diff --git a/.devops/templates/build-test-lint.yml b/.devops/templates/build-test-lint.yml
deleted file mode 100644
index 29b4fb761f1683..00000000000000
--- a/.devops/templates/build-test-lint.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-steps:
-  - template: tools.yml
-
-  - task: Bash@3
-    inputs:
-      filePath: yarn-ci.sh
-    displayName: yarn (install packages)
-
-  - script: |
-      yarn nx run workspace-plugin:check-graph
-      yarn nx g @fluentui/workspace-plugin:tsconfig-base-all --verify
-      yarn nx g @fluentui/workspace-plugin:normalize-package-dependencies --verify
-
-    displayName: Workspace lint
-
-  - script: |
-      # following packages need to be build in advance:
-      # @fluentui/api-docs is used within apps/public-docsite-resources/just.config.ts,
-      # @fluentui/digest is used within packages/fluentui/perf-test-northstar/just.config.ts, thus it needs to be build in advance
-      #
-      # NOTE: we are running this via nx in order to get cache hits later on
-      yarn nx run-many -t build -p api-docs digest
-      yarn tsc -p ./tsconfig.just-scripts-configs.json
-    displayName: Type-check just.config.ts files
-
-  - script: |
-      yarn check:installed-dependencies-versions
-    displayName: 'check packages: installed dependencies versions'
-
-  - script: |
-      if [[ -n "$(targetBranch)" ]]; then
-        yarn nx format:check --base $(targetBranch)
-      else
-        yarn nx format:check --all
-      fi
-    displayName: check formatting
-
-  ## Danger.js checks for Fluent UI N*
-  - script: |
-      DANGER_DISABLE_TRANSPILATION="true" yarn danger ci
-    displayName: danger
-    condition: eq(variables.isPR, true)
-    env:
-      DANGER_GITHUB_API_TOKEN: $(DANGER_GITHUB_API_TOKEN)
-
-  - script: |
-      yarn nx affected -t build test lint type-check test-ssr test-integration verify-packaging --nxBail $(sinceArg)
-    displayName: build, test, lint, test-ssr (affected)
-    condition: eq(variables.isPR, true)
-
-  - script: |
-      yarn nx run-many -t build test lint type-check test-ssr test-integration verify-packaging --nxBail
-    displayName: build, test, lint, test-ssr (all)
-    condition: eq(variables.isPR, false)
-
-  - template: cleanup.yml
diff --git a/.devops/templates/cleanup.yml b/.devops/templates/cleanup.yml
deleted file mode 100644
index 5e6fb5430aa570..00000000000000
--- a/.devops/templates/cleanup.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-parameters:
-  - name: checkForModifiedFiles
-    type: boolean
-    default: true
-
-steps:
-  - script: |
-      yarn check:modified-files
-    condition: ${{ parameters.checkForModifiedFiles }}
-    displayName: 'check: modified files'
-
-  # In theory the "workspace: clean: all" setting should handle this, but it doesn't always seem to work.
-  # ReallyClean is a custom task from our internal UI Fabric azure-devops-tasks repo which attempts to
-  # delete the given directory with multiple retries.
-  # - task: ReallyClean@0
-  #   inputs:
-  #     directory: $(Agent.BuildDirectory)
-  #   condition: always()
diff --git a/.devops/templates/deployE2E.yml b/.devops/templates/deployE2E.yml
deleted file mode 100644
index 2d97d3f63bda8a..00000000000000
--- a/.devops/templates/deployE2E.yml
+++ /dev/null
@@ -1,82 +0,0 @@
-steps:
-  - template: tools.yml
-
-  - task: Bash@3
-    inputs:
-      filePath: yarn-ci.sh
-    displayName: yarn
-
-  - script: |
-      yarn playwright install --with-deps
-    displayName: Install Playwright dependencies
-
-  - script: |
-      yarn cypress verify
-    displayName: verify cypress install
-
-  # this also builds FUI N* docs if appropriate
-  - script: |
-      yarn nx affected -t bundle --nxBail $(sinceArg)
-    displayName: bundle
-    condition: eq(variables.isPR, true)
-
-  - script: |
-      yarn nx affected -t build-storybook --nxBail $(sinceArg)
-    displayName: build Storybooks
-    condition: eq(variables.isPR, true)
-
-  ## This runs regardless of scope, the app will adapt to the scope as well
-  - script: |
-      yarn nx run pr-deploy-site:generate:site
-    displayName: generate PR Deploy Site
-
-  - task: AzureCLI@2
-    displayName: Upload PR deploy site
-    condition: eq(variables.isPR, true)
-    inputs:
-      azureSubscription: $(azureSubscription)
-      scriptType: 'bash'
-      scriptLocation: 'inlineScript'
-      inlineScript: |
-        az storage blob upload-batch \
-          --destination '$web' \
-          --source apps/pr-deploy-site/dist \
-          --account-name $(azureStorage) \
-          --destination-path $(deployBasePath) \
-          --auth-mode login \
-          --overwrite
-
-  - task: GithubPRStatus@0
-    displayName: 'Update PR deploy site github status'
-    condition: eq(variables.isPR, true)
-    inputs:
-      githubOwner: microsoft
-      githubRepo: fluentui
-      githubContext: 'Pull request demo site'
-      githubDescription: 'Click "Details" to go to the deployed demo site for this pull request'
-      # This MUST have a trailing slash, or the links to PR deploy site assets won't work
-      githubTargetLink: $(deployUrl)/
-
-  # TODO: once https://github.com/nrwl/nx/issues/26903 will be fixed we can remove NX_PARALLEL=1 override via env variable
-  - script: |
-      NX_PARALLEL=1 yarn nx affected -t e2e --nxBail --parallel 1 $(sinceArg)
-    displayName: Cypress E2E tests
-    condition: eq(variables.isPR, true)
-
-  - script: |
-      yarn nx run-many -t bundle --nxBail
-    displayName: bundle
-    condition: eq(variables.isPR, false)
-
-  - script: |
-      yarn nx run-many -t build-storybook --nxBail
-    displayName: build Storybooks
-    condition: eq(variables.isPR, false)
-
-  # TODO: once https://github.com/nrwl/nx/issues/26903 will be fixed we can remove NX_PARALLEL=1 override via env variable
-  - script: |
-      NX_PARALLEL=1 yarn nx run-many -t e2e --nxBail --parallel 1
-    displayName: Cypress E2E tests
-    condition: eq(variables.isPR, false)
-
-  - template: cleanup.yml
diff --git a/.devops/templates/publish-website.yml b/.devops/templates/publish-website.yml
index 9dae51b47ff6b6..921c86db491b6e 100644
--- a/.devops/templates/publish-website.yml
+++ b/.devops/templates/publish-website.yml
@@ -1,7 +1,5 @@
-parameters:
-  - name: version
-    type: string
-    default: 8
+# This template is no longer used in the v8 release pipeline, since v8 website updates are unlikely to be needed.
+# If this is re-enabled, the Azure service connection will need to be re-created.
 
 steps:
   - task: AzureCLI@2
@@ -15,7 +13,7 @@ steps:
         --destination 'fabric-website' \
         --source $(System.DefaultWorkingDirectory)/apps/public-docsite/dist \
         --account-name fabricweb \
-        --destination-path v${{ parameters.version }}/$(Build.BuildNumber)/ \
+        --destination-path v8/$(Build.BuildNumber)/ \
         --auth-mode login \
         --overwrite
 
@@ -29,8 +27,8 @@ steps:
         az storage blob upload \
         --account-name fabricweb \
         --container-name fabric-website \
-        --name manifests/v${{ parameters.version }}-df.js \
-        --file $(System.DefaultWorkingDirectory)/site-manifests/v${{ parameters.version }}-df.js \
+        --name manifests/v8-df.js \
+        --file $(System.DefaultWorkingDirectory)/site-manifests/v8-df.js \
         --auth-mode login \
         --overwrite
 
@@ -44,7 +42,7 @@ steps:
         az storage blob upload \
         --account-name fabricweb \
         --container-name fabric-website \
-        --name manifests/v${{ parameters.version }}-prod.js \
-        --file $(System.DefaultWorkingDirectory)/site-manifests/v${{ parameters.version }}-prod.js \
+        --name manifests/v8-prod.js \
+        --file $(System.DefaultWorkingDirectory)/site-manifests/v8-prod.js \
         --auth-mode login \
         --overwrite
diff --git a/.devops/templates/tools.yml b/.devops/templates/tools.yml
index 7f2b53a8e32c1c..f9a31c66951c06 100644
--- a/.devops/templates/tools.yml
+++ b/.devops/templates/tools.yml
@@ -1,9 +1,13 @@
-# Install versions of Node and Yarn required by build pipelines.
+# Install tools and dependencies and set shared configuration
 parameters:
   - name: dryRun
     displayName: Dry Run Mode
     type: boolean
     default: false
+  - name: githubPAT
+    displayName: GitHub Personal Access Token
+    type: string
+    default: ''
 
 steps:
   # Logs a message when dry run mode is enabled.
@@ -25,9 +29,6 @@ steps:
     displayName: 'Install Node.js'
     retryCountOnTaskFailure: 1
 
