diff --git a/.github/actions/pr-sanity-checks/action.yaml b/.github/actions/pr-sanity-checks/action.yaml
index 60976e27e..3114f8a94 100644
--- a/.github/actions/pr-sanity-checks/action.yaml
+++ b/.github/actions/pr-sanity-checks/action.yaml
@@ -7,10 +7,6 @@ defaults:
 runs:
   using: composite
   steps:
-    - name: Work around https://github.com/actions/checkout/issues/766
-      shell: bash
-      run: |
-        git config --global --add safe.directory "$GITHUB_WORKSPACE"
     - name: Run gitlint
       shell: bash
       env:
@@ -22,7 +18,7 @@ runs:
     - name: Run shellcheck
       shell: bash
       run: |
-        apt-get update -y && apt-get install -y shellcheck
+        DEBIAN_FRONTEND=noninteractive apt-get update -qy && apt-get install -qy shellcheck
         ./scripts/shellcheck.sh
       # https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions
     - name: Check workflow files
@@ -45,9 +41,7 @@ runs:
     - name: Check Erlang code formatting
       shell: bash
       run: |
-        echo "==> ./scripts/check-format.sh"
         ./scripts/check-format.sh
-        echo "==> check-format ok"
     - name: Run elvis check
       shell: bash
       run: |
diff --git a/.github/workflows/_pr_entrypoint.yaml b/.github/workflows/_pr_entrypoint.yaml
index 4b30304e6..67cedcfb8 100644
--- a/.github/workflows/_pr_entrypoint.yaml
+++ b/.github/workflows/_pr_entrypoint.yaml
@@ -1,13 +1,18 @@
 name: PR Entrypoint
 
+concurrency:
+  group: pr-entrypoint-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request:
+  workflow_dispatch:
+    inputs:
+      ref:
+        required: false
 
 env:
   IS_CI: "yes"
-  OTP_VSN: "25.3.2-1"
-  ELIXIR_VSN: "1.14.5"
-  BUILDER_VSN: "25.3.2-1"
 
 jobs:
   sanity-checks:
@@ -28,7 +33,11 @@ jobs:
     steps:
       - uses: actions/checkout@v3
         with:
+          ref: ${{ github.event.inputs.ref }}
           fetch-depth: 0
+      - name: Work around https://github.com/actions/checkout/issues/766
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - uses: ./.github/actions/pr-sanity-checks
       - name: Build matrix
         id: matrix
@@ -50,10 +59,10 @@ jobs:
           ')"
           echo "${MATRIX}" | jq
           CT_MATRIX="$(echo "${MATRIX}" | jq -c 'map({profile, builder, otp, elixir}) | unique')"
-          CT_HOST="$(echo "${MATRIX}" | jq -c 'map(select(.runner == "host"))')"
+          CT_HOST="$(echo "${MATRIX}"   | jq -c 'map(select(.runner == "host"))')"
           CT_DOCKER="$(echo "${MATRIX}" | jq -c 'map(select(.runner == "docker"))')"
           echo "ct-matrix=${CT_MATRIX}" | tee -a $GITHUB_OUTPUT
-          echo "ct-host=${CT_HOST}" | tee -a $GITHUB_OUTPUT
+          echo "ct-host=${CT_HOST}"     | tee -a $GITHUB_OUTPUT
           echo "ct-docker=${CT_DOCKER}" | tee -a $GITHUB_OUTPUT
           echo "version-emqx=$(./pkg-vsn.sh emqx)" | tee -a $GITHUB_OUTPUT
           echo "version-emqx-enterprise=$(./pkg-vsn.sh emqx-enterprise)" | tee -a $GITHUB_OUTPUT
diff --git a/.github/workflows/_push-entrypoint.yaml b/.github/workflows/_push-entrypoint.yaml
new file mode 100644
index 000000000..af014e74d
--- /dev/null
+++ b/.github/workflows/_push-entrypoint.yaml
@@ -0,0 +1,179 @@
+name: Push Entrypoint
+
+concurrency:
+  group: push-entrypoint-${{ github.event_name }}-${{ github.sha }}
+  cancel-in-progress: true
+
+on:
+  push:
+    tags:
+      - 'v*'
+      - 'e*'
+    branches:
+      - 'master'
+      - 'release-51'
+      - 'ci/**'
+
+env:
+  IS_CI: 'yes'
+
+jobs:
+  prepare:
+    runs-on: ${{ github.repository_owner == 'emqx' && 'aws-amd64' || 'ubuntu-22.04' }}
