c *MockUnderlyingSlackClient_PostMessage_OngoingVerification) GetAllCapturedArguments() (_param0 []string, _param1 []string, _param2 []slack.PostMessageParameters) {
+func (c *MockUnderlyingSlackClient_PostMessage_OngoingVerification) GetAllCapturedArguments() (_param0 []string, _param1 [][]slack.MsgOption) {
 	params := pegomock.GetGenericMockFrom(c.mock).GetInvocationParams(c.methodInvocations)
 	if len(params) > 0 {
 		_param0 = make([]string, len(c.methodInvocations))
 		for u, param := range params[0] {
 			_param0[u] = param.(string)
 		}
-		_param1 = make([]string, len(c.methodInvocations))
-		for u, param := range params[1] {
-			_param1[u] = param.(string)
-		}
-		_param2 = make([]slack.PostMessageParameters, len(c.methodInvocations))
-		for u, param := range params[2] {
-			_param2[u] = param.(slack.PostMessageParameters)
+		_param1 = make([][]slack.MsgOption, len(c.methodInvocations))
+		for u := 0; u < len(c.methodInvocations); u++ {
+			_param1[u] = make([]slack.MsgOption, len(params)-1)
+			for x := 1; x < len(params); x++ {
+				if params[x][u] != nil {
+					_param1[u][x-1] = params[x][u].(slack.MsgOption)
+				}
+			}
 		}
 	}
 	return
diff --git a/server/events/webhooks/slack_client.go b/server/events/webhooks/slack_client.go
index d60837d81a..42fc9bfb4b 100644
--- a/server/events/webhooks/slack_client.go
+++ b/server/events/webhooks/slack_client.go
@@ -16,7 +16,7 @@ package webhooks
 import (
 	"fmt"
 
-	"github.com/nlopes/slack"
+	"github.com/slack-go/slack"
 )
 
 const (
@@ -40,7 +40,7 @@ type SlackClient interface {
 type UnderlyingSlackClient interface {
 	AuthTest() (response *slack.AuthTestResponse, error error)
 	GetConversations(conversationParams *slack.GetConversationsParameters) (channels []slack.Channel, nextCursor string, err error)
-	PostMessage(channel, text string, parameters slack.PostMessageParameters) (string, string, error)
+	PostMessage(channelID string, options ...slack.MsgOption) (string, string, error)
 }
 
 type DefaultSlackClient struct {
@@ -65,11 +65,13 @@ func (d *DefaultSlackClient) TokenIsSet() bool {
 }
 
 func (d *DefaultSlackClient) PostMessage(channel string, applyResult ApplyResult) error {
-	params := slack.NewPostMessageParameters()
-	params.Attachments = d.createAttachments(applyResult)
-	params.AsUser = true
-	params.EscapeText = false
-	_, _, err := d.Slack.PostMessage(channel, "", params)
+	attachments := d.createAttachments(applyResult)
+	_, _, err := d.Slack.PostMessage(
+		channel,
+		slack.MsgOptionAsUser(true),
+		slack.MsgOptionText("", false),
+		slack.MsgOptionAttachments(attachments[0]),
+	)
 	return err
 }
 
diff --git a/server/events/webhooks/slack_client_test.go b/server/events/webhooks/slack_client_test.go
index ea6157497e..d472489712 100644
--- a/server/events/webhooks/slack_client_test.go
+++ b/server/events/webhooks/slack_client_test.go
@@ -17,7 +17,6 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/nlopes/slack"
 	"github.com/runatlantis/atlantis/server/events/models"
 	"github.com/runatlantis/atlantis/server/events/webhooks"
 	"github.com/runatlantis/atlantis/server/events/webhooks/mocks"
@@ -57,12 +56,15 @@ func TestTokenIsSet(t *testing.T) {
 	Equals(t, true, c.TokenIsSet())
 }
 
+/*
+// The next 2 tests are commented out because they currently fail using the Pegamock's
+// VerifyWasCalledOnce using variadic parameters.
+// See issue https://github.com/petergtz/pegomock/issues/112
 func TestPostMessage_Success(t *testing.T) {
 	t.Log("When apply succeeds, function should succeed and indicate success")
 	setup(t)
 
-	expParams := slack.NewPostMessageParameters()
-	expParams.Attachments = []slack.Attachment{{
+	attachments := []slack.Attachment{{
 		Color: "good",
 		Text:  "Apply succeeded for <url|runatlantis/atlantis>",
 		Fields: []slack.AttachmentField{
@@ -83,30 +85,37 @@ func TestPostMessage_Success(t *testing.T) {
 			},
 		},
 	}}
-	expParams.AsUser = true
-	expParams.EscapeText = false
 
 	channel := "somechannel"
 	err := client.PostMessage(channel, result)
 	Ok(t, err)
-	underlying.VerifyWasCalledOnce().PostMessage(channel, "", expParams)
+	underlying.VerifyWasCalledOnce().PostMessage(
+		channel,
+		slack.MsgOptionAsUser(true),
+		slack.MsgOptionText("", false),
+		slack.MsgOptionAttachments(attachments[0]),
+	)
 
 	t.Log("When apply fails, function should succeed and indicate failure")
 	result.Success = false
-	expParams.Attachments[0].Color = "danger"
-	expParams.Attachments[0].Text = "Apply failed for <url|runatlantis/atlantis>"
+	attachments[0].Color = "danger"
+	attachments[0].Text = "Apply failed for <url|runatlantis/atlantis>"
 
 	err = client.PostMessage(channel, result)
 	Ok(t, err)
-	underlying.VerifyWasCalledOnce().PostMessage(channel, "", expParams)
+	underlying.VerifyWasCalledOnce().PostMessage(
+		channel,
+		slack.MsgOptionAsUser(true),
+		slack.MsgOptionText("", false),
+		slack.MsgOptionAttachments(attachments[0]),
+	)
 }
 
 func TestPostMessage_Error(t *testing.T) {
 	t.Log("When the underlying slack client errors, an error should be returned")
 	setup(t)
 
-	expParams := slack.NewPostMessageParameters()
-	expParams.Attachments = []slack.Attachment{{
+	attachments := []slack.Attachment{{
 		Color: "good",
 		Text:  "Apply succeeded for <url|runatlantis/atlantis>",
 		Fields: []slack.AttachmentField{
@@ -127,15 +136,19 @@ func TestPostMessage_Error(t *testing.T) {
 			},
 		},
 	}}
-	expParams.AsUser = true
-	expParams.EscapeText = false
 
 	channel := "somechannel"
-	When(underlying.PostMessage(channel, "", expParams)).ThenReturn("", "", errors.New(""))
+	When(underlying.PostMessage(
+		channel,
+		slack.MsgOptionAsUser(true),
+		slack.MsgOptionText("", false),
+		slack.MsgOptionAttachments(attachments[0]),
+	)).ThenReturn("", "", errors.New(""))
 
 	err := client.PostMessage(channel, result)
 	Assert(t, err != nil, "expected error")
 }
+*/
 
 func setup(t *testing.T) {
 	RegisterMockTestingT(t)
diff --git a/server/events/working_dir.go b/server/events/working_dir.go
index 6ede427ff6..5476f1791d 100644
--- a/server/events/working_dir.go
+++ b/server/events/working_dir.go
@@ -14,7 +14,6 @@
 package events
 
 import (
-	"context"
 	"fmt"
 	"os"
 	"os/exec"
@@ -26,7 +25,6 @@ import (
 	"github.com/pkg/errors"
 	"github.com/runatlantis/atlantis/server/events/models"
 	"github.com/runatlantis/atlantis/server/logging"
-	"golang.org/x/sync/semaphore"
 )
 