-  - script: corepack enable
-    displayName: 'Enable Corepack'
-
   - script: |
       echo "nodejs:" && node -v
       echo "yarn:" && yarn -v
@@ -48,10 +49,21 @@ steps:
   - script: |
       printenv | sort
       echo "SHELLOPTS $SHELLOPTS"
-      echo 'deployBasePath "$(deployBasePath)"'
-      echo 'deployUrl "$(deployUrl)"'
-      echo 'isPR "$(isPR)"'
-      echo 'targetBranch "$(targetBranch)"'
       echo number of CPUs "$(getconf _NPROCESSORS_ONLN)"
     displayName: Log environment variables (Linux)
     condition: eq(variables['Agent.OS'], 'Linux')
+
+  - script: |
+      git config user.name "Fluent UI Build"
+      git config user.email "fluentui-internal@service.microsoft.com"
+    displayName: Configure git user (used by beachball)
+
+  - script: |
+      git remote set-url origin https://fabricteam:$(githubPAT)@github.com/microsoft/fluentui.git
+    displayName: Authenticate git for pushes
+    condition: and(succeeded(), ne('${{ parameters.githubPAT }}', ''))
+
+  - script: |
+      corepack enable
+      yarn install --immutable
+    displayName: yarn install
diff --git a/.devops/templates/variables.yml b/.devops/templates/variables.yml
index a72a48c528ab88..6073cf0a9684be 100644
--- a/.devops/templates/variables.yml
+++ b/.devops/templates/variables.yml
@@ -1,17 +1,3 @@
-parameters:
-  # For customizing the deployment path in non-PR builds
-  - name: deployBasePath
-    type: string
-    default: ''
-
-  # Skip the component governance detection step (injected by a pipeline decorator from an
-  # internal extension) by default because we run it separately. Since all our pipelines
-  # in each branch install the same packages, only one pipeline (currently the daily release)
-  # needs to run detection.
-  - name: skipComponentGovernanceDetection
-    type: boolean
-    default: true
-
 variables:
   # Prevents failures on CI when "caniuse-lite" becomes outdated
   BROWSERSLIST_IGNORE_OLD_DATA: true
@@ -19,27 +5,3 @@ variables:
   NX_PARALLEL: 8
   NX_PREFER_TS_NODE: true
   NX_VERBOSE_LOGGING: true
-
-  # Also accessed as process.env.DEPLOYHOST
-  deployHost: 'fluentuipr.z22.web.core.windows.net'
-
-  # Also accessed as process.env.DEPLOYURL
-  deployUrl: 'https://$(deployHost)/$(deployBasePath)'
-
-  # This service principal ("subscription" is a misleading name) only has access to the fluentuipr storage account
-  azureSubscription: Azure PR deploy - NEW
-  azureStorage: fluentuipr
-
-  ${{ if not(startsWith(variables['Build.SourceBranch'], 'refs/heads/')) }}:
-    isPR: true
-    targetBranch: 'origin/$(System.PullRequest.TargetBranch)'
-    # Deploy PRs under "pull/####" unless otherwise requested
-    # (this is also accessed as process.env.DEPLOYBASEPATH)
-    deployBasePath: ${{ coalesce(parameters.deployBasePath, 'pull/$(System.PullRequest.PullRequestNumber)') }}
-  ${{ if startsWith(variables['Build.SourceBranch'], 'refs/heads/') }}:
-    isPR: false
-    targetBranch: ''
-    # Deploy master under "heads/branchname" unless otherwise requested
-    deployBasePath: ${{ coalesce(parameters.deployBasePath, replace(variables['Build.SourceBranch'], 'refs/', '')) }}
-
-  skipComponentGovernanceDetection: ${{ parameters.skipComponentGovernanceDetection }}
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 85d83e704cf12e..ce2dba4ee93a58 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -58,10 +58,9 @@ jobs:
         run: |
           # following packages need to be build in advance:
           # @fluentui/api-docs is used within apps/public-docsite-resources/just.config.ts,
-          # @fluentui/digest is used within packages/fluentui/perf-test-northstar/just.config.ts, thus it needs to be build in advance
           #
           # NOTE: we are running this via nx in order to get cache hits later on
-          yarn nx run-many -t build -p api-docs digest
+          yarn nx run-many -t build -p api-docs
           yarn tsc -p ./tsconfig.just-scripts-configs.json
 
       - name: 'check packages: installed dependencies versions'
diff --git a/.vscode/launch.json b/.vscode/launch.json
index 2b8c0d6dec8186..501ffcb758e0c3 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -35,24 +35,6 @@
       "outputCapture": "std",
       "console": "integratedTerminal"
     },
-    {
-      "name": "Debug current open test (v0)",
-      "type": "node",
-      "request": "launch",
-      "program": "${workspaceRoot}/scripts/executors/src/debug-test.js",
-      "cwd": "${fileDirname}",
-      "stopOnEntry": false,
-      "args": ["-i", "--testPathPatterns=\\b${fileBasenameNoExtension}", "--watch"],
-      "runtimeExecutable": null,
-      "runtimeArgs": ["--nolazy", "--inspect"],
-      "env": {
-        "NODE_ENV": "test"
-      },
-      "sourceMaps": true,
-      "outFiles": ["${workspaceRoot}/packages/fluentui/*/dist/**/*.js"],
-      "outputCapture": "std",
-      "console": "integratedTerminal"
-    },
     {
       "name": "Build @fluentui/react",
       "type": "node",
@@ -160,24 +142,6 @@
       "sourceMaps": true,
       "console": "integratedTerminal"
     },
-    {
-      "name": "Debug gulp task",
-      "type": "node",
-      "request": "launch",
-      "program": "${workspaceRoot}/node_modules/gulp/bin/gulp.js",
-      "stopOnEntry": false,
-      "runtimeArgs": ["--nolazy", "--inspect"],
-      // You can change the task name and cwd locally as needed
-      "args": ["build"],
-      "cwd": "${workspaceRoot}/packages/fluentui/react-northstar",
-      "env": {
-        "NODE_ENV": "development",
-        // This is used in scripts/babel/index.js to enable sourcemaps
-        "DEBUG": "1"
-      },
-      "sourceMaps": true,
-      "console": "integratedTerminal"
-    },
     {
       "name": "Debug create-package",
       "type": "node-terminal",
diff --git a/.vscode/settings.json b/.vscode/settings.json
index c0e8e7a492731c..b86fbeba1e9419 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -35,7 +35,13 @@
     ".yarn/releases": true,
     "common/temp": true,
     "**/node_modules": true,
-    "**/lib": true,
+    // VS Code doesn't support un-excluding things, so this is the only workaround for some nx projects using "lib" for source
+    "apps/*/lib": true,
+    "packages/*/lib": true,
+    "packages/react-components/*/lib": true,
+    "packages/react-components/*/*/lib": true,
+    "packages/charts/*/lib": true,
+    "packages/charts/*/*/lib": true,
     "**/lib-amd": true,
     "**/lib-commonjs": true,
     "**/dist": true,
diff --git a/azure-pipelines-ci.yml b/azure-pipelines-ci.yml
deleted file mode 100644
index 86ad9249da84b1..00000000000000
--- a/azure-pipelines-ci.yml
+++ /dev/null
@@ -1,64 +0,0 @@
-pr: none
-
-trigger: none
-
-variables:
-  - ${{ if not(startsWith(variables['Build.SourceBranch'], 'refs/heads/')) }}:
-      - name: sinceArg
-        value: --base $(targetBranch)
-
-  - group: fabric-variables
-
-  - template: .devops/templates/variables.yml
-
-resources:
-  repositories:
-    - repository: 1esPipelines
-      type: git
-      name: 1ESPipelineTemplates/1ESPipelineTemplates
-      ref: refs/tags/release
-
-extends:
-  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
-  parameters:
-    sdl:
-      codeql:
-        compiled:
-          enabled: true
-        runSourceLanguagesInSourceAnalysis: true
-    pool:
-      name: Azure-Pipelines-1ESPT-ExDShared
-      image: windows-latest
-      os: windows # We need windows because compliance task only run on windows.
-    customBuildTags: null # send empty tags since it is not supported on GH repo's for PR's
-    customLogIssues: null # send empty tags since it is not supported on GH repo's for PR's
-    stages:
-      - stage: main
-        jobs:
-          - job: BuildTestLint
-            timeoutInMinutes: 90
-            pool:
-              name: '1ES-Host-Ubuntu'
-              image: '1ES-PT-Ubuntu-20.04'
-              os: linux
-            workspace:
-              clean: all
-            steps:
-              - template: .devops/templates/build-test-lint.yml@self
-
-          - job: DeployE2E
-            displayName: Deploy and E2E
-            timeoutInMinutes: 90
-            workspace:
-              clean: all
-            pool:
-              name: '1ES-Host-Ubuntu'
-              image: '1ES-PT-Ubuntu-20.04'
-              os: linux
-            templateContext:
-              outputs:
-                - output: pipelineArtifact
-                  targetPath: $(System.DefaultWorkingDirectory)/apps/pr-deploy-site/dist
-                  artifactName: web
-            steps:
-              - template: .devops/templates/deployE2E.yml@self
diff --git a/azure-pipelines-pr.yml b/azure-pipelines-pr.yml
deleted file mode 100644
index 9f3fe471c221b9..00000000000000
--- a/azure-pipelines-pr.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-pr:
-  - master
-
-# There's a separate pipeline for CI which also uses this file, but with a trigger override in the UI
-# https://dev.azure.com/uifabric/fabricpublic/_apps/hub/ms.vss-ciworkflow.build-ci-hub?_a=edit-build-definition&id=164&view=Tab_Triggers
-trigger: none
-
-variables:
-  - ${{ if not(startsWith(variables['Build.SourceBranch'], 'refs/heads/')) }}:
-      - name: sinceArg
-        value: --base $(targetBranch)
-
-  - group: fabric-variables
-
-  - template: .devops/templates/variables.yml
-
-pool: '1ES-Host-Ubuntu'
-
-jobs:
-  - job: BuildTestLint
-    workspace:
-      clean: all
-    steps:
-      - template: .devops/templates/build-test-lint.yml
-
-  - job: DeployE2E
-    displayName: Deploy and E2E
-    workspace:
-      clean: all
-    steps:
-      - template: .devops/templates/deployE2E.yml
diff --git a/azure-pipelines.deprecate-package.yml b/azure-pipelines.deprecate-package.yml
deleted file mode 100644
index 831d4ec64d27e3..00000000000000
--- a/azure-pipelines.deprecate-package.yml
+++ /dev/null
@@ -1,61 +0,0 @@
-pr: none
-
-trigger: none
-
-name: 'Deprecate Published Package'
-
-parameters:
-  # @see https://docs.npmjs.com/cli/v10/using-npm/package-spec
-  - name: packageSpec
-    type: string
-    default: ''
-  - name: message
-    type: string
-    default: 'Deprecated in favor of stable release'
-  - name: dryRun
-    displayName: Dry Run Mode
-    type: boolean
-    default: false
-
-variables:
-  - group: 'Github and NPM secrets'
-  - name: tags
-    value: production,externalfacing
-
-resources:
-  repositories:
-    - repository: 1esPipelines
-      type: git
-      name: 1ESPipelineTemplates/1ESPipelineTemplates
-      ref: refs/tags/release
-
-extends:
-  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
-  parameters:
-    pool:
-      name: Azure-Pipelines-1ESPT-ExDShared
-      image: windows-latest
-      os: windows # We need windows because compliance task only run on windows.
-    stages:
-      - stage: main
-        jobs:
-          - job: DeprecateRelease
-            pool:
-              name: '1ES-Host-Ubuntu'
-              image: '1ES-PT-Ubuntu-20.04'
-              os: linux
-            workspace:
-              clean: all
-            templateContext:
-              outputs:
-                - output: pipelineArtifact
-                  targetPath: $(System.DefaultWorkingDirectory)
-                  artifactName: output
-            steps:
-              - template: .devops/templates/tools.yml@self
-                parameters:
-                  dryRun: ${{ parameters.dryRun }}
-              - script: |
-                  npm deprecate ${{ parameters.packageSpec }} "${{ parameters.message }}" --registry https://registry.npmjs.org/ --//registry.npmjs.org/:_authToken=$(npmToken)
-                displayName: 'Deprecate package'
-                condition: not(${{ parameters.dryRun }})
diff --git a/azure-pipelines.hotfix.yml b/azure-pipelines.hotfix.yml
index 79e0aa6dfbae5d..d419a447eb313e 100644
--- a/azure-pipelines.hotfix.yml
+++ b/azure-pipelines.hotfix.yml
@@ -12,6 +12,8 @@ parameters:
 
