diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index f325e737..932d0a7a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -179,7 +179,7 @@ jobs:
 
         aws s3 cp "${{ env.COVERAGE_OUTPUT_DIR }}/summary.json" "${s3FullURI}" --acl bucket-owner-full-control
   lint:
-    container: golangci/golangci-lint:v1.51
+    container: golangci/golangci-lint:v1.54.1
     name: lint
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index bc6e796f..c79ab9a5 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -179,7 +179,7 @@ jobs:
 
         aws s3 cp "${{ env.COVERAGE_OUTPUT_DIR }}/summary.json" "${s3FullURI}" --acl bucket-owner-full-control
   lint:
-    container: golangci/golangci-lint:v1.51
+    container: golangci/golangci-lint:v1.54.1
     name: lint
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index 745b8d9a..b700044c 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -126,7 +126,7 @@ jobs:
         - go
         - java
   lint:
-    container: golangci/golangci-lint:v1.51
+    container: golangci/golangci-lint:v1.54.1
     name: lint
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 27c9472a..d87a7741 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -139,7 +139,7 @@ jobs:
       run: pulumictl create docs-build pulumi-${{ env.PROVIDER }}
         "${GITHUB_REF#refs/tags/}"
   lint:
-    container: golangci/golangci-lint:v1.51
+    container: golangci/golangci-lint:v1.54.1
     name: lint
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/run-acceptance-tests.yml b/.github/workflows/run-acceptance-tests.yml
index d5426749..c9431299 100644
--- a/.github/workflows/run-acceptance-tests.yml
+++ b/.github/workflows/run-acceptance-tests.yml
@@ -146,7 +146,7 @@ jobs:
         repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
         token: ${{ secrets.PULUMI_BOT_TOKEN }}
   lint:
-    container: golangci/golangci-lint:v1.51
+    container: golangci/golangci-lint:v1.54.1
     if: github.event_name == 'repository_dispatch' ||
       github.event.pull_request.head.repo.full_name == github.repository
     name: lint
@@ -263,16 +263,43 @@ jobs:
         fields: repo,commit,author,action
         status: ${{ job.status }}
   sentinel:
-    if: github.event_name == 'repository_dispatch' ||
-      github.event.pull_request.head.repo.full_name == github.repository
     name: sentinel
+    # We would like to be able to specify `sentinel` as the only required job for this
+    # workflow. To do that, we need `sentinel` to succeed only when it is safe to
+    # merge and fail in all other cases.
+    #
+    # We can't use the default `if: success()`, since GitHub interprets a skipped job as a
+    # success, and by default a dependee job failing will skip a dependent job. That means
+    # if a test step fails, then it will skip `sentinel` so GitHub will register
+    # `sentinel` as succeeded.
+    #
+    # GitHub documents `jobs.result` as:
+    #
+    #	The result of a job in the reusable workflow. Possible values are success,
+    #	failure, cancelled, or skipped.
+    #
+    # GitHub documents `cancelled()` as:
+    #
+    #	Returns true if the workflow was canceled.
+    #
+    # Combining these terms gives us an intuitive definition of success:
+    #
+    #	We have succeeded when no dependent workflow has failed and the job was
+    #	not cancelled.
+    #
+    if: (github.event_name == 'repository_dispatch' ||
+      github.event.pull_request.head.repo.full_name == github.repository) &&
+      ! cancelled()
     needs:
     - test
     - lint
     runs-on: ubuntu-latest
     steps:
-    - name: Is workflow a success
-      run: echo yes
+    - name: Workflow is not a success
+      if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')
+      run: exit 1
+    - name: Workflow is a success
+      run: echo "🎉🎈🎉🎈🎉"
   test:
     if: github.event_name == 'repository_dispatch' ||
       github.event.pull_request.head.repo.full_name == github.repository
diff --git a/.github/workflows/upgrade-bridge.yml b/.github/workflows/upgrade-bridge.yml
index 84bfe8a1..446131f9 100644
--- a/.github/workflows/upgrade-bridge.yml
+++ b/.github/workflows/upgrade-bridge.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Call upgrade provider action
-      uses: pulumi/pulumi-upgrade-provider-action@v0.0.5
+      uses: pulumi/pulumi-upgrade-provider-action@v0.0.6
       with:
         kind: bridge
     - env:
diff --git a/.github/workflows/upgrade-provider.yml b/.github/workflows/upgrade-provider.yml
index e2ed3a3c..423bc361 100644
--- a/.github/workflows/upgrade-provider.yml
+++ b/.github/workflows/upgrade-provider.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Call upgrade provider action
-      uses: pulumi/pulumi-upgrade-provider-action@v0.0.5
+      uses: pulumi/pulumi-upgrade-provider-action@v0.0.6
       with:
         kind: all
     - env: