From f83547f0ef66e5d84c51f8cf0b115cccf838e52a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:29:29 +0000
Subject: [PATCH 1/5] Initial plan
From b091dc661186643ff6e1bd5189c41c6400d22806 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:38:41 +0000
Subject: [PATCH 2/5] Merge main, resolve conflicts, fix content path
references
Co-authored-by: GeekTrainer <6109729+GeekTrainer@users.noreply.github.com>
---
.gitignore | 5 +-
README.md | 8 +-
app/server/app.py | 2 +-
content/1-hour/0-setup.md | 10 +-
content/1-hour/1-add-endpoint.md | 4 +-
content/README.md | 5 +-
content/full-day/0-setup.md | 4 +-
content/full-day/3-codespaces.md | 2 +-
content/full-day/README.md | 2 +-
content/github-actions/0-setup.md | 51 ++++
content/github-actions/1-introduction.md | 126 ++++++++
content/github-actions/2-code-scanning.md | 121 ++++++++
content/github-actions/3-running-tests.md | 202 +++++++++++++
content/github-actions/4-caching.md | 117 ++++++++
content/github-actions/5-matrix-strategies.md | 131 +++++++++
content/github-actions/6-deploy-azure.md | 249 ++++++++++++++++
content/github-actions/7-custom-actions.md | 268 ++++++++++++++++++
.../github-actions/8-reusable-workflows.md | 243 ++++++++++++++++
.../github-actions/9-required-workflows.md | 176 ++++++++++++
content/github-actions/README.md | 68 +++++
.../shared-images/code-scanning-dialog.png | Bin 0 -> 60341 bytes
content/shared-images/code-scanning-setup.png | Bin 0 -> 80965 bytes
content/shared-images/dependabot-settings.png | Bin 0 -> 94706 bytes
.../secret-scanning-settings.png | Bin 0 -> 35344 bytes
.../setup-configure-repo.png} | Bin
.../shared-images/setup-secret-protection.png | Bin 0 -> 33970 bytes
.../setup-use-template.png} | Bin
next-steps.md | 64 +++++
28 files changed, 1842 insertions(+), 16 deletions(-)
create mode 100644 content/github-actions/0-setup.md
create mode 100644 content/github-actions/1-introduction.md
create mode 100644 content/github-actions/2-code-scanning.md
create mode 100644 content/github-actions/3-running-tests.md
create mode 100644 content/github-actions/4-caching.md
create mode 100644 content/github-actions/5-matrix-strategies.md
create mode 100644 content/github-actions/6-deploy-azure.md
create mode 100644 content/github-actions/7-custom-actions.md
create mode 100644 content/github-actions/8-reusable-workflows.md
create mode 100644 content/github-actions/9-required-workflows.md
create mode 100644 content/github-actions/README.md
create mode 100644 content/shared-images/code-scanning-dialog.png
create mode 100644 content/shared-images/code-scanning-setup.png
create mode 100644 content/shared-images/dependabot-settings.png
create mode 100644 content/shared-images/secret-scanning-settings.png
rename content/{1-hour/images/0-setup-configure.png => shared-images/setup-configure-repo.png} (100%)
create mode 100644 content/shared-images/setup-secret-protection.png
rename content/{1-hour/images/0-setup-template.png => shared-images/setup-use-template.png} (100%)
create mode 100644 next-steps.md
diff --git a/.gitignore b/.gitignore
index 9ac1913..3a64e92 100644
--- a/.gitignore
+++ b/.gitignore
@@ -44,4 +44,7 @@ app/client/test-results/
app/client/playwright-report/
# e2e test database
-app/server/e2e_test_dogshelter.db
\ No newline at end of file
+app/server/e2e_test_dogshelter.db
+
+# azure
+.azure
diff --git a/README.md b/README.md
index ae74e0a..d0fd39c 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,12 @@
# Pets workshop
-This repository contains the project for two guided workshops to explore various GitHub features. The project is a website for a fictional dog shelter, with a [Flask](https://flask.palletsprojects.com/en/stable/) backend using [SQLAlchemy](https://www.sqlalchemy.org/) and an [Astro](https://astro.build/) frontend using [Tailwind CSS](https://tailwindcss.com/).
+This repository contains the project for three guided workshops to explore various GitHub features. The project is a website for a fictional dog shelter, with a [Flask](https://flask.palletsprojects.com/en/stable/) backend using [SQLAlchemy](https://www.sqlalchemy.org/) and an [Astro](https://astro.build/) frontend using [Tailwind CSS](https://tailwindcss.com/).
+
+The available workshops are:
+
+- **[One hour](./content/1-hour/README.md)** — focused on GitHub Copilot
+- **[Full-day](./content/full-day/README.md)** — a full day-in-the-life of a developer using GitHub for their DevOps processes
+- **[GitHub Actions](./content/github-actions/README.md)** — CI/CD pipelines from running tests to deploying to Azure
## Getting started
diff --git a/app/server/app.py b/app/server/app.py
index 6bc7aab..c7aa30e 100644
--- a/app/server/app.py
+++ b/app/server/app.py
@@ -80,4 +80,4 @@ def get_dog(id: int) -> tuple[Response, int] | Response:
## HERE
if __name__ == '__main__':
- app.run(debug=True, port=5100) # Port 5100 to avoid macOS conflicts
\ No newline at end of file
+ app.run(debug=True, port=5100) # Port 5100 to avoid macOS conflicts
diff --git a/content/1-hour/0-setup.md b/content/1-hour/0-setup.md
index c7db265..e364167 100644
--- a/content/1-hour/0-setup.md
+++ b/content/1-hour/0-setup.md
@@ -17,14 +17,14 @@ Let's create the repository you'll use for your workshop.
1. Navigate to [the repository root](/)
2. Select **Use this template** > **Create a new repository**
- 
+ 
3. Under **Owner**, select the name of your GitHub handle, or the owner specified by your workshop leader.
4. Under **Repository**, set the name to **pets-workshop**, or the name specified by your workshop leader.
5. Ensure **Public** is selected for the visibility, or the value indicated by your workshop leader.
6. Select **Create repository from template**.
- 
+ 
In a few moments a new repository will be created from the template for this workshop!
@@ -51,19 +51,19 @@ With the repository created, it's now time to clone the repository locally. We'l
- macOS / Linux:
```sh
- ./scripts/start-app.sh
+ ./app/scripts/start-app.sh
```
- Windows (PowerShell):
```powershell
- ./scripts/start-app.ps1
+ ./app/scripts/start-app.ps1
```
If you encounter execution policy warnings on Windows, run PowerShell as an administrator or execute the script with an explicit bypass, for example:
```powershell
- powershell -ExecutionPolicy Bypass -File .\scripts\start-app.ps1
+ powershell -ExecutionPolicy Bypass -File .\app\scripts\start-app.ps1
```
The startup script will start two applications:
diff --git a/content/1-hour/1-add-endpoint.md b/content/1-hour/1-add-endpoint.md
index b34585c..554ca67 100644
--- a/content/1-hour/1-add-endpoint.md
+++ b/content/1-hour/1-add-endpoint.md
@@ -10,10 +10,10 @@ With code completions, GitHub Copilot provides suggestions in your code editor w
It's standard to work in phases when adding functionality to an application. Given that we know we want to allow users to filter the list of dogs based on breed, we'll need to add an endpoint to provide a list of all breeds. Later we'll add the rest of the functionality, but let's focus on this part for now.
-The application uses a Flask app with SQLAlchemy as the backend API (in the [/server][server-code] folder), and an Astro app as the frontend (in the [/client][client-code] folder). You will explore more of the project later; this exercise will focus solely on the Flask application.
+The application uses a Flask app with SQLAlchemy as the backend API (in the [app/server][server-code] folder), and an Astro app as the frontend (in the [app/client][client-code] folder). You will explore more of the project later; this exercise will focus solely on the Flask application.
> [!NOTE]
-> As you begin making changes to the application, there is always a chance a breaking change could be created. If the page stops working, check the terminal window you used previously to start the application for any error messages. You can stop the app by using Ctl+C, and restart it by running the script appropriate for your operating system: `./scripts/start-app.sh` (macOS / Linux) or `./scripts/start-app.ps1` (Windows PowerShell).
+> As you begin making changes to the application, there is always a chance a breaking change could be created. If the page stops working, check the terminal window you used previously to start the application for any error messages. You can stop the app by using Ctl+C, and restart it by running the script appropriate for your operating system: `./app/scripts/start-app.sh` (macOS / Linux) or `./app/scripts/start-app.ps1` (Windows PowerShell).
## Flask routes
diff --git a/content/README.md b/content/README.md
index c3fe1aa..63c20ae 100644
--- a/content/README.md
+++ b/content/README.md
@@ -1,11 +1,12 @@
# Pets workshop
-This repository contains two workshops:
+This repository contains three workshops:
- a [one hour](./1-hour/README.md) workshop focused on GitHub Copilot.
- a [full-day](./full-day/README.md) workshop which covers a full day-in-the-life of a developer using GitHub for their DevOps processes.
+- a [GitHub Actions](./github-actions/README.md) workshop covering CI/CD pipelines from running tests to deploying to Azure.
-Both workshops are built around a fictional dog shelter, where you are a volunteer helping them build out their website.
+All workshops are built around a fictional dog shelter, where you are a volunteer helping them build out their website.
## Get started
diff --git a/content/full-day/0-setup.md b/content/full-day/0-setup.md
index 3bb7aa3..4a29341 100644
--- a/content/full-day/0-setup.md
+++ b/content/full-day/0-setup.md
@@ -12,12 +12,12 @@ Let's create the repository you'll use for your workshop.
1. Navigate to [the repository root][repo-root]
2. Select **Use this template** > **Create a new repository**
- 
+ 
3. Under **Owner**, select the name of your GitHub handle, or the owner specified by your workshop leader.
4. Under **Repository**, set the name to **pets-workshop**, or the name specified by your workshop leader.
5. Ensure **Public** is selected for the visibility, or the value indicated by your workshop leader.
6. Select **Create repository from template**.
- 
+ 
In a few moments a new repository will be created from the template for this workshop!
diff --git a/content/full-day/3-codespaces.md b/content/full-day/3-codespaces.md
index 622db1e..711ba1b 100644
--- a/content/full-day/3-codespaces.md
+++ b/content/full-day/3-codespaces.md
@@ -92,7 +92,7 @@ Before rebuilding the container, let's add **GitHub.copilot** to the list of ext
6. Just below the list of ports, add the command to run the startup script to the container definition:
```json
- "postStartCommand": "chmod +x /workspaces/pets-workshop/scripts/start-app.sh && /workspaces/pets-workshop/scripts/start-app.sh",
+ "postStartCommand": "chmod +x /workspaces/pets-workshop/app/scripts/start-app.sh && /workspaces/pets-workshop/app/scripts/start-app.sh",
```
You've now defined a custom container!
diff --git a/content/full-day/README.md b/content/full-day/README.md
index 5813ebd..985a428 100644
--- a/content/full-day/README.md
+++ b/content/full-day/README.md
@@ -15,7 +15,7 @@ This workshop is built to help guide you through some of the most common DevOps
## Prerequisites
-The application for the workshop uses is built primarily with Python (Flask and SQLAlchemy) and Astro (using Tailwind). While experience with these frameworks and languages is helpful, you'll be using Copilot to help you understand the project and generate the code. As a result, as long as you are familiar with programming you'll be able to complete the exercises!
+The application used for the workshop is built primarily with Python (Flask and SQLAlchemy) and Astro (using Tailwind). While experience with these frameworks and languages is helpful, you'll be using Copilot to help you understand the project and generate the code. As a result, as long as you are familiar with programming you'll be able to complete the exercises!
## Required resources
diff --git a/content/github-actions/0-setup.md b/content/github-actions/0-setup.md
new file mode 100644
index 0000000..3bccf7f
--- /dev/null
+++ b/content/github-actions/0-setup.md
@@ -0,0 +1,51 @@
+# Workshop Setup
+
+| [← GitHub Actions: From CI to CD][walkthrough-previous] | [Next: Introduction & Your First Workflow →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+To complete this workshop you will need to create a repository with a copy of the contents of this repository. While this can be done by [forking a repository][fork-repo], the goal of a fork is to eventually merge code back into the original (or upstream) source. In our case we want a separate copy as we don't intend to merge our changes. This is accomplished through the use of a [template repository][template-repo]. Template repositories are a great way to provide starters for your organization, ensuring consistency across projects.
+
+The repository for this workshop is configured as a template, so we can use it to create your repository.
+
+## Create your repository
+
+Let's create the repository you'll use for your workshop.
+
+1. Navigate to [the repository root][repo-root]
+2. Select **Use this template** > **Create a new repository**
+
+ 
+
+3. Under **Owner**, select the name of your GitHub handle, or the owner specified by your workshop leader.
+4. Under **Repository**, set the name to **pets-workshop**, or the name specified by your workshop leader.
+5. Ensure **Public** is selected for the visibility, or the value indicated by your workshop leader.
+6. Select **Create repository from template**.
+
+ 
+
+In a few moments a new repository will be created from the template for this workshop!
+
+## Open your codespace
+
+Now let's open a codespace so you have a development environment ready to go.
+
+1. Navigate to the main page of your newly created repository.
+2. Select **Code** > **Codespaces** > **Create codespace on main**.
+
+ In a few moments a codespace will open in your browser with a full VS Code editor. This is where you'll create and edit files throughout the workshop.
+
+> [!TIP]
+> If your codespace ever disconnects or you close the tab, you can reopen it by navigating to your repository and selecting **Code** > **Codespaces** and the name of your codespace.
+
+## Summary and next steps
+
+You've created the repository and opened a codespace — you're ready to start building! Next let's [create your first workflow][walkthrough-next].
+
+| [← GitHub Actions: From CI to CD][walkthrough-previous] | [Next: Introduction & Your First Workflow →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+[fork-repo]: https://docs.github.com/get-started/quickstart/fork-a-repo
+[template-repo]: https://docs.github.com/repositories/creating-and-managing-repositories/creating-a-template-repository
+[repo-root]: /
+[walkthrough-previous]: README.md
+[walkthrough-next]: 1-introduction.md
diff --git a/content/github-actions/1-introduction.md b/content/github-actions/1-introduction.md
new file mode 100644
index 0000000..eb6925b
--- /dev/null
+++ b/content/github-actions/1-introduction.md
@@ -0,0 +1,126 @@
+# Introduction & Your First Workflow
+
+| [← Workshop Setup][walkthrough-previous] | [Next: Securing the Development Pipeline →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+[GitHub Actions][github-actions] is an automation platform built into GitHub that lets you build, test, and deploy your code directly from your repository. While it's most commonly used for CI/CD, it can automate just about any task in your development workflow — from labeling issues to resizing images.
+
+Before diving in, here are the key terms you'll encounter:
+
+- **Workflow**: An automated process defined in a YAML file, stored in `.github/workflows/`.
+- **Event**: A trigger that starts a workflow, such as a `push`, `pull_request`, or `workflow_dispatch`.
+- **Job**: A set of steps that run on the same runner. Jobs run in parallel by default.
+- **Step**: An individual task within a job — either a shell command (`run`) or a reusable action (`uses`).
+- **Runner**: The virtual machine that executes your jobs (e.g., `ubuntu-latest`).
+- **Action**: A reusable unit of code that performs a specific task, published on the [Actions Marketplace][actions-marketplace].
+
+## Scenario
+
+The shelter has built its application — a Flask API and Astro frontend — and the team is ready to start automating their development workflow. Before diving into CI/CD, let's start with the basics: creating a simple workflow, triggering it manually, and understanding the logs.
+
+## Background
+
+A workflow file is written in YAML and lives in the `.github/workflows/` directory. Here are the core sections you'll work with:
+
+- `name`: A human-readable name for the workflow, displayed in the **Actions** tab.
+- `on`: Defines the events that trigger the workflow (e.g., `push`, `pull_request`, `workflow_dispatch`).
+- `jobs`: Contains one or more jobs, each with a unique identifier.
+ - `runs-on`: Specifies the runner environment (e.g., `ubuntu-latest`).
+ - `steps`: An ordered list of tasks the job performs.
+ - `uses`: References a reusable action (e.g., `actions/checkout@v4`).
+ - `run`: Executes a shell command.
+
+## Create your first workflow
+
+Let's start with the classic "Hello World" — a workflow you can trigger manually from the GitHub UI.
+
+1. In your codespace, create the folder `.github/workflows/` if it doesn't already exist.
+2. Create a new file named `.github/workflows/hello.yml`.
+3. Add the following content:
+
+ ```yaml
+ name: Hello World
+
+ on:
+ workflow_dispatch:
+
+ jobs:
+ greet:
+ runs-on: ubuntu-latest
+
+ steps:
+ - name: Say hello
+ run: echo "Hello, GitHub Actions!"
+
+ - name: Show environment info
+ run: |
+ echo "Runner OS: $RUNNER_OS"
+ echo "Repository: $GITHUB_REPOSITORY"
+ echo "Triggered by: $GITHUB_ACTOR"
+ ```
+
+4. Save the file.
+
+> [!NOTE]
+> The `workflow_dispatch` event lets you trigger the workflow manually from the **Actions** tab. This is useful for testing workflows without needing to push code changes every time.
+
+## Push and run
+
+Now let's push the workflow and trigger it by hand.
+
+1. Open the terminal in your codespace by pressing Ctl+`.
+2. Stage and commit your changes:
+
+ ```bash
+ git add .github/workflows/hello.yml
+ git commit -m "Add hello world workflow"
+ ```
+
+3. Push to your repository:
+
+ ```bash
+ git push
+ ```
+
+4. Navigate to your repository on GitHub and select the **Actions** tab.
+5. In the left sidebar, select the **Hello World** workflow.
+6. Select the **Run workflow** button, keep the default branch, and select **Run workflow** again to confirm.
+
+## Explore the logs
+
+Once the run completes, let's explore what happened.
+
+1. Select the workflow run that just completed.
+2. Select the **greet** job to expand it.
+3. Explore the logs for each step:
+ - **Say hello** — you'll see the `echo` output.
+ - **Show environment info** — notice the environment variables that GitHub Actions provides automatically (`RUNNER_OS`, `GITHUB_REPOSITORY`, `GITHUB_ACTOR`).
+4. Also look at the **Set up job** and **Complete job** steps that Actions adds automatically — these show the runner setup and cleanup.
+
+> [!TIP]
+> You can search within the logs using the search box at the top of the log viewer, and expand or collapse individual steps. This becomes very useful as workflows grow more complex.
+
+## Summary and next steps
+
+Congratulations! You've created and run your first GitHub Actions workflow. You've learned how to define a workflow in YAML, trigger it manually with `workflow_dispatch`, and navigate the logs in the Actions UI.
+
+Next, we'll put this knowledge to work by [securing the development pipeline][walkthrough-next] with code scanning, Dependabot, and secret scanning.
+
+## Resources
+
+- [GitHub Actions documentation][github-actions-docs]
+- [Workflow syntax for GitHub Actions][workflow-syntax]
+- [Events that trigger workflows][workflow-triggers]
+- [Understanding GitHub Actions][understanding-actions]
+
+| [← Workshop Setup][walkthrough-previous] | [Next: Securing the Development Pipeline →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+[actions-marketplace]: https://github.com/marketplace?type=actions
+[github-actions]: https://github.com/features/actions
+[github-actions-docs]: https://docs.github.com/actions
+[understanding-actions]: https://docs.github.com/actions/about-github-actions/understanding-github-actions
+[workflow-syntax]: https://docs.github.com/actions/writing-workflows/workflow-syntax-for-github-actions
+[workflow-triggers]: https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows
+[walkthrough-previous]: 0-setup.md
+[walkthrough-next]: 2-code-scanning.md
diff --git a/content/github-actions/2-code-scanning.md b/content/github-actions/2-code-scanning.md
new file mode 100644
index 0000000..55de46b
--- /dev/null
+++ b/content/github-actions/2-code-scanning.md
@@ -0,0 +1,121 @@
+# Securing the Development Pipeline
+
+| [← Introduction & Your First Workflow][walkthrough-previous] | [Next: Running Tests →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+In the previous exercise you created your first GitHub Actions workflow — a manually triggered "Hello World." Before building out CI/CD, let's explore security. Ensuring code security is imperative in today's environment, and GitHub provides tools that automate this for you — many of which are powered by GitHub Actions under the hood.
+
+When we think about how we create code today, there are three main areas to secure:
+
+- The **code we write** — which may contain vulnerabilities
+- The **libraries we use** — which may have known security issues
+- The **credentials we manage** — which may accidentally leak into source code
+
+[GitHub Advanced Security][advanced-security] provides a suite of tools covering each of these areas. Let's explore and enable them on our repository.
+
+## Scenario
+
+Security is important in every application. By detecting potential vulnerabilities early, teams can make updates before incidents occur. The shelter wants to ensure insecure code and libraries are detected as early as possible. You'll enable Dependabot, secret scanning, and code scanning to meet these needs.
+
+## Background
+
+[GitHub Advanced Security][advanced-security-docs] is a set of security features available directly in GitHub. The three pillars are:
+
+- **Code scanning** analyzes your source code for security vulnerabilities using [CodeQL][about-code-scanning], GitHub's semantic code analysis engine. When enabled, it runs as a GitHub Actions workflow — the same automation platform you used in the previous exercise. Every push and pull request triggers the analysis automatically.
+- **Dependabot** monitors your project's dependencies for known vulnerabilities and can automatically create [pull requests][about-prs] to update insecure packages to safe versions.
+- **Secret scanning** detects tokens, keys, and other credentials that have been committed to your repository, and can block pushes that contain [supported secrets][supported-secrets].
+
+> [!NOTE]
+> Code scanning is built on [GitHub Actions][github-actions]. When you enable CodeQL's default setup, GitHub creates and manages a workflow for you behind the scenes. You'll see this connection more clearly when you navigate to the **Actions** tab after enabling it. This is a great example of how Actions powers automation across the GitHub platform — not just CI/CD pipelines you write yourself.
+
+## Configure Dependabot
+
+Most projects depend on open source and external libraries. While modern development would be impossible without them, we always need to ensure the dependencies we use are secure. [Dependabot][dependabot-quickstart] monitors your repository's dependencies and raises alerts — or even creates pull requests — to update insecure packages.
+
+Public repositories on GitHub automatically have Dependabot alerts enabled. Let's configure Dependabot to also create PRs that update insecure library versions automatically.
+
+1. Navigate to your repository on GitHub.
+2. Select **Settings** > **Advanced security** (under **Security** in the sidebar).
+3. Locate the **Dependabot** section.
+
+ 
+
+4. Select **Enable** next to **Dependabot security updates** to configure Dependabot to create PRs to resolve alerts.
+
+You've now enabled Dependabot alerts and security updates! When an insecure library is detected, you'll receive an alert, and Dependabot will create a pull request to update to a secure version.
+
+> [!TIP]
+> Dependabot doesn't just alert you — it can automatically create pull requests that bump library versions to secure ones. When you pair this with a CI pipeline that runs tests on every PR (which you'll build in the [next exercise][walkthrough-next]), those Dependabot PRs are automatically tested before merging. This creates a powerful feedback loop: vulnerabilities are detected, fixes are proposed, and your tests verify the update won't break anything — all without manual intervention.
+
+> [!IMPORTANT]
+> After enabling Dependabot security updates you may notice new pull requests created for potentially outdated packages. For this workshop you can ignore these pull requests.
+
+## Enable secret scanning
+
+Many developers have accidentally checked in code containing tokens or credentials. Regardless of the reason, even seemingly innocuous tokens can create a security issue. [Secret scanning][about-secret-scanning] detects tokens in your source code and raises alerts. With push protection enabled, pushes containing supported secrets are blocked before they reach your repository.
+
+1. On the same **Advanced security** settings page, locate the **Secret Protection** section.
+2. Next to **GitHub will always send alerts to partners for detected secrets in public repositories**, select **Enable**.
+3. Next to **Push protection**, select **Enable** to block pushes containing a [supported secret][supported-secrets].
+
+ 
+
+You've now enabled secret scanning and push protection — helping prevent credentials from reaching your repository.
+
+## Enable code scanning
+
+There is a direct relationship between the amount of code an organization writes and its potential attack surface. [Code scanning][about-code-scanning] analyzes your source code for known vulnerabilities. When an issue is detected on a pull request, a comment is added highlighting the affected line with contextual information for the developer.
+
+Let's enable code scanning with the default CodeQL setup. This runs automatically whenever code is pushed to `main` or a pull request targets `main`, and on a regular schedule to catch newly discovered vulnerabilities.
+
+1. On the same **Advanced security** settings page, locate the **Code scanning** section.
+2. Next to **CodeQL analysis**, select **Set up** > **Default**.
+
+ 
+
+3. On the **CodeQL default configuration** dialog, select **Enable CodeQL**.
+
+ 
+
+> [!IMPORTANT]
+> Your list of languages may be different from what's shown in the screenshot.
+
+A background process starts and configures a CodeQL analysis workflow for your repository.
+
+> [!TIP]
+> After enabling CodeQL, navigate to the **Actions** tab in your repository. You'll see a new **CodeQL** workflow listed alongside the **Hello World** workflow you created earlier. This is the Actions workflow that GitHub created automatically to run code scanning — proof that Actions isn't just for CI/CD, but powers many of GitHub's built-in features.
+
+## Summary and next steps
+
+You've enabled GitHub Advanced Security for your repository:
+
+- **Dependabot** monitors dependencies for known vulnerabilities and creates PRs to update them.
+- **Secret scanning** detects leaked credentials and blocks pushes containing supported secrets.
+- **Code scanning** analyzes your source code using CodeQL, running as a GitHub Actions workflow on every push and PR.
+
+These tools run automatically in the background, catching security issues before they reach production. Now that you've seen how GitHub uses Actions internally for security automation, it's time to build your own CI workflow. Next, we'll [automate testing][walkthrough-next] for the shelter's application.
+
+## Resources
+
+- [About GitHub Advanced Security][advanced-security-docs]
+- [About code scanning with CodeQL][about-code-scanning]
+- [Dependabot quickstart guide][dependabot-quickstart]
+- [About secret scanning][about-secret-scanning]
+- [GitHub Skills: Secure your repository's supply chain][skills-supply-chain]
+- [GitHub Skills: Secure code game][skills-secure-code]
+
+| [← Introduction & Your First Workflow][walkthrough-previous] | [Next: Running Tests →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+[about-code-scanning]: https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning
+[about-prs]: https://docs.github.com/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-pull-requests
+[about-secret-scanning]: https://docs.github.com/code-security/secret-scanning/introduction/about-secret-scanning
+[advanced-security]: https://github.com/features/security
+[advanced-security-docs]: https://docs.github.com/get-started/learning-about-github/about-github-advanced-security
+[dependabot-quickstart]: https://docs.github.com/code-security/getting-started/dependabot-quickstart-guide
+[github-actions]: https://github.com/features/actions
+[supported-secrets]: https://docs.github.com/code-security/secret-scanning/introduction/supported-secret-scanning-patterns
+[skills-supply-chain]: https://github.com/skills/secure-repository-supply-chain
+[skills-secure-code]: https://github.com/skills/secure-code-game
+[walkthrough-previous]: 1-introduction.md
+[walkthrough-next]: 3-running-tests.md
diff --git a/content/github-actions/3-running-tests.md b/content/github-actions/3-running-tests.md
new file mode 100644
index 0000000..2fc3060
--- /dev/null
+++ b/content/github-actions/3-running-tests.md
@@ -0,0 +1,202 @@
+# Running Tests
+
+| [← Securing the Development Pipeline][walkthrough-previous] | [Next: Caching →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+Now that you know the basics of GitHub Actions and have seen how GitHub uses it for code scanning, it's time to build your own workflow. In this exercise you'll create a **continuous integration (CI)** pipeline that automatically runs the shelter's tests.
+
+## Scenario
+
+The shelter's app is growing, and the team wants to make sure new changes don't break existing functionality. The application has two test suites: **unit tests** for the Flask API, and **end-to-end (e2e) tests** that use [Playwright][playwright] to test the full stack in a browser. The goal is to run both automatically on every push and pull request (PR) to `main`.
+
+## Background
+
+As you saw in the [introduction][introduction], the `on` declaration specifies when a workflow will run. For true automation, you'll use `on` to indicate the [triggers][workflow-triggers] for the workflow to run automatically. In our scenario, this will be whenever a PR is made to the `main` branch, or when code is pushed or merged into it.
+
+Most workflows have a relatively common set of tasks. You typically need to install libraries, perform builds, and run various commands. Rather than having to script everything out by hand, there's a collection of available actions in a marketplace - the aptly named [Actions Marketplace][actions-marketplace]. There you can find pluggable, reusable actions, ready to be added to any workflow.
+
+## Using the Actions Marketplace
+
+The [Actions Marketplace][actions-marketplace] contains tens of thousands of community created actions. These include those from OSS contributors of all sizes, and vendors to allow for quick integration of their products.
+
+For most actions, you can just add the name of the action, typically `vendor/action-name`, the necessary configuration, and it's now part of your workflow!
+
+### Security and the Actions Marketplace
+
+The marketplace offers various protections to ensure you're using the right action at the right time. For starters, creators can be [verified][marketplace-badges] by GitHub, giving you the confidence the organization who says they built an action is the one who actually built it.
+
+In addition, you can [pin to a specific version, SHA or branch][action-versioning]. This both increases security, knowing the code you expect to run is what runs, and consistency as it'll always be the same code over and over.
+
+## Create the CI workflow
+
+Our application has a Flask backend with unit tests, and an Astro frontend that's validated with end-to-end tests. Let's begin building a workflow to run these tests. We'll start with the unit tests, then add the end-to-end tests a bit later in this lesson.
+
+To run the unit tests, you'll need to do the following in the workflow:
+
+- checkout the code.
+- install Python.
+- install the necessary Python libraries.
+- run the tests.
+
+Let's build that out!
+
+1. In your codespace, create a new file named `.github/workflows/run-tests.yml`.
+2. Add the following content:
+
+ ```yaml
+ name: Run Tests
+
+ on:
+ push:
+ branches: [main]
+ pull_request:
+ branches: [main]
+
+ permissions:
+ contents: read
+
+ jobs:
+ test-api:
+ runs-on: ubuntu-latest
+
+ steps:
+ - uses: actions/checkout@v4
+
+ - name: Set up Python
+ uses: actions/setup-python@v5
+ with:
+ python-version: '3.14'
+
+ - name: Install dependencies
+ run: |
+ python -m pip install --upgrade pip
+ pip install -r app/server/requirements.txt
+
+ - name: Run tests
+ working-directory: ./app/server
+ run: |
+ python -m unittest test_app -v
+ ```
+
+3. Save the file.
+
+Notice how this workflow differs from the hello world:
+- It triggers on `push` and `pull_request` events instead of `workflow_dispatch` — so it runs automatically when a PR or merge is made to the specified branch(es).
+- It declares explicit **`permissions`** — we'll explain this next.
+- It uses `actions/checkout@v4` to clone your repository code onto the runner, using the `checkout` action from the marketplace.
+- It uses `actions/setup-python@v5` to install a specific Python version, yet another action from the marketplace.
+- Next, it installs the necessary libraries using `pip`, just like you normally would.
+- Finally, it's time to run the tests - again, just like before!
+
+## Understanding `GITHUB_TOKEN` and permissions
+
+Every workflow run automatically receives a token called **`GITHUB_TOKEN`**. This is a short-lived credential that actions use behind the scenes to interact with your repository — for example, `actions/checkout` uses it to clone your code. The token is created when the workflow starts and revoked when the run ends.
+
+The **`permissions`** block controls what this token can do. For our CI workflow, we only need `contents: read` — enough to clone the repository. This follows the [principle of least privilege][principle-least-privilege]: grant only the permissions your workflow actually needs, nothing more.
+
+> [!IMPORTANT]
+> Always set explicit `permissions` in your workflows. Without it, the token inherits the repository-level defaults (**Settings** > **Actions** > **General** > **Workflow permissions**), which may be more permissive than your workflow requires. Being explicit ensures your workflow only has the access it needs — even if someone changes the repository defaults later.
+
+## Push and explore
+
+A bit later you'll use a more standard branching approach for changes. But for our purposes right now, let's push straight to `main`. What you'll notice is the workflow will automatically run, since the workflow will now exist on `main`!
+
+1. Open the terminal in your codespace by pressing Ctl+`, then stage, commit, and push:
+
+ ```bash
+ git add .github/workflows/run-tests.yml
+ git commit -m "Add CI workflow with unit tests"
+ git push
+ ```
+
+2. Navigate to the **Actions** tab — the **Run Tests** workflow should already be running (triggered by the push).
+3. Select the **test-api** job and explore the logs. Notice the flow of checkout, Python setup, and dependency installation.
+
+## Add e2e tests in parallel
+
+The unit tests cover the API, but the shelter also has Playwright e2e tests that verify the full application works end-to-end in a real browser. Let's add a second job that runs alongside the unit tests.
+
+1. Return to your codespace and open `.github/workflows/run-tests.yml`. Add the following job to the bottom of the file:
+
+ ```yaml
+ test-e2e:
+ runs-on: ubuntu-latest
+
+ steps:
+ - uses: actions/checkout@v4
+
+ - name: Set up Python
+ uses: actions/setup-python@v5
+ with:
+ python-version: '3.14'
+
+ - name: Install Python dependencies
+ run: |
+ python -m pip install --upgrade pip
+ pip install -r app/server/requirements.txt
+
+ - name: Set up Node.js
+ uses: actions/setup-node@v4
+ with:
+ node-version: '20'
+
+ - name: Install Node dependencies
+ working-directory: ./app/client
+ run: npm ci
+
+ - name: Install Playwright browsers
+ working-directory: ./app/client
+ run: npx playwright install --with-deps chromium
+
+ - name: Run e2e tests
+ working-directory: ./app/client
+ run: npx playwright test
+ ```
+
+2. Save the file.
+
+> [!NOTE]
+> Because we haven't added a `needs` key, `test-api` and `test-e2e` will run **in parallel**. Each job gets its own runner, so they don't interfere with each other and the total CI time is closer to the duration of the slower job rather than the sum of both. The `test-e2e` job needs both Python and Node.js because the Playwright tests launch the full stack — the Flask API and the Astro frontend — before running browser tests against them.
+
+1. In the terminal, stage, commit, and push:
+
+ ```bash
+ git add .github/workflows/run-tests.yml
+ git commit -m "Add e2e tests running in parallel"
+ git push
+ ```
+
+2. Navigate to the **Actions** tab and select the new workflow run. You should see both **test-api** and **test-e2e** running side by side.
+
+## Summary and next steps
+
+You've built a CI pipeline with two jobs running in parallel — unit tests for the API and end-to-end tests for the full application. This is the foundation of continuous integration — catching problems early so they don't reach production.
+
+Now, let's work to [improve the performance of our CI job][walkthrough-next] by reusing steps and caching dependencies.
+
+## Resources
+
+- [GitHub Actions documentation][github-actions-docs]
+- [Workflow syntax for GitHub Actions][workflow-syntax]
+- [Events that trigger workflows][workflow-triggers]
+- [Using jobs in a workflow][jobs-docs]
+- [Automatic token authentication][automatic-token-auth]
+- [Assigning permissions to jobs][permissions-docs]
+
+| [← Securing the Development Pipeline][walkthrough-previous] | [Next: Caching →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+[action-versioning]: https://docs.github.com/actions/how-tos/write-workflows/choose-what-workflows-do/find-and-customize-actions#using-release-management-for-your-custom-actions
+[actions-marketplace]: https://github.com/marketplace?type=actions
+[automatic-token-auth]: https://docs.github.com/actions/security-for-github-actions/security-guides/automatic-token-authentication
+[github-actions-docs]: https://docs.github.com/actions
+[introduction]: 1-introduction.md
+[jobs-docs]: https://docs.github.com/actions/writing-workflows/choosing-what-your-workflow-does/using-jobs-in-a-workflow
+[marketplace-badges]: https://docs.github.com/actions/how-tos/create-and-publish-actions/publish-in-github-marketplace#about-badges-in-github-marketplace
+[permissions-docs]: https://docs.github.com/actions/writing-workflows/choosing-what-your-workflow-does/assigning-permissions-to-jobs
+[playwright]: https://playwright.dev/
+[principle-least-privilege]: https://docs.github.com/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
+[workflow-syntax]: https://docs.github.com/actions/writing-workflows/workflow-syntax-for-github-actions
+[workflow-triggers]: https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows
+[walkthrough-previous]: 2-code-scanning.md
+[walkthrough-next]: 4-caching.md
diff --git a/content/github-actions/4-caching.md b/content/github-actions/4-caching.md
new file mode 100644
index 0000000..e75a97e
--- /dev/null
+++ b/content/github-actions/4-caching.md
@@ -0,0 +1,117 @@
+# Caching
+
+| [← Running Tests][walkthrough-previous] | [Next: Matrix Strategies & Parallel Testing →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+The [GitHub Actions Marketplace][actions-marketplace] is a collection of pre-built actions created by GitHub and the community. Actions can set up tools, run tests, deploy code, send notifications, and much more. Rather than writing everything from scratch, you can leverage the work of thousands of developers.
+
+In this exercise you'll also learn about **caching** — a technique to speed up your workflows by reusing previously downloaded dependencies instead of fetching them from the internet on every run.
+
+## Scenario
+
+The CI workflow from the previous exercise works, but both jobs reinstall every dependency from scratch on every run. That means downloading Python packages, Node modules, and Playwright browsers each time — even when they haven't changed. You want to ensure workflows run as quickly as possible, to move from idea to deployed as quickly as possible.
+
+## Background
+
+[Caching][caching-docs] stores downloaded dependencies between workflow runs so they don't need to be fetched from the internet every time. Each cache is identified by a key — typically derived from the package manager and lock file. When a workflow runs, it checks for an existing cache matching that key. On a hit, the cached files are restored and the install step completes in seconds. On a miss, the dependencies are downloaded normally and then saved for next time.
+
+Many popular setup actions — like `actions/setup-python` and `actions/setup-node` — have caching built right in, so you can enable it with a single line. GitHub provides 10 GB of cache storage per repository, with least-recently-used entries evicted when the limit is reached.
+
+## Add caching to the unit test job
+
+Many popular setup actions have caching built right in. Let's start with the `test-api` job, which uses Python. Libraries are installed for Python using `pip`, which will become the key name. This instructs the workflow to cache any libraries installed using `pip`.
+
+1. In your codespace, open `.github/workflows/run-tests.yml`.
+2. Update the **Set up Python** step in the `test-api` job to enable pip caching:
+
+ ```yaml
+ - name: Set up Python
+ uses: actions/setup-python@v5
+ with:
+ python-version: '3.14'
+ cache: 'pip'
+ ```
+
+> [!NOTE]
+> The `cache: 'pip'` option tells `setup-python` to cache downloaded pip packages. On the first run it saves the cache; on subsequent runs it restores it, skipping most download time.
+
+3. Save the file.
+
+## Add caching to the e2e test job
+
+The e2e job has two dependencies to cache — Python packages and the Node modules. We can follow the same path here! To make sure our packages are updated when versions change, we're going to set the `package-lock.json` file as a dependency. When the workflow runs, it will look to see if that file has changed; if it has it'll perform a reinstall. If not, it'll use the cache!
+
+1. Update the **Set up Python** step in the `test-e2e` job the same way:
+
+ ```yaml
+ - name: Set up Python
+ uses: actions/setup-python@v5
+ with:
+ python-version: '3.14'
+ cache: 'pip'
+ ```
+
+2. Update the **Set up Node.js** step in the `test-e2e` job to enable npm caching:
+
+ ```yaml
+ - name: Set up Node.js
+ uses: actions/setup-node@v4
+ with:
+ node-version: '20'
+ cache: 'npm'
+ cache-dependency-path: 'app/client/package-lock.json'
+ ```
+
+3. Save the file.
+
+> [!NOTE]
+> You might wonder about caching Playwright browsers too. Playwright's [official CI guidance][playwright-ci] recommends running `npx playwright install --with-deps` on every run rather than caching browsers, since browser binaries are tightly coupled to the Playwright version and caching them can lead to subtle version mismatches.
+
+## Compare run times
+
+Now let's push the changes and see the impact of caching.
+
+1. In the terminal (Ctl+` to toggle), stage, commit, and push your changes:
+
+ ```bash
+ git add .github/workflows/run-tests.yml
+ git commit -m "Add caching to CI workflow"
+ git push
+ ```
+
+2. Navigate to the **Actions** tab on GitHub and observe the workflow run.
+3. Once it completes, check the logs for the setup steps. You should see output indicating a **cache miss** — this is expected on the first run since there's nothing cached yet.
+4. To see caching in action, trigger a second run. You can push a small change (such as adding a comment to `run-tests.yml`) or use the GitHub UI:
+ - Update the `on` section to add `workflow_dispatch:` so you can trigger runs manually
+ - Push that change, then use the **Run workflow** button on the **Actions** tab
+
+5. On the second run, check the setup step logs again. You should see a **cache hit**, and the overall run time should be noticeably shorter.
+
+> [!TIP]
+> You can view cache usage for your repository by navigating to **Actions** > **Caches** in the left sidebar. This shows all active caches, their sizes, and when they were last used.
+
+## Summary and next steps
+
+The Actions Marketplace provides thousands of pre-built actions so you don't have to reinvent the wheel. Many setup actions like `setup-python` and `setup-node` have caching built in, making it easy to dramatically reduce workflow run times by reusing previously downloaded dependencies.
+
+Next, we'll explore [matrix strategies][walkthrough-next] to test across multiple configurations simultaneously.
+
+## Resources
+
+- [GitHub Actions Marketplace][actions-marketplace]
+- [Caching dependencies to speed up workflows][caching-docs]
+- [Playwright CI documentation][playwright-ci]
+- [actions/setup-python][setup-python-action]
+- [actions/setup-node][setup-node]
+
+| [← Running Tests][walkthrough-previous] | [Next: Matrix Strategies & Parallel Testing →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+[actions-marketplace]: https://github.com/marketplace?type=actions
+[caching-docs]: https://docs.github.com/actions/writing-workflows/choosing-what-your-workflow-does/caching-dependencies-to-speed-up-workflows
+[marketplace]: https://github.com/marketplace
+[playwright-ci]: https://playwright.dev/docs/ci
+[setup-node]: https://github.com/actions/setup-node
+[setup-python-action]: https://github.com/actions/setup-python
+[walkthrough-previous]: 3-running-tests.md
+[walkthrough-next]: 5-matrix-strategies.md
diff --git a/content/github-actions/5-matrix-strategies.md b/content/github-actions/5-matrix-strategies.md
new file mode 100644
index 0000000..de3e1d5
--- /dev/null
+++ b/content/github-actions/5-matrix-strategies.md
@@ -0,0 +1,131 @@
+# Matrix Strategies & Parallel Testing
+
+| [← Caching][walkthrough-previous] | [Next: Deploying to Azure with azd →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+Matrix strategies let you run a job across multiple configurations in parallel — different language versions, operating systems, or test targets. This is powerful for ensuring compatibility and catching environment-specific bugs early in the development cycle.
+
+## Scenario
+
+While the goal is to deploy the project to Azure, in the future you may look to host the app on other platforms. As part of the testing, you want to ensure the Python code will run correctly on different versions of the language runtime. This will avoid future surprises.
+
+## Background
+
+A [matrix][matrix-docs] allows you to create an array for a workflow to iterate through. This can be various configurations, operating systems, or anything else where you need to have a part of a workflow run multiple times. You define the values for the matrix in an array, then utilize the `matrix` keyword to retrieve the current value. GitHub Actions will handle the looping automatically for you!
+
+## Add a matrix to the test job
+
+Let's update the CI workflow to test the API across multiple Python versions.
+
+1. Open `.github/workflows/run-tests.yml` in your codespace.
+2. Locate the `test-api` job.
+3. Add a `strategy` block with a `matrix` definition, and update the `python-version` input to reference the matrix value.
+4. Replace the existing `test-api` job with the following:
+
+ ```yaml
+ test-api:
+ runs-on: ubuntu-latest
+ strategy:
+ matrix:
+ python-version: ['3.12', '3.13', '3.14']
+
+ steps:
+ - uses: actions/checkout@v4
+
+ - name: Set up Python ${{ matrix.python-version }}
+ uses: actions/setup-python@v5
+ with:
+ python-version: ${{ matrix.python-version }}
+ cache: 'pip'
+
+ - name: Install dependencies
+ run: |
+ python -m pip install --upgrade pip
+ pip install -r app/server/requirements.txt
+
+ - name: Run tests
+ working-directory: ./app/server
+ run: |
+ python -m unittest test_app -v
+ ```
+
+> [!IMPORTANT]
+> Make sure to quote version numbers like `'3.12'` in the matrix array. Without quotes, YAML may interpret them as floating-point numbers — for example, `3.10` becomes `3.1`, which would cause the setup step to fail.
+
+5. In the terminal (Ctl+` to toggle), stage, commit, and push your changes:
+
+ ```bash
+ git add .github/workflows/run-tests.yml
+ git commit -m "Add Python version matrix to test-api job"
+ git push
+ ```
+
+6. Navigate to the **Actions** tab on GitHub. You should see three parallel jobs running — one for each Python version.
+
+## Understanding matrix behavior
+
+By default, GitHub Actions uses **fail-fast** mode: if any matrix job fails, all remaining jobs are cancelled. This is efficient but can hide failures in other configurations.