 const workingDirPrefix = "repos"
@@ -130,15 +128,15 @@ func (w *FileWorkspace) Clone(
 // warnDiverged returns true if we should warn the user that the branch we're
 // merging into has diverged from what we currently have checked out.
 // This matters in the case of the merge checkout strategy because after
-// cloning the repo and doing the merge, it's possible master was updated.
+// cloning the repo and doing the merge, it's possible main was updated.
 // Then users won't be getting the merge functionality they expected.
 // If there are any errors we return false since we prefer things to succeed
 // vs. stopping the plan/apply.
 func (w *FileWorkspace) warnDiverged(log logging.SimpleLogging, p models.PullRequest, headRepo models.Repo, cloneDir string) bool {
 	if !w.CheckoutMerge {
-		// It only makes sense to warn that master has diverged if we're using
+		// It only makes sense to warn that main has diverged if we're using
 		// the checkout merge strategy. If we're just checking out the branch,
-		// then it doesn't matter what's going on with master because we've
+		// then it doesn't matter what's going on with main because we've
 		// decided to always run off the branch.
 		return false
 	}
@@ -174,9 +172,9 @@ func (w *FileWorkspace) warnDiverged(log logging.SimpleLogging, p models.PullReq
 
 	hasDiverged := w.HasDiverged(log, cloneDir)
 	if hasDiverged {
-		log.Info("remote master branch is ahead and thereby has new commits, it is recommended to pull new commits")
+		log.Info("remote main branch is ahead and thereby has new commits, it is recommended to pull new commits")
 	} else {
-		log.Debug("remote master branch has no new commits")
+		log.Debug("remote main branch has no new commits")
 	}
 	return hasDiverged
 }
@@ -187,7 +185,7 @@ func (w *FileWorkspace) HasDiverged(log logging.SimpleLogging, cloneDir string)
 		// we assume false here for 'branch' strategy.
 		return false
 	}
-	// Check if remote master branch has diverged.
+	// Check if remote main branch has diverged.
 	statusUnoCmd := exec.Command("git", "status", "--untracked-files=no")
 	statusUnoCmd.Dir = cloneDir
 	outputStatusUno, err := statusUnoCmd.CombinedOutput()
@@ -204,15 +202,12 @@ func (w *FileWorkspace) forceClone(log logging.SimpleLogging,
 	headRepo models.Repo,
 	p models.PullRequest) error {
 
-	value, _ := cloneLocks.LoadOrStore(cloneDir, semaphore.NewWeighted(1))
-	sem := value.(*semaphore.Weighted)
+	value, _ := cloneLocks.LoadOrStore(cloneDir, new(sync.Mutex))
+	mutex := value.(*sync.Mutex)
 
-	defer sem.Release(1)
-	if acquired := sem.TryAcquire(1); !acquired {
-		err := sem.Acquire(context.TODO(), 1)
-		if err != nil {
-			return errors.Wrap(err, "waiting for repository to be cloned")
-		}
+	defer mutex.Unlock()
+	if locked := mutex.TryLock(); !locked {
+		mutex.Lock()
 		return nil
 	}
 
diff --git a/server/events/working_dir_test.go b/server/events/working_dir_test.go
index 6dc91231df..79ee18de50 100644
--- a/server/events/working_dir_test.go
+++ b/server/events/working_dir_test.go
@@ -28,12 +28,10 @@ func disableSSLVerification() func() {
 // Test that if we don't have any existing files, we check out the repo.
 func TestClone_NoneExisting(t *testing.T) {
 	// Initialize the git repo.
-	repoDir, cleanup := initRepo(t)
-	defer cleanup()
+	repoDir := initRepo(t)
 	expCommit := runCmd(t, repoDir, "git", "rev-parse", "HEAD")
 
-	dataDir, cleanup2 := TempDir(t)
-	defer cleanup2()
+	dataDir := t.TempDir()
 
 	wd := &events.FileWorkspace{
 		DataDir:                     dataDir,
@@ -57,23 +55,22 @@ func TestClone_NoneExisting(t *testing.T) {
 // successfully when we're using the merge method.
 func TestClone_CheckoutMergeNoneExisting(t *testing.T) {
 	// Initialize the git repo.
-	repoDir, cleanup := initRepo(t)
-	defer cleanup()
+	repoDir := initRepo(t)
 
-	// Add a commit to branch 'branch' that's not on master.
+	// Add a commit to branch 'branch' that's not on main.
 	runCmd(t, repoDir, "git", "checkout", "branch")
 	runCmd(t, repoDir, "touch", "branch-file")
 	runCmd(t, repoDir, "git", "add", "branch-file")
 	runCmd(t, repoDir, "git", "commit", "-m", "branch-commit")
 	branchCommit := runCmd(t, repoDir, "git", "rev-parse", "HEAD")
 
-	// Now switch back to master and advance the master branch by another
+	// Now switch back to main and advance the main branch by another
 	// commit.
-	runCmd(t, repoDir, "git", "checkout", "master")
-	runCmd(t, repoDir, "touch", "master-file")
-	runCmd(t, repoDir, "git", "add", "master-file")
-	runCmd(t, repoDir, "git", "commit", "-m", "master-commit")
-	masterCommit := runCmd(t, repoDir, "git", "rev-parse", "HEAD")
+	runCmd(t, repoDir, "git", "checkout", "main")
+	runCmd(t, repoDir, "touch", "main-file")
+	runCmd(t, repoDir, "git", "add", "main-file")
+	runCmd(t, repoDir, "git", "commit", "-m", "main-commit")
+	mainCommit := runCmd(t, repoDir, "git", "rev-parse", "HEAD")
 
 	// Finally, perform a merge in another branch ourselves, just so we know
 	// what the final state of the repo should be.
@@ -81,8 +78,7 @@ func TestClone_CheckoutMergeNoneExisting(t *testing.T) {
 	runCmd(t, repoDir, "git", "merge", "-m", "atlantis-merge", "branch")
 	expLsOutput := runCmd(t, repoDir, "ls")
 
-	dataDir, cleanup2 := TempDir(t)
-	defer cleanup2()
+	dataDir := t.TempDir()
 
 	overrideURL := fmt.Sprintf("file://%s", repoDir)
 	wd := &events.FileWorkspace{
@@ -96,7 +92,7 @@ func TestClone_CheckoutMergeNoneExisting(t *testing.T) {
 	cloneDir, hasDiverged, err := wd.Clone(logging.NewNoopLogger(t), models.Repo{}, models.PullRequest{
 		BaseRepo:   models.Repo{},
 		HeadBranch: "branch",
-		BaseBranch: "master",
+		BaseBranch: "main",
 	}, "default")
 	Ok(t, err)
 	Equals(t, false, hasDiverged)
@@ -104,7 +100,7 @@ func TestClone_CheckoutMergeNoneExisting(t *testing.T) {
 	// Check the commits.
 	actBaseCommit := runCmd(t, cloneDir, "git", "rev-parse", "HEAD~1")
 	actHeadCommit := runCmd(t, cloneDir, "git", "rev-parse", "HEAD^2")
-	Equals(t, masterCommit, actBaseCommit)
+	Equals(t, mainCommit, actBaseCommit)
 	Equals(t, branchCommit, actHeadCommit)
 
 	// Use ls to verify the repo looks good.
@@ -116,24 +112,22 @@ func TestClone_CheckoutMergeNoneExisting(t *testing.T) {
 // the right commit, then we don't reclone.
 func TestClone_CheckoutMergeNoReclone(t *testing.T) {
 	// Initialize the git repo.
-	repoDir, cleanup := initRepo(t)
-	defer cleanup()
+	repoDir := initRepo(t)
 
-	// Add a commit to branch 'branch' that's not on master.
+	// Add a commit to branch 'branch' that's not on main.
 	runCmd(t, repoDir, "git", "checkout", "branch")
 	runCmd(t, repoDir, "touch", "branch-file")
 	runCmd(t, repoDir, "git", "add", "branch-file")
 	runCmd(t, repoDir, "git", "commit", "-m", "branch-commit")
 
-	// Now switch back to master and advance the master branch by another commit.
-	runCmd(t, repoDir, "git", "checkout", "master")
-	runCmd(t, repoDir, "touch", "master-file")
-	runCmd(t, repoDir, "git", "add", "master-file")
-	runCmd(t, repoDir, "git", "commit", "-m", "master-commit")
+	// Now switch back to main and advance the main branch by another commit.
+	runCmd(t, repoDir, "git", "checkout", "main")
+	runCmd(t, repoDir, "touch", "main-file")
+	runCmd(t, repoDir, "git", "add", "main-file")
+	runCmd(t, repoDir, "git", "commit", "-m", "main-commit")
 