 variables:
   - template: .devops/templates/variables.yml
+  - name: skipComponentGovernanceDetection
+    value: true
   - name: tags
     value: production,externalfacing
 
@@ -40,30 +42,25 @@ extends:
               os: linux
             workspace:
               clean: all
-            templateContext:
-              outputs:
-                - output: pipelineArtifact
-                  targetPath: $(System.DefaultWorkingDirectory)
-                  artifactName: output
             steps:
+              - script: |
+                  if [[ -z "$(targetNpmVersion)" ]]; then
+                    echo "##vso[task.logissue type=error]targetNpmVersion is not specified"
+                    exit 1
+                  fi
+                displayName: 'Checking for targetNpmVersion variable'
+
               - template: .devops/templates/tools.yml@self
                 parameters:
                   dryRun: ${{ parameters.dryRun }}
 
               - script: |
-                  node -e "if('$(targetNpmVersion)' === '') throw new Error('targetNpmVersion is not specified');"
-                displayName: 'Checking for targetNpmVersion variable'
-
-              - script: |
-                  npm install semver
-                  node -e "let semver = require('semver');if(semver.valid('$(targetNpmVersion)') === null){ throw new Error('Invalid version specified'); }"
+                  if ! yarn semver '$(targetNpmVersion)' >/dev/null; then
+                    echo "##vso[task.logissue type=error]Invalid version specified: $(targetNpmVersion)"
+                    exit 1
+                  fi
                 displayName: 'Check targetNpmVersion is valid semver'
 
