@@ -87,6 +87,7 @@ github:
           - "check Cargo.toml formatting"
           - "check configs.md and ***_functions.md is up-to-date"
           - "check example README is up-to-date"
+          - "Check datafusion crates used in datafusion-examples"
           - "Verify MSRV (Min Supported Rust Version)"
     # needs to be updated as part of the release process
     # .asf.yaml doesn't support wildcard branch protection rules, only exact branch names
@@ -117,6 +118,13 @@ github:
     allow_auto_merge: true
     # auto-delete head branches after being merged
     del_branch_on_merge: true
+    # Limit open pull requests per user without write access.
+    #
+    # With coding agents, the number of open PRs now far exceeds our review capacity.
+    # Setting a limit helps reviewers focus on fewer PRs at a time.
+    creation_cap:
+      enabled: true
+      max_open_pull_requests: 3
 
 # publishes the content of the `asf-site` branch to
 # https://datafusion.apache.org/
 
@@ -45,7 +45,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Install cargo-audit
-        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375  # v2.87.12
+        uses: taiki-e/install-action@861a07ce7084f55488e375df125cdc99bba60eb7  # v2.87.23
         with:
           tool: cargo-audit
       - name: Run audit check
 
@@ -89,7 +89,7 @@ jobs:
 
       - name: Install cargo-semver-checks
         if: steps.changed_crates.outputs.packages != ''
-        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375  # v2.87.12
+        uses: taiki-e/install-action@861a07ce7084f55488e375df125cdc99bba60eb7  # v2.87.23
         with:
           tool: cargo-semver-checks
 
 
@@ -45,11 +45,11 @@ jobs:
         persist-credentials: false
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
       with:
         languages: actions
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
       with:
         category: "/language:actions"
@@ -24,6 +24,10 @@ concurrency:
 on:
   push:
     branches-ignore:
+      # Commits reach main through the merge queue, which runs this workflow at
+      # the same SHA, so do not repeat the jobs after the merge. Release
+      # branches and every other branch keep their post-push runs.
+      - 'main'
       - 'gh-readonly-queue/**'
       - 'dependabot/**'
   pull_request:
@@ -65,7 +69,7 @@ jobs:
           . ci/scripts/utils/tool_versions.sh
           echo "CARGO_MACHETE_VERSION=${CARGO_MACHETE_VERSION}" >> "$GITHUB_ENV"
       - name: Install cargo-machete
-        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375  # v2.87.12
+        uses: taiki-e/install-action@861a07ce7084f55488e375df125cdc99bba60eb7  # v2.87.23
         with:
           tool: cargo-machete@${{ env.CARGO_MACHETE_VERSION }}
       - name: Detect unused dependencies
 
@@ -19,6 +19,10 @@ name: Dev
 on:
   push:
     branches-ignore:
+      # Commits reach main through the merge queue, which runs this workflow at
+      # the same SHA, so do not repeat the jobs after the merge. Release
+      # branches and every other branch keep their post-push runs.
+      - 'main'
       - 'gh-readonly-queue/**'
       - 'dependabot/**'
   pull_request:
@@ -38,7 +42,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Install HawkEye
-        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375  # v2.87.12
+        uses: taiki-e/install-action@861a07ce7084f55488e375df125cdc99bba60eb7  # v2.87.23
         with:
           tool: hawkeye@7.0.0
       - name: Run license header check
@@ -66,7 +70,7 @@ jobs:
           source ci/scripts/utils/tool_versions.sh
           echo "LYCHEE_VERSION=${LYCHEE_VERSION}" >> "$GITHUB_ENV"
       - name: Install lychee
-        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375  # v2.87.12
+        uses: taiki-e/install-action@861a07ce7084f55488e375df125cdc99bba60eb7  # v2.87.23
         with:
           tool: lychee@${{ env.LYCHEE_VERSION }}
       - name: Run markdown link check
@@ -91,7 +95,7 @@ jobs:
       # it may cause checks to fail more often.
       # We can upgrade it manually once a while.
       - name: Install typos
-        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375  # v2.87.12
+        uses: taiki-e/install-action@861a07ce7084f55488e375df125cdc99bba60eb7  # v2.87.23
         with:
           tool: typos@1.37.0
       - name: Run typos check
 
@@ -43,7 +43,7 @@ jobs:
           path: asf-site
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
 
       - name: Install dependencies
         run: uv sync --package datafusion-docs
@@ -53,7 +53,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y graphviz
       - name: Install cargo-depgraph
-        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375  # v2.87.12
+        uses: taiki-e/install-action@861a07ce7084f55488e375df125cdc99bba60eb7  # v2.87.23
         with:
           tool: cargo-depgraph@1.6
 