+
+- **`fail-fast: false`** — continues running all matrix jobs even if one fails. This is valuable when you want to see the full picture of which configurations pass and which don't.
+- **`max-parallel`** — limits the number of jobs running concurrently. Useful when you have resource constraints or are hitting rate limits.
+
+Update the strategy block to disable fail-fast:
+
+```yaml
+strategy:
+ fail-fast: false
+ matrix:
+ python-version: ['3.12', '3.13', '3.14']
+```
+
+> [!TIP]
+> Setting `fail-fast: false` is particularly useful during initial setup or when debugging, as it provides a complete view of compatibility across all configurations.
+
+## Using include and exclude
+
+Matrix strategies support `include` and `exclude` to fine-tune which combinations run.
+
+- **`include`** adds extra combinations or additional variables to existing combinations.
+- **`exclude`** removes specific combinations from the matrix.
+
+Here's an example that adds an extra combination with an additional environment variable, and excludes a specific one:
+
+```yaml
+strategy:
+ fail-fast: false
+ matrix:
+ python-version: ['3.12', '3.13', '3.14']
+ os: [ubuntu-latest, ubuntu-22.04]
+ exclude:
+ - python-version: '3.14'
+ os: ubuntu-22.04
+ include:
+ - python-version: '3.14'
+ os: ubuntu-latest
+ experimental: true
+```
+
+In this example:
+
+- The `exclude` block skips Python 3.14 on `ubuntu-22.04`.
+- The `include` block adds an `experimental` flag to the Python 3.14 / `ubuntu-latest` combination, which you could reference with `${{ matrix.experimental }}` in your steps.
+
+> [!NOTE]
+> You don't need to add this to your workflow right now. This is provided as a reference for more advanced matrix configurations.
+
+## Summary and next steps
+
+Matrix strategies let you test across multiple configurations — language versions, operating systems, and more — with minimal YAML duplication. Combined with `fail-fast`, `max-parallel`, `include`, and `exclude`, you have fine-grained control over parallel testing. Next we'll [deploy to Azure using azd][walkthrough-next].
+
+## Resources
+
+- [Using a matrix for your jobs][matrix-docs]
+- [Workflow syntax for `jobs..strategy`][strategy-syntax]
+
+| [← Caching][walkthrough-previous] | [Next: Deploying to Azure with azd →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+[matrix-docs]: https://docs.github.com/actions/using-jobs/using-a-matrix-for-your-jobs
+[strategy-syntax]: https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstrategy
+[walkthrough-previous]: 4-caching.md
+[walkthrough-next]: 6-deploy-azure.md
diff --git a/content/github-actions/6-deploy-azure.md b/content/github-actions/6-deploy-azure.md
new file mode 100644
index 0000000..b557857
--- /dev/null
+++ b/content/github-actions/6-deploy-azure.md
@@ -0,0 +1,249 @@
+# Deploying to Azure with azd
+
+| [← Matrix Strategies & Parallel Testing][walkthrough-previous] | [Next: Creating custom actions →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+With CI in place, it's time for CD — continuous deployment or continuous delivery. We'll use the [Azure Developer CLI (azd)][azd-docs], Microsoft's recommended tool for deploying to Azure. **azd** handles the heavy lifting: generating infrastructure-as-code (Bicep), configuring passwordless authentication (OIDC), and creating the GitHub Actions workflow.
+
+## Scenario
+
+With the prototype built, the shelter is ready to share their application with the world! They want to deploy automatically whenever code is pushed to `main` — but only after CI passes.
+
+## Background
+
+### Secrets and variables
+
+Speaking of secrets and variables... In a prior exercise you utilized `GITHUB_TOKEN`. `GITHUB_TOKEN` is a special secret automatically available to every workflow, and provides access to the current repository. You can add your own secrets and variables to your repository for use in workflows.
+
+Secrets are exactly that - secret. These are passwords and other values you don't want the public to be able to see. You can add secrets via the CLI, APIs, and your repository's page on github.com. Secrets are write-only, and are only available to be read by a running workflow. In fact, there's even a filter so if the workflow attempts to write or log a secret it'll automatically be hidden. You can confidently add secrets to a public repository, and the only visible aspect will be its name and not the value.
+
+Variables, on the other hand, are designed to be public values. They're settings like URLs or names, or other values that aren't sensitive. Variables can be both read and written. Use variables whenever you need the ability to configure a value outside a workflow.
+
+### Protecting production
+
+There are several strategies for ensuring only validated code reaches production. In a later exercise we'll configure **branch rulesets** to require CI checks and pull request reviews before code can be merged to `main`. Since our deploy workflow only triggers on pushes to `main`, this creates a natural gate: code must pass CI and be reviewed before it can be deployed.
+
+> [!TIP]
+> GitHub also supports **environments** with deployment protection rules (like manual approval gates). Environments are a powerful option when you need separate staging and production deployments — but for this workshop, branch rulesets give us the same safety with less setup. See the [environments documentation][environments-docs] to explore that approach on your own.
+
+## Install and initialize azd
+
+Let's set up the Azure Developer CLI and scaffold the infrastructure for our project.
+
+1. Open the terminal in your codespace (or press Ctl+` to toggle it).
+2. Install azd by running:
+
+ ```bash
+ curl -fsSL https://aka.ms/install-azd.sh | bash
+ ```
+
+3. Log in to Azure:
+
+ ```bash
+ azd auth login
+ ```
+
+ Follow the device code flow — open the URL shown, enter the code, and sign in with your Azure account.
+
+4. Initialize the project by running:
+
+ ```bash
+ azd init --from-code
+ ```
+
+5. `azd` will scan your project and detect the client and server services. When prompted, select **Confirm and continue initializing my app** to accept the detected services and generate the project configuration.
+6. By default, `azd` generates infrastructure in memory at deploy time. To customize the infrastructure, persist it to disk by running:
+
+ ```bash
+ azd infra gen
+ ```
+
+7. Explore the generated `infra/` directory. You'll see Bicep files (`.bicep`) that define the Azure resources for your application:
+
+ ```bash
+ ls infra/
+ ```
+
+> [!TIP]
+> Bicep is Azure's domain-specific language for defining infrastructure as code. If you have GitHub Copilot, try asking it to explain the generated Bicep files!
+
+The generated `infra/` directory contains several Bicep files that work together:
+
+- **`main.bicep`** — The entry point. It defines the deployment's parameters (like location and environment name) and orchestrates the other files.
+- **`main.parameters.json`** — Default parameter values passed to `main.bicep` at deployment time.
+- **`resources.bicep`** — The core of the infrastructure. It defines the Azure Container Apps environment and the individual container apps for the client and server, including their Docker images, environment variables, ingress settings, and scaling rules.
+- **`modules/`** — Helper modules referenced by the main files (e.g., for fetching container image metadata).
+- **`abbreviations.json`** — A lookup table `azd` uses to generate consistent, short resource names following Azure naming conventions.
+
+## Configure the infrastructure
+
+The generated Bicep files define the Azure Container Apps that will host the client and server. We need to add an environment variable so the client knows where to find the API server.
+
+1. Open `infra/resources.bicep` in your codespace.
+2. Find the section (around line 109) that reads:
+
+ ```bicep
+ {
+ name: 'PORT'
+ value: '4321'
+ }
+ ```
+
+3. Create a new line below the closing `}` and add the following:
+
+ ```bicep
+ {
+ name: 'API_SERVER_URL'
+ value: 'https://${server.outputs.fqdn}'
+ }
+ ```
+
+> [!NOTE]
+> While the syntax resembles JSON, **it's not JSON**. You'll need to resist the natural urge to add commas between the objects!
+
+## Create the CD workflow
+
+By default, `azd pipeline config` generates a simple workflow that deploys on every push to `main`. That works for getting started, but we want a workflow that only deploys **after CI passes**. If you create the workflow file *first*, `azd` will detect it and configure credentials around your custom workflow instead of generating the default.
+
+Let's create a workflow that:
+- Only deploys **after CI passes** — using [`workflow_run`][workflow-run-docs]
+- Can also be **triggered manually** via `workflow_dispatch`
+- Prevents **conflicting deployments** with concurrency controls
+
+1. Create a new file at `.github/workflows/azure-dev.yml`.
+2. Add the following content:
+
+ ```yaml
+ name: Deploy App
+
+ on:
+ workflow_dispatch:
+ workflow_run:
+ workflows: ["Run Tests"]
+ branches: [main]
+ types: [completed]
+
+ permissions:
+ id-token: write
+ contents: read
+
+ jobs:
+ deploy:
+ runs-on: ubuntu-latest
+ if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+ concurrency:
+ group: deploy-production
+ cancel-in-progress: false
+
+ steps:
+ - uses: actions/checkout@v4
+
+ - name: Install azd
+ uses: Azure/setup-azd@v2
+
+ - name: Log in with Azure (Federated Credentials)
+ run: |
+ azd auth login \
+ --client-id "${{ vars.AZURE_CLIENT_ID }}" \
+ --federated-credential-provider "github" \
+ --tenant-id "${{ vars.AZURE_TENANT_ID }}"
+
+ - name: Provision and deploy
+ run: azd up --no-prompt
+ env:
+ AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+ AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}
+ AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
+ ```
+
+3. Save the file.
+
+Let's walk through the key parts:
+
+- **`permissions: id-token: write`** — In the [Running Tests][running-tests] module you set `contents: read`. Here, `id-token: write` is added because the workflow needs to request OIDC tokens from Azure. This is how passwordless authentication works — no stored credentials, just short-lived tokens.
+- **`vars.*`** — Variables like `${{ vars.AZURE_CLIENT_ID }}` reference **repository variables** that `azd pipeline config` will create for you in the next step.
+- **`workflow_run`** triggers this workflow whenever the **Run Tests** workflow completes on `main`. The `if` condition ensures it only proceeds when tests **succeeded** — or when triggered manually via `workflow_dispatch`.
+- **`concurrency`** prevents conflicting deployments. Note `cancel-in-progress: false` to avoid accidentally cancelling an active deployment.
+- **`azd up`** provisions infrastructure and deploys your application in one command.
+
+## Set up Azure authentication
+
+Now let's let `azd` configure the pipeline credentials. Because the workflow file already exists, `azd` will configure OIDC and variables around it rather than generating a new one.
+
+1. Configure the deployment pipeline:
+
+ ```bash
+ azd pipeline config
+ ```
+
+2. Follow the prompts — here's what to expect:
+
+ | Prompt | What to select |
+ |--------|---------------|
+ | **Select a provider** | Choose **GitHub** |
+ | **Enter a unique environment name** | Enter a short name (e.g., `-pets-workshop`) — this names your Azure resource group |
+ | **Select an Azure subscription** | Choose the subscription you want to deploy to |
+ | **Select an Azure location** | Pick a region close to you (e.g., `eastus2`) |
+ | **Select how to authenticate the pipeline to Azure** | Choose **Federated Service Principal (SP + OIDC)** |
+
+ After you answer these, `azd` will:
+ - Create OIDC credentials in Azure for passwordless authentication
+ - Store the necessary secrets and variables in your repository automatically
+ - Detect your existing workflow file and configure it
+
+3. When prompted to commit and push your local changes, say **yes**.
+
+> [!TIP]
+> After `azd pipeline config` completes, navigate to **Settings** > **Secrets and variables** > **Actions** > **Variables** tab to see the repository variables it created (like `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, etc.). These are the `vars.*` values your workflow references.
+
+## Test the pipeline
+
+When you said **yes** to `azd pipeline config`'s commit prompt, it pushed your changes — including the workflow file. Let's verify everything is working.
+
+1. Navigate to the **Actions** tab. The push will trigger the **Run Tests** workflow first.
+2. Once tests complete successfully, the **Deploy App** workflow will start automatically (via the `workflow_run` trigger).
+3. Watch the deploy job run — it will provision Azure resources and deploy both the client and server applications.
+4. Once the deployment completes return to your codespace.
+5. Run the following in the terminal to list the details of your new Azure environment:
+
+ ```bash
+ azd show
+ ```
+
+6. Look for the **client** service endpoint in the output.
+7. Open the client URL in your browser — you should see the pet shelter application live!
+
+## Summary and next steps
+
+Congratulations! You've deployed the pet shelter application to Azure with a CI/CD pipeline:
+
+- **CI-gated deployment** — CD only runs after CI passes, using `workflow_run`
+- **OIDC authentication** — passwordless, short-lived tokens instead of stored credentials
+- **Concurrency controls** — preventing conflicting deployments
+- **azd integration** — `azd pipeline config` configured credentials around your custom workflow
+
+In a later exercise, we'll add **branch rulesets** to ensure code must pass CI and be reviewed before it can reach `main` — creating a natural production gate.
+
+Next we'll [create custom actions][walkthrough-next] to reduce duplication and make our workflows more maintainable.
+
+## Resources
+
+- [What is the Azure Developer CLI?][azd-docs]
+- [Create a custom pipeline definition][azd-pipeline-definition]
+- [Events that trigger workflows: workflow_run][workflow-run-docs]
+- [About security hardening with OpenID Connect][oidc-docs]
+- [Deploying with GitHub Actions][actions-deploy]
+- [Using environments for deployment][environments-docs]
+
+| [← Matrix Strategies & Parallel Testing][walkthrough-previous] | [Next: Creating custom actions →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+[actions-deploy]: https://docs.github.com/actions/use-cases-and-examples/deploying/deploying-with-github-actions
+[azd-docs]: https://learn.microsoft.com/azure/developer/azure-developer-cli/overview
+[azd-pipeline-definition]: https://learn.microsoft.com/azure/developer/azure-developer-cli/pipeline-create-definition
+[environments-docs]: https://docs.github.com/actions/managing-workflow-runs-and-deployments/managing-deployments/using-environments-for-deployment
+[oidc-docs]: https://docs.github.com/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect
+[running-tests]: 3-running-tests.md
+[workflow-run-docs]: https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflow_run
+[walkthrough-previous]: 5-matrix-strategies.md
+[walkthrough-next]: 7-custom-actions.md
diff --git a/content/github-actions/7-custom-actions.md b/content/github-actions/7-custom-actions.md
new file mode 100644
index 0000000..1302521
--- /dev/null
+++ b/content/github-actions/7-custom-actions.md
@@ -0,0 +1,268 @@
+# Creating Custom Actions
+
+| [← Deploy to Azure][walkthrough-previous] | [Next: Reusable Workflows →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+Custom actions let you encapsulate reusable logic into a single step you can use across workflows. GitHub Actions supports three types of custom actions: **[composite][creating-composite-action]** (combines multiple steps), **[JavaScript][creating-javascript-action]** (runs Node.js code), and **[Docker container][creating-docker-container-action]** (runs in a container). Composite actions are the most approachable and a great starting point for bundling common step patterns.
+
+In this exercise you'll create a composite action that sets up the Python environment and seeds the test database, then use it in your CI workflow.
+
+## Scenario
+
+The pet shelter's test workflows need to seed the database before running tests. This involves setting up Python, installing dependencies, and running `seed_database.py`. Rather than duplicating these steps in every workflow, we'll create a custom composite action that any workflow can reference in a single step.
+
+## Background
+
+The great advantage to a composite action is it builds upon the knowledge you already have. You've defined actions already, and a custom action uses a very similar syntax, all defined in YAML.
+
+Every custom action is defined by an `action.yml` file. This file describes the action's interface and behavior:
+
+- **`name`**: A human-readable name for the action.
+- **`description`**: A short summary of what the action does.
+- **`inputs`**: Parameters the caller can pass to the action.
+- **`outputs`**: Values the action makes available to subsequent steps.
+- **`runs`**: Defines how the action executes. Composite actions use `runs.using: 'composite'` with a list of `steps`.
+
+Inputs and outputs let the action communicate with the calling workflow, making the action flexible and reusable across different contexts.
+
+## Create the setup-python-env action
+
+Let's create a composite action that sets up Python, installs dependencies, and seeds the test database.
+
+1. In your codespace, open a terminal window by selecting Ctl+\`.
+2. Create the directory for the action by executing the following command in the terminal:
+
+ ```bash
+ mkdir -p .github/actions/setup-python-env
+ ```
+
+3. In the newly created `setup-python-env` folder, create a new file named `action.yml` to store your composite action.
+4. Add the following YAML to the file to define your composite action:
+
+ ```yaml
+ name: 'Setup Python Environment'
+ description: 'Sets up Python, installs dependencies, and seeds the test database'
+
+ inputs:
+ python-version:
+ description: 'Python version to use'
+ required: false
+ default: '3.14'
+ database-path:
+ description: 'Path to the test database file'
+ required: false
+ default: './test_dogshelter.db'
+
+ outputs:
+ database-file:
+ description: 'Path to the seeded database file'
+ value: ${{ steps.set-output.outputs.database-file }}
+
+ runs:
+ using: 'composite'
+ steps:
+ - name: Set up Python
+ uses: actions/setup-python@v5
+ with:
+ python-version: ${{ inputs.python-version }}
+
+ - name: Install dependencies
+ run: pip install -r app/server/requirements.txt
+ shell: bash
+
+ - name: Seed the database
+ id: seed
+ run: python app/server/utils/seed_database.py
+ shell: bash
+ env:
+ DATABASE_PATH: ${{ inputs.database-path }}
+
+ - name: Set output
+ run: echo "database-file=${{ inputs.database-path }}" >> $GITHUB_OUTPUT
+ shell: bash
+ id: set-output
+ ```
+
+> [!NOTE]
+> Composite action steps must include `shell: bash` for every `run` step — this is required even though it seems redundant. Without it, the workflow will fail with a validation error.
+
+Review the key parts of the action:
+- **Inputs** provide sensible defaults so callers only need to override what's different.
+- **Outputs** reference the `set-output` step's output, making the database path available to the calling workflow.
+- Each `run` step explicitly declares `shell: bash` as required by composite actions.
+
+## Use the action in the CI workflow
+
+Now let's update the CI workflow to use the custom action instead of the individual setup and install steps. We'll also store the test database path as a repository variable — configured once in your repository settings and available to every workflow.
+
+1. Navigate to your repository on GitHub and go to **Settings** > **Secrets and variables** > **Actions** > **Variables** tab. Select **New repository variable** and create:
+ - **Name**: `TEST_DATABASE_PATH`
+ - **Value**: `./test_dogshelter.db`
+
+ This is the same `vars.*` mechanism that `azd pipeline config` used in the [deploy lesson][deploy-azure] for Azure credentials. Repository variables keep configuration out of your workflow files, making them easier to change without a code commit.
+
+2. Return to your codespace and open `.github/workflows/run-tests.yml`. In the `test-api` job, replace the **Set up Python** and **Install dependencies** steps (lines 23–32) with a single call to the composite action:
+
+ ```yaml
+ - name: Setup Python environment
+ id: seed
+ uses: ./.github/actions/setup-python-env
+ with:
+ python-version: ${{ matrix.python-version }}
+ database-path: ${{ vars.TEST_DATABASE_PATH }}
+ ```
+
+3. Update the **Run tests** step in `test-api` (line 34) to pass the database path from the action's output:
+
+ ```yaml
+ - name: Run tests
+ run: python -m unittest test_app -v
+ working-directory: ./app/server
+ env:
+ DATABASE_PATH: ${{ steps.seed.outputs.database-file }}
+ ```
+
+4. The `test-e2e` job has the same **Set up Python** and **Install Python dependencies** steps — a perfect chance to reuse the action. Replace those two steps with the same composite action call (no `python-version` override needed since the action defaults to 3.14):
+
+ ```yaml
+ - name: Setup Python environment
+ id: seed
+ uses: ./.github/actions/setup-python-env
+ with:
+ database-path: ${{ vars.TEST_DATABASE_PATH }}
+ ```
+
+ Then update the **Run e2e tests** step to pass the database path so the Flask server started by Playwright can find the seeded database:
+
+ ```yaml
+ - name: Run e2e tests
+ working-directory: ./app/client
+ run: npx playwright test
+ env:
+ DATABASE_PATH: ${{ steps.seed.outputs.database-file }}
+ ```
+
+5. Here's the complete updated `run-tests.yml` for reference:
+
+ ```yaml
+ name: Run Tests
+
+ on:
+ push:
+ branches: [main]
+ pull_request:
+ branches: [main]
+
+ permissions:
+ contents: read
+
+ jobs:
+ test-api:
+ runs-on: ubuntu-latest
+ strategy:
+ fail-fast: false
+ matrix:
+ python-version: ['3.12', '3.13', '3.14']
+
+ steps:
+ - uses: actions/checkout@v4
+
+ - name: Setup Python environment
+ id: seed
+ uses: ./.github/actions/setup-python-env
+ with:
+ python-version: ${{ matrix.python-version }}
+ database-path: ${{ vars.TEST_DATABASE_PATH }}
+
+ - name: Run tests
+ run: python -m unittest test_app -v
+ working-directory: ./app/server
+ env:
+ DATABASE_PATH: ${{ steps.seed.outputs.database-file }}
+
+ test-e2e:
+ runs-on: ubuntu-latest
+
+ steps:
+ - uses: actions/checkout@v4
+
+ - name: Setup Python environment
+ id: seed
+ uses: ./.github/actions/setup-python-env
+ with:
+ database-path: ${{ vars.TEST_DATABASE_PATH }}
+
+ - name: Set up Node.js
+ uses: actions/setup-node@v4
+ with:
+ node-version: '20'
+ cache: 'npm'
+ cache-dependency-path: 'app/client/package-lock.json'
+
+ - name: Install Node dependencies
+ working-directory: ./app/client
+ run: npm ci
+
+ - name: Install Playwright browsers
+ working-directory: ./app/client
+ run: npx playwright install --with-deps chromium
+
+ - name: Run e2e tests
+ working-directory: ./app/client
+ run: npx playwright test
+ env:
+ DATABASE_PATH: ${{ steps.seed.outputs.database-file }}
+ ```
+
+6. In the terminal (Ctl+` to toggle), commit and push your changes:
+
+ ```bash
+ git add .github/actions/setup-python-env/action.yml .github/workflows/run-tests.yml
+ git commit -m "Add setup-python-env composite action"
+ git push
+ ```
+
+7. Navigate to the **Actions** tab on GitHub and verify the workflow runs successfully with the new action.
+
+> [!TIP]
+> When developing custom actions, you can test them by pushing to a branch and triggering a workflow run. Check the workflow logs to ensure each step in your composite action executes as expected.
+
+## Types of custom actions
+
+GitHub Actions supports three types of custom actions, each suited to different use cases:
+
+| Type | Best for | Runs on | Complexity |
+|------|----------|---------|------------|
+| **Composite** | Bundling multiple existing steps into one | Directly on the runner | Easiest to create |
+| **JavaScript** | Complex logic, API calls, or custom computations | Node.js runtime | Moderate |
+| **Docker container** | Actions that need specific tools or environments | Inside a container | Most involved |
+
+- **Composite actions** are ideal when you want to combine several existing steps (like we did with setup, install, and seed) into a single reusable unit. They're the fastest to create because they use the same step syntax you already know.