-              - task: Bash@3
-                inputs:
-                  filePath: yarn-ci.sh
-                displayName: yarn
-
               - script: |
                   npm version $(targetNpmVersion)
                 workingDirectory: 'packages/react'
@@ -85,7 +82,3 @@ extends:
                   npm publish packages/react/react-$(targetNpmVersion).tgz --tag hf8 --//registry.npmjs.org/:_authToken=$(npmToken)
                 displayName: Publish new version
                 condition: not(${{ parameters.dryRun }})
-
-              - template: .devops/templates/cleanup.yml@self
-                parameters:
-                  checkForModifiedFiles: false
diff --git a/azure-pipelines.perf-test.yml b/azure-pipelines.perf-test.yml
deleted file mode 100644
index ceae7a1f6a5ade..00000000000000
--- a/azure-pipelines.perf-test.yml
+++ /dev/null
@@ -1,199 +0,0 @@
-pr:
-  - master
-  - website-content
-
-trigger: none
-
-variables:
-  - group: fabric-variables
-  - template: .devops/templates/variables.yml
-
-pool: '1ES-Host-Ubuntu'
-
-jobs:
-  - job: CheckIfPackagesAffected
-    steps:
-      - template: .devops/templates/tools.yml
-
-      - task: Bash@3
-        inputs:
-          filePath: yarn-ci.sh
-        displayName: yarn
-
-      - script: |
-          NorthstarAffected=$(yarn check:affected --project react-northstar)
-          V8Affected=$(yarn check:affected --project react)
-          ReactComponentsAffected=$(yarn check:affected --project react-components)
-          if [[ $NorthstarAffected == true ]]; then
-            echo "##vso[task.setvariable variable=NorthstarPackageAffected;isOutput=true]true"
-          fi
-          if [[ $V8Affected == true ]]; then
-            echo "##vso[task.setvariable variable=V8PackageAffected;isOutput=true]true"
-          fi
-          if [[ $ReactComponentsAffected == true ]]; then
-            echo "##vso[task.setvariable variable=ReactComponentsPackageAffected;isOutput=true]true"
-          fi
-        name: PackagesAffected
-        displayName: Check if v8, v9 and/or northstar packages were affected
-
-  - job: PerfTestReactNorthstar
-    displayName: Perf test for @fluentui/react-northstar
-    dependsOn: CheckIfPackagesAffected
-    condition: eq(dependencies.CheckIfPackagesAffected.outputs['PackagesAffected.NorthstarPackageAffected'], true)
-    workspace:
-      clean: all
-    steps:
-      - template: .devops/templates/tools.yml
-
-      - task: Bash@3
-        inputs:
-          filePath: yarn-ci.sh
-        displayName: yarn
-
-      - script: |
-          yarn nx run perf-test-northstar:test-perf --base
-        condition: eq(variables.isPR, false)
-        displayName: Run Perf Test Base (Northstar)
-
-      - script: |
-          yarn nx run perf-test-northstar:test-perf
-        condition: eq(variables.isPR, true)
-        displayName: Run Perf Test (Northstar)
-
-      - task: AzureCLI@2
-        condition: eq(variables.isPR, true)
-        displayName: Upload Perf Test Result to PR deploy site (Fluent N*)
-        inputs:
-          azureSubscription: $(azureSubscription)
-          scriptType: 'bash'
-          scriptLocation: 'inlineScript'
-          inlineScript: |
-            az storage blob upload-batch \
-              --destination '$web' \
-              --source packages/fluentui/perf-test-northstar/dist \
-              --account-name $(azureStorage) \
-              --destination-path $(deployBasePath)/perf-test-northstar \
-              --auth-mode login \
-              --overwrite
-
-      - task: GithubPRComment@0
-        condition: eq(variables.isPR, true)
-        displayName: 'Post @fluentui/react-northstar Perf Results to Github Pull Request'
-        inputs:
-          githubOwner: microsoft
-          githubRepo: 'fluentui'
-          blobFilePath: '$(Build.SourcesDirectory)/$(PerfCommentFilePathReactNorthstar)'
-          status: '$(PerfCommentStatusReactNorthstar)'
-          uniqueId: 'perfComment9424'
-
-      - script: |
-          yarn gulp stats
-        condition: eq(variables.isPR, false)
-        displayName: Bundle Statistics (master only)
-
-      - script: |
-          yarn nx run perf:test-perf
-        condition: eq(variables.isPR, false)
-        displayName: Performance Tests (master only)
-
-      # HEADS UP: also see tag-version-prefix in fluentui-publish.js
-      - script: |
-          yarn gulp stats:save --tag=`git tag --points-at HEAD | grep ^@fluentui/react-northstar_v | grep -o 'northstar_v.*'`
-        condition: eq(variables.isPR, false)
-        displayName: Save Statistics to DB (master only)
-        env:
-          STATS_URI: $(STATS_URI)
-
-      - template: .devops/templates/cleanup.yml
-
-  - job: PerfTestReact
-    displayName: Perf test for @fluentui/react
-    dependsOn: CheckIfPackagesAffected
-    condition: eq(dependencies.CheckIfPackagesAffected.outputs['PackagesAffected.V8PackageAffected'], true)
-    workspace:
-      clean: all
-    steps:
-      - template: .devops/templates/tools.yml
-      - task: Bash@3
-        inputs:
-          filePath: yarn-ci.sh
-        displayName: yarn
-
-      - script: |
-          yarn nx run perf-test:test-perf
-        condition: eq(variables.isPR, true)
-        displayName: Run Perf Test
-
-      - task: AzureCLI@2
-        condition: eq(variables.isPR, true)
-        displayName: Upload Perf Test Result to PR deploy site (V8)
-        inputs:
-          azureSubscription: $(azureSubscription)
-          scriptType: 'bash'
-          scriptLocation: 'inlineScript'
-          inlineScript: |
-            az storage blob upload-batch \
-              --destination '$web' \
-              --source apps/perf-test/dist \
-              --account-name $(azureStorage) \
-              --destination-path $(deployBasePath)/perf-test \
-              --auth-mode login \
-              --overwrite
-
-      - task: GithubPRComment@0
-        condition: eq(variables.isPR, true)
-        displayName: 'Post @fluentui/react Perf Results to Github Pull Request'
-        inputs:
-          githubOwner: microsoft
-          githubRepo: 'fluentui'
-          blobFilePath: '$(Build.SourcesDirectory)/$(PerfCommentFilePathReact)'
-          status: '$(PerfCommentStatusReact)'
-          uniqueId: 'perfComment9423'
-
-      - template: .devops/templates/cleanup.yml
-
-  - job: PerfTestReactComponents
-    displayName: Perf test for @fluentui/react-components
-    dependsOn: CheckIfPackagesAffected
-    condition: eq(dependencies.CheckIfPackagesAffected.outputs['PackagesAffected.ReactComponentsPackageAffected'], true)
-    workspace:
-      clean: all
-    steps:
-      - template: .devops/templates/tools.yml
-      - task: Bash@3
-        inputs:
-          filePath: yarn-ci.sh
-        displayName: yarn
-
-      - script: |
-          yarn nx run perf-test-react-components:test-perf
-        condition: eq(variables.isPR, true)
-        displayName: Run Perf Test
-
-      - task: AzureCLI@2
-        condition: eq(variables.isPR, true)
-        displayName: Upload Perf Test Result to PR deploy site (React Components)
-        inputs:
-          azureSubscription: $(azureSubscription)
-          scriptType: 'bash'
-          scriptLocation: 'inlineScript'
-          inlineScript: |
-            az storage blob upload-batch \
-              --destination '$web' \
-              --source apps/perf-test-react-components/dist \
-              --account-name $(azureStorage) \
-              --destination-path $(deployBasePath)/perf-test-react-components \
-              --auth-mode login \
-              --overwrite
-
-      - task: GithubPRComment@0
-        condition: eq(variables.isPR, true)
-        displayName: 'Post @fluentui/react-components Perf Results to Github Pull Request'
-        inputs:
-          githubOwner: microsoft
-          githubRepo: 'fluentui'
-          blobFilePath: '$(Build.SourcesDirectory)/$(PerfCommentFilePathReactComponents)'
-          status: '$(PerfCommentStatusReactComponents)'
-          uniqueId: 'perfComment9425'
-
-      - template: .devops/templates/cleanup.yml
diff --git a/azure-pipelines.release-headless-experimental.yml b/azure-pipelines.release-headless-experimental.yml
index f0f7491c6a63a5..e96d88f419b947 100644
--- a/azure-pipelines.release-headless-experimental.yml
+++ b/azure-pipelines.release-headless-experimental.yml
@@ -14,8 +14,6 @@ name: 'headless_experimental_$(Date:yyyyMMdd)$(Rev:.r)'
 variables:
   - group: 'Github and NPM secrets'
   - template: .devops/templates/variables.yml
-    parameters:
-      skipComponentGovernanceDetection: false
   - name: tags
     value: production,externalfacing
 
@@ -49,15 +47,6 @@ extends:
                   targetPath: $(System.DefaultWorkingDirectory)
                   artifactName: output
             steps:
-              - template: .devops/templates/tools.yml@self
-                parameters:
-                  dryRun: ${{ parameters.dryRun }}
-
-              - script: |
-                  git config user.name "Fluent UI Build"
-                  git config user.email "fluentui-internal@service.microsoft.com"
-                displayName: Configure git user (used by beachball)
-
               - task: Bash@3
                 name: validation
                 inputs:
@@ -76,10 +65,9 @@ extends:
                     echo "Feature name: $FEATURE_NAME"
                 displayName: Validate branch and extract feature name
 
-              - script: |
-                  corepack enable
-                  yarn install --immutable
-                displayName: Install dependencies
+              - template: .devops/templates/tools.yml@self
+                parameters:
+                  dryRun: ${{ parameters.dryRun }}
 
                 # Deletes all existing changefiles so that only the experimental bump happens
               - script: |
@@ -131,7 +119,3 @@ extends:
                 condition: and(succeeded(), not(${{ parameters.dryRun }}))
                 env:
                   NPM_TOKEN: $(npmToken)
-
-              - template: .devops/templates/cleanup.yml@self
-                parameters:
-                  checkForModifiedFiles: false
diff --git a/azure-pipelines.release-vnext-experimental.yml b/azure-pipelines.release-vnext-experimental.yml
index be0e54ae30bfa0..17b3def1bbf677 100644
--- a/azure-pipelines.release-vnext-experimental.yml
+++ b/azure-pipelines.release-vnext-experimental.yml
@@ -14,8 +14,6 @@ name: 'v9_experimental_$(Date:yyyyMMdd)$(Rev:.r)'
 variables:
   - group: 'Github and NPM secrets'
   - template: .devops/templates/variables.yml
-    parameters:
-      skipComponentGovernanceDetection: false
   - name: release.vnext # Used to scope beachball to release only vnext packages
     value: true
   - name: tags
@@ -55,11 +53,6 @@ extends:
                 parameters:
                   dryRun: ${{ parameters.dryRun }}
 
-              - script: |
-                  git config user.name "Fluent UI Build"
-                  git config user.email "fluentui-internal@service.microsoft.com"
-                displayName: Configure git user (used by beachball)
-
               - task: Bash@3
                 name: validation
                 inputs:
@@ -78,11 +71,6 @@ extends:
                     echo "Feature name: $FEATURE_NAME"
                 displayName: Validate branch and extract feature name
 
-              - script: |
-                  corepack enable
-                  yarn install --immutable
-                displayName: Install dependencies
-
                 # Deletes all existing changefiles so that only bump that happens is for nightly
               - script: |
                   rm -f change/*
@@ -124,7 +112,3 @@ extends:
                 condition: and(succeeded(), not(${{ parameters.dryRun }}))
                 env:
                   NPM_TOKEN: $(npmToken)
-
-              - template: .devops/templates/cleanup.yml@self
-                parameters:
-                  checkForModifiedFiles: false
diff --git a/azure-pipelines.release-vnext-nightly.yml b/azure-pipelines.release-vnext-nightly.yml
index f80c50372ca3c0..edfadfb044c0f4 100644
--- a/azure-pipelines.release-vnext-nightly.yml
+++ b/azure-pipelines.release-vnext-nightly.yml
@@ -14,8 +14,6 @@ name: 'v9_nightly_$(Date:yyyyMMdd)$(Rev:.r)'
 variables:
   - group: 'Github and NPM secrets'
   - template: .devops/templates/variables.yml
-    parameters:
-      skipComponentGovernanceDetection: false
   - name: release.vnext # Used to scope beachball to release only vnext packages
     value: true
   - name: tags
@@ -65,16 +63,6 @@ extends:
                 parameters:
                   dryRun: ${{ parameters.dryRun }}
 
