diff --git a/.github/workflows/go-check.yml b/.github/workflows/go-check.yml
index 251f7faa9..cc65ce68a 100644
--- a/.github/workflows/go-check.yml
+++ b/.github/workflows/go-check.yml
@@ -8,26 +8,20 @@ jobs:
   unit:
     runs-on: ubuntu-latest
     name: All
-    env:
-      RUNGOGENERATE: false
     steps:
       - uses: actions/checkout@v3
         with:
           submodules: recursive
+      - id: config
+        uses: protocol/.github/.github/actions/read-config@master
       - uses: actions/setup-go@v3
         with:
-          go-version: "1.19.x"
+          go-version: 1.20.x
       - name: Run repo-specific setup
         uses: ./.github/actions/go-check-setup
         if: hashFiles('./.github/actions/go-check-setup') != ''
-      - name: Read config
-        if: hashFiles('./.github/workflows/go-check-config.json') != ''
-        run: |
-          if jq -re .gogenerate ./.github/workflows/go-check-config.json; then
-            echo "RUNGOGENERATE=true" >> $GITHUB_ENV
-          fi
       - name: Install staticcheck
-        run: go install honnef.co/go/tools/cmd/staticcheck@376210a89477dedbe6fdc4484b233998650d7b3c # 2022.1.3 (v0.3.3)
+        run: go install honnef.co/go/tools/cmd/staticcheck@4970552d932f48b71485287748246cf3237cebdf # 2023.1 (v0.4.0)
       - name: Check that go.mod is tidy
         uses: protocol/multiple-go-modules@v1.2
         with:
@@ -39,7 +33,7 @@ jobs:
             fi
             git diff --exit-code -- go.sum go.mod
       - name: gofmt
-        if: ${{ success() || failure() }} # run this step even if the previous one failed
+        if: success() || failure() # run this step even if the previous one failed
         run: |
           out=$(gofmt -s -l .)
           if [[ -n "$out" ]]; then
@@ -47,12 +41,12 @@ jobs:
             exit 1
           fi
       - name: go vet
-        if: ${{ success() || failure() }} # run this step even if the previous one failed
+        if: success() || failure() # run this step even if the previous one failed
         uses: protocol/multiple-go-modules@v1.2
         with:
           run: go vet ./...
       - name: staticcheck
-        if: ${{ success() || failure() }} # run this step even if the previous one failed
+        if: success() || failure() # run this step even if the previous one failed
         uses: protocol/multiple-go-modules@v1.2
         with:
           run: |
@@ -60,11 +54,11 @@ jobs:
             staticcheck ./... | sed -e 's@\(.*\)\.go@./\1.go@g'
       - name: go generate
         uses: protocol/multiple-go-modules@v1.2
-        if: (success() || failure()) && env.RUNGOGENERATE == 'true'
+        if: (success() || failure()) && fromJSON(steps.config.outputs.json).gogenerate == true
         with:
           run: |
             git clean -fd # make sure there aren't untracked files / directories
-            go generate ./...
+            go generate -x ./...
             # check if go generate modified or added any files
             if ! $(git add . && git diff-index HEAD --exit-code --quiet); then
               echo "go generated caused changes to the repository:"
diff --git a/.github/workflows/go-test.yml b/.github/workflows/go-test.yml
index 8a1697b2d..c5cb3efc7 100644
--- a/.github/workflows/go-test.yml
+++ b/.github/workflows/go-test.yml
@@ -10,15 +10,17 @@ jobs:
       fail-fast: false
       matrix:
         os: [ "ubuntu", "windows", "macos" ]
-        go: [ "1.18.x", "1.19.x" ]
+        go: ["1.19.x","1.20.x"]
     env:
       COVERAGES: ""
-    runs-on: ${{ format('{0}-latest', matrix.os) }}
+    runs-on: ${{ fromJSON(vars[format('UCI_GO_TEST_RUNNER_{0}', matrix.os)] || format('"{0}-latest"', matrix.os)) }}
     name: ${{ matrix.os }} (go ${{ matrix.go }})
     steps:
       - uses: actions/checkout@v3
         with:
           submodules: recursive
+      - id: config
+        uses: protocol/.github/.github/actions/read-config@master
       - uses: actions/setup-go@v3
         with:
           go-version: ${{ matrix.go }}
@@ -27,7 +29,7 @@ jobs:
           go version
           go env
       - name: Use msys2 on windows
-        if: ${{ matrix.os == 'windows' }}
+        if: matrix.os == 'windows'
         shell: bash
         # The executable for msys2 is also called bash.cmd
         #   https://github.com/actions/virtual-environments/blob/main/images/win/Windows2019-Readme.md#shells
@@ -38,6 +40,7 @@ jobs:
         uses: ./.github/actions/go-test-setup
         if: hashFiles('./.github/actions/go-test-setup') != ''
       - name: Run tests
+        if: contains(fromJSON(steps.config.outputs.json).skipOSes, matrix.os) == false
         uses: protocol/multiple-go-modules@v1.2
         with:
           # Use -coverpkg=./..., so that we include cross-package coverage.
@@ -45,16 +48,21 @@ jobs:
           # this means ./B's coverage will be significantly higher than 0%.
           run: go test -v -shuffle=on -coverprofile=module-coverage.txt -coverpkg=./... ./...
       - name: Run tests (32 bit)
-        if: ${{ matrix.os != 'macos' }} # can't run 32 bit tests on OSX.
+        # can't run 32 bit tests on OSX.
+        if: matrix.os != 'macos' &&
+          fromJSON(steps.config.outputs.json).skip32bit != true &&
+          contains(fromJSON(steps.config.outputs.json).skipOSes, matrix.os) == false
         uses: protocol/multiple-go-modules@v1.2
         env:
           GOARCH: 386
         with:
           run: |
-            export "PATH=${{ env.PATH_386 }}:$PATH"
+            export "PATH=$PATH_386:$PATH"
             go test -v -shuffle=on ./...
       - name: Run tests with race detector
-        if: ${{ matrix.os == 'ubuntu' }} # speed things up. Windows and OSX VMs are slow
+        # speed things up. Windows and OSX VMs are slow
+        if: matrix.os == 'ubuntu' &&
+          contains(fromJSON(steps.config.outputs.json).skipOSes, matrix.os) == false
         uses: protocol/multiple-go-modules@v1.2
         with:
           run: go test -v -race ./...
@@ -62,7 +70,7 @@ jobs:
         shell: bash
         run: echo "COVERAGES=$(find . -type f -name 'module-coverage.txt' | tr -s '\n' ',' | sed 's/,$//')" >> $GITHUB_ENV
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # v3.1.0
+        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
         with:
           files: '${{ env.COVERAGES }}'
           env_vars: OS=${{ matrix.os }}, GO=${{ matrix.go }}
diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml
index fde81c1f8..e2408e37c 100644
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -3,9 +3,11 @@
 