+    container: 'ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04'
+    outputs:
+      profile: ${{ steps.parse-git-ref.outputs.profile }}
+      edition: ${{ steps.parse-git-ref.outputs.edition }}
+      release: ${{ steps.parse-git-ref.outputs.release }}
+      latest: ${{ steps.parse-git-ref.outputs.latest }}
+      version: ${{ steps.parse-git-ref.outputs.version }}
+      ct-matrix: ${{ steps.matrix.outputs.ct-matrix }}
+      ct-host: ${{ steps.matrix.outputs.ct-host }}
+      ct-docker: ${{ steps.matrix.outputs.ct-docker }}
+      runner: ${{ github.repository_owner == 'emqx' && 'aws-amd64' || 'ubuntu-22.04' }}
+      builder: 'ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04'
+      builder_vsn: '5.1-3'
+      otp_vsn: '25.3.2-1'
+      elixir_vsn: '1.14.5'
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.inputs.ref }}
+          fetch-depth: 0
+      - name: Work around https://github.com/actions/checkout/issues/766
+        shell: bash
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - name: Detect emqx profile and version
+        id: parse-git-ref
+        run: |
+          JSON="$(./scripts/parse-git-ref.sh $GITHUB_REF)"
+          PROFILE=$(echo "$JSON" | jq -cr '.profile')
+          EDITION=$(echo "$JSON" | jq -cr '.edition')
+          RELEASE=$(echo "$JSON" | jq -cr '.release')
+          LATEST=$(echo "$JSON"  | jq -cr '.latest')
+          VERSION="$(./pkg-vsn.sh "$PROFILE")"
+          echo "profile=$PROFILE" | tee -a $GITHUB_OUTPUT
+          echo "edition=$EDITION" | tee -a $GITHUB_OUTPUT
+          echo "release=$RELEASE" | tee -a $GITHUB_OUTPUT
+          echo "latest=$LATEST"   | tee -a $GITHUB_OUTPUT
+          echo "version=$VERSION" | tee -a $GITHUB_OUTPUT
+      - name: Build matrix
+        id: matrix
+        run: |
+          APPS="$(./scripts/find-apps.sh --ci)"
+          MATRIX="$(echo "${APPS}" | jq -c '
+            [
+              (.[] | select(.profile == "emqx") | . + {
+                builder: "5.1-3",
+                otp: "25.3.2-1",
+                elixir: "1.14.5"
+              }),
+              (.[] | select(.profile == "emqx-enterprise") | . + {
+                builder: "5.1-3",
+                otp: ["25.3.2-1"][],
+                elixir: "1.14.5"
+              })
+            ]
+          ')"
+          echo "${MATRIX}" | jq
+          CT_MATRIX="$(echo "${MATRIX}" | jq -c 'map({profile, builder, otp, elixir}) | unique')"
+          CT_HOST="$(echo "${MATRIX}"   | jq -c 'map(select(.runner == "host"))')"
+          CT_DOCKER="$(echo "${MATRIX}" | jq -c 'map(select(.runner == "docker"))')"
+          echo "ct-matrix=${CT_MATRIX}" | tee -a $GITHUB_OUTPUT
+          echo "ct-host=${CT_HOST}"     | tee -a $GITHUB_OUTPUT
+          echo "ct-docker=${CT_DOCKER}" | tee -a $GITHUB_OUTPUT
+
+  build_packages:
+    if: ${{ needs.prepare.outputs.release == 'true' }}
+    needs:
+      - prepare
+    uses: ./.github/workflows/build_packages.yaml
+    with:
+      profile: ${{ needs.prepare.outputs.profile }}
+      publish: ${{ needs.prepare.outputs.release }}
+      otp_vsn: ${{ needs.prepare.outputs.otp_vsn }}
+      elixir_vsn: ${{ needs.prepare.outputs.elixir_vsn }}
+      runner: ${{ needs.prepare.outputs.runner }}
+      builder_vsn: ${{ needs.prepare.outputs.builder_vsn }}
+
+  build_and_push_docker_images:
+    if: ${{ needs.prepare.outputs.release == 'true' }}
+    needs:
+      - prepare
+    uses: ./.github/workflows/build_and_push_docker_images.yaml
+    with:
+      profile: ${{ needs.prepare.outputs.profile }}