-              - script: |
-                  git config user.name "Fluent UI Build"
-                  git config user.email "fluentui-internal@service.microsoft.com"
-                displayName: Configure git user (used by beachball)
-
-              - task: Bash@3
-                inputs:
-                  filePath: yarn-ci.sh
-                displayName: yarn
-
                 # Deletes all existing changefiles so that only bump that happens is for nightly
               - script: |
                   rm -f change/*
@@ -109,7 +97,3 @@ extends:
                 condition: not(${{ parameters.dryRun }})
                 env:
                   NPM_TOKEN: $(npmToken)
-
-              - template: .devops/templates/cleanup.yml@self
-                parameters:
-                  checkForModifiedFiles: false
diff --git a/azure-pipelines.release-vnext.yml b/azure-pipelines.release-vnext.yml
index 831d2d45b3748b..cf1a7ffb528987 100644
--- a/azure-pipelines.release-vnext.yml
+++ b/azure-pipelines.release-vnext.yml
@@ -14,24 +14,11 @@ parameters:
 variables:
   - group: 'Github and NPM secrets'
   - template: .devops/templates/variables.yml
-    parameters:
-      skipComponentGovernanceDetection: false
   - name: release.vnext # Used to scope beachball to release only vnext packages
     value: true
   - name: tags
     value: production,externalfacing
 
-# TODO set schedule once the pipeline is validated after a few manual releases
-# schedules:
-#   # minute 0, hour 7 in UTC (11pm in UTC-8), Every monday
-#   # https://docs.microsoft.com/en-us/azure/devops/pipelines/build/triggers?tabs=yaml&view=azure-devops#supported-cron-syntax
-#   - cron: '0 7 * * 1'
-#     # will be 12am during daylight savings time unless trigger is updated
-#     displayName: 'Scheduled release (Every monday)'
-#     branches:
-#       include:
-#         - master
-
 resources:
   repositories:
     - repository: 1esPipelines
@@ -65,17 +52,7 @@ extends:
               - template: .devops/templates/tools.yml@self
                 parameters:
                   dryRun: ${{ parameters.dryRun }}
-
-              - script: |
-                  git config user.name "Fluent UI Build"
-                  git config user.email "fluentui-internal@service.microsoft.com"
-                  git remote set-url origin https://$(githubUser):$(githubPAT)@github.com/microsoft/fluentui.git
-                displayName: Authenticate git for pushes
-
-              - task: Bash@3
-                inputs:
-                  filePath: yarn-ci.sh
-                displayName: yarn
+                  githubPAT: $(githubPAT)
 
               - script: |
                   FLUENT_PROD_BUILD=true yarn nx run-many -t build -p tag:vNext --exclude 'tag:tools,tag:type:stories,apps/**' --nxBail
@@ -89,11 +66,6 @@ extends:
                   FLUENT_PROD_BUILD=true yarn nx run-many -t lint -p tag:vNext --exclude 'tag:tools,tag:type:stories,apps/**' --nxBail
                 displayName: lint
 
-              - script: |
-                  node -r ./scripts/ts-node/src/register ./scripts/executors/src/deprecate-react-components-preview-packages.ts --token $(npmToken)
-                displayName: 'Deprecate preview packages'
-                condition: not(${{ parameters.dryRun }})
-
               - script: |
                   yarn beachball publish --config scripts/beachball/src/release-vNext.config.js --message 'release: applying package updates - react-components'
                   git reset --hard origin/master
@@ -113,15 +85,3 @@ extends:
               - script: |
                   yarn syncpack list-mismatches
                 displayName: Check for dependency mismatches
-
-              # TODO update release notes script for v9
-              # - script: |
-              #     node -r ./scripts/ts-node/src/register ./scripts/update-release-notes/src/index.ts --token=$(githubPAT) --apply --debug
-              #   displayName: 'Update github release notes'
-
-              # This would usually be run automatically (via a pipeline decorator from an extension), but the
-              # thorough cleanup step prevents it from working. So run it manually here.
-
-              - template: .devops/templates/cleanup.yml@self
-                parameters:
-                  checkForModifiedFiles: false
diff --git a/azure-pipelines.release.headless.yml b/azure-pipelines.release.headless.yml
index 9fad65c70cd948..cbdf20662fbe17 100644
--- a/azure-pipelines.release.headless.yml
+++ b/azure-pipelines.release.headless.yml
@@ -14,8 +14,6 @@ parameters:
 variables:
   - group: 'Github and NPM secrets'
   - template: .devops/templates/variables.yml
-    parameters:
-      skipComponentGovernanceDetection: false
   - name: tags
     value: production,externalfacing
 
@@ -54,17 +52,7 @@ extends:
               - template: .devops/templates/tools.yml@self
                 parameters:
                   dryRun: ${{ parameters.dryRun }}
-
-              - script: |
-                  git config user.name "Fluent UI Build"
-                  git config user.email "fluentui-internal@service.microsoft.com"
-                  git remote set-url origin https://$(githubUser):$(githubPAT)@github.com/microsoft/fluentui.git
-                displayName: Authenticate git for pushes
-
-              - task: Bash@3
-                inputs:
-                  filePath: yarn-ci.sh
-                displayName: yarn
+                  githubPAT: $(githubPAT)
 
               - script: |
                   echo "Following packages will be published (if they contain changes):"
@@ -91,7 +79,3 @@ extends:
                   NPM_TOKEN: $(npmToken)
                 displayName: Publish changes and bump versions
                 condition: not(${{ parameters.dryRun }})
-
-              - template: .devops/templates/cleanup.yml@self
-                parameters:
-                  checkForModifiedFiles: false
diff --git a/azure-pipelines.release.tools-experimental.yml b/azure-pipelines.release.tools-experimental.yml
index 518fe3874503e9..20336d66b332d2 100644
--- a/azure-pipelines.release.tools-experimental.yml
+++ b/azure-pipelines.release.tools-experimental.yml
@@ -14,8 +14,6 @@ name: 'tools_experimental_$(Date:yyyyMMdd)$(Rev:.r)'
 variables:
   - group: 'Github and NPM secrets'
   - template: .devops/templates/variables.yml
-    parameters:
-      skipComponentGovernanceDetection: false
   - name: tags
     value: production,externalfacing
 
@@ -54,11 +52,7 @@ extends:
               - template: .devops/templates/tools.yml@self
                 parameters:
                   dryRun: ${{ parameters.dryRun }}
-
-              - script: |
-                  git config user.name "Fluent UI Build"
-                  git config user.email "fluentui-internal@service.microsoft.com"
-                displayName: Configure git user (used by beachball)
+                  githubPAT: $(githubPAT)
 
               - task: Bash@3
                 name: validation
@@ -78,11 +72,6 @@ extends:
                     echo "Feature name: $FEATURE_NAME"
                 displayName: Validate branch and extract feature name
 
-              - script: |
-                  corepack enable
-                  yarn install --immutable
-                displayName: Install dependencies
-
                 # Deletes all existing changefiles so that only bump that happens is for experimental
               - script: |
                   rm -f change/*
@@ -123,7 +112,3 @@ extends:
                 condition: and(succeeded(), not(${{ parameters.dryRun }}))
                 env:
                   NPM_TOKEN: $(npmToken)
-
-              - template: .devops/templates/cleanup.yml@self
-                parameters:
-                  checkForModifiedFiles: false
diff --git a/azure-pipelines.release.tools.yml b/azure-pipelines.release.tools.yml
index cb1701fd804418..6982cc82f2e80c 100644
--- a/azure-pipelines.release.tools.yml
+++ b/azure-pipelines.release.tools.yml
@@ -14,8 +14,6 @@ parameters:
 variables:
   - group: 'Github and NPM secrets'
   - template: .devops/templates/variables.yml
-    parameters:
-      skipComponentGovernanceDetection: false
   - name: tags
     value: production,externalfacing
 
@@ -54,17 +52,7 @@ extends:
               - template: .devops/templates/tools.yml@self
                 parameters:
                   dryRun: ${{ parameters.dryRun }}
-
-              - script: |
-                  git config user.name "Fluent UI Build"
-                  git config user.email "fluentui-internal@service.microsoft.com"
-                  git remote set-url origin https://$(githubUser):$(githubPAT)@github.com/microsoft/fluentui.git
-                displayName: Authenticate git for pushes
-
-              - task: Bash@3
-                inputs:
-                  filePath: yarn-ci.sh
-                displayName: yarn
+                  githubPAT: $(githubPAT)
 