 name: Release Checker
 on:
-  pull_request:
+  pull_request_target:
     paths: [ 'version.json' ]
 
 jobs:
   release-check:
     uses: protocol/.github/.github/workflows/release-check.yml@master
+    with:
+      go-version: 1.20.x
diff --git a/core/test/peer.go b/core/test/peer.go
index 11998ff8e..58d704103 100644
--- a/core/test/peer.go
+++ b/core/test/peer.go
@@ -1,7 +1,7 @@
 package test
 
 import (
-	"math/rand"
+	"crypto/rand"
 	"testing"
 
 	"github.com/libp2p/go-libp2p/core/peer"
diff --git a/examples/go.mod b/examples/go.mod
index 7d3fc061b..51bf3953b 100644
--- a/examples/go.mod
+++ b/examples/go.mod
@@ -1,6 +1,6 @@
 module github.com/libp2p/go-libp2p/examples
 
-go 1.18
+go 1.19
 
 require (
 	github.com/gogo/protobuf v1.3.2
diff --git a/examples/ipfs-camp-2019/07-Messaging/chat.pb.go b/examples/ipfs-camp-2019/07-Messaging/chat.pb.go
index 059bb036c..562290f91 100644
--- a/examples/ipfs-camp-2019/07-Messaging/chat.pb.go
+++ b/examples/ipfs-camp-2019/07-Messaging/chat.pb.go
@@ -5,8 +5,9 @@ package main
 
 import (
 	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
 	math "math"
+
+	proto "github.com/gogo/protobuf/proto"
 )
 
 // Reference imports to suppress errors if they are not otherwise used.
diff --git a/examples/ipfs-camp-2019/08-End/chat.pb.go b/examples/ipfs-camp-2019/08-End/chat.pb.go
index 059bb036c..562290f91 100644
--- a/examples/ipfs-camp-2019/08-End/chat.pb.go
+++ b/examples/ipfs-camp-2019/08-End/chat.pb.go
@@ -5,8 +5,9 @@ package main
 
 import (
 	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
 	math "math"
+
+	proto "github.com/gogo/protobuf/proto"
 )
 
 // Reference imports to suppress errors if they are not otherwise used.
diff --git a/examples/ipfs-camp-2019/go.mod b/examples/ipfs-camp-2019/go.mod
index 3790bd62c..e571a66e1 100644
--- a/examples/ipfs-camp-2019/go.mod
+++ b/examples/ipfs-camp-2019/go.mod
@@ -1,6 +1,6 @@
 module github.com/libp2p/go-libp2p/examples/ipfs-camp-2019
 