+      edition: ${{ needs.prepare.outputs.edition }}
+      version: ${{ needs.prepare.outputs.version }}
+      latest: ${{ needs.prepare.outputs.latest }}
+      publish: ${{ needs.prepare.outputs.release }}
+      otp_vsn: ${{ needs.prepare.outputs.otp_vsn }}
+      elixir_vsn: ${{ needs.prepare.outputs.elixir_vsn }}
+      runner: ${{ needs.prepare.outputs.runner }}
+      builder_vsn: ${{ needs.prepare.outputs.builder_vsn }}
+
+  compile:
+    runs-on: ${{ needs.prepare.outputs.runner }}
+    container: ${{ needs.prepare.outputs.builder }}
+    needs:
+      - prepare
+    strategy:
+      matrix:
+        profile:
+          - emqx
+          - emqx-enterprise
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.inputs.ref }}
+          fetch-depth: 0
+      - name: Work around https://github.com/actions/checkout/issues/766
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - id: compile
+        env:
+          PROFILE: ${{ matrix.profile }}
+          ENABLE_COVER_COMPILE: 1
+        run: |
+          make $PROFILE
+          zip -ryq $PROFILE.zip .
+      - uses: actions/upload-artifact@v3
+        with:
+          name: ${{ matrix.profile }}
+          path: ${{ matrix.profile }}.zip
+          retention-days: 1
+
+  run_test_cases:
+    needs:
+      - prepare
+      - compile
+    uses: ./.github/workflows/run_test_cases.yaml
+    with:
+      runner: ${{ needs.prepare.outputs.runner }}
+      builder: ${{ needs.prepare.outputs.builder }}
+      ct-matrix: ${{ needs.prepare.outputs.ct-matrix }}
+      ct-host: ${{ needs.prepare.outputs.ct-host }}
+      ct-docker: ${{ needs.prepare.outputs.ct-docker }}
+
+  run_conf_tests:
+    needs:
+      - prepare
+      - compile
+    uses: ./.github/workflows/run_conf_tests.yaml
+    with:
+      runner: ${{ needs.prepare.outputs.runner }}
+      builder: ${{ needs.prepare.outputs.builder }}
+
+  static_checks:
+    needs:
+      - prepare
+      - compile
+    uses: ./.github/workflows/static_checks.yaml
+    with:
+      runner: ${{ needs.prepare.outputs.runner }}
+      builder: ${{ needs.prepare.outputs.builder }}
+      ct-matrix: ${{ needs.prepare.outputs.ct-matrix }}
+
diff --git a/.github/workflows/build_and_push_docker_images.yaml b/.github/workflows/build_and_push_docker_images.yaml
index ddcf2c6ac..63225eec3 100644
--- a/.github/workflows/build_and_push_docker_images.yaml
+++ b/.github/workflows/build_and_push_docker_images.yaml
@@ -1,144 +1,106 @@
 name: Build and push docker images
 
 concurrency:
-  group: docker-build-${{ github.event_name }}-${{ github.ref }}
+  group: docker-build-${{ github.event_name }}-${{ github.sha }}
   cancel-in-progress: true
 
 on:
   workflow_call:
-# on:
-#   push:
-#     tags:
-#     - v*
-#     - e*
-#     - docker-latest-*
+    inputs:
+      profile:
+        required: true
+        type: string
+      edition:
+        required: true
+        type: string
+      version:
+        required: true
+        type: string
+      latest:
+        required: true
+        type: string
+      publish:
+        required: true
+        type: string
+      otp_vsn:
+        required: true
+        type: string
+      elixir_vsn:
+        required: true
+        type: string
+      runner:
+        required: true
+        type: string
+      builder_vsn:
+        required: true
+        type: string
   workflow_dispatch:
     inputs:
-      branch_or_tag:
+      ref:
         required: false
+      version:
+        required: true
+        type: string
       profile:
         required: false