               - script: |
                   echo "Following packages will be published(if they contain changes):"
@@ -90,7 +78,3 @@ extends:
                   NPM_TOKEN: $(npmToken)
                 displayName: Publish changes and bump versions
                 condition: not(${{ parameters.dryRun }})
-
-              - template: .devops/templates/cleanup.yml@self
-                parameters:
-                  checkForModifiedFiles: false
diff --git a/azure-pipelines.release.web-components.yml b/azure-pipelines.release.web-components.yml
index 7e7fd8d0a0fae0..1708cfe0eca3b8 100644
--- a/azure-pipelines.release.web-components.yml
+++ b/azure-pipelines.release.web-components.yml
@@ -14,8 +14,6 @@ parameters:
 variables:
   - group: 'Github and NPM secrets'
   - template: .devops/templates/variables.yml
-    parameters:
-      skipComponentGovernanceDetection: false
   - name: release.web_components # Used to scope beachball to release only vnext packages
     value: true
   - name: tags
@@ -64,17 +62,7 @@ extends:
               - template: .devops/templates/tools.yml@self
                 parameters:
                   dryRun: ${{ parameters.dryRun }}
-
-              - script: |
-                  git config user.name "Fluent UI Build"
-                  git config user.email "fluentui-internal@service.microsoft.com"
-                  git remote set-url origin https://$(githubUser):$(githubPAT)@github.com/microsoft/fluentui.git
-                displayName: Authenticate git for pushes
-
-              - task: Bash@3
-                inputs:
-                  filePath: yarn-ci.sh
-                displayName: yarn
+                  githubPAT: $(githubPAT)
 
               - script: |
                   yarn nx run-many -t format:check lint test build -p tag:web-components --exclude vr-tests-web-components --nxBail
@@ -88,7 +76,3 @@ extends:
                   NPM_TOKEN: $(npmToken)
                 displayName: Publish changes and bump versions
                 condition: not(${{ parameters.dryRun }})
-
-              - template: .devops/templates/cleanup.yml@self
-                parameters:
-                  checkForModifiedFiles: false
diff --git a/azure-pipelines.release.yml b/azure-pipelines.release.yml
index 6bfc06bedbe290..f6d01bb71fb18a 100644
--- a/azure-pipelines.release.yml
+++ b/azure-pipelines.release.yml
@@ -14,22 +14,9 @@ parameters:
 variables:
   - group: 'Github and NPM secrets'
   - template: .devops/templates/variables.yml
-    parameters:
-      skipComponentGovernanceDetection: false
   - name: tags
     value: production,externalfacing
 
-# Disabling automatic scheduled releases for more control
-# schedules:
-#   # minute 0, hour 7 in UTC (11pm in UTC-8), any day of month, any month, days 1-5 of week (M-F)
-#   # https://docs.microsoft.com/en-us/azure/devops/pipelines/build/triggers?tabs=yaml&view=azure-devops#supported-cron-syntax
-#   - cron: '0 7 * * 1-5'
-#     # will be 12am during daylight savings time unless trigger is updated
-#     displayName: 'Daily release (Sundary-Thursday at 11pm PST)'
-#     branches:
-#       include:
-#         - master
-
 resources:
   repositories:
     - repository: 1esPipelines
@@ -62,45 +49,20 @@ extends:
                   targetPath: $(System.DefaultWorkingDirectory)/homepage
                   artifactName: homepage.htm
                   displayName: homepage.htm
-                - output: pipelineArtifact
-                  targetPath: $(System.DefaultWorkingDirectory)/oufr-version.txt
-                  artifactName: oufr-version
-                  displayName: oufr-version
                 - output: pipelineArtifact
                   targetPath: $(System.DefaultWorkingDirectory)/site-manifests
                   artifactName: fabric-website-manifests
                   displayName: fabric-website-manifests
-                - output: pipelineArtifact
-                  targetPath: $(System.DefaultWorkingDirectory)/apps/public-docsite-resources/dist/demo
-                  artifactName: fabric-website-resources
-                  displayName: fabric-website-resources
                 - output: pipelineArtifact
                   targetPath: $(System.DefaultWorkingDirectory)/apps/public-docsite/dist
                   artifactName: fabric-website
                   displayName: fabric-website
-                - output: pipelineArtifact
-                  targetPath: $(System.DefaultWorkingDirectory)/packages/react/dist
-                  artifactName: fabric
-                  displayName: fabric
-                - output: pipelineArtifact
-                  targetPath: $(Build.ArtifactStagingDirectory)/api
-                  artifactName: api-json
-                  displayName: api-json
+
             steps:
               - template: .devops/templates/tools.yml@self
                 parameters:
                   dryRun: ${{ parameters.dryRun }}
-
-              - script: |
-                  git config user.name "Fluent UI Build"
-                  git config user.email "fluentui-internal@service.microsoft.com"
-                  git remote set-url origin https://$(githubUser):$(githubPAT)@github.com/microsoft/fluentui.git
-                displayName: Authenticate git for pushes
-
-              - task: Bash@3
-                inputs:
-                  filePath: yarn-ci.sh
-                displayName: yarn
+                  githubPAT: $(githubPAT)
 
               - script: |
                   yarn generate-version-files
@@ -135,19 +97,6 @@ extends:
                   NPM_TOKEN: $(npmToken)
                 displayName: Publish changes and bump versions
 
-              - script: |
-                  echo Making $(Build.ArtifactStagingDirectory)/api
-                  mkdir -p $(Build.ArtifactStagingDirectory)/api
-                  cp packages/*/dist/*.api.json $(Build.ArtifactStagingDirectory)/api
-                displayName: Copy api.json files to artifact staging directory
-
-              - script: |
-                  oufrVersion=$(node -p -e "require('./packages/react/package.json').version")
-                  echo "OUFR Version: $oufrVersion"
-                  echo $oufrVersion > oufr-version.txt
-                  echo "##vso[task.setvariable variable=oufrVersion;]$oufrVersion"
-                displayName: 'Set oufrVersion variable'
-
               # create-site-manifests is a script defined in @fluentui/public-docsite-setup.
               # It generates manifest files used to load the current version on developer.microsoft.com/fluentui.
               - script: |
@@ -161,10 +110,10 @@ extends:
                   node ./packages/public-docsite-setup/scripts/generateHomepage ./homepage
                 displayName: 'Generate homepage.htm'
 
-              - ${{ if eq(parameters.dryRun, false) }}:
-                  - template: .devops/templates/publish-website.yml@self
-                    parameters:
-                      version: 8
+              # Since v8 updates should be very rare, it's probably not necessary to update the website.
+              # If this is re-enabled, the Azure service connection will need to be re-created.
+              # - ${{ if eq(parameters.dryRun, false) }}:
+              #     - template: .devops/templates/publish-website.yml@self
 
               # Run this near the end because it's more likely to fail than the artifact upload tasks, and its
               # failure doesn't need to block anything else
@@ -172,7 +121,3 @@ extends:
                   node -r ./scripts/ts-node/src/register ./scripts/update-release-notes/src/index.ts --token=$(githubPAT) --apply --debug
                 condition: not(${{ parameters.dryRun }})
                 displayName: 'Update github release notes'
-
-              - template: .devops/templates/cleanup.yml@self
-                parameters:
-                  checkForModifiedFiles: false
diff --git a/change/@fluentui-web-components-786aaeb9-9222-4019-b392-cf304c916b30.json b/change/@fluentui-web-components-786aaeb9-9222-4019-b392-cf304c916b30.json
new file mode 100644
index 00000000000000..1a6f68fc46738c
--- /dev/null
+++ b/change/@fluentui-web-components-786aaeb9-9222-4019-b392-cf304c916b30.json
@@ -0,0 +1,7 @@
+{
+  "type": "patch",
+  "comment": "fix(web-components): prevent unsafe theme token values from injecting CSS",
+  "packageName": "@fluentui/web-components",
+  "email": "machi@microsoft.com",
+  "dependentChangeType": "patch"
+}
diff --git a/package.json b/package.json
index e678e2f1328477..78ee53bc7172fc 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,6 @@
     "dedupe": "yarn dedupe --strategy highest",
     "change": "beachball change",
     "check:change": "beachball check",
-    "check:modified-files": "node -r ./scripts/ts-node/src/register ./scripts/executors/src/check-for-modified-files",
     "check:affected": "node ./scripts/executors/src/checkIfPackagesAffected.js",
     "check:installed-dependencies-versions": "satisfied --no-peers --skip-invalid",
     "create-component": "nx g @fluentui/workspace-plugin:react-component",
diff --git a/packages/web-components/src/theme/set-theme.spec.ts b/packages/web-components/src/theme/set-theme.spec.ts
index e2460b3413607b..04167f6a423066 100644
--- a/packages/web-components/src/theme/set-theme.spec.ts
+++ b/packages/web-components/src/theme/set-theme.spec.ts
@@ -182,4 +182,21 @@ test.describe('setTheme()', () => {
     await expect(span).toHaveCSS('--foo', 'foo2');
     await expect(span).toHaveCSS('--bar', 'bar2');
   });
+
+  test('sanitizes token values', async ({ fastPage, page }) => {
+    const body = page.locator('body');
+
+    await fastPage.setTemplate();
+
+    await page.evaluate(() => {
+      window.setTheme({
+        foo: 'red; } body { font-size: 10px; } /* ',
+        'bar: blue;} body { font-size': '10px',
+      });
+    });
+
+    await expect(body).not.toHaveCSS('--foo', 'red');
+    await expect(body).not.toHaveCSS('--bar', 'blue');
+    await expect(body).not.toHaveCSS('font-size', '10px');
+  });
 });
diff --git a/packages/web-components/src/theme/set-theme.ts b/packages/web-components/src/theme/set-theme.ts
index 8776132463a7c6..359ba5c0733f4e 100644
--- a/packages/web-components/src/theme/set-theme.ts
+++ b/packages/web-components/src/theme/set-theme.ts
@@ -68,15 +68,26 @@ export function setTheme(theme: Theme | null, node: Document | HTMLElement = doc
   }
 }
 