-go 1.18
+go 1.19
 
 require (
 	github.com/gogo/protobuf v1.3.2
diff --git a/examples/multipro/main.go b/examples/multipro/main.go
index d0192edf7..f7b1ede5f 100644
--- a/examples/multipro/main.go
+++ b/examples/multipro/main.go
@@ -13,9 +13,9 @@ import (
 )
 
 func main() {
+	rnd := rand.New(rand.NewSource(666))
 	// Choose random ports between 10000-10100
-	rand.Seed(666)
-	port1 := rand.Intn(100) + 10000
+	port1 := rnd.Intn(100) + 10000
 	port2 := port1 + 1
 
 	done := make(chan bool, 1)
diff --git a/examples/multipro/pb/p2p.pb.go b/examples/multipro/pb/p2p.pb.go
index 2dc6a440e..a33d54974 100644
--- a/examples/multipro/pb/p2p.pb.go
+++ b/examples/multipro/pb/p2p.pb.go
@@ -3,9 +3,13 @@
 
 package protocols_p2p
 
-import proto "github.com/gogo/protobuf/proto"
-import fmt "fmt"
-import math "math"
+import (
+	fmt "fmt"
+
+	proto "github.com/gogo/protobuf/proto"
+
+	math "math"
+)
 
 // Reference imports to suppress errors if they are not otherwise used.
 var _ = proto.Marshal
diff --git a/examples/pubsub/basic-chat-with-rendezvous/go.mod b/examples/pubsub/basic-chat-with-rendezvous/go.mod
index fdb16f866..ceef5508e 100644
--- a/examples/pubsub/basic-chat-with-rendezvous/go.mod
+++ b/examples/pubsub/basic-chat-with-rendezvous/go.mod
@@ -1,6 +1,6 @@
 module github.com/libp2p/go-libp2p/examples/pubsub/chat
 
-go 1.18
+go 1.19
 
 require (
 	github.com/libp2p/go-libp2p v0.25.1
diff --git a/examples/pubsub/chat/go.mod b/examples/pubsub/chat/go.mod
index c1d1c289f..930b09cfe 100644
--- a/examples/pubsub/chat/go.mod
+++ b/examples/pubsub/chat/go.mod
@@ -1,6 +1,6 @@
 module github.com/libp2p/go-libp2p/examples/pubsub/chat
 
-go 1.18
+go 1.19
 
 require (
 	github.com/gdamore/tcell/v2 v2.5.2
diff --git a/go.mod b/go.mod
index fcab69d6a..21b845956 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/libp2p/go-libp2p
 
-go 1.18
+go 1.19
 
 require (
 	github.com/benbjohnson/clock v1.3.0
diff --git a/p2p/host/resource-manager/sys_unix.go b/p2p/host/resource-manager/sys_unix.go
index 75d4f7f4f..50042c1fe 100644
--- a/p2p/host/resource-manager/sys_unix.go
+++ b/p2p/host/resource-manager/sys_unix.go
@@ -1,5 +1,4 @@
 //go:build linux || darwin
-// +build linux darwin
 
 package rcmgr
 
diff --git a/p2p/net/pnet/psk_conn_test.go b/p2p/net/pnet/psk_conn_test.go
index 832808833..3faac9738 100644
--- a/p2p/net/pnet/psk_conn_test.go
+++ b/p2p/net/pnet/psk_conn_test.go
@@ -3,7 +3,7 @@ package pnet
 import (
 	"bytes"
 	"context"
-	"math/rand"
+	"crypto/rand"
 	"net"
 	"testing"
 )
@@ -62,8 +62,7 @@ func TestPSKFragmentation(t *testing.T) {
 	psk1, psk2 := setupPSKConns(ctx, t)
 
 	in := make([]byte, 1000)
-	_, err := rand.Read(in)
-	if err != nil {
+	if _, err := rand.Read(in); err != nil {
 		t.Fatal(err)
 	}
 
@@ -85,8 +84,7 @@ func TestPSKFragmentation(t *testing.T) {
 		in = in[100:]
 	}
 
-	err = <-wch
-	if err != nil {
+	if err := <-wch; err != nil {
 		t.Fatal(err)
 	}
 }
diff --git a/p2p/protocol/circuitv2/relay/relay_test.go b/p2p/protocol/circuitv2/relay/relay_test.go
index fc797c42c..a8c56e73c 100644
--- a/p2p/protocol/circuitv2/relay/relay_test.go
+++ b/p2p/protocol/circuitv2/relay/relay_test.go
@@ -3,9 +3,9 @@ package relay_test
 import (
 	"bytes"
 	"context"
+	"crypto/rand"
 	"fmt"
 	"io"
-	"math/rand"
 	"testing"
 	"time"
 