+- **JavaScript actions** are best when you need custom logic, such as making API calls, processing data, or interacting with the GitHub API. They run on Node.js and have access to the `@actions/core` and `@actions/github` packages.
+- **Docker container actions** are best when your action requires specific tools, operating system libraries, or a particular runtime environment. They run in a Docker container, giving you full control over the execution environment.
+
+## Summary and next steps
+
+Custom actions reduce duplication and make workflows cleaner. You've created a composite action that encapsulates Python setup and database seeding into a single reusable step. Any workflow in the repository can now prepare the Python environment with a single `uses` reference.
+
+Next, we'll take reusability to the next level by exploring [reusable workflows][walkthrough-next] for sharing entire workflow patterns across your CI/CD pipeline.
+
+## Resources
+
+- [Creating a composite action][creating-composite-action]
+- [About custom actions][about-custom-actions]
+- [Metadata syntax for GitHub Actions][metadata-syntax]
+- [GitHub Skills: Reusable workflows][skills-reusable-workflows]
+
+| [← Deploy to Azure][walkthrough-previous] | [Next: Reusable Workflows →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+[about-custom-actions]: https://docs.github.com/actions/sharing-automations/creating-actions/about-custom-actions
+[creating-composite-action]: https://docs.github.com/actions/sharing-automations/creating-actions/creating-a-composite-action
+[creating-docker-container-action]: https://docs.github.com/actions/sharing-automations/creating-actions/creating-a-docker-container-action
+[creating-javascript-action]: https://docs.github.com/actions/sharing-automations/creating-actions/creating-a-javascript-action
+[deploy-azure]: 6-deploy-azure.md
+[metadata-syntax]: https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions
+[skills-reusable-workflows]: https://github.com/skills/reusable-workflows
+[walkthrough-previous]: 6-deploy-azure.md
+[walkthrough-next]: 8-reusable-workflows.md
diff --git a/content/github-actions/8-reusable-workflows.md b/content/github-actions/8-reusable-workflows.md
new file mode 100644
index 0000000..4d84be1
--- /dev/null
+++ b/content/github-actions/8-reusable-workflows.md
@@ -0,0 +1,243 @@
+# Reusable Workflows
+
+| [← Creating Custom Actions][walkthrough-previous] | [Next: Required Workflows, Protection & Wrap-Up →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+Reusable workflows let you define an entire workflow that other workflows can call, like a function. This is different from custom actions — actions encapsulate individual *steps*, while reusable workflows encapsulate entire *jobs*. They're triggered with the `workflow_call` event and can accept inputs, secrets, and produce outputs.
+
+In this exercise you'll extract the deployment pattern into a reusable workflow, then call it from both your CD pipeline and a new manual deployment workflow for rollbacks and hotfixes.
+
+## Scenario
+
+The shelter's deploy workflow is working — code that passes CI on `main` gets deployed automatically. But what happens when something goes wrong in production and you need to quickly roll back to a known-good version? Or deploy a hotfix from a specific commit? Right now, the only option is to push to `main` and wait for CI. Let's create a manual deployment workflow that lets the team deploy any git ref on demand, and extract the shared deploy logic into a reusable workflow so both pipelines stay in sync.
+
+## Background
+
+In the [previous exercise][walkthrough-previous] you created a composite action to bundle steps together. Reusable workflows solve a similar problem — avoiding duplication — but at a different level. It's important to understand when to reach for each one.
+
+A **composite action** combines multiple *steps* into a single step that runs inside a job. A **reusable workflow** packages one or more entire *jobs* that a caller workflow references at the job level. Here's a side-by-side comparison:
+
+| | Composite Action | Reusable Workflow |
+|---|---|---|
+| **What it encapsulates** | Multiple steps, run as a single step | One or more complete jobs |
+| **Where it lives** | `action.yml` in any directory (e.g. `.github/actions/`) | `.github/workflows/` directory only |
+| **How it's called** | `uses:` inside a job's `steps` | `uses:` directly on a `job`, not inside steps |
+| **Runner control** | Runs on the caller job's runner | Each job specifies its own runner |
+| **Secrets** | Cannot access secrets directly | Can receive secrets via `secrets:` or `secrets: inherit` |
+| **Logging** | Appears as one collapsed step in the log | Every job and step is logged individually |
+| **Nesting depth** | Up to 10 composite actions per workflow | Up to 10 levels of workflow nesting |
+| **Marketplace** | Can be published to the [Actions Marketplace][actions-marketplace] | Cannot be published to the Marketplace |
+
+**When to use which:**
+
+- Choose a **composite action** when you want to bundle a handful of related steps that run within a single job — like the `setup-python-env` action you just built.
+- Choose a **reusable workflow** when you want to share entire job definitions — including runner selection, environment targeting, and concurrency controls — across multiple workflows. Deployment pipelines are a classic use case, which is exactly what we'll build next.
+
+## Understanding secrets in reusable workflows
+
+Reusable workflows often need access to secrets and variables — for example, deployment credentials. There are two approaches:
+
+### Pass all secrets
+
+Using `secrets: inherit` to forward every secret available in the calling workflow to the reusable workflow.
+
+ ```yaml
+ deploy:
+ uses: ./.github/workflows/reusable-deploy.yml
+ with:
+ deploy-ref: main
+ secrets: inherit
+ ```
+
+### Define specific secrets
+
+For a more controlled approach, you can identify which specific secrets to pass in the reusable workflow's `on.workflow_call.secrets` section:
+
+```yaml
+on:
+ workflow_call:
+ inputs:
+ deploy-ref:
+ required: false
+ type: string
+ secrets:
+ AZURE_CLIENT_ID:
+ required: true
+ AZURE_TENANT_ID:
+ required: true
+ AZURE_SUBSCRIPTION_ID:
+ required: true
+```
+
+Then caller then passes each secret explicitly:
+
+```yaml
+deploy:
+ uses: ./.github/workflows/reusable-deploy.yml
+ with:
+ deploy-ref: main
+ secrets:
+ AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+ AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+ AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+```
+
+> [!IMPORTANT]
+> For deployment workflows that need Azure credentials, `secrets: inherit` is the simplest approach. However, defining specific secrets provides better documentation and prevents accidentally exposing secrets the reusable workflow doesn't need. We'll use `secrets: inherit` in this exercise for simplicity.
+
+## Create a reusable deployment workflow
+
+Let's extract the shared deploy steps into a reusable workflow. The workflow will accept an optional `deploy-ref` input so callers can deploy any git ref — the current commit, a previous release tag, or a specific commit SHA.
+
+1. In your codespace, create a new file at `.github/workflows/reusable-deploy.yml`.
+
+2. Define the `workflow_call` trigger with an input for the git ref to deploy:
+
+ ```yaml
+ name: Reusable Deploy Workflow
+
+ on:
+ workflow_call:
+ inputs:
+ deploy-ref:
+ description: 'Git ref to deploy (commit SHA, tag, or branch). Defaults to the caller workflow ref.'
+ required: false
+ type: string
+ default: ''
+ ```
+
+3. Add a single job that checks out the code, authenticates with Azure, and deploys:
+
+ ```yaml
+ jobs:
+ deploy:
+ runs-on: ubuntu-latest
+ concurrency:
+ group: deploy-production
+ cancel-in-progress: false
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ inputs.deploy-ref || github.sha }}
+
+ - name: Install azd
+ uses: Azure/setup-azd@v2
+
+ - name: Log in with Azure (Federated Credentials)
+ run: |
+ azd auth login \
+ --client-id "${{ vars.AZURE_CLIENT_ID }}" \
+ --federated-credential-provider "github" \
+ --tenant-id "${{ vars.AZURE_TENANT_ID }}"
+
+ - name: Deploy application
+ run: azd up --no-prompt
+ env:
+ AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+ AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}
+ AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
+ ```
+
+> [!NOTE]
+> Reusable workflows have a few important limitations: they can be nested up to 4 levels deep, and the workflow file must be located in the `.github/workflows` directory. You also cannot call a reusable workflow from within a reusable workflow's `steps` — they are called at the job level.
+
+## Update the CD workflow
+
+Now update your `azure-dev.yml` to call the reusable workflow instead of defining the deploy steps inline.
+
+1. Replace the contents of `.github/workflows/azure-dev.yml` with:
+
+ ```yaml
+ name: Deploy App
+
+ on:
+ workflow_dispatch:
+ workflow_run:
+ workflows: ["Run Tests"]
+ branches: [main]
+ types: [completed]
+
+ permissions:
+ id-token: write
+ contents: read
+
+ jobs:
+ deploy:
+ if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+ uses: ./.github/workflows/reusable-deploy.yml
+ secrets: inherit
+ ```
+
+ Notice how the entire job definition is replaced by a single `uses:` reference. The reusable workflow handles checkout, authentication, and deployment — the caller just decides *when* to deploy.
+
+## Create a manual deploy workflow
+
+Now let's add the second caller — a manual deploy workflow for rollbacks and hotfixes. This is where the reusable workflow really earns its keep: same deploy logic, different trigger.
+
+1. Create a new file at `.github/workflows/manual-deploy.yml`.
+2. Add the following content:
+
+ ```yaml
+ name: Manual Deploy
+
+ on:
+ workflow_dispatch:
+ inputs:
+ deploy-ref:
+ description: 'Git ref to deploy (commit SHA, tag, or branch)'
+ required: true
+ default: 'main'
+
+ permissions:
+ id-token: write
+ contents: read
+
+ jobs:
+ deploy:
+ uses: ./.github/workflows/reusable-deploy.yml
+ with:
+ deploy-ref: ${{ inputs.deploy-ref }}
+ secrets: inherit
+ ```
+
+ This workflow is only triggered **manually** via `workflow_dispatch` — it appears as a "Run workflow" button in the Actions tab. It prompts for a **git ref** (a commit SHA, tag, or branch name to deploy), passes that ref to the reusable workflow's `deploy-ref` input, and uses the same deploy logic as the automated pipeline.
+
+3. In the terminal (Ctl+` to toggle), commit and push your changes:
+
+ ```bash
+ git add .github/workflows/reusable-deploy.yml .github/workflows/azure-dev.yml .github/workflows/manual-deploy.yml
+ git commit -m "Extract reusable deploy workflow and add manual deploy"
+ git push
+ ```
+
+4. Navigate to the **Actions** tab on GitHub and verify that the deploy workflow runs successfully. You should also see **Manual Deploy** in the workflow list — try clicking **Run workflow** to test deploying a specific ref.
+
+> [!TIP]
+> When viewing a workflow run that calls reusable workflows, GitHub shows each caller job separately. Select a job to see the steps from the reusable workflow running inside it.
+
+This pattern keeps your deployment logic in one place. When you need to update the deployment process — like adding health checks or notifications — you change it once in the reusable workflow and every caller benefits.
+
+## Summary and next steps
+
+Reusable workflows reduce duplication at the workflow level. You've extracted the shared deployment pattern into a template that both the automated CD pipeline and the manual deploy workflow call with a single `uses` reference. This keeps your deployment process maintainable as it grows — any change happens in one place.
+
+Next, we'll ensure quality gates are enforced with [branch protection, required workflows, and more][walkthrough-next].
+
+## Resources
+
+- [Reusing workflows][reusing-workflows]
+- [The `workflow_call` event][workflow-call-event]
+- [Sharing workflows with your organization][sharing-workflows]
+- [GitHub Skills: Reusable workflows][skills-reusable-workflows]
+
+| [← Creating Custom Actions][walkthrough-previous] | [Next: Required Workflows, Protection & Wrap-Up →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+[actions-marketplace]: https://github.com/marketplace?type=actions
+[reusing-workflows]: https://docs.github.com/actions/sharing-automations/reusing-workflows
+[sharing-workflows]: https://docs.github.com/actions/sharing-automations/sharing-workflows-secrets-and-runners-with-your-organization
+[skills-reusable-workflows]: https://github.com/skills/reusable-workflows
+[workflow-call-event]: https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflow_call
+[walkthrough-previous]: 7-custom-actions.md
+[walkthrough-next]: 9-required-workflows.md
diff --git a/content/github-actions/9-required-workflows.md b/content/github-actions/9-required-workflows.md
new file mode 100644
index 0000000..b1100bc
--- /dev/null
+++ b/content/github-actions/9-required-workflows.md
@@ -0,0 +1,176 @@
+# Rulesets, Required Workflows & Wrap-Up
+
+| [← Reusable Workflows][walkthrough-previous] | [Next: GitHub Actions section overview →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+Building a CI/CD pipeline is only half the battle — you also need to enforce it. Repository rulesets ensure that code can't be merged without passing checks and getting reviewed. Required workflows go further, allowing organizations to mandate specific workflows across all repositories. In this final exercise, you'll configure a ruleset on `main`, explore required workflows, and wrap up the workshop.
+
+## Scenario
+
+The shelter's CI/CD pipeline is comprehensive, but nothing currently prevents someone from merging code without passing CI — meaning untested code could reach `main` and trigger a deployment. The organization also wants to ensure all repositories run security scanning. Let's lock things down with rulesets and explore how required workflows enforce standards at scale.
+
+## Background
+
+### Repository rulesets
+
+[Rulesets][about-rulesets] are GitHub's recommended approach for enforcing rules on branches and tags. They offer flexibility and visibility that legacy branch protection rules don't:
+
+- **Layering** — Multiple rulesets can apply to the same branch; the most restrictive rule wins.
+- **Status management** — Toggle between **Active** and **Disabled** without losing configuration.
+- **Visibility** — Anyone with read access can see active rulesets (not just admins).
+- **Bypass permissions** — Granular bypass for specific roles, teams, or GitHub Apps.
+- **Scope** — Repository-level or organization-wide (on GitHub Enterprise).
+- **Required workflows** — Rulesets can require specific workflows to pass before merging.
+
+Rulesets are available on all GitHub plans for public repositories, and on GitHub Pro, Team, and Enterprise plans for private repositories.
+
+### Required workflows
+
+One of the most powerful ruleset features is the ability to **require specific workflows to pass before merging**. This is particularly useful at the organization level:
+
+- An organization creates a reusable workflow (e.g. `security-scan.yml`) in a central repository.
+- An organization-wide ruleset requires that workflow for all (or a subset of) repositories.
+- Every PR across those repositories now runs the required workflow automatically — individual repository owners can't skip it.
+
+Common use cases include security scanning, license compliance, and code quality checks.
+
+## Add a summary job to the CI workflow
+
+Right now we have two sets of tests - end to end tests with Playwright, and unit tests with Python. The latter is actually setup using a matrix, where we run the tests against different versions of Python. As time goes on, the list of tests may grow and change. We want to ensure we can easily indicate that **all** tests have passed in one, centralized report. This will allow us to then use this as our flag when creating a gate, to ensure our CI has completed successfully before allowing a merge into `main`. We'll do this by adding a new job to the end of our tests workflow, which will check if all jobs in the workflow have succeeded.
+
+1. Open `.github/workflows/run-tests.yml` and add the following job at the end of the `jobs:` section (after the `test-e2e` job):
+
+ ```yaml
+ tests-passed:
+ if: always()
+ needs: [test-api, test-e2e]
+ runs-on: ubuntu-latest
+ steps:
+ - name: Check results
+ run: |
+ if [[ "${{ needs.test-api.result }}" != "success" || "${{ needs.test-e2e.result }}" != "success" ]]; then
+ echo "One or more jobs failed"
+ exit 1
+ fi
+ ```
+
+2. Commit and push the change:
+
+ ```bash
+ git add .github/workflows/run-tests.yml
+ git commit -m "Add tests-passed summary job"
+ git push
+ ```
+
+The `if: always()` ensures this job runs even when upstream jobs fail, so it can correctly report failure. The `needs` key creates a dependency on both test jobs, and the step checks their results.
+
+## Create a ruleset for `main`
+
+Let's create a ruleset that requires our tests to pass, and pull requests to be reviewed, before merging to `main`.
+
+1. Navigate to your repository on GitHub.
+2. Select **Settings**, then in the left sidebar under **Code and automation**, expand **Rules** and select **Rulesets**.
+3. Select **New ruleset** > **New branch ruleset**.
+4. Under **Ruleset name**, enter `main-gate`.
+5. Set the **Enforcement status** to **Active**.
+6. Under **Target branches**, select **Add target** > **Include default branch**. This targets `main`.
+7. Under **Branch rules**, enable the following rules:
+
+ | Rule | Configuration |
+ |------|--------------|
+ | **Require a pull request before merging** | Set **Required approvals** to `1` |
+ | **Require status checks to pass** | Check **Require branches to be up to date before merging**, then add `tests-passed` as a required check |
+ | **Block force pushes** | *(enabled by default)* |
+
+8. Select **Create** to save the ruleset.
+
+> [!TIP]
+> If your status checks don't appear when searching, make sure the CI workflow has run at least once on the repository. GitHub only shows status checks that have been reported previously.
+
+> [!NOTE]
+> You can start a ruleset in **Disabled** mode to test it before enforcing. This lets you preview which PRs would be blocked without actually blocking anyone.
+
+## Test the ruleset
+
+Let's verify the ruleset is working.
+
+1. Return to your codespace and open the terminal (Ctl+` to toggle). Create a new branch and make a small change:
+
+ ```bash
+ git checkout -b test-ruleset
+ echo "# test change" >> app/server/app.py
+ git add app/server/app.py
+ git commit -m "Test ruleset enforcement"
+ git push -u origin test-ruleset
+ ```
+
+2. Navigate to your repository on GitHub and create a pull request from `test-ruleset` to `main`.
+3. Observe that the **Merge pull request** button is disabled — the required status checks must pass and the PR needs an approving review.
+4. Watch the CI workflow run. Even after all checks pass, the merge button remains disabled until the review requirement is satisfied.
+5. You can close the pull request — the important thing is that the ruleset is enforced!
+
+> [!IMPORTANT]
+> Rulesets ensure your CI pipeline isn't just a suggestion — it's a requirement. Code cannot reach `main` without passing the checks and reviews you've defined. Since your deploy workflow only triggers on pushes to `main`, this means only validated, reviewed code gets deployed.
+
+## Organizational required workflows
+
+Organization-wide rulesets can mandate that specific workflows run across all repositories. This pairs naturally with the reusable workflows you built in the [previous exercise](8-reusable-workflows.md) — an organization could create a reusable security-scanning workflow in a central `.github` repository, then enforce it via a ruleset so every PR across the organization runs it automatically.
+
+> [!NOTE]
+> Organization-wide rulesets are available on GitHub Team and GitHub Enterprise plans. For personal repositories on the Free plan, repository-level rulesets (as configured above) provide similar enforcement at the repo level.
+
+## Advanced features to explore
+
+Here are some additional GitHub Actions features you can explore on your own:
+
+- **Service containers**: Spin up databases, caches, or other services alongside your test jobs. Define them under `services` in a job, and GitHub Actions handles the lifecycle for you.
+- **Job summaries**: Write Markdown to the `$GITHUB_STEP_SUMMARY` environment file to create rich, formatted output that appears on the workflow run summary page.
+- **Self-hosted runners**: Run workflows on your own infrastructure for specialized hardware needs, compliance requirements, or to stay within your network. Useful when you need GPUs, specific OS versions, or access to internal resources.
+- **Larger runners**: GitHub-hosted runners with more CPU and memory (up to 96-core x64 and 64-core ARM), available on Team and Enterprise plans. Swap `runs-on: ubuntu-latest` for a larger runner label when your builds or tests need more compute. See the [larger runners documentation][larger-runners].
+- **`repository_dispatch`**: Trigger workflows from external events via the GitHub API. This is useful for integrating GitHub Actions with external systems like monitoring tools, chatbots, or other CI/CD platforms.
+
+## Wrap-up and congratulations
+
+Congratulations! You've built a complete CI/CD pipeline for the pet shelter application. Let's review what you've accomplished:
+
+- **Continuous integration**: Tests run on every push and pull request across multiple Python versions, catching bugs before they reach `main`.
+- **Continuous deployment**: Automated deployment to Azure via `azd`, triggered after CI passes on `main`.
+- **Custom actions**: Encapsulated Python setup and database seeding into a reusable composite action, eliminating duplication across jobs.
+- **Reusable workflows**: Extracted the deployment pattern into a callable workflow template, shared by both the automated CD pipeline and a manual deploy workflow for rollbacks.
+- **Manual deployment**: Added on-demand deployment capability for rollbacks and hotfixes, using `workflow_dispatch` with a git ref input.
+- **Rulesets**: Enforced quality gates so code can't be merged without passing CI checks and peer review — the production safeguard that ensures only validated code gets deployed.
+
+This pipeline follows the same patterns used by teams across GitHub. As the shelter's application grows, this foundation will scale with it.
+
+### Continue learning
+
+If you want to keep exploring, here are some suggested next steps:
+
+- Add a code scanning workflow using [GitHub Advanced Security][github-security].
+- Explore [GitHub Environments][environments-docs] with deployment protection rules for staged deployments (e.g., staging → production with manual approval).
+- Explore the [GitHub Actions Marketplace][actions-marketplace] for community-built actions.
+- Take the [GitHub Skills: Deploy to Azure][skills-deploy-azure] course for a deeper dive into Azure deployment.
+
+## Resources
+
+- [About rulesets][about-rulesets]
+- [Creating rulesets for a repository][creating-rulesets]
+- [Available rules for rulesets][available-rules]
+- [The `workflow_dispatch` event][workflow-dispatch]
+- [GitHub Skills: Deploy to Azure][skills-deploy-azure]
+- [GitHub Actions Marketplace][actions-marketplace]
+
+| [← Reusable Workflows][walkthrough-previous] | [Next: GitHub Actions section overview →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+[about-rulesets]: https://docs.github.com/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets
+[actions-marketplace]: https://github.com/marketplace?type=actions
+[available-rules]: https://docs.github.com/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets
+[creating-rulesets]: https://docs.github.com/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository
+[environments-docs]: https://docs.github.com/actions/managing-workflow-runs-and-deployments/managing-deployments/managing-environments-for-deployment
+[github-security]: https://github.com/features/security
+[larger-runners]: https://docs.github.com/actions/using-github-hosted-runners/using-larger-runners
+[skills-deploy-azure]: https://github.com/skills/deploy-to-azure
+[workflow-dispatch]: https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflow_dispatch
+[walkthrough-previous]: 8-reusable-workflows.md
+[walkthrough-next]: README.md
diff --git a/content/github-actions/README.md b/content/github-actions/README.md
new file mode 100644
index 0000000..f05541c
--- /dev/null
+++ b/content/github-actions/README.md
@@ -0,0 +1,68 @@
+# GitHub Actions: From CI to CD
+
+| [← Pets workshop selection][walkthrough-previous] | [Next: Workshop Setup →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+[GitHub Actions][github-actions] is a powerful automation platform available right in your GitHub repository. With Actions you can build, test, and deploy your code — and automate just about anything else in your software development lifecycle. This workshop walks you through building a complete CI/CD pipeline, starting with running tests on every push and ending with automated deployment to Azure.
