diff --git a/.ci/pr-sanity-checks.sh b/.ci/pr-sanity-checks.sh
new file mode 100755
index 000000000..bdd4b3d48
--- /dev/null
+++ b/.ci/pr-sanity-checks.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if ! type "docker" > /dev/null; then
+    echo "docker is not installed"
+    exit 1
+fi
+
+if ! type "yq" > /dev/null; then
+    echo "yq is not installed"
+    exit 1
+fi
+
+EMQX_BUILDER_VERSION=${EMQX_BUILDER_VERSION:-5.1-1}
+EMQX_BUILDER_OTP=${EMQX_BUILDER_OTP:-25.3.2-1}
+EMQX_BUILDER_ELIXIR=${EMQX_BUILDER_ELIXIR:-1.14.5}
+EMQX_BUILDER_PLATFORM=${EMQX_BUILDER_PLATFORM:-ubuntu22.04}
+EMQX_BUILDER=${EMQX_BUILDER:-ghcr.io/emqx/emqx-builder/${EMQX_BUILDER_VERSION}:${EMQX_BUILDER_ELIXIR}-${EMQX_BUILDER_OTP}-${EMQX_BUILDER_PLATFORM}}
+
+commands=$(yq ".runs.steps[].run" .github/actions/pr-sanity-checks/action.yaml | grep -v null)
+
+BEFORE_REF=${BEFORE_REF:-$(git rev-parse master)}
+AFTER_REF=${AFTER_REF:-$(git rev-parse HEAD)}
+docker run --rm -it -v "$(pwd):/emqx" -w /emqx \
+       -e GITHUB_WORKSPACE=/emqx \
+       -e BEFORE_REF="$BEFORE_REF" \
+       -e AFTER_REF="$AFTER_REF" \
+       -e GITHUB_BASE_REF="$BEFORE_REF" \
+       -e MIX_ENV=emqx-enterprise \
+       -e PROFILE=emqx-enterprise \
+       "${EMQX_BUILDER}" /bin/bash -c "${commands}"
diff --git a/.github/actions/pr-sanity-checks/action.yaml b/.github/actions/pr-sanity-checks/action.yaml
new file mode 100644
index 000000000..7a6a02f1d
--- /dev/null
+++ b/.github/actions/pr-sanity-checks/action.yaml
@@ -0,0 +1,82 @@
+name: 'Pull request sanity checks'
+
+defaults:
+  run:
+    shell: 'bash -Eeuo pipefail {0}'
+
+runs:
+  using: composite
+  steps:
+    - name: Work around https://github.com/actions/checkout/issues/766
+      shell: bash
+      run: |
+        git config --global --add safe.directory "$GITHUB_WORKSPACE"
+    - name: Run gitlint
+      shell: bash
+      env:
+        BEFORE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+        AFTER_REF: ${{ github.sha }}
+      run: |
+        pip install gitlint
+        gitlint --commits $BEFORE_REF..$AFTER_REF --config .github/workflows/.gitlint
+    - name: Check line-break at EOF
+      shell: bash
+      run: ./scripts/check-nl-at-eof.sh
+    - name: Run shellcheck
+      shell: bash
+      run: |
+        apt-get update -y
+        apt-get install -y shellcheck
+        ./scripts/shellcheck.sh
+        echo "success"
+    - name: Check Erlang code formatting
+      shell: bash
+      run: ./scripts/check-format.sh
+    - name: Apps version check
+      shell: bash
+      run: ./scripts/apps-version-check.sh
+    - name: Run elvis check
+      shell: bash
+      run: ./scripts/elvis-check.sh $GITHUB_BASE_REF
+    - name: Setup mix
+      env:
+        MIX_ENV: emqx-enterprise
+        PROFILE: emqx-enterprise
+      shell: bash
+      run: |
+        mix local.hex --force
+        mix local.rebar --force
+        mix deps.get
+    - name: Run check-deps-integrity.escript
+      env:
+        MIX_ENV: emqx-enterprise
+        PROFILE: emqx-enterprise
+      shell: bash
+      run: ./scripts/check-deps-integrity.escript
+    - name: Check Elixir code formatting
+      env:
+        MIX_ENV: emqx-enterprise
+        PROFILE: emqx-enterprise
+      shell: bash
+      run: mix format --check-formatted
+    - name: Check applications
+      env:
+        MIX_ENV: emqx-enterprise
+        PROFILE: emqx-enterprise
+      shell: bash
+      run: ./scripts/check-elixir-applications.exs
+    - name: Check elixir deps
+      env:
+        MIX_ENV: emqx-enterprise
+        PROFILE: emqx-enterprise
+      shell: bash
+      run: ./scripts/check-elixir-deps-discrepancies.exs
+    - name: Upload produced lock files
+      uses: actions/upload-artifact@v3
+      if: failure()
+      with:
+        name: produced_lock_files
+        path: |
+          mix.lock
+          rebar.lock
+        retention-days: 1
diff --git a/.github/workflows/_pr_entrypoint.yaml b/.github/workflows/_pr_entrypoint.yaml
new file mode 100644
index 000000000..908a2af5f
--- /dev/null
+++ b/.github/workflows/_pr_entrypoint.yaml
@@ -0,0 +1,17 @@
+name: PR Entrypoint
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  entrypoint:
+    runs-on: aws-amd64
+    container: ghcr.io/emqx/emqx-builder/5.1-1:1.14.5-25.3.2-1-ubuntu22.04
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/pr-sanity-checks
+
diff --git a/.github/workflows/check_deps_integrity.yaml b/.github/workflows/check_deps_integrity.yaml
deleted file mode 100644
index 4a079c570..000000000
--- a/.github/workflows/check_deps_integrity.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-name: Check Rebar Dependencies
-
-on:
-  pull_request:
-
-jobs:
-  check_deps_integrity:
-    runs-on: ubuntu-22.04
-    container: ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04
-
-    steps:
-      - uses: actions/checkout@v3
-      - name: Run check-deps-integrity.escript
-        run: ./scripts/check-deps-integrity.escript
diff --git a/.github/workflows/code_style_check.yaml b/.github/workflows/code_style_check.yaml
deleted file mode 100644
index ff1043b81..000000000