 
@@ -26,12 +26,14 @@ on:
   push:
     paths:
       - "docs/**"
+      - "ci/scripts/check_docs_html.sh"
     branches:
       - main
       - branch-*
   pull_request:
     paths:
       - "docs/**"
+      - "ci/scripts/check_docs_html.sh"
   # manual trigger
   # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
   workflow_dispatch:
@@ -50,7 +52,7 @@ jobs:
           submodules: true
           fetch-depth: 1
       - name: Setup uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
       - name: Install doc dependencies
         run: uv sync --package datafusion-docs
       - name: Install Graphviz
@@ -59,11 +61,8 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y graphviz
       - name: Install cargo-depgraph
-        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375  # v2.87.12
+        uses: taiki-e/install-action@861a07ce7084f55488e375df125cdc99bba60eb7  # v2.87.23
         with:
           tool: cargo-depgraph@1.6
       - name: Build docs html and check for warnings
-        run: |
-          set -x
-          cd docs
-          uv run --package datafusion-docs ./build.sh # fails on errors
+        run: ./ci/scripts/check_docs_html.sh # fails on errors
@@ -60,14 +60,14 @@ jobs:
     runs-on: ${{ vars.USE_RUNS_ON == 'true' && format('runs-on={0},family=m8a+m7a+c8a,cpu=32,image=ubuntu24-full-x64,extras=s3-cache,disk=large,tag=datafusion', github.run_id) || 'ubuntu-latest' }}
     # note: do not use amd/rust container to preserve disk space
     steps:
-      - uses: runs-on/action@efac073ea2507ec18797de3a81704201ade11d9d  # v2.3.1
+      - uses: runs-on/action@17b59092eb37ebfdbb034460892887c09100eaa3  # v2.5.0
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ github.event.inputs.pr_head_sha }} # otherwise use the event's commit, including the merge group
           submodules: true
           fetch-depth: 1
       - name: Free Disk Space (Ubuntu)
-        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be  # v1.3.1
+        uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6  # v2.0.0
       - parallel:
           - name: Install Rust
             run: |
@@ -99,7 +99,7 @@ jobs:
     container:
       image: amd64/rust
     steps:
-      - uses: runs-on/action@efac073ea2507ec18797de3a81704201ade11d9d  # v2.3.1
+      - uses: runs-on/action@17b59092eb37ebfdbb034460892887c09100eaa3  # v2.5.0
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ github.event.inputs.pr_head_sha }} # otherwise use the event's commit, including the merge group
@@ -123,7 +123,7 @@ jobs:
     container:
       image: amd64/rust
     steps:
-      - uses: runs-on/action@efac073ea2507ec18797de3a81704201ade11d9d  # v2.3.1
+      - uses: runs-on/action@17b59092eb37ebfdbb034460892887c09100eaa3  # v2.5.0
       - parallel:
           - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
             with:
 
@@ -36,10 +36,6 @@ jobs:
         with:
           fetch-depth: 0
       - name: Check size of new Git objects
-        env:
-          # 1.5 MB ought to be enough for anybody.
-          # TODO in case we may want to consciously commit a bigger file to the repo without using Git LFS we may disable the check e.g. with a label
-          MAX_FILE_SIZE_BYTES: 1572864
         shell: bash
         run: |
           if [ "${{ github.event_name }}" = "merge_group" ]; then
@@ -51,18 +47,4 @@ jobs:
             base_sha="${{ github.event.pull_request.base.sha }}"
             head_sha="${{ github.event.pull_request.head.sha }}"
           fi
-          git rev-list --objects ${base_sha}..${head_sha} \
-            > pull-request-objects.txt
-          exit_code=0
-          while read -r id path; do
-            # Skip objects which are not files (commits, trees)
-            if [ ! -z "${path}" ]; then
-              size="$(git cat-file -s "${id}")"
-              if [ "${size}" -gt "${MAX_FILE_SIZE_BYTES}" ]; then
-                exit_code=1
-                echo "Object ${id} [${path}] has size ${size}, exceeding ${MAX_FILE_SIZE_BYTES} limit." >&2
-                echo "::error file=${path}::File ${path} has size ${size}, exceeding ${MAX_FILE_SIZE_BYTES} limit."
-              fi
-            fi
-          done < pull-request-objects.txt
-          exit "${exit_code}"
+          ./ci/scripts/check_large_files.sh --base "${base_sha}" --head "${head_sha}"