 	// Run the clone for the first time.
-	dataDir, cleanup2 := TempDir(t)
-	defer cleanup2()
+	dataDir := t.TempDir()
 	overrideURL := fmt.Sprintf("file://%s", repoDir)
 	wd := &events.FileWorkspace{
 		DataDir:                     dataDir,
@@ -146,7 +140,7 @@ func TestClone_CheckoutMergeNoReclone(t *testing.T) {
 	_, hasDiverged, err := wd.Clone(logging.NewNoopLogger(t), models.Repo{}, models.PullRequest{
 		BaseRepo:   models.Repo{},
 		HeadBranch: "branch",
-		BaseBranch: "master",
+		BaseBranch: "main",
 	}, "default")
 	Ok(t, err)
 	Equals(t, false, hasDiverged)
@@ -158,7 +152,7 @@ func TestClone_CheckoutMergeNoReclone(t *testing.T) {
 	cloneDir, hasDiverged, err := wd.Clone(logging.NewNoopLogger(t), models.Repo{}, models.PullRequest{
 		BaseRepo:   models.Repo{},
 		HeadBranch: "branch",
-		BaseBranch: "master",
+		BaseBranch: "main",
 	}, "default")
 	Ok(t, err)
 	Equals(t, false, hasDiverged)
@@ -172,10 +166,9 @@ func TestClone_CheckoutMergeNoReclone(t *testing.T) {
 // merged is a fast-forward merge. See #584.
 func TestClone_CheckoutMergeNoRecloneFastForward(t *testing.T) {
 	// Initialize the git repo.
-	repoDir, cleanup := initRepo(t)
-	defer cleanup()
+	repoDir := initRepo(t)
 
-	// Add a commit to branch 'branch' that's not on master.
+	// Add a commit to branch 'branch' that's not on main.
 	// This will result in a fast-forwardable merge.
 	runCmd(t, repoDir, "git", "checkout", "branch")
 	runCmd(t, repoDir, "touch", "branch-file")
@@ -183,8 +176,7 @@ func TestClone_CheckoutMergeNoRecloneFastForward(t *testing.T) {
 	runCmd(t, repoDir, "git", "commit", "-m", "branch-commit")
 
 	// Run the clone for the first time.
-	dataDir, cleanup2 := TempDir(t)
-	defer cleanup2()
+	dataDir := t.TempDir()
 	overrideURL := fmt.Sprintf("file://%s", repoDir)
 	wd := &events.FileWorkspace{
 		DataDir:                     dataDir,
@@ -197,7 +189,7 @@ func TestClone_CheckoutMergeNoRecloneFastForward(t *testing.T) {
 	_, hasDiverged, err := wd.Clone(logging.NewNoopLogger(t), models.Repo{}, models.PullRequest{
 		BaseRepo:   models.Repo{},
 		HeadBranch: "branch",
-		BaseBranch: "master",
+		BaseBranch: "main",
 	}, "default")
 	Ok(t, err)
 	Equals(t, false, hasDiverged)
@@ -209,7 +201,7 @@ func TestClone_CheckoutMergeNoRecloneFastForward(t *testing.T) {
 	cloneDir, hasDiverged, err := wd.Clone(logging.NewNoopLogger(t), models.Repo{}, models.PullRequest{
 		BaseRepo:   models.Repo{},
 		HeadBranch: "branch",
-		BaseBranch: "master",
+		BaseBranch: "main",
 	}, "default")
 	Ok(t, err)
 	Equals(t, false, hasDiverged)
@@ -222,25 +214,23 @@ func TestClone_CheckoutMergeNoRecloneFastForward(t *testing.T) {
 // Test that if there's a conflict when merging we return a good error.
 func TestClone_CheckoutMergeConflict(t *testing.T) {
 	// Initialize the git repo.
-	repoDir, cleanup := initRepo(t)
-	defer cleanup()
+	repoDir := initRepo(t)
 
-	// Add a commit to branch 'branch' that's not on master.
+	// Add a commit to branch 'branch' that's not on main.
 	runCmd(t, repoDir, "git", "checkout", "branch")
 	runCmd(t, repoDir, "sh", "-c", "echo hi >> file")
 	runCmd(t, repoDir, "git", "add", "file")
 	runCmd(t, repoDir, "git", "commit", "-m", "branch-commit")
 
-	// Add a new commit to master that will cause a conflict if branch was
+	// Add a new commit to main that will cause a conflict if branch was
 	// merged.
-	runCmd(t, repoDir, "git", "checkout", "master")
+	runCmd(t, repoDir, "git", "checkout", "main")
 	runCmd(t, repoDir, "sh", "-c", "echo conflict >> file")
 	runCmd(t, repoDir, "git", "add", "file")
 	runCmd(t, repoDir, "git", "commit", "-m", "commit")
 
 	// We're set up, now trigger the Atlantis clone.
-	dataDir, cleanup2 := TempDir(t)
-	defer cleanup2()
+	dataDir := t.TempDir()
 	overrideURL := fmt.Sprintf("file://%s", repoDir)
 	wd := &events.FileWorkspace{
 		DataDir:                     dataDir,
@@ -253,7 +243,7 @@ func TestClone_CheckoutMergeConflict(t *testing.T) {
 	_, _, err := wd.Clone(logging.NewNoopLogger(t), models.Repo{}, models.PullRequest{
 		BaseRepo:   models.Repo{},
 		HeadBranch: "branch",
-		BaseBranch: "master",
+		BaseBranch: "main",
 	}, "default")
 
 	ErrContains(t, "running git merge -q --no-ff -m atlantis-merge FETCH_HEAD", err)
@@ -267,9 +257,8 @@ func TestClone_CheckoutMergeConflict(t *testing.T) {
 // Test that if the repo is already cloned and is at the right commit, we
 // don't reclone.
 func TestClone_NoReclone(t *testing.T) {
-	repoDir, _ := initRepo(t)
-	dataDir, cleanup2 := TempDir(t)
-	defer cleanup2()
+	repoDir := initRepo(t)
+	dataDir := t.TempDir()
 
 	runCmd(t, dataDir, "mkdir", "-p", "repos/0/")
 	runCmd(t, dataDir, "mv", repoDir, "repos/0/default")
@@ -297,10 +286,8 @@ func TestClone_NoReclone(t *testing.T) {
 // Test that if the repo is already cloned but is at the wrong commit, we
 // reclone.
 func TestClone_RecloneWrongCommit(t *testing.T) {
-	repoDir, cleanup := initRepo(t)
-	defer cleanup()
-	dataDir, cleanup2 := TempDir(t)
-	defer cleanup2()
+	repoDir := initRepo(t)
+	dataDir := t.TempDir()
 
 	// Copy the repo to our data dir.
 	runCmd(t, dataDir, "mkdir", "-p", "repos/0/")
@@ -336,8 +323,7 @@ func TestClone_RecloneWrongCommit(t *testing.T) {
 // checkout-strategy=merge, we warn the user (see #804).
 func TestClone_MasterHasDiverged(t *testing.T) {
 	// Initialize the git repo.
-	repoDir, cleanup := initRepo(t)
-	defer cleanup()
+	repoDir := initRepo(t)
 
 	// Simulate first PR.
 	runCmd(t, repoDir, "git", "checkout", "-b", "first-pr")
@@ -348,7 +334,7 @@ func TestClone_MasterHasDiverged(t *testing.T) {
 	// Atlantis checkout first PR.
 	firstPRDir := repoDir + "/first-pr"
 	runCmd(t, repoDir, "mkdir", "-p", "first-pr")
-	runCmd(t, firstPRDir, "git", "clone", "--branch", "master", "--single-branch", repoDir, ".")
+	runCmd(t, firstPRDir, "git", "clone", "--branch", "main", "--single-branch", repoDir, ".")
 	runCmd(t, firstPRDir, "git", "remote", "add", "head", repoDir)
 	runCmd(t, firstPRDir, "git", "fetch", "head", "+refs/heads/first-pr")
 	runCmd(t, firstPRDir, "git", "config", "--local", "user.email", "atlantisbot@runatlantis.io")
@@ -357,7 +343,7 @@ func TestClone_MasterHasDiverged(t *testing.T) {
 	runCmd(t, firstPRDir, "git", "merge", "-q", "--no-ff", "-m", "atlantis-merge", "FETCH_HEAD")
 