--- a/.github/workflows/code_style_check.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-name: Code style check
-
-on: [pull_request]
-
-jobs:
-  code_style_check:
-    runs-on: ubuntu-22.04
-    container: "ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04"
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 1000
-      - name: Work around https://github.com/actions/checkout/issues/766
-        run: |
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-      - name: Check line-break at EOF
-        run: |
-          ./scripts/check-nl-at-eof.sh
-      - name: Check Elixir code formatting
-        run: |
-          mix format --check-formatted
-
-      - name: Check Erlang code formatting
-        run: |
-          ./scripts/check-format.sh
-
-      - name: Run elvis check
-        run: |
-          ./scripts/elvis-check.sh $GITHUB_BASE_REF
diff --git a/.github/workflows/elixir_apps_check.yaml b/.github/workflows/elixir_apps_check.yaml
deleted file mode 100644
index 31f70690e..000000000
--- a/.github/workflows/elixir_apps_check.yaml
+++ /dev/null
@@ -1,45 +0,0 @@
----
-
-name: Check Elixir Release Applications
-
-on:
-  pull_request:
-
-jobs:
-  elixir_apps_check:
-    runs-on: ubuntu-22.04
-    # just use the latest builder
-    container: "ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04"
-
-    strategy:
-      fail-fast: false
-      matrix:
-        profile:
-          - emqx
-          - emqx-enterprise
-          - emqx-pkg
-          - emqx-enterprise-pkg
-
-    steps:
-      - name: fix_git_permission
-        run: git config --global --add safe.directory '/__w/emqx/emqx'
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      - name: ensure rebar
-        run: ./scripts/ensure-rebar3.sh
-      - name: Work around https://github.com/actions/checkout/issues/766
-        run: |
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-      - name: check applications
-        run: ./scripts/check-elixir-applications.exs
-        env:
-          MIX_ENV: ${{ matrix.profile }}
-          PROFILE: ${{ matrix.profile }}
-#      - name: check applications started with emqx_machine
-#        run: ./scripts/check-elixir-emqx-machine-boot-discrepancies.exs
-#        env:
-#          MIX_ENV: ${{ matrix.profile }}
-
-...
diff --git a/.github/workflows/elixir_deps_check.yaml b/.github/workflows/elixir_deps_check.yaml
deleted file mode 100644
index a7e086bb1..000000000
--- a/.github/workflows/elixir_deps_check.yaml
+++ /dev/null
@@ -1,49 +0,0 @@
----
-
-name: Elixir Dependency Version Check
-
-on:
-  pull_request:
-
-jobs:
-  elixir_deps_check:
-    runs-on: ubuntu-22.04
-    container: ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: ensure rebar
-        run: ./scripts/ensure-rebar3.sh
-      - name: Work around https://github.com/actions/checkout/issues/766
-        run: |
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-      - name: setup mix
-        run: |
-          mix local.hex --force
-          mix local.rebar --force
-          mix deps.get
-        # we check only enterprise because `rebar3 tree`, even if an
-        # enterprise app is excluded from `project_app_dirs` in
-        # `rebar.config.erl`, will still list dependencies from it.
-        # Since the enterprise profile is a superset of the
-        # community one and thus more complete, we use the former.
-        env:
-          MIX_ENV: emqx-enterprise
-          PROFILE: emqx-enterprise
-      - name: check elixir deps
-        run: ./scripts/check-elixir-deps-discrepancies.exs
-        env:
-          MIX_ENV: emqx-enterprise
-          PROFILE: emqx-enterprise
-      - name: produced lock files
-        uses: actions/upload-artifact@v3
-        if: failure()
-        with:
-          name: produced_lock_files
-          path: |
-            mix.lock
-            rebar.lock
-          retention-days: 1
-
-...
diff --git a/.github/workflows/run_gitlint.yaml b/.github/workflows/run_gitlint.yaml
deleted file mode 100644
index 52082c56e..000000000
--- a/.github/workflows/run_gitlint.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
-name: Run gitlint
-
-on: [pull_request]
-
-jobs:
-  run_gitlint:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      - name: Run gitlint
-        shell: bash
-        run: |
-          set -ex
-          docker run --ulimit nofile=1024 -v $(pwd):/repo -w /repo ghcr.io/emqx/gitlint --commits ${{ github.event.pull_request.base.sha }}..$GITHUB_SHA --config .github/workflows/.gitlint
diff --git a/.github/workflows/shellcheck.yaml b/.github/workflows/shellcheck.yaml
deleted file mode 100644
index 7f29572b9..000000000
--- a/.github/workflows/shellcheck.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-name: Shellcheck
-
-on:
-  pull_request:
-
-jobs:
-  shellcheck:
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout source code
-        uses: actions/checkout@v3
-      - name: Install shellcheck
-        run: |
-          sudo apt-get update
-          sudo apt install shellcheck
-      - name: Run shellcheck
-        run: |
-          ./scripts/shellcheck.sh
-          echo "success"