-function getThemeStyleText(theme: Theme): string {
-  if (!themeStyleTextMap.has(theme)) {
-    const tokenDeclarations: string[] = [];
+const TOKEN_NAME_REGEX = /^[a-zA-Z_-][a-zA-Z0-9_-]*$/;
+function sanitizeTokenName(name: string): string {
+  return TOKEN_NAME_REGEX.test(name) ? name : '';
+}
 
-    for (const [tokenName, tokenValue] of Object.entries(theme)) {
-      tokenDeclarations.push(`--${tokenName}:${tokenValue.toString()};`);
-    }
+const TOKEN_VALUE_BLOCK_REGEX = /(;|{|}|\/\*|\*\/|@import|url\s*\(|expression\s*\(|javascript:)/i;
+function sanitizeTokenValue(value: string): string {
+  return TOKEN_VALUE_BLOCK_REGEX.test(value) ? '' : value;
+}
 
-    themeStyleTextMap.set(theme, tokenDeclarations.join(''));
+function getThemeStyleText(theme: Theme): string {
+  if (!themeStyleTextMap.has(theme)) {
+    themeStyleTextMap.set(
+      theme,
+      Object.keys(theme).reduce((acc, token) => {
+        const tokenName = sanitizeTokenName(token);
+        const tokenValue = sanitizeTokenValue(theme[token].toString());
+        return tokenName && tokenValue ? `${acc}--${tokenName}:${tokenValue};` : acc;
+      }, ''),
+    );
   }
 
   return themeStyleTextMap.get(theme)!;
diff --git a/scripts/beachball/base.config.js b/scripts/beachball/base.config.js
index d14f984c54b7d0..f517bdb3117e29 100644
--- a/scripts/beachball/base.config.js
+++ b/scripts/beachball/base.config.js
@@ -31,7 +31,6 @@ const config = {
     '**/SPEC*.md',
     '**/tests/**',
   ],
-  scope: ['!packages/fluentui/*'],
   changehint: "Run 'yarn change' to generate a change file",
 };
 
diff --git a/scripts/beachball/src/config.test.ts b/scripts/beachball/src/config.test.ts
index 42b906f85d763b..d3ca9fc7d5e61a 100644
--- a/scripts/beachball/src/config.test.ts
+++ b/scripts/beachball/src/config.test.ts
@@ -13,7 +13,6 @@ jest.mock('child_process', () => ({
 }));
 
 describe(`beachball configs`, () => {
-  const excludedPackagesFromReleaseProcess = ['!packages/fluentui/*'];
   const execSyncMock = jest.mocked(execSync);
   const precommit = sharedConfig.hooks.precommit;
 
@@ -61,7 +60,6 @@ describe(`beachball configs`, () => {
         '**/tests/**',
       ],
       registry: 'https://registry.npmjs.org',
-      scope: ['!packages/fluentui/*'],
       tag: 'latest',
       changelog: {
         customRenderers: {
@@ -99,7 +97,6 @@ describe(`beachball configs`, () => {
   it(`should generate v8 release config`, () => {
     expect(v8Config.scope).toEqual(
       expect.arrayContaining([
-        ...excludedPackagesFromReleaseProcess,
         'packages/azure-themes',
         'packages/cra-template',
         'packages/date-time-utilities',
@@ -131,18 +128,12 @@ describe(`beachball configs`, () => {
   });
 
   it(`should generate vNext release config`, () => {
-    expect(vNextConfig.scope).toEqual(expect.arrayContaining(excludedPackagesFromReleaseProcess));
-
-    expect(vNextConfig.scope.some(scope => scope.startsWith('packages/react-'))).toBe(true);
-
-    const includeScopes = vNextConfig.scope.filter(scope => !excludedPackagesFromReleaseProcess.includes(scope));
-
     expect(vNextConfig.changelog.customRenderers).toEqual(sharedConfig.changelog.customRenderers);
     expect(vNextConfig.changelog.groups).toEqual([
       {
         changelogPath: 'packages/react-components/react-components',
         mainPackageName: '@fluentui/react-components',
-        include: includeScopes,
+        include: vNextConfig.scope,
       },
     ]);
 
@@ -155,11 +146,7 @@ describe(`beachball configs`, () => {
 
   it(`should generate web-components release config`, () => {
     expect(webComponentsConfig.scope).toEqual(
-      expect.arrayContaining([
-        ...excludedPackagesFromReleaseProcess,
-        'apps/vr-tests-web-components',
-        'packages/web-components',
-      ]),
+      expect.arrayContaining(['apps/vr-tests-web-components', 'packages/web-components']),
     );
 
     expect(webComponentsConfig.changelog).toEqual(sharedConfig.changelog);
diff --git a/scripts/beachball/src/release-headless.config.js b/scripts/beachball/src/release-headless.config.js
index 609bf972d44c5d..a99830c36595de 100644
--- a/scripts/beachball/src/release-headless.config.js
+++ b/scripts/beachball/src/release-headless.config.js
@@ -6,7 +6,7 @@ const { getConfig } = require('./utils');
 const { scope } = getConfig({ version: 'headless' });
 
 /**
- * @type {typeof sharedConfig}
+ * @type {import('./shared.config').ScopedConfig}
  */
 const config = {
   ...sharedConfig,
diff --git a/scripts/beachball/src/release-tools.config.js b/scripts/beachball/src/release-tools.config.js
index e5099bd1b048ed..8a15eb8d48f0fa 100644
--- a/scripts/beachball/src/release-tools.config.js
+++ b/scripts/beachball/src/release-tools.config.js
@@ -6,7 +6,7 @@ const { getConfig } = require('./utils');
 const { scope } = getConfig({ version: 'tools' });
 
 /**
- * @type {typeof sharedConfig}
+ * @type {import('./shared.config').ScopedConfig}
  */
 const config = {
   ...sharedConfig,
diff --git a/scripts/beachball/src/release-v8.config.js b/scripts/beachball/src/release-v8.config.js
index a1f54c75a81c57..fc06bc3781a1d1 100644
--- a/scripts/beachball/src/release-v8.config.js
+++ b/scripts/beachball/src/release-v8.config.js
@@ -6,11 +6,11 @@ const { getConfig } = require('./utils');
 const { scope } = getConfig({ version: 'v8' });
 
 /**
- * @type {typeof sharedConfig}
+ * @type {import('./shared.config').ScopedConfig}
  */
 const config = {
   ...sharedConfig,
-  scope: [...sharedConfig.scope, ...scope],
+  scope,
 };
 
 module.exports = config;
diff --git a/scripts/beachball/src/release-vNext.config.js b/scripts/beachball/src/release-vNext.config.js
index 0d546e68ef2130..834c9114b8e3c1 100644
--- a/scripts/beachball/src/release-vNext.config.js
+++ b/scripts/beachball/src/release-vNext.config.js
@@ -6,11 +6,11 @@ const { getConfig } = require('./utils');
 const { scope, groupConfig } = getConfig({ version: 'vNext' });
 
 /**
- * @type {typeof sharedConfig}
+ * @type {import('./shared.config').ScopedConfig}
  */
 const config = {
   ...sharedConfig,
-  scope: [...sharedConfig.scope, ...scope],
+  scope,
   changelog: {
     ...sharedConfig.changelog,
     groups: [groupConfig],
diff --git a/scripts/beachball/src/release-web-components.config.js b/scripts/beachball/src/release-web-components.config.js
index 5ecb33e99213b6..ac8bf8a9bbbb37 100644
--- a/scripts/beachball/src/release-web-components.config.js
+++ b/scripts/beachball/src/release-web-components.config.js
@@ -6,14 +6,11 @@ const { getConfig } = require('./utils');
 const { scope } = getConfig({ version: 'web-components' });
 