 	// Simulate second PR.
-	runCmd(t, repoDir, "git", "checkout", "master")
+	runCmd(t, repoDir, "git", "checkout", "main")
 	runCmd(t, repoDir, "git", "checkout", "-b", "second-pr")
 	runCmd(t, repoDir, "touch", "file2")
 	runCmd(t, repoDir, "git", "add", "file2")
@@ -366,7 +352,7 @@ func TestClone_MasterHasDiverged(t *testing.T) {
 	// Atlantis checkout second PR.
 	secondPRDir := repoDir + "/second-pr"
 	runCmd(t, repoDir, "mkdir", "-p", "second-pr")
-	runCmd(t, secondPRDir, "git", "clone", "--branch", "master", "--single-branch", repoDir, ".")
+	runCmd(t, secondPRDir, "git", "clone", "--branch", "main", "--single-branch", repoDir, ".")
 	runCmd(t, secondPRDir, "git", "remote", "add", "head", repoDir)
 	runCmd(t, secondPRDir, "git", "fetch", "head", "+refs/heads/second-pr")
 	runCmd(t, secondPRDir, "git", "config", "--local", "user.email", "atlantisbot@runatlantis.io")
@@ -375,10 +361,10 @@ func TestClone_MasterHasDiverged(t *testing.T) {
 	runCmd(t, secondPRDir, "git", "merge", "-q", "--no-ff", "-m", "atlantis-merge", "FETCH_HEAD")
 
 	// Merge first PR
-	runCmd(t, repoDir, "git", "checkout", "master")
+	runCmd(t, repoDir, "git", "checkout", "main")
 	runCmd(t, repoDir, "git", "merge", "first-pr")
 
-	// Copy the second-pr repo to our data dir which has diverged remote master
+	// Copy the second-pr repo to our data dir which has diverged remote main
 	runCmd(t, repoDir, "mkdir", "-p", "repos/0/")
 	runCmd(t, repoDir, "cp", "-R", secondPRDir, "repos/0/default")
 
@@ -391,7 +377,7 @@ func TestClone_MasterHasDiverged(t *testing.T) {
 	_, hasDiverged, err := wd.Clone(logging.NewNoopLogger(t), models.Repo{CloneURL: repoDir}, models.PullRequest{
 		BaseRepo:   models.Repo{CloneURL: repoDir},
 		HeadBranch: "second-pr",
-		BaseBranch: "master",
+		BaseBranch: "main",
 	}, "default")
 	Ok(t, err)
 	Equals(t, hasDiverged, true)
@@ -402,7 +388,7 @@ func TestClone_MasterHasDiverged(t *testing.T) {
 	_, hasDiverged, err = wd.Clone(logging.NewNoopLogger(t), models.Repo{}, models.PullRequest{
 		BaseRepo:   models.Repo{},
 		HeadBranch: "second-pr",
-		BaseBranch: "master",
+		BaseBranch: "main",
 	}, "default")
 	Ok(t, err)
 	Equals(t, hasDiverged, false)
@@ -410,8 +396,7 @@ func TestClone_MasterHasDiverged(t *testing.T) {
 
 func TestHasDiverged_MasterHasDiverged(t *testing.T) {
 	// Initialize the git repo.
-	repoDir, cleanup := initRepo(t)
-	defer cleanup()
+	repoDir := initRepo(t)
 
 	// Simulate first PR.
 	runCmd(t, repoDir, "git", "checkout", "-b", "first-pr")
@@ -422,7 +407,7 @@ func TestHasDiverged_MasterHasDiverged(t *testing.T) {
 	// Atlantis checkout first PR.
 	firstPRDir := repoDir + "/first-pr"
 	runCmd(t, repoDir, "mkdir", "-p", "first-pr")
-	runCmd(t, firstPRDir, "git", "clone", "--branch", "master", "--single-branch", repoDir, ".")
+	runCmd(t, firstPRDir, "git", "clone", "--branch", "main", "--single-branch", repoDir, ".")
 	runCmd(t, firstPRDir, "git", "remote", "add", "head", repoDir)
 	runCmd(t, firstPRDir, "git", "fetch", "head", "+refs/heads/first-pr")
 	runCmd(t, firstPRDir, "git", "config", "--local", "user.email", "atlantisbot@runatlantis.io")
@@ -431,7 +416,7 @@ func TestHasDiverged_MasterHasDiverged(t *testing.T) {
 	runCmd(t, firstPRDir, "git", "merge", "-q", "--no-ff", "-m", "atlantis-merge", "FETCH_HEAD")
 
 	// Simulate second PR.
-	runCmd(t, repoDir, "git", "checkout", "master")
+	runCmd(t, repoDir, "git", "checkout", "main")
 	runCmd(t, repoDir, "git", "checkout", "-b", "second-pr")
 	runCmd(t, repoDir, "touch", "file2")
 	runCmd(t, repoDir, "git", "add", "file2")
@@ -440,7 +425,7 @@ func TestHasDiverged_MasterHasDiverged(t *testing.T) {
 	// Atlantis checkout second PR.
 	secondPRDir := repoDir + "/second-pr"
 	runCmd(t, repoDir, "mkdir", "-p", "second-pr")
-	runCmd(t, secondPRDir, "git", "clone", "--branch", "master", "--single-branch", repoDir, ".")
+	runCmd(t, secondPRDir, "git", "clone", "--branch", "main", "--single-branch", repoDir, ".")
 	runCmd(t, secondPRDir, "git", "remote", "add", "head", repoDir)
 	runCmd(t, secondPRDir, "git", "fetch", "head", "+refs/heads/second-pr")
 	runCmd(t, secondPRDir, "git", "config", "--local", "user.email", "atlantisbot@runatlantis.io")
@@ -449,10 +434,10 @@ func TestHasDiverged_MasterHasDiverged(t *testing.T) {
 	runCmd(t, secondPRDir, "git", "merge", "-q", "--no-ff", "-m", "atlantis-merge", "FETCH_HEAD")
 
 	// Merge first PR
-	runCmd(t, repoDir, "git", "checkout", "master")
+	runCmd(t, repoDir, "git", "checkout", "main")
 	runCmd(t, repoDir, "git", "merge", "first-pr")
 
-	// Copy the second-pr repo to our data dir which has diverged remote master
+	// Copy the second-pr repo to our data dir which has diverged remote main
 	runCmd(t, repoDir, "mkdir", "-p", "repos/0/")
 	runCmd(t, repoDir, "cp", "-R", secondPRDir, "repos/0/default")
 
@@ -475,9 +460,9 @@ func TestHasDiverged_MasterHasDiverged(t *testing.T) {
 	Equals(t, hasDiverged, false)
 }
 