+
+## Scenario
+
+You're a developer, volunteering for a pet adoption shelter. They have a [Flask][flask] API and an [Astro][astro] frontend. They're ready to productionize their app, and deploy it to the cloud! But they also know there's some processes that should be followed to ensure everything flows smoothly. The goal is to work to automate all of those - through the use of GitHub Actions!
+
+## Prerequisites
+
+To complete this workshop, you will need the following:
+
+- A [GitHub account][github-signup]
+- An [Azure subscription][azure-free] (for the deployment exercises)
+- Familiarity with Git basics (commit, push, pull)
+
+> [!NOTE]
+> If you have access to [GitHub Copilot][github-copilot], it can help you write workflow YAML files. You'll see tips throughout the exercises on how to use it effectively.
+
+## Exercises
+
+0. [Workshop Setup][setup] — Create your repository from the template
+1. [Introduction & Your First Workflow][introduction] — Create your first workflow and explore the Actions UI
+2. [Securing the Development Pipeline][code-scanning] — Enable code scanning, Dependabot, and secret scanning
+3. [Running Tests][ci] — Automate unit and e2e testing with parallel jobs
+4. [Caching][marketplace] — Speed up workflows by caching dependencies
+5. [Matrix strategies & parallel testing][matrix] — Test across multiple configurations simultaneously
+6. [Deploying to Azure with azd][deployment] — Set up continuous deployment to Azure
+7. [Creating custom actions][custom-actions] — Build your own reusable action
+8. [Reusable workflows][reusable-workflows] — Share workflow logic across repositories
+9. [Required workflows, protection & wrap-up][protection] — Enforce standards and protect your branches
+
+## Resources
+
+- [GitHub Actions documentation][github-actions-docs]
+- [GitHub Actions Marketplace][actions-marketplace]
+- [Workflow syntax reference][workflow-syntax]
+- [Azure Developer CLI (azd) documentation][azd-docs]
+
+| [← Pets workshop selection][walkthrough-previous] | [Next: Workshop Setup →][walkthrough-next] |
+|:-----------------------------------|------------------------------------------:|
+
+[actions-marketplace]: https://github.com/marketplace?type=actions
+[astro]: https://astro.build/
+[azure-free]: https://azure.microsoft.com/free/
+[azd-docs]: https://learn.microsoft.com/azure/developer/azure-developer-cli/overview
+[ci]: ./3-running-tests.md
+[code-scanning]: ./2-code-scanning.md
+[custom-actions]: ./7-custom-actions.md
+[deployment]: ./6-deploy-azure.md
+[flask]: https://flask.palletsprojects.com/
+[github-actions]: https://github.com/features/actions
+[github-actions-docs]: https://docs.github.com/actions
+[github-copilot]: https://github.com/features/copilot
+[github-signup]: https://github.com/join
+[introduction]: ./1-introduction.md
+[marketplace]: ./4-caching.md
+[matrix]: ./5-matrix-strategies.md
+[protection]: ./9-required-workflows.md
+[repo-root]: /
+[reusable-workflows]: ./8-reusable-workflows.md
+[setup]: ./0-setup.md
+[walkthrough-next]: ./0-setup.md
+[walkthrough-previous]: ../README.md
+[workflow-syntax]: https://docs.github.com/actions/writing-workflows/workflow-syntax-for-github-actions
diff --git a/content/shared-images/code-scanning-dialog.png b/content/shared-images/code-scanning-dialog.png
new file mode 100644
index 0000000000000000000000000000000000000000..e43dec08a8c51aa9397db763ea5ee15c64ca0880
GIT binary patch
literal 60341
zcmdSBRa6{X*Dj0(m*7r<1@{DZcY?bF8V&C5kPzJ6U4jR9cXxNE@y7W(`%U)uj&uH-
zb8#+CkE+qttJYjPtJYled1ilCl$St3BtV3KfIyLw6jg$NfWicy&hT%*DZ42UqYw~~
zy5=Gxic%sX?-cEAOw7LmARwrtoubC+y6y1#^^LTWI3*>Qq>2r#c&H2SqYH@VzM|lI
zfmXwo_NHB8opV;w1ML%E4RF7|3exNZBB>YaYUq#8SBCT6TzlV~xn+!Bxn&I&)5KRn
zFY0uD8v|lzd+wgP-Q}V@>PzLj>*etvj5y{
zqv)=_?fp_raSP)EWyM7}kZ&(YakL*CuK_O;H)g
z;!Mm066@km@3AxMhfXQY7CA=eIXQ!~?Tu1wD5uMaM6QU_5(OX}9*ilgZ`(7#|YcQAk-t
zN(%g~Y-A4rSUZ^6IC{rf$b*ZTGgr}Y)R2?qHnOo|G&HvP0$_Btvi&Ur!RyKmzO({3
z8oqP2`fBaK?aD{?PY!PI_3vaRvUmSvakS(k(~whqCt_m{c=w5snUR@{AMxG0cf9t-
zCfrJ*;(x@!zxc?^935@BnV4K$To_&07;WrLnOL~ExR{t(nOIpFz&RKk+^ii9T^Xz$
z$p2Hw-*Q9&4o3FowvOgD*6)6oYxu>+$&rtY>~}@~e*V)=fUEic)MV}Or(56-GX1{8
z#KOqT^l#ZZ%YRG$
z*PZ`WQq=)qFJfZ_uF{eJe`e;7@PFU@Bgo72yXXHk68{aYpJoZv9h8WPhwj=rJVZC{Feli+r6TN
z(Ffm1YPygp1fhN(=W6!;toxkPwZQncA;6QN{tz|L_GCNV-jaZ3*&uAq`*Kv
zN2S|<1Y0H6-iAMdQG!s6D9&W5^{$gTF-}~LsS+Lp5$6}<4dRZUsZQRCrbSwd%Dv5w
z>3==mA~@^A#`M?5cnA5<;ipKxF{9VtD^>PjgX`c(uJgnO@1vW{j7u!VN%}ocDpqZ(
zK#s0hDL)~uSmzq;QMXaypSJ#P?i|cd-Bw!l3ccvzL?#*85r8gEF0QK*ZJddL{{o1J
zXsU4h-65;-1nw7=oXN@kS(KmBU%!6U2>7xmu%Hy|6s
zLKdsjWGlp|*OCQI7~ZK_{4MGm?>$m8-bYc&7%j>eO`5lM_Ck~pV*bK^8)ED6Rx($d
zl9jp}N{29KJTsn7{U;|Rv$Pm(E+DD&aH=47U_^6A*s)fp0o_X8LFQk%)VIDYkgsgU
z1Js(;CW%+3;{*A_iS&pQ@3Ry+xdidVw$c#8sxS}{q9Fbp9SydpOR9r;VJP-$TQpcS
z$T@LCjTkrxv>3tg^?xQq5GoiV40+;h7M-AJ
z8*1fU7Tdxqg;K{O#u)Zn+h2K+ft$Syf2;E)gqpz4ViR=nMTN{4)}~^9#;o~7{ckN4
z8$Tc%-?TcyK+#%}!4`NKgiH%~Wp6wETLbz8cfb^JEoydzvLQf*7Q>VCKVvTWt`^>4
zv&ivq`Vcm+GD)Qp2I;e2BL;aQqu!LZ4-k5_Gh0L_Mx{7jf=caI-oJeheB&1u9qq4L
z6f2Tdl&5MbyD6a76vhwCl!t(&FzS;`@5Q<+N1>0Fd;cHJg2ZUJhlx>+wq;)lyVE9oF)+gW(@c0qNMtLDM6oVqDO;bN?nJ!R_hO;&{a;b_-@2y%Q4+~_
zcQ6~|ZxLgnJbQ{^>jL&C-y*Un!Tl|P9O^{_CMK5?VH7U@`%V$|TEHKEiMIN^&v))mX18~%APATcB{AZanBy7~wH9dZ?_
zJLG=_C^8_t59ltc@MHfLy5amG%MpPVv;I+}<1+RioeAXd`$c>f6_Y>I!~iq4?S4zd
zwW^0UGpOPxJ)q5PK9v{Ua(_AK_x#vP-+sv8ne`JeoFI30?9wiOHqi;qYBEzKNLfDJ
zsZg;uo~e&Y%LCLZn>sYGGFvwvj&i;N|!MFZPN!PF0;Akh{NpNN6Y!i
z#J!ORiBDE52aFmEnRNPX{_I~@G^7)0a=r6`p`I6qAM8&SSniz`NR`CXQ(4_&JekjZ
z4E5!0U>nkhj>4fUq6L)@(sAd5w-qM_$`k6o-<
z7@@VzQ^zQhmcnm;*@Lk7%c-;lG`5U^?Zle|h-C!~OJ%k_U-OM+aABeYa=zqCUye91
z!T&0riOj=qbUsb_x>70B_VlD&kFs%afk`28OT>ML8Ocwk{p;(e&(PH<#+pdDG-N(c
z_ld>>w%fSJ(h2m*^g}(ZUJp`MHzR^%vyr1Kp+h~f3IgO_Kp;>BxZNM28mcWhL5#ms58{PWpLd5*aV)r4gPp-khKhQ++qh9Z$XHx^v3WR_V2
zi4MZl%*3bDrNM>ov3cIz!3ku3{-UCyk`ZZKH}_K01v0Z1v;Nv`5QQ%TMv=o4>mkRU
z%h(7jRDhwl2i~9LX{A`yii)hJgE_CJqY1M&_L9T`pspYCp*=wdW{ba0gMWFju`ZW;
zplMbbC%?ST)~~OJ(ZlRyRGKVeBTz4V$jRB6DUPjno2EJ@VM$~PX(ih%AG5Bj*23;5
z#%Pd&aXwop0G7pv9^)XS!MBlZQlE$atlQ=s^r2HJqXzoiRVi~H)RFSq3MLQNNbQXz
z-+V;&db%D~bi2-m1I!L#%WsNYWP$iVL%ty-&O-zv(-ILx2`z3{Tr_g)65F1|cJ?x@jPMxnE6Vw|T!1hbsrAd2?bRfcfLzJcaX-M(UK
zXEi@QEezmK;Qm-5RnNmMb=8Nmd-#E5-l(SmUZxjQf$tP+&D&Q`=VFWUq_E}8h{5iT
znL@=teq2Axx8F>&+Bm*2(_^g(wLQ`_!&CTZw&cAokJF4c(ekqpGnT(=XN*BS_I>zB
z(&W%>;Du4SmkST&%z4OX^i^H7dBthypjN*q;S4j)fbZEwU@N#deg{QGQY<%
z-5T-pF(Pi)iEXQBapCzGtBTD>C6R5BZ;rUHc7}>b<+#c`mmw)Gb
zbj4wqv?1m&L*vW5@2vKL4nWU~oS@5F!ir%yQnaZ~gTao4rywNUYZiJOXn{LPG<@Un
z&2tv!gm9MJ7yD(SX#>*K-@mXYtES5Stuj~^F!1h$`2ZQ64qSx)S1GWjo0=f{TP
zmGeZ2U~0+JJ+Z_fj``KaJ6^jv3@+g)s(rhNEzkgU
z!cxQ1&6Q0X63kavu8xNqFLypauK2VIvM{&t;4EUc{
z^Dg{Ki>aQOpRF)A;=
zq8SZAk`mc|>OWK=3EvrumGFML$Cdfcyq|skbU$wf>7mZT&qu}g=;YBR*IFRw65xQ7
zuhX8DR;auEpbdJN!N($tZEG##OpLODpqHRZKbo~P3mVf?(`nAN}w|ZJj=I6k|C%=^gH{*ZEuFPu^T@>qer9tXY8GCUaj
zblVUAK@189VFeBca~c|i#lfmvt4q$vvOTF@~LbnS?>l_0edRz%s2Wae+$U^I<=!
z@i`ht%WdIU5{=vC-t6Ft6KECcSUlEbwCoKjZidGLjpbcuQoLM+m_*A@+)S7V~M2X}I{CJrK9kF+wn4BH&ZC$&E$Lv2(MUE(f2B3!iv>^b=I`U
zZuC(pz~^Z#CF8qcSvVob!HV^IlN|rUhIqwmNM`WC8b9MF)tfEumR*Urt8Y3d;DRMc
z+;=|LQOnQ}Q%R3{+Y+-_l^DDxB0tNkEHCB@mHXw6|uHMog#;0y~CfOvxulpk@luWJXY4Iw;$NVf#!Kswjga!b`(+w~0
z^B3e(H2>U5$hs8YxR=>*W{qv%P)X
z;B-hBnQ8&ZoLF!zK)L|i{rLuUXoE>)WLnqLD(_DvqB!9VE
zRidy(?!8Ig*GK0h7fz`+duuZqBPM;w9tzVXo5H-NL^Y)cLh8H^l;*4ZmiU&M>lOrs
zli;%MEz|aBSBZd8c}iHpL;s1YbEnATvH1|l(XoT3tr2+ACSSB)zy6q+ukxknT1}_E
zXUzApo)l8!or!GvLDhyLb(qp7iy{Ogj7l=6!)@5C3~Q^T&(%V$rUM>7G@##cR>MGIQtupeO
znyg_ipeP4b)%5Rs*%#2>pv1&b%4jNo^y+QIpRd{~d5dh-fEdht;_oCF)=sw6i88Mm%%aDn>q;?+j#(D${QzCi_xm^R
z^u;5H_>G-!a6-4l@_m!Dv#{QBaP!DRx`FrXQN~c
zvBq@#CzFxR5@**)NG6)CySRYv934F6dZbIE
z3W3ME)H<7b#NH;i44o?g8Ze^b`QCv+V5&NDytyDf&ZrsqHVs9W5>M@&3qUHOsa`yV`7EXmo~_@sU7g9
z-fstNUIM<1ooLGcIPdsDJUxHnzc$OU{%VlkrPOuqqEYW0KHJ98R9c6~ZvmRR9;jT)@I&xbYQqiY9RMnxqAf|8Oj6z+r6@b<*@dbvBd~Y<}XwZQ!
z0tyOVCzOQq;e31hGqcd6hSY50Q}caar8>~#QR9X4n|g(}7yiXObw2z{0Rsc4X=eWP
zYSdVefLcMAGTRB5
z(k9@PkYwX~?Byy8MPcgz5962wEp~U;jaC+vdcN7^&kcuqqK;%rudH`^AK&l8z#@VG
z|2jV)P&FBjQQ%1>wJ)#dc8U_Ix2w^#w2J3rA3v+>J<1g~KT_0Kv#;xa
z7_0ck%^Rgdfj8pK5>yK5KXGgP$^12OZj*7~LGzj9*AGw&{VPxPdOo8mdm$|9vis~%
z6090rI{BGR;}lM$vKIkg0uJ5pY;aw@x(QbX2rJrhh7CN)qT07C)DT{p5j{Uv4i$dr
zWNpt#cwkU1snrIMaSb2QtQ*+e`ImapIF9U9qG`WF(eSHm3t$-)K{%KyPn9P@fy+R#
zLCN7Gl}Vs?wh&~=$9&C(Sup*a#HsPPY#~>3LyzsDST6zSw(jD|R#ySkK
zTrkWod|_blc|E~3Gfzj;zqN>-a+2Ek34eG;QCxOrs
zU$e{XbdL@&0PWPQ?yJjd8z_0h9jOv@b4GbUnUde04z++fQPdQnT$(U}({*+BkqJ9V
z2T)fNTF2GKm?WS-pISP7cuJSHd%
z8w7D8*Ga&`*=a2X%>C1^I{LhiRnx6j%4Vl&(HX5RKgW?0TEK=@eg*;J@p3Iq?5>};
z*DhwAPJJnvUv1?WT=0fYx)g`?!bYus>87;{vr{X_)Ne(MsOP>?nG5uWmVL2nUs$*U
zCZ$*L6w3GHMhQ~CZLp`LqNt9Y@Dz=!P@-czx~s|pkQnV^&!qX#x73Jm$#z{^k&fRu
z8-*$3(&@>n(XGSJzZucxO)9Kn=fFbHM``2ZFN2{}<*&C{{^a7tt<46(c#iZiF3U-#5#4XYS9trdi
zVW>^ncTPv_{*~-zsT7o6
zNXv^Q1Ff-HO(~)bpem6KiZ(BIWuypjZuk4{5;pi7GTU(w<{i04Hl+i>#caVaTOzd6
z*&odmqmR?nNPw4xQp_yCmRf~j0x*Hn7oR|d!g}!t&?)(j9>F$=oW3+Xnd%SnG4Wmy
zK<0Sl&-KS)?N>c^K2jTf1Jcof@W{CSl?>hbgumIE(-ByI1HUs8uT85~(z9DDlEs(=``0nA4JF|HN*w>avYgK(?N4@LU%{_m>Epkn7r~kM
z{YmRe=n#qIl?IS~wT#67@Mm_=-<<;!7*wc)vq=8CL?qmiLe{sx>iWa}jvYLDkxoA1
z|5~Ep^Ba_6*+8pPmhC_8dvqw6U^GH;02$1YpXOimtCG_8?1_sO(@@)Eg!2#Z5(p3Z
z(xv`Q1*S&m4^p%#?K>peFh_JH_b1`KFgW4=)g14#hD1wLij8}UCNJljfkAX=d#V3U
zrXP$FC3DOC28~id+*JOs-!o{}CEOD8NdNk}2sn)CWxWdl?&b<*4uK65;{_WLO1Y(4*7IjH
zz-m(+>sI8toJ#An?Zk&_pLPEGv($?6tDB?wM4l$+*e>V9I3YkSjp*GSP}uNOLdpsF6&@8vrL(jzIr7svxgUl>Vy;Al7yAR3
zN%}`YxD%(&-EU;3*d9>G{CImd8`=>~9+D4UYMZh%_yFK(xr#O3DZ2Gd{Sg^{HNTR3SH%gwPkJaKB$}ltz5g_ZU`3ZJHmFK)b@kZ?!9S7f&y)J($y4`n1MK=wT$(K%k{K5$jMT2R