@@ -325,8 +325,7 @@ func TestRelayLimitData(t *testing.T) {
 
 	buf := make([]byte, 1024)
 	for i := 0; i < 3; i++ {
-		_, err = rand.Read(buf)
-		if err != nil {
+		if _, err := rand.Read(buf); err != nil {
 			t.Fatal(err)
 		}
 
@@ -345,8 +344,7 @@ func TestRelayLimitData(t *testing.T) {
 	}
 
 	buf = make([]byte, 4096)
-	_, err = rand.Read(buf)
-	if err != nil {
+	if _, err := rand.Read(buf); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/p2p/security/noise/transport_test.go b/p2p/security/noise/transport_test.go
index 4006c9095..7cdd56294 100644
--- a/p2p/security/noise/transport_test.go
+++ b/p2p/security/noise/transport_test.go
@@ -271,12 +271,6 @@ func TestPeerIDOutboundNoCheck(t *testing.T) {
 	require.NoError(t, initErr)
 }
 
-func makeLargePlaintext(size int) []byte {
-	buf := make([]byte, size)
-	rand.Read(buf)
-	return buf
-}
-
 func TestLargePayloads(t *testing.T) {
 	initTransport := newTestTransport(t, crypto.Ed25519, 2048)
 	respTransport := newTestTransport(t, crypto.Ed25519, 2048)
@@ -287,11 +281,12 @@ func TestLargePayloads(t *testing.T) {
 
 	// enough to require a couple Noise messages, with a size that
 	// isn't a neat multiple of Noise message size, just in case
-	size := 100000
+	rnd := rand.New(rand.NewSource(1234))
+	const size = 100000
+	before := make([]byte, size)
+	rnd.Read(before)
 
-	before := makeLargePlaintext(size)
-	_, err := initConn.Write(before)
-	if err != nil {
+	if _, err := initConn.Write(before); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/p2p/test/reconnects/reconnect_test.go b/p2p/test/reconnects/reconnect_test.go
index 0a768b265..4e3680ead 100644
--- a/p2p/test/reconnects/reconnect_test.go
+++ b/p2p/test/reconnects/reconnect_test.go
@@ -71,6 +71,7 @@ func runRound(t *testing.T, hosts []host.Host) {
 		numStreams = 5
 		maxDataLen = 64 << 10
 	)
+	rnd := rand.New(rand.NewSource(12345))
 	// exchange some data
 	for _, h1 := range hosts {
 		for _, h2 := range hosts {
@@ -80,10 +81,10 @@ func runRound(t *testing.T, hosts []host.Host) {
 			var wg sync.WaitGroup
 			wg.Add(numStreams)
 			for i := 0; i < numStreams; i++ {
+				data := make([]byte, rand.Intn(maxDataLen)+1)
+				rnd.Read(data)
 				go func() {
 					defer wg.Done()
-					data := make([]byte, rand.Intn(maxDataLen)+1)
-					rand.Read(data)
 					str, err := h1.NewStream(context.Background(), h2.ID(), protocol.TestingID)
 					require.NoError(t, err)
 					defer str.Close()
diff --git a/p2p/transport/quic/transport.go b/p2p/transport/quic/transport.go
index 3a082243c..5ccebf936 100644
--- a/p2p/transport/quic/transport.go
+++ b/p2p/transport/quic/transport.go
@@ -45,6 +45,7 @@ type transport struct {
 
 	holePunchingMx sync.Mutex
 	holePunching   map[holePunchKey]*activeHolePunch
+	rnd            rand.Rand
 
 	connMx sync.Mutex
 	conns  map[quic.Connection]*conn
@@ -94,6 +95,7 @@ func NewTransport(key ic.PrivKey, connManager *quicreuse.ConnManager, psk pnet.P
 		rcmgr:        rcmgr,
 		conns:        make(map[quic.Connection]*conn),
 		holePunching: make(map[holePunchKey]*activeHolePunch),
+		rnd:          *rand.New(rand.NewSource(time.Now().UnixNano())),
 
 		listeners: make(map[string][]*virtualListener),
 	}, nil
@@ -217,7 +219,7 @@ func (t *transport) holePunch(ctx context.Context, raddr ma.Multiaddr, p peer.ID
 	var punchErr error
 loop:
 	for i := 0; ; i++ {
-		if _, err := rand.Read(payload); err != nil {
+		if _, err := t.rnd.Read(payload); err != nil {
 			punchErr = err
 			break
 		}
diff --git a/tools.go b/tools.go
index 9f83ded5c..46a8037df 100644
--- a/tools.go
+++ b/tools.go
@@ -1,5 +1,4 @@
 //go:build tools
-// +build tools
 
 package libp2p