-func initRepo(t *testing.T) (string, func()) {
-	repoDir, cleanup := TempDir(t)
-	runCmd(t, repoDir, "git", "init", "--initial-branch=master")
+func initRepo(t *testing.T) string {
+	repoDir := t.TempDir()
+	runCmd(t, repoDir, "git", "init", "--initial-branch=main")
 	runCmd(t, repoDir, "touch", ".gitkeep")
 	runCmd(t, repoDir, "git", "add", ".gitkeep")
 	runCmd(t, repoDir, "git", "config", "--local", "user.email", "atlantisbot@runatlantis.io")
@@ -485,5 +470,5 @@ func initRepo(t *testing.T) (string, func()) {
 	runCmd(t, repoDir, "git", "config", "--local", "commit.gpgsign", "false")
 	runCmd(t, repoDir, "git", "commit", "-m", "initial commit")
 	runCmd(t, repoDir, "git", "branch", "branch")
-	return repoDir, cleanup
+	return repoDir
 }
diff --git a/server/jobs/project_command_output_handler_test.go b/server/jobs/project_command_output_handler_test.go
index 96187a65b4..604daace78 100644
--- a/server/jobs/project_command_output_handler_test.go
+++ b/server/jobs/project_command_output_handler_test.go
@@ -26,8 +26,8 @@ func createTestProjectCmdContext(t *testing.T) command.ProjectContext {
 		},
 		Pull: models.PullRequest{
 			Num:        1,
-			HeadBranch: "master",
-			BaseBranch: "master",
+			HeadBranch: "main",
+			BaseBranch: "main",
 			Author:     "test-user",
 			HeadCommit: "234r232432",
 		},
diff --git a/server/metrics/scope_test.go b/server/metrics/scope_test.go
new file mode 100644
index 0000000000..280486c83b
--- /dev/null
+++ b/server/metrics/scope_test.go
@@ -0,0 +1,34 @@
+package metrics_test
+
+import (
+	"testing"
+
+	"github.com/runatlantis/atlantis/server/core/config/valid"
+	"github.com/runatlantis/atlantis/server/metrics"
+)
+
+var (
+	prometheusConfig = valid.Metrics{
+		Prometheus: &valid.Prometheus{
+			Endpoint: "/metrics",
+		},
+	}
+)
+
+func TestNewScope_PrometheusTaggingCapabilities(t *testing.T) {
+	scope, _, _, err := metrics.NewScope(prometheusConfig, nil, "test")
+	if err != nil {
+		t.Fatalf("got an error: %s", err.Error())
+	}
+
+	scope.Tagged(map[string]string{
+		"base_repo": "runatlantis/atlantis",
+		"pr_number": "2687",
+	})
+
+	want := true
+	got := scope.Capabilities().Tagging()
+	if want != got {
+		t.Errorf("Scope does not have Capability to do Tagging")
+	}
+}
diff --git a/server/server.go b/server/server.go
index 8bbf2543b3..2a59b19a40 100644
--- a/server/server.go
+++ b/server/server.go
@@ -17,6 +17,7 @@ package server
 
 import (
 	"context"
+	"crypto/tls"
 	"flag"
 	"fmt"
 	"io"
@@ -112,6 +113,9 @@ type Server struct {
 	ProjectJobsErrorTemplate       templates.TemplateWriter
 	SSLCertFile                    string
 	SSLKeyFile                     string
+	CertLastRefreshTime            time.Time
+	KeyLastRefreshTime             time.Time
+	SSLCert                        *tls.Certificate
 	Drainer                        *events.Drainer
 	WebAuthentication              bool
 	WebUsername                    string
@@ -389,14 +393,15 @@ func NewServer(userConfig UserConfig, config Config) (*Server, error) {
 	if err != nil && flag.Lookup("test.v") == nil {
 		return nil, errors.Wrap(err, "initializing terraform")
 	}
-	markdownRenderer := &events.MarkdownRenderer{
-		GitlabSupportsCommonMark: gitlabClient.SupportsCommonMark(),
-		DisableApplyAll:          userConfig.DisableApplyAll,
-		DisableMarkdownFolding:   userConfig.DisableMarkdownFolding,
-		DisableApply:             userConfig.DisableApply,
-		DisableRepoLocking:       userConfig.DisableRepoLocking,
-		EnableDiffMarkdownFormat: userConfig.EnableDiffMarkdownFormat,
-	}
+	markdownRenderer := events.GetMarkdownRenderer(
+		gitlabClient.SupportsCommonMark(),
+		userConfig.DisableApplyAll,
+		userConfig.DisableMarkdownFolding,
+		userConfig.DisableApply,
+		userConfig.DisableRepoLocking,
+		userConfig.EnableDiffMarkdownFormat,
+		userConfig.MarkdownTemplateOverridesDir,
+	)
 
 	var lockingClient locking.Locker
 	var applyLockingClient locking.ApplyLocker
@@ -621,6 +626,7 @@ func NewServer(userConfig UserConfig, config Config) (*Server, error) {
 		instrumentedProjectCmdRunner,
 		userConfig.ParallelPoolSize,
 		userConfig.SilenceVCSStatusNoProjects,
+		userConfig.QuietPolicyChecks,
 	)
 
 	planCommandRunner := events.NewPlanCommandRunner(
@@ -746,6 +752,7 @@ func NewServer(userConfig UserConfig, config Config) (*Server, error) {
 		logger,
 		controllers.JobIDKeyGenerator{},
 		projectCmdOutputHandler,
+		userConfig.WebsocketCheckOrigin,
 	)
 
 	jobsController := &controllers.JobsController{
@@ -887,13 +894,15 @@ func (s *Server) Start() error {
 		s.ProjectCmdOutputHandler.Handle()
 	}()
 
-	server := &http.Server{Addr: fmt.Sprintf(":%d", s.Port), Handler: n}
+	tlsConfig := &tls.Config{GetCertificate: s.GetSSLCertificate, MinVersion: tls.VersionTLS12}
+
+	server := &http.Server{Addr: fmt.Sprintf(":%d", s.Port), Handler: n, TLSConfig: tlsConfig, ReadHeaderTimeout: 10 * time.Second}
 	go func() {
 		s.Logger.Info("Atlantis started - listening on port %v", s.Port)
 
 		var err error
 		if s.SSLCertFile != "" && s.SSLKeyFile != "" {
-			err = server.ListenAndServeTLS(s.SSLCertFile, s.SSLKeyFile)
+			err = server.ListenAndServeTLS("", "")
 		} else {
 			err = server.ListenAndServe()
 		}
@@ -1029,6 +1038,30 @@ var healthzData = []byte(`{
   "status": "ok"
 }`)
 
+func (s *Server) GetSSLCertificate(*tls.ClientHelloInfo) (*tls.Certificate, error) {
+	certStat, err := os.Stat(s.SSLCertFile)
+	if err != nil {
+		return nil, fmt.Errorf("while getting cert file modification time: %w", err)
+	}
+
+	keyStat, err := os.Stat(s.SSLKeyFile)
+	if err != nil {
+		return nil, fmt.Errorf("while getting key file modification time: %w", err)
+	}
+
+	if s.SSLCert == nil || certStat.ModTime() != s.CertLastRefreshTime || keyStat.ModTime() != s.KeyLastRefreshTime {
+		cert, err := tls.LoadX509KeyPair(s.SSLCertFile, s.SSLKeyFile)
+		if err != nil {
+			return nil, fmt.Errorf("while loading tls cert: %w", err)
+		}
+
+		s.SSLCert = &cert
+		s.CertLastRefreshTime = certStat.ModTime()
+		s.KeyLastRefreshTime = keyStat.ModTime()
+	}
+	return s.SSLCert, nil
+}
+
 // ParseAtlantisURL parses the user-passed atlantis URL to ensure it is valid
 // and we can use it in our templates.
 // It removes any trailing slashes from the path so we can concatenate it
diff --git a/server/server_test.go b/server/server_test.go
index 1af422be3b..fe35138b8c 100644
--- a/server/server_test.go
+++ b/server/server_test.go
@@ -15,12 +15,12 @@ package server_test
 
 import (
 	"bytes"
+	"crypto/tls"
 	"errors"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
-	"os"
 	"testing"
 	"time"
 
@@ -37,9 +37,8 @@ import (
 
 func TestNewServer(t *testing.T) {
 	t.Log("Run through NewServer constructor")
-	tmpDir, err := os.MkdirTemp("", "")
-	Ok(t, err)
-	_, err = server.NewServer(server.UserConfig{
+	tmpDir := t.TempDir()
+	_, err := server.NewServer(server.UserConfig{
 		DataDir:     tmpDir,
 		AtlantisURL: "http://example.com",
 	}, server.Config{})
@@ -49,9 +48,8 @@ func TestNewServer(t *testing.T) {
 // todo: test what happens if we set different flags. The generated config should be different.
 
 func TestNewServer_InvalidAtlantisURL(t *testing.T) {
-	tmpDir, err := os.MkdirTemp("", "")
-	Ok(t, err)
-	_, err = server.NewServer(server.UserConfig{
+	tmpDir := t.TempDir()
+	_, err := server.NewServer(server.UserConfig{
 		DataDir:     tmpDir,
 		AtlantisURL: "example.com",
 	}, server.Config{
@@ -166,6 +164,30 @@ func BenchmarkHealthz(b *testing.B) {
 	}
 }
 