zpgf$)pO!*-xyLP+6f{3vEHAB985(V09oCl-W<;w!T18MJ;)Et_V#3nwt>
z=6IZ&&G@{SSMq002<(rg$A4l-m8lU&xnYJagK;n!pK=q`ayp)!mr9^lm8OFMt$8J$
zthLI}i70+~S*`9pOd#fQnhTxY`HpG4^KFyc=W1`PDp-ZvhX$#s#=mUJr)O
zcQf?(>Vozo4coc$2ciGIUn!wDdQG9!zP&*qlnRMRhY2_98wgXXHDej2bV`|#_jCp>
z?K<*$%+WUCK}dUaVudYECGOz_?xbqrU{{sqz9FQaN|DBA
zoBl{bI;Pgkk`7@z{q?qL?^Snv4wG7Xtp-8;ebT=TR)yjaOTIhn?^J4**Byn~dl|O)
z)^!IDM%Os2n#!I&oIv%9e)!xC_tVanPu0RSzlSCwF<>N_Z8+%yv-i%t!`^;(2*oD|
z{(IE${8bbgS(_o8rPTtZ>6p#~vu@M1lH$D**nwj8E?4}eI9(c!_b!Sg=eNUr<8?6h
zL;igFYMnxer4Gs8m4h1n+d9D;F7^9(N~q8tFmSK~HbnE~!!4#7g!t|+ug0&_H?^bC
zxm*vj)To$KyBS?>nwGtbJaLHF$XEeGCyr|x@FRmfz@vQZ?;>z$()*~VwUN+IxN~KC
z`2jsrX+&TYZhUPZo~J&AFJ@G9cG-kMi<8)9y-ki3?cqS=6a=}BcGYe&J2cfk?xp66
zyy>WnT4Zq9S6X2vM&@yQa=Aokqh;72@@LV>7Js)G|NRo1$mAJ}andNiXpKUvA#m~u
zuV~_5!=m{V$lA-!_nbtnfmTWjQW6qOGd%Rrf);Yq_&n6mLX1aKX3gJ-ufIH>b~<{d
zY1CQd3ugNY8g@9!!P8?#$q{l`SPl(L8o|~mm#CCet-qY-V$rGT=yUiaFliUKJQhFV
z9V5xl*h~mk;5;l~DjXf#PCXqaWT$t-uOJER9PQDzx*|*(8)Kx#-b_i
zRTsVSxEuI3a3!I-8drf9jPbd~&%cfAVM`Uy8L*`?^j)--;+?ll0nNgNc1Y_xT
zh@gdTw4ohyHpe!BJJ%>DtKmJlFIZG*f!l!f$442%kIg%ojaP9&Ms>zRaZ(mDW%<~J
zo$EXW!F!{r3N-Zb#$7wb)q?lBI?BgZwd(wo=$vs%e>oE>2rz2N4g8{z`#oS#yN}KR
zj0azT4W8F`(_ACIYjc(iR3@7X_Z=5h_{eT|di0T)>Gq*A(30%D$~Van=|li@9jnwN
ztJzwKjRiCEpuy~uF``{7O2-HfjX%+z8AkL`9L-4Zz9VV~yu(K*&`a6G9$CR-vxw6&
z-I6a>uFr^Ykz~+<70Yu@=U%e#jXlpdn{UdmW@eAOCFYh6yDY_HJ7OyDFavCHBWd8f
zgHGNHpb=9gK~9x58sWhxYqsB=D0hya4uGL``gPCOT<3v6GU!gl372(GN?WS@ze`vV
z2K+&eDgpyV8K$j9j~2@Jc=>c-6xC?Tp;*pdQ8J16hN*8hrYvsn1EzE5P`rj8<}qgy
zHpl7wC_fgKtXwad&dj&V|B_-FG+{<^RQ>8?DJt3fKD_svO!GGi8Ymb|DNRO`n`Ivg`t4xJ
zi?BbZ*DVM`<*=50dJjdv-fDHMR_M4wY_Mpl5TlGTywO&vH!A+XKHXGzCf@1P{Cbme-Um8;bc<0lFf|Wt`m#OprR|uqTZHe(=^-)NLed%lC
z)^p_d#xid(4X)N=S!%3U|GWj=Yfa8MW?!Xhi!$G{mlkY-`3yRUtWkc3DVZ%IU##Ab
zD%zI7#C|oAu$U|e@E*&Z4J{pH==2;1zdPwiwd!KMUQg9ZTe-dI`nB(?jYp|a2tG~&
zSNQ9MPwOnzTVX-&<>IIAU>CXCjV#d>!I)0jXPF>%0p0@}S4<|nMjP{
zXXLB27Y680hJX8ZUJ8#*t2(=xz?f0NgXJxDiB9bmj2uH{#eHlMi({21O4C1eKPR;;
z?|y^4*uBh1`Dk4dhiXmsVs{nanIk4sM9MHiL#Iw3U1W3-PuIdj%)dDv!#N*50Sy*)PNn+VE7HtH%
zH7)TvyYIJWf;UBl{iyu^VGr}F-;8^mXyAMl(l?x
z-S*7e^0i;+?P0sGN@RKO6eB(>VuD6*D-hfE+}PPVVVfIquCo9P=RCXoafKeIAYl2+
zU1ITkQY=Ms+?&Y-@`7-Bjo@sIGYe
zVlg}&4}RvpU7cmS6Qh-RLr{!#1hO2dxXKB0-RoRr9H=<10jvpmaGq@QPI0{IRxC%_
z3E0|teagbxB+7vH$USE835KL+|F$oGj?&>|>+oTKCqu>u#=J3Dtc{KC$8ckf>CVaF
z^hFt8gAMo1)7B#-Kh^l2cLDz?uK~+agLj?$bRgSGRPYBOJO|=+N$P6x5ij&U#^C1X
zN0WBz+tv709g($*)m{&q9=$g@pj+MZo3rHVja1|PKo735)rN}3*V7iKS1Oof$>=Y=
z`6lTP4~%yW^m@z^^68FGtftX9z4h|?pk*ymwH?l0c$Y@Gfc|nkY%r$Xz_3`WH9#1wHTlyKnt6cuXgM0~RxZf-QZx<~$Y2E{Nl%x4cO#HLtQG|(xDBWI6dbdC
zw3wf7O+Sq7Kio!)FO^oi=@ORe`Jr85sC>K|qC_LK!^0;vc37{rk~&9A_{F6l$W6$Mt6slnc~gs!lJ0JzLBF(U}j)a
z8@k&aPP}O~#O89}soWV%Rgmaq^YcvVTgcllK558U0FC5X{o-=ijpn8mxH}g?CFM0>
zJS?wwsQ@fTq=-~uJY_$ewRrT?h9SLTF
z;cBsCRPOLCN*SaV1rmWF@5QAM`z5Vppj>W^%Q)j=rFC7~TBQ`yDmh0e%$jQ4yz}=3)ji
z#N4Pk>oBQjR~u*$1EJf9U2QI2gk|xwdYT>?@2<`khhrEdP#a6iKHU`vos-n6rA^2`
z)h|DyaU8+d4`!z3$cl=aBqUFNkQ&0GnH`?e5x~3C*x1%@)RKFCmlHF=sj5zTi~0HU
z5r8)*J`DO1G}JUpS6hJE3uVF|7NVwZlxsdS%wgGw^-QksM97}7BrTOB@Mu$^nk>gR
zQi;4F##8F;SKGomxCL1&KrvDKn!zn(2|}5XQ4~$ay{I<8|4fasAmQ2~c|-8&t>?R^
z=qFgjVq99S)ko52rL62=COCTDwkdf;I*&ClXqq?LGtqLfZPsYNKgslgzr$3u0T0Ta%&qK6Ein1U`Z`ti>{qHTqL?91XF;`=E*FAn&i$*r9xAJ
zwJ5Vhf*kI`*@rjvV>|{MkCVVnjbTu0vdhZXGO0M*tlQG+VV1VpevxU>
zG0EZ!HhzR3>8zB1a_+O+L9eh_nWx&s^QYz>%W#C$2#Tn`o{tY~8<5c2Q|pdW?IigU
zVG*$>5&7HjLr~A=J1@$%9|PXthR0SsZF0f=AP+$+0kx;Sy!pD`r1?{?wSpND}MX&{AFLyzx?=UDIcqiM&Q@$4R^<=~3>Z)Pgd9*Mf6T^F6ikj>Yeo`q&MMW-J!=>fEiKN7;q~`G_5l
zc)e^+H%IufUgL)os8Q8D+nByV=UeSo_Z}tlmnEw!iu@?TbyRAJCnm2tEwnvWa)^Z}sqGV-CuNCLDr07Lmr%Cz8OH2=!H5jsa1r0T-v|f$!P-uJSv
zkV0{=P>smM?-lhoLNk5(`xoKMK6%6|lS~PwAQZ>)-d`S~LA%=?_+=YHI*_*wS#~9t
zS3GUu`v<{?vz>)B`EDIby}bsj9+RTQt7^BqYe7YkXN7jnlriNRj++S3cIxIysP(onN|UzgAN;1DFs1(?1x-Oy_NXYJU|8w`-H2WEx+Y2BC29hE5i%_
zEtpq-FmiUlKFS=#CuFm(?ZH{oZr;tUx;LCsQxED5l;A&4@2kfg3fsmXx3s%faSja0
zV)F%^4P*zfy39F#5bIj$b~^s83rKPDp5wASDn+)R%OSGmsX5?Ru!do<5XhOWQgBg7
z8R6Y)omuu&ugNy?;C{etZ5Zm**cX4yfMuf%#(9Sq8?ZsiBK@6z^Ac|R%S~J(zEQnv
zV;Id039=iz|0d?O;QMpRj$xxjJV3#%`b1V|Uc}{Qx6x(T9r#^DPse`k+$jSUM4xy>
zY4Dn)M09Q#bWc=cjZV^<=6?k1pT%Jevz^R5OjuRpi-5OflWshKUR+K>#qgD>BzW;#
z#bt`Ei6xeb!o65)reXqQa|gz@RLd$U(Ywi^4;|k=7sJ99B&`|(ah`mu-4=)GV**HUiy1t>K(ecTA-;@1pxh(sAV~o2Yv`xrfegIQ!e#4
zpw*g0Sf_6hv~7M1!o?wCL0huF-Fjo14R(PfqM!23$I?Ds^hqs~JYgC52b1}+NQA-W
zRCQ?(k`&#Pa3oC}X5_~wV}#$YA7v=QFt_+_zVU(aCV^EQCz9ts(A_dZ0~(UsNe77Q
zu>>0E2{zY|k9_M_Q6NHmOR`{(O((NS*6ZY`Z~h@DelT+}#|2`V@$$8Tz=b#8T^7%J
zsMKVy0|vn_7uVR2V7-pR{~<3`K(Pr!>BHpyxP?BZhZ26AL(V<=BW(pA$*tEeXk~GF
zY3WO3h~93agXy({@73E+6(0H^2~9S@SXqDgTijM_g)f)E%;MjDYe-;7H9SQ2X~Of;
zK&m(%OD0X(%6e96fq`>uamLgbl|3Cy2rDVA_hd8o@UN$bt}E4
zedXW<$|>N=M+{(+xHsPjVG9x$&aE9&TV8DCmuWvr^U#!)rRuDAGQZ)kJSgwZi$KG_
z>q>(YgZ39EE;Gc2`Vc5VzG3xXEPS*RWq%ZKsZ=D%!dD9g=(DE0RMXoT*8mfkzoRu&
zJdrH4E70YM#bLmfVtJ}ElY}37L?KydK!*F{yPrGx*oqLGr$Q2r?1Lz%Y|i0?HISK9
z%anAh1WGc^6)t$wT^O1RZTDI#s*`LN$SNuqvUvySM((jyxK3lD+`;5LV(jj3uKUbh
zLu9Saon
z*vuY66X%^+09xHl$1AuO^u~A&d$zhHWEiB2jojkh2k33iZ?CvaxBiW6b@xalQ?@x>
zGDsCZ@I%o3vYd~b0(};zds`^SYKLerL^Dx1eZb9Th>H)WJ=IejmCv0TlvwbdNp|}1
zwVpG6c6ZPcBcFUP4K%WO3Fo+5wyXv9Tg7m02EsJwX4>1z9$E4cGK&(d&+zWmrEyGtBC^F5qz?;Vi>sb`ZH;Z-)fJe)
zm{MrM!9L?Awss-QvnC|L?=@SqP3#yLbc2>4%6>*E6F)2OTf{-``f6}0(v83ZtZzJP
zS}jgHQ`{eo$1E&dBsviLvVdx0H^b(Mll9bysekW)+wYA!HfYl-rTp4oR
z3ic}77w1p;Z?nOu(R0cZtfNXGW@KW=Vek1kDrHqJrF#(Dt-kh}qOC)Mm%;s{i>r-s
zwl_hL5%XqI(dr`+%ry^SB>*C3{5bk}eDu|~{6d-KUKsz~*;;r{n}_SC3t|ZmV~TqF
zz8+g+;q(x>Cv9`W&u!A>oZCHk(y$_EBxtpEzpD08_V~@R&-4_Nj0
zuCUOgCCmYO0Ux;1*z9b|Y~h&9Ws}+cug(RX3%SUV%UA{~T6tdz!td5D&%&{{sKh&P
zzhI&1n^WY;v(o`+gqb>GUFn#D%M5~RYp&z(k5Bw)NLUZ@wW)8KC
z%k5)NVF3%U5|2u=TvM$L9sd-%h}Ty@A-II7@K6VD3-m$ua&+07y4%ZS|kk
zbwe;H4>{Eq+*_L!%r4j=p)@oxD7R~80p&L}PI0@z4pm%0;9TZDXXDhAr>y$wdg@Xa
zvKkz#Y8|h0P$`70;HfEUZiuO=}
z!!=sNFn~YU&8d`25BJA`Nx=qoa|X_QjW9OpSO$~L{^Od4@r8*04k2ia@dwSf<-yEi
zwd0xRAC~_Ek3hZyvo|2nlVScytc-y}{8q;5#;gD0JrMAU$?y=ORDWUpdNy!?U%kU=
z&B6^-<)~xx@2hGUY3K#|QpG2)-~e
zi4fjyH$(AwjgA*FYj2Lvgg#TTii?-5Co9l_10WOyMu{1!s^D?2YhnvG$aSUV6Yaj`Y^WDL8Tv|s*hxu}t{ofE=3`qzp)+LkLNwZRD1~55zgWNA0g%-o_
zCshHMPV-M>vJ|=RFMKQZr6WNZ!FU8S9+pHSsC0>cZ&RQ{K$+!=tg-rO5<31u7PMkR
z_>1^KLDo)oCK=)@4vV4>jZ*wusc;&2I?*fMnMD5Og`|TM6f55E{hRQ=@SW`
zi(ot!6F($srvBF9zcTg%+rdnqCDoplzwJ1{%o-Oxn1Aaa`L_phU@D2EI@5D5%78O%|A|2
z+-KAUES$fc^67vmlxYxXaDU9CveGK#9CTA`aYZo_1Z{zMN3pG&K$?V)P;d(
zud{fg{s^vgg##gDQf4iVW8y^T7$swKT0uwM0kEo8%#NnrlAb`4J>FFHfwi0C&@1nA^vCP%{oIofqBEz={9V4Z56;
z6i8D3zBX5`tw8rdwUleVv;yX{{&?$oj!vV!7{8}aR>elkKac-=v3F&0-+3FSq=7t_
zGB?u6AA3F$jt^yGq76oGCt{*}6bt<(+Ak;FW8-r-sYKxnT%!c*aGql_Ys?25y?cji
zJoCvsJEfRJFb#glK|z3~@oFcUtHzX3&L-gRe*sWZmxBW|W)o7xe&9T)P=(^qluTzl
zkINQ%fI|Yca&pJD_gPKCW*))ekR_dAlaC>oSsNM%l!hOC{Gcv(=hqLg7)2$9!4!qs
z**DVj-I4qS*bU#e`zbe3$!uC~L$8m#B4snVKMEaUG3tmK?D{DtOQLhX0h6-eA)yR&
zW!X#8b=w}Z{PU!|x+!#XMC(v7rSr<>`1Nv`IA9(3MSS{Bja^D;cf;l#Ty>&L@
z-b=s(!P#^n@Y!Bx-6&!ucjTnfz2&CwSgBQ9PAZYHHS4`Z_si1{CK)hSZ}&He^sK2l
z5gf{_~^kt=NWTQOKGA?k>cl&`42iTf}bJjY!_S1W2a|d
zZ%?AZgbwX}9D2=y5Z++qm(TH_4_+k5zq!`w96N)OtL``X<~4iOHb5WNFL$K;S5{kw
zKQ@1i={8AzkI6Sa+!AAT8p6{3q|@9CYF!ur2V~}%=f2@y=X?R<*;-X1USOF0H>cu<
zS~+{7lcoA_Q8fAPlUs;COi;GjsVnx$L7#a4;mftlSK{B-JN6OSJ)XVq@(>eu>7nHSrvO2Y_w`nbUnyr8txV#i6*nySBKyySqzqcPZ{}
z8}2Q4&+hB)*{6NY`I1aB`DXs}vqApwf#_9a{9-Y$kC(=6Em*nRueXe{e)4Br78aeF
z*2m+yhcf~X4s@zerDyNgCr=L$=?mS-1~*OHg`*itlvTHjnjC4RVkHUxXWlOXCxE7>
zT@c($@LdmV*ijZD{ArRU3#s9G7D~f2RD2}97UuzX>(#N##9cUjGNQj~IPRxnA*`2h
z%pRhh%C5nWTeGX#rXK@3jVFANZBCXQsK|`Vq(f?Y
zr7xxk*lZiYV@$YD@3zNDYgP#|2cjP&`g;;_3`x*f;>+h23ASxSFZ`?gC=b)2_r++d
z&m3wu{uzh-R96QrW;P+_#)m%|xwXw-*moZs`S^f#$i0}-VV
zP;vURgHSG!5V75EMd7eGrPI=iM}_291}2UBZwC~&QeNO=D+ebac0{8*#{xf-KI8I!
z;eFULNRgv-E^DzCIup`xM3CQYd*&A2p*e`5@FKRpJtaE&Sz+6UfCp!fn3lxn|CBrS
zvp(OaZq>C5*XEx}hDdI$H&FoE_@mCT9k1=pvy_pm{~1Ml5km{*$0C*Zcp01nf0s)g
zk{WefYcoKX;ZpT&jwl!OdzN!*6@PWe2|-K0L4VCeoM1
zR=1xk0ca2=d{2kAm5%eUPFodyS9cRegZsTmGhQnWS5xGUlpF?P5ei+nL&_&D`3T0(
zcB(v998u4Yle)HpN9ab*Cnobm39Njd4E#R!}!e?YA5yd?6Dr7ZX}r&=*M_2VtJu*
z-b=z_yG^~D=;e|Bs`kM@>{d}XgLwvaT?gJti
ze>@(A}o1$Ujbp_sHM+yIJYpu>Rm8o};2qVr3j~8BaE&Wwt
z!}*cpTX8rZkEyrg@-xeY<-vXE-sB}Ow&rA_21d(adSBW{GZj4j749(}8wQC#Qle)9
zK8S#((_v;efnFV#p|H;N=R68!S1gvt!HYq!T=fLwY+oog8T`Rad|sO4m%BRY=qlsU
zKa8gsSlr!uFjRo7lov_|iv)+Qcy@Tz<$=yt(sH&;=fv)CZ|!uwD}Eb%Z~@Tw*^k?7
z54i+)Uc6SVNNfI9g^
ze3D*~LT8BgfkNz0;W?R@9Zp-Fp5wr!zt|q4C|RtYMhKyhOResG^ms6+XUo}KGM#RU
z;KV0$ShbA^DlLI0lZ=lYN}xaB_$Gfw5Oy*A>Ef~+(zzHYLT9WM7IT?2f=KnCc=1GS
zwi}sz?Vj%=eHwPm7t1TMZo+%#;1C_(pX^~f-=8{pGXDnb;049Gv4Wv7xxixC6(?s6
z@D88n*(|U|E59*HIkNzJHK8&T@;=%+~YAR0-oljkMzyJU)GR|{b*
z-jLcTMTEJ7O(62ALPS8N2y{Yl>)HJ$8U~nc^z@QE4YoZo*d>SK<{W9Q5oRB)TOaqE
zP7J$svbHwm@N(TaWRq8}c4Tnu7eqon`4hF??Z0dl^by2aPNT!eYBA!T0!o}}wDs*-
zT!c6lW9eCebW&Yu{8y*6w;l?d{alXP*~a-pU=*|IlA{+&W)$kI@#i(irsM%o7A}ZA
z0TZuwVn(wSF!fr~uw=4v;WVi~1eAiJsjl}}EiQn>#;Yn*3l`n#a{Op_*nRRq1&c+=
zV3gu3m&m6K!Q+;)h*UgpNOXj((ha&*8Wq~v4!w-Kvxk$*Q+Qfl`MGpd{`uR-p)%GR
zf>@7WE$Jt09W-eyziPA94%q8)k_gkCtUj(s`r`NQ$L;69k_Bm)qk{#6>6v_1ziiLo
zQ9$jVz#m@}ukvzf5XxNl+GZD#W_xnce0%cn`-V{n+^uqd!IFiVtNqB_-Jo^92HUR(
z&Ro{SlIJ@k6mt2ZwQ;8H>vI7_AgWj;xiGDl`)1DA6s1p@xTl0JKTc}>X?kUUWxI5g
z<{p}B)&(bhK07Gq+iLfEYWyt(4&DYUEtbM$UTCrOJD>RZfxxZUjmo9~pWAul8!HCg
zmweRV-1}CTJH<*Rs-sJ+B5cM*d`ZFT8?>A&BC`YkRtopS*
zF5s)PA>ZlLnw8>g+f3_iHEvS)9Ku`4(8~(di{g{xVx)HHzt95nU^L)(G}-=ryttOk
zr_*PZ%ac>A3?$M_UWIc0Vsvi~_cv*mH$5$uN#>OKT42w`*pl#1YSTJDAuTNmBx$Ta
zga2XFL#lS!i@~Z60EW2U-5JNn;G$DA!`}cxX3LRu$GwK#>Mk-`5H%W*maTlsJ|xLv
z)2%RF(_CvMZoAWT6$C5zUEaG}k`}*da5H6H8E6!?<9jQ~v12WxvDD>w5<+ar;uDZn
zXpTQvGy@X_R`N+#t+7AT?