 /**
- * @type {typeof sharedConfig}
+ * @type {import('./shared.config').ScopedConfig}
  */
 const config = {
   ...sharedConfig,
-  scope: [...sharedConfig.scope, ...scope],
-  changelog: {
-    ...sharedConfig.changelog,
-  },
+  scope,
 };
 
 module.exports = config;
diff --git a/scripts/beachball/src/shared.config.ts b/scripts/beachball/src/shared.config.ts
index b0038d3755fd32..b70d2c5020907e 100644
--- a/scripts/beachball/src/shared.config.ts
+++ b/scripts/beachball/src/shared.config.ts
@@ -5,11 +5,14 @@ import type { BeachballConfig } from 'beachball';
 import { renderEntry, renderHeader } from './customRenderers';
 import baseConfig from '../base.config';
 
+type SharedConfig = typeof baseConfig & Required<Pick<BeachballConfig, 'branch' | 'changelog' | 'hooks' | 'registry'>>;
+
+export type ScopedConfig = SharedConfig & { scope: string[] };
+
 /**
  * Shared Beachball release config.
  */
-export const config: typeof baseConfig &
-  Required<Pick<BeachballConfig, 'branch' | 'changelog' | 'hooks' | 'registry'>> = {
+export const config: SharedConfig = {
   ...baseConfig,
   // This can't be in the base config because people might use different names for remotes,
   // but it should be safe in release pipelines.
diff --git a/scripts/executors/src/check-for-modified-files.ts b/scripts/executors/src/check-for-modified-files.ts
deleted file mode 100644
index dbb47e0cef6494..00000000000000
--- a/scripts/executors/src/check-for-modified-files.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-import { logger } from 'just-scripts';
-import { EOL } from 'os';
-import { execSync } from 'child_process';
-
-export function checkForModifiedFiles() {
-  const notEmpty = (value: string) => value.trim() !== '';
-
-  const gitStatusOutput = execSync('git status -s --untracked-files=no').toString('utf8');
-  const hasChangedFiles = gitStatusOutput.split(EOL).filter(notEmpty).length > 0;
-
-  if (hasChangedFiles) {
-    logger.error('This build has files that are tracked by git that resulted in modified files.');
-    logger.error('Check the following output and resolve the problem that caused these files to change .');
-    logger.error('Most likely you committed your files with --no-verify.');
-    logger.error(gitStatusOutput);
-
-    // Diffing against HEAD will include both unstaged and staged files
-    // (some scripts, such as gulp build:docs:toc, automatically stage the modified files)
-    execSync('git diff HEAD', { stdio: 'inherit' });
-    logger.error('');
-
-    throw new Error('Found modified files');
-  }
-}
diff --git a/scripts/tasks/src/ts.ts b/scripts/tasks/src/ts.ts
index 66f1ef2d8d4040..a90a7812001c7c 100644
--- a/scripts/tasks/src/ts.ts
+++ b/scripts/tasks/src/ts.ts
@@ -7,9 +7,6 @@ import { getTsPathAliasesConfig, getTsPathAliasesConfigUsedOnlyForDx } from './u
 
 const libPath = path.resolve(process.cwd(), 'lib');
 const srcPath = path.resolve(process.cwd(), 'src');
-// Temporary hack: only use tsbuildinfo file for things under packages/fluentui
-const useTsBuildInfo =
-  /[\\/]packages[\\/]fluentui[\\/]/.test(process.cwd()) && path.basename(process.cwd()) !== 'perf-test-northstar';
 
 function prepareTsTaskConfig(options: TscTaskOptions) {
   // docs say pretty is on by default, but it's actually disabled when tsc is run in a
@@ -54,7 +51,6 @@ export const ts = {
     const options = prepareTsTaskConfig({
       outDir: 'lib-commonjs',
       module: 'commonjs',
-      ...(useTsBuildInfo && { tsBuildInfoFile: '.commonjs.tsbuildinfo' }),
     });
 
     return tscTask(options);
@@ -73,7 +69,6 @@ export const ts = {
       target: 'es5',
       outDir: 'lib-amd',
       module: 'amd',
-      ...(useTsBuildInfo && { tsBuildInfoFile: '.amd.tsbuildinfo' }),
     });
 
     return tscTask(options);
diff --git a/syncpack.config.js b/syncpack.config.js
index de292844fbc124..7ce18fb599ffec 100644
--- a/syncpack.config.js
+++ b/syncpack.config.js
@@ -8,7 +8,6 @@ const config = {
     'packages/*/package.json',
     'packages/web-components/package.json',
     'packages/react-components/*/package.json',
-    'packages/fluentui/!(e2e|docs|circulars-test|local-sandbox|perf-test-northstar|perf|projects-test)/package.json',
   ],
   semverGroups: [
     {
diff --git a/tools/workspace-plugin/src/generators/generate-change-file.spec.ts b/tools/workspace-plugin/src/generators/generate-change-file.spec.ts
index 5f1fc7a71d6df7..c2b1a815080d34 100644
--- a/tools/workspace-plugin/src/generators/generate-change-file.spec.ts
+++ b/tools/workspace-plugin/src/generators/generate-change-file.spec.ts
@@ -31,7 +31,7 @@ describe(`generate change file task`, () => {
         1. Make sure your files are staged
         2. Run following command:
 
-        yarn beachball change --scope \\"!packages/fluentui/*\\" --no-commit --message \\"it iiiiz wat it iiiz\\" --type \\"none\\" --dependent-change-type \\"none\\"
+        yarn beachball change --message \\"it iiiiz wat it iiiz\\" --type \\"none\\" --dependent-change-type \\"none\\"
         "
       `);
     });
diff --git a/tools/workspace-plugin/src/generators/generate-change-files.ts b/tools/workspace-plugin/src/generators/generate-change-files.ts
index 97773f1e405b75..63795d4de2a6db 100644
--- a/tools/workspace-plugin/src/generators/generate-change-files.ts
+++ b/tools/workspace-plugin/src/generators/generate-change-files.ts
@@ -32,7 +32,7 @@ function _generateChangeFiles(tree: Tree, options: { cwd?: string } & ChangeFile
 }
 
 function createCommand(options: ChangeFileOptions) {
-  const cmd = 'beachball change --scope "!packages/fluentui/*" --no-commit';
+  const cmd = 'beachball change';
   const flags = Object.entries({
     message: options.message,
     type: options.type,
diff --git a/tools/workspace-plugin/src/generators/split-library-in-two/generator.spec.ts b/tools/workspace-plugin/src/generators/split-library-in-two/generator.spec.ts
index e2cad879728194..d816249f7c4e34 100644
--- a/tools/workspace-plugin/src/generators/split-library-in-two/generator.spec.ts
+++ b/tools/workspace-plugin/src/generators/split-library-in-two/generator.spec.ts
@@ -315,7 +315,8 @@ describe('split-library-in-two generator', () => {
       export const tags = ['autodocs'];
       "
     `);
-  });
+    // Test was sometimes timing out in CI
+  }, 10_000);
 });
 
 function setup(tree: Tree) {
diff --git a/yarn-ci.sh b/yarn-ci.sh
deleted file mode 100755
index 7052f9f9b2b77c..00000000000000
--- a/yarn-ci.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/bin/bash
-
-# Shell script (Linux only) to run yarn with a timeout and retries.
-# This is to address the issue where sometimes postinstall hangs forever.
-attempt=1
-MAX_TIME=5
-MAX_RETRIES=3
-LOG_ERROR="##vso[task.logissue type=error]"
-LOG_WARNING="##vso[task.logissue type=warning]"
-
-corepack enable
-
-# In .devops/templates/tools.yml we enable errexit and errtrace to ensure that the whole task fails
-# if any line of a multi-line script fails. However, that's not desirable here since the `timeout`
-# command below is intended to exit non-zero if a timeout occurs. (+o means turn option off)
-set +o errexit
-set +o errtrace
-
-while [ $attempt -le $MAX_RETRIES ]; do
-  printf "\n\nRunning yarn (attempt $attempt)...\n\n"
-
-  # `timeout` is in GNU coreutils. These are installed by default on Linux but not on Mac.
-  # https://www.gnu.org/software/coreutils/manual/html_node/timeout-invocation.html#index-timeout
-  timeout -k "$((MAX_TIME+1))m" "${MAX_TIME}m" yarn install --immutable
-  result=$?
-
-  if [ $result = 0 ]; then
-    exit 0
-  elif [ $result = 124 ]; then # special timeout exit code
-    printf "\n\n$LOG_WARNING yarn took more than $MAX_TIME minutes"
-  else # other error exit code
-    printf "\n\n$LOG_WARNING yarn exited with code $result"
-  fi
-
-  ((attempt++))
-done
-
-printf "\n\n$LOG_ERROR yarn failed to complete successfully in $MAX_TIME minutes after $MAX_RETRIES attempts\n"
-exit 1