+func TestGetCertificate(t *testing.T) {
+	s := server.Server{}
+	clientHelloInfo := &tls.ClientHelloInfo{}
+
+	// Initial certificate load
+	s.SSLCertFile = "../testdata/cert.pem"
+	s.SSLKeyFile = "../testdata/key.pem"
+	cert, err := s.GetSSLCertificate(clientHelloInfo)
+	Ok(t, err)
+
+	// Certificate reload
+	s.SSLCertFile = "../testdata/cert2.pem"
+	s.SSLKeyFile = "../testdata/key2.pem"
+	s.CertLastRefreshTime = s.CertLastRefreshTime.Add(-1 * time.Second)
+	s.KeyLastRefreshTime = s.KeyLastRefreshTime.Add(-1 * time.Second)
+	newCert, err := s.GetSSLCertificate(clientHelloInfo)
+
+	Ok(t, err)
+	Assert(
+		t,
+		!bytes.Equal(bytes.Join(cert.Certificate, nil), bytes.Join(newCert.Certificate, nil)),
+		"Certificate expected to rotate")
+}
+
 func TestParseAtlantisURL(t *testing.T) {
 	cases := []struct {
 		In     string
diff --git a/server/user_config.go b/server/user_config.go
index a7d7dde0c4..3abd34d86c 100644
--- a/server/user_config.go
+++ b/server/user_config.go
@@ -51,10 +51,12 @@ type UserConfig struct {
 	HidePrevPlanComments            bool   `mapstructure:"hide-prev-plan-comments"`
 	LockingDBType                   string `mapstructure:"locking-db-type"`
 	LogLevel                        string `mapstructure:"log-level"`
+	MarkdownTemplateOverridesDir    string `mapstructure:"markdown-template-overrides-dir"`
 	ParallelPoolSize                int    `mapstructure:"parallel-pool-size"`
 	StatsNamespace                  string `mapstructure:"stats-namespace"`
 	PlanDrafts                      bool   `mapstructure:"allow-draft-prs"`
 	Port                            int    `mapstructure:"port"`
+	QuietPolicyChecks               bool   `mapstructure:"quiet-policy-checks"`
 	RedisDB                         int    `mapstructure:"redis-db"`
 	RedisHost                       string `mapstructure:"redis-host"`
 	RedisPassword                   string `mapstructure:"redis-password"`
@@ -104,6 +106,7 @@ type UserConfig struct {
 	WebUsername            string          `mapstructure:"web-username"`
 	WebPassword            string          `mapstructure:"web-password"`
 	WriteGitCreds          bool            `mapstructure:"write-git-creds"`
+	WebsocketCheckOrigin   bool            `mapstructure:"websocket-check-origin"`
 }
 