zf~}#HEoC8YBvxnlfh$*Rglmr834>9+Z5apP%M;H66s7M*D|8`@pn@UxcUoPJX9i?`
zGOKf?Wd8200aSvfB4BV8$3A-HU$3ZJZc%gH^wA;x`;Z`?$$IssCr|zJ?)kMy7*6*<
zREPDQt_vtqQgPtM_@lZP@TN_ttO7iDUzeAJThQ49p9MPgQ-b(ox>&~~l?%TWf#MP@
z!_52)Y(Y1pLO$-i<%F_jn_+Ihhe(Bh7aK_q@5xEG!&Gc)Iu$?3x2dcyqurzbm1p~P
z8K&67QxAKXwqr&MJc9MoTdB~Rr3-{yi?y>$EPMi1?rGuU$R4TrI*m73^Y67E$7_j6
zddSk>T7Nh7Sxr8>J#beBc!L;O&z7cuNkvg~fa%Xy8l%v5#$hrYNb7PyBh<+=X5=T=
zFfHZ41n6-5aW2Gguyzc8UE@EJA^ou@r{6lDK0CU3-XRa|>ew5z4^A_)eoVny#~yS4
zj;>dkX1mNDo?5!QjQ0?e+T?gVnvroHmrBtm$q^t}9xkNt?tsls;k^VFABs*}#D-jJ
z#-pPmQlv55_F5Z*S57}~Os}e=&TNHy5W`un>wWOh!Rt&Axdbs<^6-4EL>`S}m%oGv
zi~RM~fWRc7?!8IzSiNeG$amAUw+AE5op>movy9H`5t5ncf{J
z4GS78lL;fjE5PE*>{VYsw`iM45=-OfMDkbir;7}I$tY%*D!X3s>jz^7v-w{PfzYcP
zrM}vdEiR~g(?I&agEVJ^;R=D{qwiFQP+g
zg#$Q@tZ|gtLL~p*tm73w!&FKl|BE3liN4}zqH!ace|3ZWjIa0^q;l?C^Xfjl;%A?Y
zs`CF{6bTN%PrL=>Y@L1oUFsHzA1ADqa~xUTXam5*Bx2ZP
z(l7ci|9eg_evmi3DF{Hf02=`oDKRne_?@Bi-+S?cNf7>Ts1#EInc~i{5+#_HqVyY#
zge(CP4DpI?5m_ejV`TxR6tmeFlSx*zYjtIf^S0TU#D)hHaqXA8Wu?@AVJ}46?S0qSB}3#
z`syN@DqQ40-(dhWT;^v*8~_dwJ*-~I`9!G(7?wz-X1;Usq6QVImUc@OIR+_cM9tN^
z%QTy{$|hb;W?MfO*x_zsqh<~R#OC%ub`XK2fcs>&Oi@{$RD!mp^~&MTa&ek4g|CO+
zIXx_7jOH$`YWfOITZ>=D@=MqG&NpPF?-cWXtYW$}1(-FibS5{-L^0=}!8^&N5&1k%
zbDmZ*R9Va|jH!Q^MktnB6Z==>4$br0Y+N22H5Gsr0z|L!U5G31HCw*oQOV~ABA{Ym
zP-wDS#-?!9N;2h8#?t9Xq*+ea#vIPq2(g)~9mLK7=!4;L@!ma@lrGGfs$?9MaZVVA
z7y@1_5b6efyb5T+8eH!xN4c)g5DN(Q@r0m+bt6J7D9W3CEqt#MLz%W{>c+wfc
zJ8NDBpFP^3`Cfx2KV^Y&qT8d%;a)i%$jUPn(N8j!w>QZ2
zr`3JtwcpRKG<__J^Tn|Z}=q~(X5-1S?PX6J>TXKv89NP
zx&$snohO?*o>5gO>f)sUO|R9MT{;~%VKiiB1ZHhEYep%iEL3YT0y~|b_Zz-`i0&7{
z(X|&K{2J&9`CVzX!q-R?pfBI5kEWiD?WSXrl?UXD?6Y_y+E6)i{w{VHyhMBrF>7siYl^pPfEpacBDE|J-YX0Y@~^NL}>sVRU5Pv?#*
zqgtF283>t-q|BjgUj;MbvDu1zRXU~%e+>+c6}k9&V3?7pRH~wgXtI7M(4wR&*%y>g
z`N{n-a7t-ANFMI%3y*T?mzGR4WEc1Pf1^09E?|Hlgs#<%t$_p`gyYpb?2xQR2l#_7
zzxTfd>9k{?uBK{nevvfF4d?{zF?w2v+wU7H
z{nKo*^5;7plS%#J@j`_RIzwVn-yIXGS2LkZU|BU&F_@o0nt~@WixK+PZfK=DW)XtB
z0-M%?or1W!)0&v4=#p|&yW8oIH4^J3U}>9D!8+x4a$Obzf_nN?=K!fSpgQUc$N!Cv
z8SD0Z*tR{<6LM`>?6xTmLjym-*2>^C%>uU5f6yjr(s^M`MlMQaOH)$6^!Kj@|Bug5
zlN89D%MAbYt}Pvxl7waX+gu7gO_k2}Q$edG
zW&Hf}=i5OtMNT(t`#;zop_d_rm0~Q+aBF`oRfwV<$uyHcfj61c1;%(Vge&IgFWwxS
zYlM`h2m7W;)7y96th)1_m_s1f1_qnupTqt3=+a=aNY}U@LBpwNhLhu@t|A2+g5z?m
zKJen4a;>d`(ukEb!pA9m7Sa^76J8{^tzP4!#lt*rztp-7yKM}h
zgGtjHOW`S@gS+PVWV53(7*=`vMYWxHtCw)RK#_v?JMC6r*gJwE!6t}qp#^!02KT)f#F(h#lmd()gej(%Bh?BX
z$L}T|)`g&A?K4s>ir0%__@GHJ(YQ-+WczEf<%~KvO;laL@IEHmtgm<0GAL!Ya+d;%)DXeKu
zWVAS&NI`YOc1(8!07Y2iL=6K3z6JBR7nfGE`)E=%SGkS@6P&{xPcAiMun3G?`4(Nh
z6X_KOXH2)V?RCVmPg(yGp1zP?f#=GmJtBAx*E-^(#d=4em*Fu|x*GxMpKnyheM$>m
z(Gd!W5Da(#i{+dYhZ!M413e?TMmdi}LZwHWH4+wu`M0q>#|9>G(YVgr;^p|?$j{|zZxhK)v
zbguIDcD{fWc*nVJlFMYf^~oxfXxI;AWB+b>d7=oxpo_IO5FN@83h=gHjFi23=n%@5
zp08BM)8=v7?!ge`EE~rCyL!2mBBUJbe$UWC+v2=xuuVixE(%0Omb|Pk=9MkY*MuCd
zwv9EqHyswMw`fSl(o)S~C$V^Bd};Y1qrq-zDr^15zw3z*u65z^xGa~T1p&O|t1C3y
z`l(T&?T1W5kr?}Yy`E3DWSpdb#G{n%dE4?W`fAlA+n?2)WAy7>C)gGNvRESXNvJqf_%Xlt|9?oMM0WV3Ef
z&#uPCQYj9Orf_9Dg~Xr#*_7))UT(@34vGfSe#fNFkjXBu03(;glRv!C^HPJ#qv>?f
z5J?0N{Sy>iBv5(vclbbE@)U!ZLUobro{e`!NKWRCkk(L-)s|=;3H|MIJ>*p
zB~9F_~@*
z`vs6ytq(h9c<5ng>0`Wg6LhMr%}c*)e!@MkyF3wKM4~^><|`{!8V(e8<;tc=0#pgmEgR@t;qbVKp<6`5Jm{ZfNUR7Sm*CKKYz1bt>R#WOR|hd3R)sAUeT&WdTy7e@|u
z^TYN_D6k`*4-W(P_GVWmu}@)jEAfGW&<(l%lId#vL?)B9CEU;bUF6hnDdR{=V4!$A
z-zKsPMh}5k&GQwT$C-7oT$ogNoaN;;QD8|9%B?s+R@?C!YdMhjvOnvUht1n!HXhAH
z3!R}$9w0$Ph)i>T)Yh@gqQ&^pkR_$+c6%@;beLE2RC~nrO=M%u3w$Eo!n{B+D>)SF
zqa=+?xhSbhI>>af#y=YV7lStK5^T;-lrXmhws)1>_v0WY`Nt0zay~T^r(JSFmn|Po
z&nVI+cD0?KKc$q7;w_jINu@MiL7?NlC90D`d3jQ!C>N?sIz8X4(&1kq96kmW
z8u0C?0(@jfmwsTDVS$1T03@q7ZuyIJq#~6H$^HtQ2;(|``3(i0qg+LP4#W`5`9OYe
zbBVy`EHO@XRzN({Roi*6Z2OH4V^yS;7v7pmrAS`#rsmpEbLZsZ4XUs%xR^
z&rD7E0@F12L_2(kHJNL=D?d!xAuonevjgrAogV8LErHTI)N*qbHK<%T7`;tnR8?90
z2+%7=DYsJTY7j!e_>~powsW^D;#Fy(H#%!ME+0>;UHr(WBH40(wOz)vd1+^WF
zXt_Yq72N%A0SfTT%wC=vQp^x_`^T=P!qWm|_O4;=|UaMC$T?DWF5*U_T%G5DidXJR#uW
zevzvl56YJ7W1fulsZ0jhya9Y}4>xt!6;-ZD1`A*L?D6+-3Rcs-LNPyT;Ja){*bW|C
zGsI!^&kkaH*)fK$%iuen5~Z9Z*O(sYCblr8zdSh;z##`Lu)~yA^i$kDH3hCO|P
z23qe0$2VRUA)Rzqr>my_yAsX01!~y0eCSp2@qTBlP8M&jO$WB9hVc2-a!-{*1Vpie
zz4z2wbDY0GZl28CQEs`hB%z$9NY?t*eA%aeujt4FbBlL}Yd2BuS2?D#Z|
zssym6$QI}lZTymGE%=r`utjK<6+)2Slu>a2#1W_RfL`!nb3Qo3){orT?xq~GrF-zT
zq(Y#V3zp%)lcG0!ClWziuDRSCW?&cwhYn}s*r~mzFWQSCXyqHX$z)wmvC!q>=QNw<
zM2y5U{nJg$ZS;PlI)p0emgj>SlYIEG!*y)21A1`1Eicm7l+n#}E(k(UY9ls4qNhdKCaEjaTAQabJqj@;7r6z0MfrPw{?jIM
zAe<(|VZ_%5Sw&EtehqO$>JzhdJ=tGG9I#6lxPnLEej*i6CI7+_d__#HT9BEi+W50|
z51Ti#4<4uBBc>8Vn_ED*^9W4w0RP{f1GZkk_4=7BO-kS773616JRTA-y;%`Jpx};i
zoG^|syqx$pfh;XRgff4yf*O|Zz1|;UFd=yV$Oai-nEUVW{EF$Ow43Kh1Mw~Fd)I$)}S8w4ii4J+y>>F9VSP
zKR(Z3RskXBxsMQ@h&Agdq5MfSVYj-rrOj{YQyO3)-iL8DOx4C0(iup$yO%%1A_
zR}UgB)%Xp
zEjSL}mt4x~Z!Cr?r<+<`zVaO8O`DR<(>NKW42?Z33^yme&?a9TFF66V?;7cv1Jj38
zZl(P%?8=!g+_cEJ)E`R9qI|6_CGEyexK41!A2K9T$SR-cqHE3wqHA&<(im8N93d27s;ZO{02Dkv&$-To%Q(35te@l77_sJjV|XmZ9*0z@B>HR`e;{6tMZeDH3>nf!5Ae9|B|?jPA*
z>x^o59BPJ={oQJ0ilLzBQ&P>{>Y%;FfSu8n7%?M!$)bdJ=ceRV1(bk*0CEAiQ28^g
zsi9%4Z-CgG)YtbJUTMxZMz`uew)}d&E%fJ8UML<#MMaTS`uPPMfNVL>Q`cT=TU(#q
z(-d#F`Jy=?BOiQgJw@JL@JUQmd&*Inb%4GS{aKt5ZhZ!WoYS_o&k7xcw^*C3IQm1k
z{Ia-hB!F#$V6H=+Asg}idlua9IOfjZ&omiRceQp$5&J0_c!?^MIJdyL@-i&)8Q{1h
zA>oEle08@5+T%kW>)Xr|cr5E=Td#lFhH$Dsk6tVR>1+8s5Q8sL+A!$rGGE#{lUnPy
zrub)i+oY@oY9Rvpq%z_$mJgtie}AvWI`!_<-#%Ol$R;!jAuWU=A*~2&FtFAu&EC6v
zL@^s7)N+`>{lsEkiJEP}K5I}NI)2ZyHGH{9+I*&q#^e#T)G|q$88>9F6>Gcjg=Ua*
zC+D32GW!<$akau1%A|uA;`x2Qz8gtRUq
zO2#{ysy@gep|$RZbZ$T%JZb8f4~jfr`bE5NMlA0>v&8v;l04Oeo93LCKpN_%bsj;V
zF#OSjao2S_V(&^QXx}C+T?)6~M*0K=|8aJod^&-r=|}&3m2tN5i97SvMa0sc
ze^|3%I4&pUVy#7VcuJGR=2or-0~!k_G}^&QDaq>0$Vv-6z}7Q6eb?&)cHo$%Nl11@
zV(1bLw?}*i5K5kdsm{yh3
zybmyfFVjCxQso)$WjgKfVoC>uVv-nY&%k0Z
ze4f=tLY#AcaZ(A@$lhtxq9N-dq{{k0=O_X@AyRDVPj(xdxASKI?CMl2xuXJkMEJ1
zT=3v#s>3}mTo0cwQ~66a_!SOWKBO3XY$)1G9++;UL>lAH2{Nj>m;zs$La@!4_+h*8
zFi7(GdO7mlC_$`ia^KzB9J$T?W>g~zQ4q=sn>I2ul3d8XP1y%z<6U>L^N6yj{2%NR
zp}nH0zZOWgMDlakkuxz}Hi0o)qFICh$}7zg4w~(}B89XGd><$vM+A!4E01@mSZxVddCAwQQ9ttv4+iIi
zWScjIi;C0gRJI4kpbx(9Bv&4i{A4e9Z_4FU4d;q+USs)iiKCW@-SV*KATsoe#kR1v
zWSsGU&oPl!-b)l9=JT~6zC0`N)qE1p!wjyJtCtG-#v~hUp|$fIATX)%dFS)M{9T1J
z?J24vtseY?Qhm}eD)6Mj6ZAp
zChIa{`}|zX+0_@u3kn<2V|J9YrK_sUIjaM{20m
z5R#gSf{yGsjcQHI)LM>@r5jvYmCA;(w_`SWjU8OK8R&=E2iC6m*UU;~!?I-?T74tS
zw;e5*`pKrv2v_qHK;+Jlpm1hN*?e^LQ%J|QjyD1Nwdk}zE;BPavoEFHfP#W+(Gh_W
z)4*1!qVo!Win7naTCDbXgCml%lu9tK>j0y1s>E6!_rz9Ie_ufaPc9>FtB1
zMqZhzO11{44iCctidZ1zaqAqcqsr!X4fK=KMt#G}$}*Qsn`Vb1dqL_$ljq~XY$>(%
zd&eI@_=4e_XkRy`HMBKK=1n$WrC%{^i%bq_&OMEx;HV$pv=UfQlrGst7+
zpj836AI>nyvBe7|kdal=t6m-5S=F?>>vn|7d5*EC3oisGqPOsjJTJJBd{8Ys;01M4
z%Y;XU?DC1
zDH>c=U9-ArGN3|S>I{njWoJ>GPh)|G`ijS
zh9r~j&>iowd*2K)BRJiIVEY`){pDHqU@qq;pi&!{T7`{TTdRcPgeEr2&kB=iM}kRPA%&
zs{Rn4R(DW=9Rud$SOuvakF~+K=4GW3ze3<@IjY&1kn8b_74Z{K
z7^X~6sHhp$y|Zuve}yDL2U9;~;}(LZvgLN7%~AG(uQ~Ar#>k`GIzCH^3*rpSKh58v
z@Lt1?9Y>w!lCZwZr4N>ogwSs+`E|cTpkvO>u@~a8Gpdl3a(+&74fcZ6jWxZkiM)Iy
zu$jUCCD_4MrbBlWr;~`DcLk5cOIH9o^s@S5W6TAsw5n%6h2L5Fb9)tt5N@xZTGkdh
zFo68JiTlM9W13o7aS!1S`eB>>w@I8Lg%)^bP!ESg7W5Sspd$4%H+i_U1aPqbxJa
z#0Zt6Gt!y~9e1V;E>qk)9}0@iFG2jMJlFp|3SD1>DE3NNOPt~esJ0KJ#
zSb>1#1)22A%{7tJ{$(y@Mz<)&XPJ&zP?hhx_rzy|H!}Q0Dq^ul4N$uh(rJCuA6NSv
zp*Q@WI;6c&zYT-vQ!=I?P2b^HDUfhG1;VUd($ZKYnwf$#!B@DYS;3&7QKiN=Ir#gU
zfqXOkc|b4Yk$5fKsA%`DV=KYXCBGPQj9A~%1a*zxDc+;ZYj@j
zHF)ZGCd=>+R3AAJIB-%p(D1;pZ;P!4Nkxo$R{%^I$^SroxG2Rw~_V}2dvBvHOj887%SvwEO}V;qu$x2GDQ
z3u@n%YcETMfq+d-vi=Fl@GPKpTh_RTmU|ReRfW$~fpi>$&xIwG8qMK0pxjx{J{;G1
z32yUsN9#Bdv|Fef-br@<3s(;`O0zAf6mv?vgH{O*$lT)7nLr2#^ou1vPM*;-x>i#4!3$<~|rkH={@7Fz2k(9PrSb
zYDPRDNOWrU6CUG?+srGmUhUH|I5Wv^v51yJ4ro+?CGD)pDxGTU^X}<(FgGR5pilqnX*exAfNyzf#MJTn)?@v|`$k)FAo`u53M>}
zyAy?#H$$KPaiW03sDbQryXjrI
zyCAZ$+y1iD&~vrhWv)wdsVXFiJ^@`J=g;TJU=z?g}Y&wDx7q;5sJd`9nNf`^0ieFrd;d
z?dECOgP69LR%4nNZgESeV6b$wl&q5|IJ0Fi^^IEmwu%3c`pwAsl_m&f4x1AHi7nUy-!6KGlwY~J1O5JeLVv#a6V-;*#er7>B6ICq61OQN=;NBUyL;-E
z;clY2@^qtQx3Kj0VgQK{|M4T<@T=i|8I<$O-bSG*>d;?|4ip*5EfF#5G|(z2EQF;k
zJyb`t6!zkQ70TE5>0RHi!|$*`g?~QAzbQV^2t5OwLVIpSj6z2+vx+)_wHjj%XoRq{
zMlzsuQx$Pje^ZY}@{_^nO83r%GGQCkw2hSMgE1i|E~H1EI^
zx;tfQ{-dq!ox7%R+BfN@csn8lqbO9fF);^6A``OvpYP~z&TVA@5GGX2q9^lbhTp3n
z4W0hJA$~AWDMDUe0ZMYPS{F5@zqf&Q1yff~LPhafl_@5A!|vEXoyozPJkSdtUz*0eagxeiH(7d60UNWBg#N`hGHE#-FPYQmf52sq)
zuy2A{U6k}h=)-5dqc@m#4MtuX!WE;!`)`Ah=77)Q|3NdL;ivZf0s^GI{khvmLq!$W
z)?N`&t`qQqJl~{9ja4z%80r9r+O8mQf5{xIO8R_E@O)WmXly*>aQsrsGxD}0@f0lB
zuGj&H*)bsPB4uK#5H6{#tTY@uUOq4LcoqV)>W{(v?at)1J%}qVs@m>*5j*8BH~8nX98Pm1j|t{
z)pZ|(dADf3(s^1^jQaRZDZMQ~xYpx~a?u-xvz5wak$}keB<=0vWAvwdo!MnZx+At{
zDyd3JI^>JTX4v_5EW_5U+>1hK^F1~e`*SnJM(#k&Hn451sI=?l{O&}dve}I}BpfcO
zLm~V6wI;<-Ym3Wv?oZ38XK+aIka)Uf{Y>+wAKuJsA3I`0@|NvSS|*CsZEdmbg%%R$
zFoR*_@i@u_AuEK*!fE+NnT-uLlnT2=b7
z^W&^Gg=#1s#f#IE{T+~9{sZIgax5*H!sFav)7~?(9d$5-;Zf!JWOhtkRyO?1X31sM
z4@!aep(xL2J9vA?T|Ftu`ym4XsEGez59)DYrYOgJk33^2+3)IY
zsRT)XS#!0Att`Z4&?L1|C-RTVKZ*j
zUQR?*wBe@VE%3W0g+B}#<>~$=fe%Pl-(zX+HU)M>*bz|)jB76pQbI#~xn0y5v4{AA
zfX}G}`%z1s?c2Dnt;tdH^!YgW&Ce$8@%%H&Dp`)NE
zsvxJnJ^7F~e|t#K;&Htq`7*aUvE3epid8$KJm2Hm6S*34-$}~_pVMhZ!1gm#n}Ihq
z5$i&oLl5`&>6}y}tXzqO8cR!k(&vZc2XA)u&a8D-=y+=sa`Eb5?;IKx2@U7usUp?Y
zr0#=fVE@3aYpxUKliox?Y14ci(KZxt(zg4NPVQ~Elp#kdFZy&iL@FdGIP5}3NIEew
zVK}m{eBKg(Z`URScFH8b>4xgm&@j-eHzm-B`NPzov#pk^B
zRtaHb{EvA3OqEMkoVWTwS==)RN@L-
z99T2H;*%4FGF&k4-#1a>w%o%-%4#*L)`#jo!CV4nW~o{HmK@cz=ZS0++Y%wiphtKd
zGARH`CmW5kA1}1m1Rzo+^#r3SG?W~dFKZxKK&3v7k*XgB}DS`znFfz(RRym3Q>uUN~KRq+M7@p;Rj%K!!z%O=%grjfw@eB
z%$)lAd_gCl*J1edcXXth*l4OmoVPdF-n4_~*6!}m<0lp}cJ{v5$xLN47zBi7>1I0xse`>|uouG-buXv7hlws26glregQ=WowqQGR;fl2T#dgCqMZf
z2rw0Ce&My%g=w0t(~c)dp?ZXFlHO1Z?v7Hm#_=#n{LuPah=IXjM)1~$&W4oJK*
zz}U-6)-kCa4pvsBOgqmT+-{f4ePiEl?=oYlg?Scox_w6HrMTWEM$1vSvTfx{!|z{y
zq2@CV3|I#tZ!Okr;!sgjQ~j_S>lasj`aHX#|NF;ILVZ|Wr6j2pZaQ3G+T$ZPP!nQ2
zHaDV)itjWZ57f}A)ZPND6qQ0nd`g^=oRhht^!Hy4;k-1WK2zZYJj4_{?t-nwtu^+;
zLql;K=HTu-E#>9yv5GSRbTkxPL(rYjPqK4A7Tq*4jPGi>fAR^niH-8YA|kT)eG~oS
z+Wbp`=cs0+b#5Iy(G#khI_$N$HbwUGL_-)97hrs)($2?;`O(MX1`DL)U>h68qYxn
zVk6czF}ambKj|!pykhdZ8mEVHUefhA+r=`$M2y~>pV4}eQ>zQRd1!%Tl)6JC%fH*jB5H2g`&C<#KF7f^zc!{bm$RRp7R
z<>vuR$q@P&`;ryjBpW5pq$HsGkBy-SzcYMyGLoJ_vOFoDe-JIAgY$X)JIVsLVK-)w
zycg7vGEo&oDmk9;y1nUmdDL(k*U*=X>AKo**a2v|K+jjAX=VgRT6-)4XhlEB5sS2D
z2Lj$)-qVW0SGhEAVncxB>88TwD#R$ZSSD5HIH8GY6&aeDkjYCsy!pO+T~cX&@YU8l
zzZMFNutHYLmK&g}y63&UPobu)GoLpc-1sMyX$k@il!p8?zzINS
zb1+k7Kjjc_#(s)mU1p63^>B1JS+ICcB*D)BVEy|5_n2p|V?*C=AV8Q@3~VbU7@se2-cqUdFO6(R9AWwkbGgWZ$iz
zC^bH6qC$%O?(2nU3@J0UBwMK_T>v5;BUmp6jUxmj9z?I13SEp<7?l7Y;k7}}gvfRL
zR{)+eCi#;qlSJLY8GHj!8qq)5Vp0~{sG>@nTSfGztd9z}a}gKp|BwP~T|7X&#-7Xi
zed7}p|E193d#TH2w}nP_yz8_Uom*OkB$;UA)4o_|obW-Ti*!5bIqUbOxkoSF0=fHB&cnG{WuEs=#~aCeF;q)~jthOdR$Jo&7hCFL
zY2xeG{@a|ngx^KEdOSN01>q_%kRR?{vTUH)NVKr9c)(PEA5&-SJbRvja~
zWN7fDC)GBup)Rk-diK4-54vGfO$JBlvOU0C;+4DT8I?_F=TZR}09-B`HAc7I0tC6>
z*Mbz<5DfGniQkiK=fF+@t*47N$z*?WtHuqicB-Wwz>Io
z6MZ8@`f$JEa}@d13iL-VT3gkK$lvXtat3y_^U3*m!c4TQNXx975OmZOsnSyQ)B|5h
zgDiTyki5K!8!p~KvaHQa88c`z5((qjNl*%N$43{BLziTRAN_SU^TZw1BS=@r{PhB?