 // ToLogLevel returns the LogLevel object corresponding to the user-passed
diff --git a/testdata/cert.pem b/testdata/cert.pem
new file mode 100644
index 0000000000..b2adc796d9
--- /dev/null
+++ b/testdata/cert.pem
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDiDCCAnACCQDOnvpjFkiR7TANBgkqhkiG9w0BAQsFADCBhTELMAkGA1UEBhMC
+YXQxETAPBgNVBAgMCGF0bGFudGlzMREwDwYDVQQHDAhhdGxhbnRpczERMA8GA1UE
+CgwIYXRsYW50aXMxETAPBgNVBAsMCGF0bGFudGlzMREwDwYDVQQDDAhhdGxhbnRp
+czEXMBUGCSqGSIb3DQEJARYIYXRsYW50aXMwHhcNMjIxMTEwMTg1ODAwWhcNMjIx
+MjEwMTg1ODAwWjCBhTELMAkGA1UEBhMCYXQxETAPBgNVBAgMCGF0bGFudGlzMREw
+DwYDVQQHDAhhdGxhbnRpczERMA8GA1UECgwIYXRsYW50aXMxETAPBgNVBAsMCGF0
+bGFudGlzMREwDwYDVQQDDAhhdGxhbnRpczEXMBUGCSqGSIb3DQEJARYIYXRsYW50
+aXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDQ+d1Yhu2MBljro63h
+bYJk3NgMjhiHQzvV2Uy9C6UnXZ0pELWa3utYx+rTAJUjOWxfed59qF2IGAAMWmm7
+GQt/Apz0AMtU1uSYzQGYQkWVnAODKRtUC+nBrJYnW4r1zY1/duP74rVuLMFLWhlg
+O7XPHbtQK5psYlXLmiyaljWpIMnj3pf/H1MUue+AD9yTpg+sRKscnbNsOVB8NV7Z
+mfpeddTkNuQL1d1KqfzF6bKz+zbyrcBz+NHC1SmvCGViRie/nE7UDd5OyHA4WM21
+CDfLvCJxmKG69nFDY8Z8EPu/WGWYndeG0piefdlFpZ8GQTpmxD7dgcZ6M3fnCIdX
+Zvp/AgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGlib941RVj17ynlH/MQ+R1x01a/
+f0GrhHbM4N2IuwGZ77bS4f/yQMC5YJBDcBOog5v7bR3VM8rCNgYSlZDl2aBzBP+8
+vXDjGQHr4AfV+dgM/6J7xdzQKpfFr7JCR421O9KOoI+rbuk4+HG2JpILR6H305XX
+KOkiD3Ywbdvsng0gA3rMxKTTs0XWu8Rki7r227P5p73yNBOwLQHwiewAfDiASJ/P
+UfzOEJjRHYe6ivz181HVQVn/4RJa1LbVtCVDk70VBA3N4tGHLb4eyeMcn/do1Hvg
+8m//uN6x2s7TeswAEGCoj1LIhjHWIulAwlNCHIcXMguJqvubfhzlxmE601I=
+-----END CERTIFICATE-----
diff --git a/testdata/cert2.pem b/testdata/cert2.pem
new file mode 100644
index 0000000000..7fbb623191
--- /dev/null
+++ b/testdata/cert2.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDlDCCAnwCCQCGl++WdvHa4jANBgkqhkiG9w0BAQsFADCBizELMAkGA1UEBhMC
+YXQxEjAQBgNVBAgMCWF0bGFudGlzMjESMBAGA1UEBwwJYXRsYW50aXMyMRIwEAYD
+VQQKDAlhdGxhbnRpczIxEjAQBgNVBAsMCWF0bGFudGlzMjESMBAGA1UEAwwJYXRs
+YW50aXMyMRgwFgYJKoZIhvcNAQkBFglhdGxhbnRpczIwHhcNMjIxMTEwMTkwNDIx
+WhcNMjIxMjEwMTkwNDIxWjCBizELMAkGA1UEBhMCYXQxEjAQBgNVBAgMCWF0bGFu
+dGlzMjESMBAGA1UEBwwJYXRsYW50aXMyMRIwEAYDVQQKDAlhdGxhbnRpczIxEjAQ
+BgNVBAsMCWF0bGFudGlzMjESMBAGA1UEAwwJYXRsYW50aXMyMRgwFgYJKoZIhvcN
+AQkBFglhdGxhbnRpczIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+
+6bvLyg+VlYT/SU7lXJc2Dmdtehe7C/yckNpl+Zjj/8nkNRYfqJ2g8iwHASOWO7+V
+vdg91Ti6eC+OMjg54iSmd2rZQ6734I+hSo3C/l4alkOArjDumQPddynjMiOaB67u
+S67+vyBwbQq10BxOgJOhY/wQnLBJhOUhWh+UrjnL1LsET6qQicLwTzt/1cWzXmYS
+I8gTs0um+7r5WCB/Raf++KhboCtX3zEj6CV164ucEV65y2vQRIa7PQH+znCHGxbT
+nnZdielbJPc0S2hVtL2cRqocKCdEYKY3co27Hgvt/M7byETyLbmxbMK1r4f4icr9
+dyqKeY6aT+PxZ43nggYdAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAJTVkyx5SGnh
+J5hKOgseJbh4AvwPB++jsrN+z5FE5A6WR/3zZA2bfUuit5uKLAQ0di3l03bZf+2l
+zvxLmmeShOArzkaCQ0IRZdHl7rIaFHignikHnon1/fkBVqOoi+R0Hsn6GhVoQYo/
+C7zxQYyM/57Yw1VOW9vheIhvNgomv4GxaztrGEVT5tG58j9BgKqKYOfsHz07rYXc
+S2/iMML0xsgj5vXq9XiNJ0NVT3hD+LBnR5DZG64ITP9AgK22VeYKQrXiPWuzacKC
+zn+ptHXFDeqofAS6UoelrQ4ZchIsc48IsWdIW5SI3FOfiao4R0l5T7BqToSyP5V2
+DYLLTHTfIL4=
+-----END CERTIFICATE-----
diff --git a/testdata/key.pem b/testdata/key.pem
new file mode 100644
index 0000000000..9b00b63f00
--- /dev/null
+++ b/testdata/key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDQ+d1Yhu2MBljr
+o63hbYJk3NgMjhiHQzvV2Uy9C6UnXZ0pELWa3utYx+rTAJUjOWxfed59qF2IGAAM
+Wmm7GQt/Apz0AMtU1uSYzQGYQkWVnAODKRtUC+nBrJYnW4r1zY1/duP74rVuLMFL
+WhlgO7XPHbtQK5psYlXLmiyaljWpIMnj3pf/H1MUue+AD9yTpg+sRKscnbNsOVB8
+NV7ZmfpeddTkNuQL1d1KqfzF6bKz+zbyrcBz+NHC1SmvCGViRie/nE7UDd5OyHA4
+WM21CDfLvCJxmKG69nFDY8Z8EPu/WGWYndeG0piefdlFpZ8GQTpmxD7dgcZ6M3fn
+CIdXZvp/AgMBAAECggEANjUaXaRiajgbSMSkjh1B/bfrsxYI9s1R8B718PPcW2HF
+KqnS8eFxWw5As4srJH/4xKtwM1hBKtRO7uVlF8tfWArte73ZAKDdm2VSTJSkSDK4
+FoXLOPn+IOcL7Bmq6ifv1GiaqvQb7ABgA5PTkUrr1lX4CMvGuuanKrFLcK4WLVCD
+9+GHiduaV0BfTPA3RmszrA4zLOXlI+5zlGwGNb5pUz914i9Lk0feIYbOXRMx9M+U
+FmDrKvasIXguUHGRWZ7D7ugV6j5/BTuCBjbzH6067YkA4NnXfiSKNTkedz+qTkGC
+IJXUCPMDzy6TKbdPMx94OKot14f0qaGZx8zZ0taLAQKBgQDwfoT4gYKl+X/3X0aG
+IZ5tSaLzAXKdlZ55W8YXCWDUX/b3YULGzILqEiS5RgnRIA0tGbtu3PMXtiol5Iff
+e4ywSZGilvvPJBbw17l8iC3Y/rnHp6wlOhVusdjozBhOuc3CQj3k56p0OXyahmzN
+eHp/zsOMimIeef2ZlskmvXZqjwKBgQDecx8VQoi8Ph8/IDD/2P6wIU73qv57AY8K
+pRQqRX3zffEN6nr0Xnlb44Oy/zA/5/7FNcEF4D2jhPQF8zkOll5tf0HlbVAVIlfC
+F5o8t0S05Uj5a6zAkc34bCV+oWwvCmxk5vCvDl2POAiO+dqYxom4bFsxRmMOf1VC
+hh5YDXcpEQKBgQChc36XSnLINCipjIfO8nDmU6IWW6lzi4d5V5gzzPL5gHdO+jeX
+OKLGu2l2DEP45fiSh4ziT2jPSVcgWzywVsRLcQhZS90+4a6Y/2oh5VZKMC/Ojo0t
+7MGIr9K77pB/AZPVzxy4OKKhJhq1rnsKsdAjT07OYfSfGyyaWLUv0c/WlwKBgQDR
+pYOk4LjHWHDQaIFljtexnSK0TgZaXUS3To8rq6Shh49YgyVwC12q2Uh0uQZ7JCU7
+LYcGB6lv48yrkueyNMs3vRiYpiY0VNKKjP4CvOJW7kSRNQZx0rhgqWPI7U9tIhC4
+I+KvyQUqBjAit51qIKsJEa38SY7vydfLw2TzrXUhUQKBgBgxh9csF9JQfMRKO1Nv
+g5YWGFHdujl1Y2Qnf9nWHhQKy2wmCCoD0a0aRs6p0tyZXyqJfyBrPBEGF3VUONqf
+OK1b5tSj3w+APFW0hNFQABE8lRYBA/Qq6dAf+pTnDF0+ak9DKzlafhFI7w0dOZU2
+bYCXCqkOjIcnONDRDr04jE8c
+-----END PRIVATE KEY-----
diff --git a/testdata/key2.pem b/testdata/key2.pem
new file mode 100644
index 0000000000..1c6deb2845
--- /dev/null
+++ b/testdata/key2.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC+6bvLyg+VlYT/
+SU7lXJc2Dmdtehe7C/yckNpl+Zjj/8nkNRYfqJ2g8iwHASOWO7+Vvdg91Ti6eC+O
+Mjg54iSmd2rZQ6734I+hSo3C/l4alkOArjDumQPddynjMiOaB67uS67+vyBwbQq1
+0BxOgJOhY/wQnLBJhOUhWh+UrjnL1LsET6qQicLwTzt/1cWzXmYSI8gTs0um+7r5
+WCB/Raf++KhboCtX3zEj6CV164ucEV65y2vQRIa7PQH+znCHGxbTnnZdielbJPc0
+S2hVtL2cRqocKCdEYKY3co27Hgvt/M7byETyLbmxbMK1r4f4icr9dyqKeY6aT+Px
+Z43nggYdAgMBAAECggEAKUNxsLFivu0LSvY4VEC3+hoQ5sut12LW3aw9WC8jiZwe
+sfF7b6pNL51IQNdRLsaJOT9IPs0YLs2NUcmu92vWihhjgsQrTC5APRdVHqFGC68Q
+tf5wWxG9kR+RcSbEJSWl/KFlGHCM/V/EIdnyVFFcF1T6BUkonStZLuVA0Cz8Fv7r
+MO2mtmwtOcTAQaUqHSxdcq9ASmuh3QA9tUmn11oCjHwVbKrFrKNQW20vSn71pk4Z
+UiXnppRi7tk1t+PJb4VIEdUTw3JYwtp/HRgnfQ8VFDxWxWDPL4hHkBU270i7oIr3
++DR0+A1eylCuKXO5Il75uMYs8mKjFyGCLFWoGWtW7QKBgQDlAva0FYrbDUFmdUjz
+MCOVfOoPkaQB1bd9CK21b8HxGrcXbXwJzs/n2RV4GHZgodSADN2+fKvslpJofD3z
+Cnim60MJ8WcxB8Ez+Jvfktap8Kox0qQEZPpIN9hQxBxcXaLL+9TcWvkYJwCDjy+7
+LmfHEh9puECnxw5YAlHAreRCowKBgQDVaWB80Ehp9Q4McescrUtbsA0CYI3mkZgx
+6YU44/+DqiQStwQLttaOXvI4HXUqTdQgi8wMIJN/EOkMeAA1tuyULXJK9dkEB1pm
+zHF65USCr29g2hr/PsLckryKMtnyDGRW7YimXz8P03t5LfJ/M6Ovc7QJm6HSwCkS
+FyxrvU3gPwKBgCcWlGk0bBjrcEg+qI7pnok7Yu/5Wdb+VW0/9/ZJ9v5iIvIau9so
+s4/NG7793easeIrKp2aF/QpKwP6YhjJfjSxgZ3bg/039Ftr6ChDlDULAUyxh2aDu
+Y1HERmWys2yIhuruNuzNkkqvDYVnASyfxRLTYw02Z8K7VRVsf+u1QoqlAoGBAJ6i
+HNnKTPmN8apoh3aijhCSdakdsn0AHpyDU8btG4J4VyYeKoC2oRflFbGGnBAdGCA1
+KjCdimX6YPEmxiknVwXyHjIAOxdWi+k78OKER3/I/kaE+Wpf8aLZ5BHqKL1WXsOK
+/3eD9zFBZ1e1Qrsw3GxP2jUGHay1sBHFbfyME7YrAoGAXaa9GiSi/HjOgOS8nzGf
+OzSl+I/fm651QjQ0tRVjVH777P3ZYyjdZNFYDb0x+fsvqTbkfkVtgeWuyoAVIwqy
+BtWyvTYutjwwUi53oIpRBe3qhIWIQUZgyAwXVis8FChSv3aaCePij+Bwju6laIfj
++K5StCn2WaOE1d1akqF6C40=
+-----END PRIVATE KEY-----
diff --git a/testdrive/testdrive.go b/testdrive/testdrive.go
index c2e5e80a50..53a839e414 100644
--- a/testdrive/testdrive.go
+++ b/testdrive/testdrive.go
@@ -99,7 +99,7 @@ To continue, we need you to create a GitHub personal access token
 with [green]"repo" [reset]scope so we can fork an example terraform project.
 