zHpyKv#1XIEp2XiC95gkV7sll@)O$td4bK#@0&KOG(x*e{=w}SB6~D&{jl?By_%++a
zN?Sqzxy1IGEfHBR8dG=16wa5us|MKkGcj*9GE)A@fKO5um+vbWYSc>nCS4idXv*(t
z_&}}pc5eZ4YR(02EY-`_KrhOn%oq%AUQ-Y~|6qR1eb|%myfyDU
z1D{@(HG*8``@L!fV45@>=yW2p(9~Xy7ymK}3P!Gn4xFhSxax4
z-NVfdDYnbE8$&apG=uaQGBc?$kyq#fkFg;mvq#=?FG
z+CBKBj3WlLFidWcXed5|Ijd;TB$AYur--ApG=D*<!Wu9n3a^taFUdozlenVB;Dhk*8F95en0ThLeu!;kzS
z_5!Qdr=;)$}}FNJc@-{|9?t8C6C9?<=rL
zX+*k95b17^20^5y8wBa@E~UFsQo6fCq`SKtHo0le;G@s~to!=jyY5-*uI2ItY-VQ9
zo|*moe)3|v&36~p8Lg}U6u4Qtq>nSCoTI6t7Ug5+9o1lu6JG$8mBLZvVB}PV=)M}(
zwugv2SLZU$qsr4`;^MI{`SFNBl%$Cbp+xL{WOzrgD^^XTv;*TcgLt8}AGj?P&pAss
zzdt#ye*l7fLc;`}+olql(d-J!8oXssD?P^BgKppJ+qyyhh=!!XAbdc&6!d$@@{uOZ
zw~O%X&Xa3cgJGzNR`c90tw?o19MAJa&b9ugQQLIJa~bthV9-Uovp)}g^!Rl?ihR0r
z14IAHr8pk<&G!OkgVG5IzG1BGU_u;3WSDa*=LbUQLXlquqUJ=N3v!1BM@bC-HZ&(=
zwgulI`3zb=@#+uZSvf`-7o!_}SXKV?GO`1AJYUAqgw19GXrrq=4IK#B5#{(m2%S3D
zI4}a=JU)=efYH4gWwRY7;74*F*mf$b=#m@Ei0rd!f`6MwR&n9+(sAf<
zM0lDl{PS(Mg$H6$Mc+j?63l0@fs)`Kk{@+EG@|Z?*wTG+hRkOmlN_2(C2$=!M#aD(
z6!kTz%(^l0KaBuNoIdzu)CC06E|9`tF51$sp_)N7#+P3i9g+;+p2@-1&0`FxrZdr%
zTF_sgW0NRoKlHEi_}Vi&KrzDpUX)3$tUY0sgspVLVeP0gJojekRMm?s!Y7>5b3?I*
zPa2|TP{ER_j@xX-<{xzD{cGS)CPFQZDgKTId%zErh&1B=8fU6~0er1^$CxAf52{)a
z4*X!U+^F||+$Owrx2IVO%MaYG^Un
zUta>?nG*J9@N3(FpYr|lIewxCkW~D6hoZj)n;^I+X!ZZU;(zb?@EIw{|9KUHwOP`5
z90wGd$(X7o67sq#y&TA(@p>4SQMTdz7sscxMnt??WIgGM5sX>ByL1{WSENCFj+Ovi
zDP~LG0~Q>Hn@>+nbR@0ImaSY6Pm~vnN!)=U3rOo(I4iy_IHIOc`t#x53AL3{xH*gZ
zFSz#?f6&yV7kr$RH+tVHz+y4-EXjQxB|0hTsnau>fO>Hw=#$QaSXWPvOrop9-gK$g
zHD~;re^842QINAqhIS%%v~M5k+38BPgF$;osm$RCJbzL^#1!HfCorM70m~K^X
zwZfps(J9$xo#vMl@k5CP(85>JaD#vSkQLDv#<@t3LckHrUZ~nQ9#`$>LqNVW+C!YM
zN+BVwpci#8UppQA-SKd~KSuDjexguEp2KQR>3gsgr+mECBII+-rM-0MNyFC^CSlL3
z9Rs>#YAJwrIasVz1#a_&>-5LPFJrl%HKh2{3NG%Vrf&7{SnLxIW-B$`!yWYId6K;i
zLP_8%R=vMLiIrjO9UP1Taxqi(A$$C-XJE)iyoOaAgH~hj)Ef=T*RT6E*Z&6PD&hF-
zB;xk|l1#`P;=jSp;Bo0-gdBeJTWVc)m#L_%+)NHx-vrtd1^PX1l63m3r$Ae1nzIT1={CVr6pC+?oYATnF2tJ$Xd-B~HtClEUtHzuz
z?rmWhY{CpL?spvy(m&16Q6WnXK|-bjT4j=_XQzf>Z_gph3hQ0lC%hg}^=s64p5jIf
zW3FVS@t{n$kHl8N$@&Y&K<-x8d-2}>!8p>iBcJVd{3dRQ*S_{_nP(dP#~Kmffp2aLqv?1?x*X%Cf&_GE;L-5V-IiRfl@cw$$NfWBj)=Dy(IP7
zBVSQv_K}t!^LYV72UiC`{(X#I7hm0*t;^kcj0%uRm^&6r_N@{PFTF1MGy3mbbW-vz
zh6V0L`7wu6Xb$Akcw}5%lfSm=SAE6jPy$#T!>;yeyX{}`gDLNpeEf#cj<}eehE$(O
z2wC;xmNUV$mop|~7ki667W{&wYI{?~uO(1P;`7qoI{=lFZf!a;!b{vf-$l>uMdL3K
zjmOvVvyVIXkU__lOkwJo^Ggj&j>Dif=N+Hh!E=~g_Eb1V(2>pBl}-D7y4xk5UA@h^
zp-IJuTOebSW4v)J+m6@+>pkM5Hng3~GYENW7
za&s|f^;dSOu{zeio?3M3GZ1_TL2NphY^+@&2`9OKpr~-49XkzO`JE{TTzcTwKEHmw
zIw?#PDtbGt-Mmrlb*IGyR`;u2OOU^p6}Y-mbn>Rmg~Dh5M1Qe2$;k}QQEc}G`z1PN
zVxaR*`|aS%X`NdLfv+-Y_sw$m%${S-?GL(XTBfv!WRC92tN6}hI98}qG8
zwRcd=ktHYCSrW*NiF9!(IND#Wmfa$xg6dG3rnBr4N=^^#TB87~a9m0T;vep{Edyk0
zTX9d|9g>r%mU}%=IUH9&6Cc)5X7QrNW1geZer@DP*v9bX~?=6Tx
zYlj0jcgjY3I--WSSglL~J%`lo`5{f>URiu%;w!7xvy!{rxYilP3Y&E}EX_I9gjx|L
zUD~aR90vJkd?;pSCR74s!r)8!y!(?)!4%pT&gygqVB@xrRTi5=mxu7gv7C>EP)YYU
zDRyc$wvQgmEVpXuZ~s!tGQxoVD1=knOY3Na+k=mJSgY*)REfGl`c$LiF#}M#%zW61
zDKTT$>iH97+R@2mbR+vjDcSFg2;*~nGK`P+e3;EMHlvMq*De+TiNL}fkfs@fHGi5R
zHF=}OLUw6L2v&V}V=wln@S}8>jK0Z;<+-1@gnTGpgDHH^B*yBomq1l=zcp*J*)7;Y
zIn4j)yYOx43s82uo4GuEsNP->*@x?^a3X-%m8x5R=(X(HZwNoH`uKpR&gIpTotqx7
zkkylT23%?RvM2vCA)XW~)02eGc^wz3IyvTY5y_dN$o9?=Ab-$OG59J=FqT_qkRz^V
zqKDsUfk7gII0_&|Q{srxF?%A2Vl=21b@ge>Y+>3HofA5|ef$i&eks^W>l{?s2AHo@
zmBSl#6TH~#&(q~d;|2qI!^iZv-SOOHHZ>0x+X+)F1VplvgVJ<{sGE!Fhh2e(JUKTm
z6o>9cW~NCWGx(+^Bt^Ew_%@`7(}7A9wTF;hoGPN@V_ZJ_{JUG7(%w80FGKBc_M6bx
z1Gk)*lZut5tI(Z5J|Ot7!$%1gs|wcC|9r=DKV5le
zj@0i6{U4uLF_wwbzJKqzd?e`09A#x{>VofM^f7-HWRj%T2x`o$(`MmqX2j;d)AoLI
z3|fHFpx_JJ@n3Q=ffiVV_g5Lr(*Grr7yu$^QY;zr*FV=E`>eamXs+Dia{CmP0j;FMoDk@C6vz9HO>7{@ipcEL4DoCCQOKMeI*J!lanD{`UsS
zGl9P|ND?NvFcA<5W>xKv%@#AhnvP3%M4PsbU~255MjOFQi(G
z&rFQd0#r|~U^ez9@d9+92)i-}#=~CrYmsJ6UEfh+a`GAjFB|3g!f-Wwl3mLTr{$QE
z>-ioHYo6!U&~bfCMg}8II7tj3!XK9T!;a^7KbaMPh@5?KmqC;mqx~%uK*;O~;og=r
zHO)sYDi_z~@V&7ssU!?;E)?r=9|rUi8gMoaI>EQ
z*r$AH?tnQEQtJJEXcZ$$d;SZ-_rYHoDKQ2|5$j+ug43-+2Et%QN(x2K1S-Y7YI8
zmN}9}eDEc7$V*~`)78Ld=G3_5X4*5MqFUhk+J&kjYsl2C##T&F?d*cT((Jcy&}WYl
zSiUHXhSr)+e!M}&wTNDic#ICvdCrGZ27EWm)TVoU&1^dvI@Bz8wwKa
z$WxT-tLT0{konce8VnxAEF}lUXTcn=UE5Le^7a$Dd7kgF3MF$`>B$+aXjI$&Nab==
zx$z?hvLBbk?`>54~ej(G;#mSbG?w6O(07+aiPVfo^06*Bk*hQ|Vgl;PP=
z2kOHaMAiP@n4U%AT#T%ry=2&ffOCmu`Viied`b1O#&lA=;bQ0Tp@c-xQFP=HJqut%
zFehf`$|-`3sy!tXtaO%HQ__EP==pNc38J!HKY#Wg;3-myX1oZ>f3`D`(}<_Z%svKa
z*jY^hpHcta$#Jotb>9y~+tV&)3Kp=0+kJA}RxgQfw&e$Y?i{ZjHwXdc>J5nBWJ}4z
zm!8e5>lTfe`gs#_0g&RI05npkxaID7FV&l)?Fw4w4p9&E@(-B{4A2?o(9e~B^x>&<;?UQ>jt&4o;%6b@VaieKrz@GLxUUpUoYi?8
zcc}qoG94B52e~vR2gw3eo$$gHpL}0-iwQOOE_-ZRl)-0vyQ|D0bYLH0Z26YvoAU%l
z!P}7yp<6w$v^&3BgQ^0Yu`_uFt9ikT4IIhRmit8*ic>&9N$wFy8>if#(9kUMYWkyX
zjPb`(S#`F@*Q~$vMUBf^O?r~_380Au7L`ffIxtMHKSH#4Yw;5J7uL|>Ik>R=D3Imj
z5r_u{><0(up@>S1kn?e6nXlHQ@I;^k^G*PQTgty-3nRf>@Cf{2Wp`venca$3{Ue7c
zJYe;+A3^p7ziRvP%sg9urYtx4rBQqTd+qy3;_npiGS*h*mTR4AlS)oh;Ijkv3E|{n
za>ZI^n?~=e%o$Q|y(QbQc+#gjUGl7zsU=a#wCRpfN
zRye!`92MY1{d`#EyxrC(w79h%GQ*7}CH?p#5A<4(sm|hK>(4i)(z*QPgBn#TWHw#d
zew=#eb+6yi!|20-&o!~PxFf8NF$&~2n7T^T?0zE0IuY4`$|`OK;?35T4$AGGD}?M)
zxC^!oUDmUP*^w->n_njrzkKoHAU&71kO3VD9T`k6JR{O2$(*|w9kvapNW3(l`uMZE
z8&7zDz+~N>RNxkcP```f=u3^uN23;#bQhQ3xa|YAwN#g=dRUvZKhMnszuOItc8pSz4q-Y=*l_sHJVnNRrA3G3)knbALZ&l;tCRN4}9$^)u;axlq
zUnA838lBsXdNP=bzBlKo%S9*?vyO6{(5T%z4{8Yt1fy?VoOd>cRnj8-u~66hi_022
zC;l+#!F!z+)yw}-ksy7bF@G9b@mV5)gg4cx>lsp;*jHgZMO^(R^c-qJs1nsksWmmy
zT&;7|NeZdDwWOP?sqsge+&u=
zN{VB+Dygzu9P;>4!MiyL3l*swA*AHYE|;Gvq@$mM)D^&aHrWbxUFAhF2Gg%D5&^!L
z7|Q#HxrZQClx3qX6{Vjm&7I9=f0mZeeXKr$6Xq%mtUmDw(f)d7wEAdFCM_9A-5fnZzE)S~xNYwVuxhmQWhW123I
zC=&8AyL*P8l4%D);3Pd$u#T*g(geQg0Y(??8nfx|b3z32<$>&|S}aaX+H{64!JIAQ
zk~YCE=`8|j|MN6lCP~g~Jy;nRYFwo*^FcIS+>Zxu!fNeW_O{^Mz;f7l^W+{H;v>D
zH7Yy8--H{nRbH|uW5osaOp)s+aM&=-50kp|!@IQ`A{G&=fic<0;d
zUcqQOF8t#fetUm|
z?xt4lMTtemth=MzHxJV@-dY?$+oSH-+VoJ}p2^X?_(4<+a{-Wkfq0%|JU*!57k2f_
zCrf^m%DKS??FI1Lm{N7y9$GYSf6pL3{eHm2u{j!%P=t-(KRBiqSy9xqZ?w7Y^3Si6
z-;!pk*i8^x6#bReM|uPEg`Sl4UyU85weXY99)W=MPv6orL^WWli3k0Mp1=_WW)|Nv
zW~@I$&HtfI6dX9r>FKRv;$hRytR>+7zEOVX!%fOO6VwjY$sXz*`Z1=HTY|}qfkp6o
zbrmBzEiI>&FzJUNg|=GrxijaVv5XYzKLY)6orxj#)-6qJwYwu0@5r)N(xjNQcVr6K
z%|BWG(rVBkFjGW1ZtKq1ay$cjTY4@cDTe><#jB>oq|X@SpcI%@OZvwH>jw0689vbvLSesAta=IQ^EJ_X*u
zFACK3c2$Q(v8z(V{^7g$lXT=sSMQ2e?)hh`L|=K*)i?R6@&7rC2=>5b;Is6$
zh~&@5{{PHjJaMs4Lhq|!j3EUO}7#Fv?udlCcNOyO)?ZJ$~
z_0autJkY~^yUH-B*u{kX7FQC`bW`ZKUz%MkRHZf|6SF9FbaYU1*M}S|lxL+*;5gMk
zw)p_j9CTs$oFCvCyU(uHq|pu*_+2lf_e)xr&hG*F{=V;P0s?~95%*U#(ZGP*dOv7~
zqlwD;^kI9qB7zPK1Rktg9!F`S7qUYze)r~#)6yEZ0+6oDV`l^v8QJJEpBgdZRa)DO
z&HBdNzEvdeQN!)`KFg)109uo=!5GE@LgU|3bT2Ffwc#$EhfB1OhzJ~K@}tM8<_f)g
zp7Be$G~U9-JN}UHkf_%CGxqv*m1&Zx9
zN;;>Urh|ffBi*f)N~^&!4q({SD_yIb9*=lGC@C36bIp&Gc)-`Mg_c)ntKT2DTFGcz
zmb?+)$7filk&Ok=vtOfG5*x=}9+Mu$MMVAQj9#AVmi31!o%TS2(&;Qs##8EqY)v1S
zc3)s=Xx{PN^&RW(Xki{QKA+Ok{j!(Qbwv&|_4?1SgwZ(_gaM!d>{mmzxy+043gy>H
z_Tz@wS-mWW{fwJeCkD2I)zkex_qQ91P7gG3Kb+Ed9N3N>Sae57XB&*ZxN~nle`C^m
z>zU~K7En1K(iAuXnZfLVf;T&Wy8(|88MCLmyEjJuUS!LiT|=exquHtIIq!I_j@O~z
z`~pOjo43X)MqcoGCbcjnmJ*QVS0hjGe79uHlZRY4+v5C_RtARg`IpN=6AJ+vwuJ7K
zr`9%KQ?amo5O6-$y1qZwex)GTMe@W$QUa(29OT%%r1)cP`)2z{JFJ&lv0fP-r*SMl
zeR-OITR5BPh|tPKJ^;Rln9JW?F<-k55hl6se?EO8KF`nX@z^bbdBd8QpGX`otvEkE}==BEcT{TvcLJ24HO^=>Ot($V#$v&>V_
zIhVBFNK?F8_zX7XgsUi|`5J>oBbUe(LpyFFnI#^!xVf>hf$QVr13r=PdIcnG+38gB
z)`aQq7$R}rI;g&5Gg6Hm25NW)+2H3IfI6WQz8VN1#4G_U@*yE1?0L(c`|n&1kG*1k
zu$su|>r0isfVe`!>M?(hVwuUU3r8_+G367e{)t+7*5W{bMW
z-=8BU@tf!B@p@dU=31CQpP$98mqbPg+%6y}Z&%}u=k+pX+$6<9(rmU|_7da?^w#*C
z?q-E@$)u
zsmzO-o#Qojk)2Yq5i393PQC|Fqm3Rhpc|v5Kpil=B^DR-{;Q8XXQR>k?_Q>b)xug;H(}m3;(VpRuhn4
z!UZ*@IWl6pP@0NF|2_B~0)j#C2Z?rkc3Lot<~!L?v?OCb-mm{@;QL%s5##M_K5Ji)
z6UgSJmvZTQ2i%#CeQ<_XE5q}x!I;+8%LWWgbSK@@T2&q9rPt1=q~yB8_fu2?QE%MsQ}%P{aW3@w3posnuoG36qHEjjEPM7%c(xembvJLJ)DC4#2sF
zafy{3R<^o+JZ@cBV0g`{nEr6Bc$zV-!wLQ4`!b$kpy~m@j4a0bp~apR>O6E1KFX|z
zl2Xd0^U*#+_Du{g2a>k#p6F<>@95K)TV??wXoC%2^JWUHbZpk>bZDEg_oMx@&T!hg
zz(ePkR=Y+|90qmc+_x*AJXf!`7tHvam~woCpTXfg0Dhsb=+;x6tPy8iP^b#tcj6y-<9YP?{_=8aknT;dfgsDRb@k)zV6BB?#(ac;^Rm_@
zkkKlOPMRA~(8<(%(dGeZu!5C`I)Kbgg%NNhdUXay#9A&krubk9*CU+!FWU4ELNlTc
zxCRag!wP;hZ!5Y$x>u{m#(oJHzwWY-@puMONq8*kDED3OlC5nsE*1^
zYT;4=^d^aih{Iz}$!?I=xBqsC6egG9C8Opmv~;ZW8p4TDq~rNXnfT=7Ptfl34yKI7
zAFJaLu}ay9V==MUpq>^4S4l$M#P9Ci$4^7&t8B7(r4mXO7j7MU>SJxvhU9rsVCva<
zBSm{e=M}YU&8LeTGkT;k_|!X?xRkn>P|8jgJWl-Yc5!t2#^MS$H(Q%NZ9&qEX4H^V
z=c{@rhu#wfH{qrCJ)V?Kzf&)qwu&vqVc-yfHuK|aLgIBw*9r4+Mp1JXt((2J@ZQC&P&&U$-pqww(ah?UHktU=)58o(!t<*<5YL
z&o}ws&^|w|J6}kveuch#{Ymb4IM$4H0a6JK1HH-`rtZ!8TsvLD6Z|%*QTN+!9?9Jf
zb4Klt0jHm;!fI5Yw{B#VMW1JzW)FN3e{+rn(L(O-zMyOq@+WtSO&7^w2!6h)ALE;^
zg{AdF2jp!d*YGcBzI+M&T!Cc8uNu%6hSu3s>#>(K6jw~@UpSaH-a$9&z-VV%G9%Vmz?7xF}@*7!8=e+>PZ2GGbZD!j##GABCs3sy_
zM;4z>pvJ4zaF1OU@HAlG55>ljY|DR=MINXmy2>DkPl__Dc?u>X^(i3t?gl~aCJFg5
zOQ59KpAFtr?b?p7*O`=R<8yoQIvQ;cr5U@Gle`T?VTF0tmjvixjsypQUa%;vo`{q+
zW?Tw2tiXJiJcpx&ZjhPd!9*`eF&vM1;hq6emRmDlPYn8CQuV>2@4nCy!$d)y*IKu=
z*S6aA-9hG=pM;mvs{T>qBb3ueP-_R6^6RsiP_T_j%P*n@G#hlLU`g546_SO=6GTKH
z?P5~E?^~Lh9@JaHFb`i&n)5933+*OrpLdqINC)>TS|Wr}fEzeT{OSZtFpdqI7#$wS
z-i_(x!3I^1%S^$%$a)=Fr1i@ww=93e*r~^xUXy7#)z7)&1OvV8a%sw7Yv|YSV9|VN
z=%f)33bjcG
ze??XW6CU{}gVgkQG_ifoa97F-paQ*{wCHRD3xs^g#MeaLP;JK6PgC%CM@$OwIMWv4
z=F28oeFCq^cs+bU)YPo92oM-GQQ0FR0yF_w8?VRO2TF<(`RxLK_@Xd$39Gx)DNdh`
zwdD2lU~pPL`Yn&nbc0`>ZmC&CmDx_M(vWWJzsT3MKoJzqJdd)H+CT!h=pf!GEr{&dC&rD)4
zvMwS`E-bjCNbH94tARN@8ZkP^b1lN@?B$yQQk-17Tijraw)FtnR=$%N17mBTV|fjl
zsZKA1qDWFzxh-}4*_M9-S```$N&3MF=!;p}lN0X7RZ4qrLW0DT6ywGc9sv>DvxiWG
z@2%_~A*I$EQ85?bs9VpJ>xu4;K<0x@ZFRqma{V4gOb@bGfOPAqbWW?ry)G7+`~9Nj
zIK6S;7N4m&z*`dmv8eBASDu&?;(Qjy39_NQ5@<8$aQ=l}`FIjUg7nai-m06oSC(B}
z7_S(0{I&Ps>X}Pk3tBV-5&oSDw81SOMa|$lpdv^
z2mS~hdBVR^!mD`FBf;ThJgWxcE@;TV*`Gycst
za~5|tkRUQ|%-4uTk#&hIWR5FqJ#N%}theci^bU(at=jm_Rvm$!^%C_`0AnUfGwz&Ek9-(vM7-XBOuweC+{ySI6pNof~*|^k;YrE+ZN(vtpEu6Q(bkE#vOEEM@ex0EYe1l3&NF
zx|y`*W%VNsbJzFJ2ag9-r`q;q*FTdS_E>$2HNxIhRC##LtwW51JeLkryX`@zXr*%~
zQQy)cc-gYFXGgY-XSKOPJY+O}nf?T}L<%WmOe%y363mpbmBaeG1ln7^w_hi8Aw
z|9|U6ph6K_*9`UkOziJ(5kPlt)V?AeRIk`RP^#4mCurZkz}eS$^W`+Vj#MJ_`Prvs
z&cHYS_>xJX(4e8-Q2TZoC`*dEDP4~d;|pV9(hA>{){)9Mi2ckdMnC@B3!jkKmg6qXEzW9ypKApnPROpFMnFW)&7&nbr
zh=?{g9yD0vHlsOL44E$dQ!Msf*E)^oX*Z`$_?%aqnB)6F+5|Y92Vx;dC;X+;1-FK#
zX{gcmXTIJk-wQ2Kn*i8B=#UIOQXjfKeo{}1r#2yEU0my~xZqn01_lNuwz9`k^2)D<
zX#06-#CLnPC+=1L!CMAYyYW;w$|}|t6(FnLgKMryfoiaC(obCWi%*w#Z?jRPhB&9qYN&@
zCp4Y|e!1Qv=*U!;LQ7l4`D6duypNi)yx3a<(T?ePxMlW5iRxMfzqdD{l&O~SeI!~_
z6W*SmoB7s<1ck?uhP2rAZnq(6Y#J
z&6bKnES4IyDk|+{<6Wg3vem~8J)$F6rXfeXq