 Follow these instructions to create a token (we don't store any tokens):
-[green]https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-token[reset]
+[green]https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-fine-grained-personal-access-token[reset]
 - use "atlantis" for the token description
 - add "repo" scope
 - copy the access token
@@ -173,6 +173,7 @@ Follow these instructions to create a token (we don't store any tokens):
 	// will just choose a random API port and we won't be able to get the right
 	// url.
 	ngrokConfig := fmt.Sprintf(`
+version: 1
 web_addr: %s
 tunnels:
   atlantis:
@@ -181,7 +182,7 @@ tunnels:
     proto: http
 `, ngrokAPIURL, atlantisPort)
 
-	ngrokConfigFile, err := os.CreateTemp("", "")
+	ngrokConfigFile, err := os.CreateTemp("", "atlantis-testdrive-ngrok-config")
 	if err != nil {
 		return errors.Wrap(err, "creating ngrok config file")
 	}
@@ -251,7 +252,7 @@ tunnels:
 	// Create a new pr in the example repo.
 	colorstring.Println("=> creating a new pull request")
 	s.Start()
-	pullRequestURL, err := githubClient.CreatePullRequest(githubUsername, terraformExampleRepo, "example", "master")
+	pullRequestURL, err := githubClient.CreatePullRequest(githubUsername, terraformExampleRepo, "example", "main")
 	if err != nil {
 		return errors.Wrapf(err, "creating new pull request for repo %s/%s", githubUsername, terraformExampleRepo)
 	}
diff --git a/testdrive/utils.go b/testdrive/utils.go
index 7539414efa..0cbfe0f4e0 100644
--- a/testdrive/utils.go
+++ b/testdrive/utils.go
@@ -34,7 +34,7 @@ import (
 )
 
 const hashicorpReleasesURL = "https://releases.hashicorp.com"
-const terraformVersion = "1.3.1"
+const terraformVersion = "1.3.5"
 const ngrokDownloadURL = "https://bin.equinox.io/c/4VmDzA7iaHb"
 const ngrokAPIURL = "localhost:41414" // We hope this isn't used.
 const atlantisPort = 4141
diff --git a/testing/Dockerfile b/testing/Dockerfile
index b94ea7d108..eefd5c2bcd 100644
--- a/testing/Dockerfile
+++ b/testing/Dockerfile
@@ -1,9 +1,11 @@
-FROM golang:1.17
+FROM golang:1.19
 
-RUN apt-get update && apt-get install unzip
+RUN apt-get update && apt-get --no-install-recommends -y install unzip \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
 
 # Install Terraform
-ENV TERRAFORM_VERSION=1.3.1
+ENV TERRAFORM_VERSION=1.3.5
 RUN case $(uname -m) in x86_64|amd64) ARCH="amd64" ;; aarch64|arm64|armv7l) ARCH="arm64" ;; esac && \
     wget -nv -O terraform.zip https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_${ARCH}.zip && \
     mkdir -p /usr/local/bin/tf/versions/${TERRAFORM_VERSION} && \
@@ -12,7 +14,8 @@ RUN case $(uname -m) in x86_64|amd64) ARCH="amd64" ;; aarch64|arm64|armv7l) ARCH
     rm terraform.zip
 
 # Install conftest
-ENV CONFTEST_VERSION=0.34.0
+ENV CONFTEST_VERSION=0.35.0
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN case $(uname -m) in x86_64|amd64) ARCH="x86_64" ;; aarch64|arm64|armv7l) ARCH="arm64" ;; esac && \
     curl -LOs https://github.com/open-policy-agent/conftest/releases/download/v${CONFTEST_VERSION}/conftest_${CONFTEST_VERSION}_Linux_${ARCH}.tar.gz && \
     curl -LOs https://github.com/open-policy-agent/conftest/releases/download/v${CONFTEST_VERSION}/checksums.txt && \
@@ -23,4 +26,6 @@ RUN case $(uname -m) in x86_64|amd64) ARCH="x86_64" ;; aarch64|arm64|armv7l) ARC
     rm conftest_${CONFTEST_VERSION}_Linux_${ARCH}.tar.gz && \
     rm checksums.txt
 
-RUN go get golang.org/x/tools/cmd/goimports
+RUN useradd -u 1001 -m atlantis
+
+USER atlantis
diff --git a/testing/README.md b/testing/README.md
index dc732aa515..4c36e35cd0 100644
--- a/testing/README.md
+++ b/testing/README.md
@@ -3,9 +3,9 @@
 The Docker image used by the tests is `runatlantis/testing-env`. It's built by the Dockerfie
 in this directory.
 
-The image is automatically built by Docker Hub on merges to `master`.
+The image is automatically built by Docker Hub on merges to `main`.
 
-To update the image, create a pull request that updates the Dockerfile and get it merged to `master`.
+To update the image, create a pull request that updates the Dockerfile and get it merged to `main`.
 
 Wait until the build at https://hub.docker.com/repository/docker/runatlantis/testing-env/builds finishes
 and then scroll to the bottom to find output like:
diff --git a/testing/temp_files.go b/testing/temp_files.go
index 8584de4594..8ff0630b59 100644
--- a/testing/temp_files.go
+++ b/testing/temp_files.go
@@ -6,25 +6,12 @@ import (
 	"testing"
 )
 
-// TempDir creates a temporary directory and returns its path along
-// with a cleanup function to be called via defer, ex:
-//
-//	dir, cleanup := TempDir()
-//	defer cleanup()
-func TempDir(t *testing.T) (string, func()) {
-	tmpDir, err := os.MkdirTemp("", "")
-	Ok(t, err)
-	return tmpDir, func() {
-		os.RemoveAll(tmpDir) // nolint: errcheck
-	}
-}
-
 // DirStructure creates a directory structure in a temporary directory.
 // structure describes the dir structure. If the value is another map, then the
 // key is the name of a directory. If the value is nil, then the key is the name
 // of a file. If val is a string then key is a file name and val is the file's content.
 // It returns the path to the temp directory containing the defined
-// structure and a cleanup function to delete the directory.
+// structure.
 // Example usage:
 //
 //		versionConfig := `
@@ -32,7 +19,7 @@ func TempDir(t *testing.T) (string, func()) {
 //		  required_version = "= 0.12.8"
 //	 }
 //	 `
-//		tmpDir, cleanup := DirStructure(t, map[string]interface{}{
+//		tmpDir := DirStructure(t, map[string]interface{}{
 //			"pulldir": map[string]interface{}{
 //				"project1": map[string]interface{}{
 //					"main.tf": nil,
@@ -42,11 +29,10 @@ func TempDir(t *testing.T) (string, func()) {
 //				},
 //			},
 //		})
-//	 defer cleanup()
-func DirStructure(t *testing.T, structure map[string]interface{}) (string, func()) {
-	tmpDir, cleanup := TempDir(t)
+func DirStructure(t *testing.T, structure map[string]interface{}) string {
+	tmpDir := t.TempDir()
 	dirStructureGo(t, tmpDir, structure)
-	return tmpDir, cleanup
+	return tmpDir
 }
 
 func dirStructureGo(t *testing.T, parentDir string, structure map[string]interface{}) {