+        type: string
         default: 'emqx'
-      is_latest:
+      edition:
         required: false
+        type: string
+        default: 'Opensource'
+      latest:
+        required: false
+        type: boolean
         default: false
+      publish:
+        required: false
+        type: boolean
+        default: false
+      otp_vsn:
+        required: false
+        type: string
+        default: '25.3.2-1'
+      elixir_vsn:
+        required: false
+        type: string
+        default: '1.14.5'
+      runner:
+        required: false
+        type: string
+        default: 'ubuntu-22.04'
+      builder_vsn:
+        required: false
+        type: string
+        default: '5.1-3'
 
 jobs:
-  prepare:
-    runs-on: ubuntu-22.04
-    # prepare source with any OTP version, no need for a matrix
-    container: "ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04"
-
-    outputs:
-      PROFILE: ${{ steps.get_profile.outputs.PROFILE }}
-      EDITION: ${{ steps.get_profile.outputs.EDITION }}
-      IS_LATEST: ${{ steps.get_profile.outputs.IS_LATEST }}
-      IS_EXACT_TAG: ${{ steps.get_profile.outputs.IS_EXACT_TAG }}
-      VERSION: ${{ steps.get_profile.outputs.VERSION }}
-
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          ref: ${{ github.event.inputs.branch_or_tag }} # when input is not given, the event tag is used
-          path: source
-          fetch-depth: 0
-
-      - name: Get profiles to build
-        id: get_profile
-        env:
-          INPUTS_PROFILE: ${{ github.event.inputs.profile }}
-        run: |
-          cd source
-          # tag docker-latest-ce or docker-latest-ee
-          if git describe --tags --exact --match 'docker-latest-*' 2>/dev/null; then
-            echo 'is_latest=true due to docker-latest-* tag'
-            is_latest=true
-          elif [ "${{ inputs.is_latest }}" = "true" ]; then
-            echo 'is_latest=true due to manual input from workflow_dispatch'
-            is_latest=true
-          else
-            echo 'is_latest=false'
-            is_latest=false
-          fi
-          # resolve profile
-          if git describe --tags --match "v*" --exact; then
-            echo "This is an exact git tag, will publish images"
-            is_exact='true'
-            PROFILE=emqx
-          elif git describe --tags --match "e*" --exact; then
-            echo "This is an exact git tag, will publish images"
-            is_exact='true'
-            PROFILE=emqx-enterprise
-          else
-            echo "This is NOT an exact git tag, will not publish images"
-            is_exact='false'
-          fi
-
-          case "${PROFILE:-$INPUTS_PROFILE}" in
-            emqx)
-              EDITION='Opensource'
-              ;;
-            emqx-enterprise)
-              EDITION='Enterprise'
-              ;;
-            *)
-              echo "ERROR: Failed to resolve build profile"
-              exit 1
-              ;;
-          esac
-
-          VSN="$(./pkg-vsn.sh "$PROFILE")"
-          echo "Building emqx/$PROFILE:$VSN image (latest=$is_latest)"
-          echo "Push = $is_exact"
-          echo "IS_LATEST=$is_latest" >> $GITHUB_OUTPUT
-          echo "IS_EXACT_TAG=$is_exact" >> $GITHUB_OUTPUT
-          echo "PROFILE=$PROFILE" >> $GITHUB_OUTPUT
-          echo "EDITION=$EDITION" >> $GITHUB_OUTPUT
-          echo "VERSION=$VSN" >> $GITHUB_OUTPUT
-      - name: get_all_deps
-        env:
-          PROFILE: ${{ steps.get_profile.outputs.PROFILE }}
-        run: |
-          zip -ryq source.zip source/* source/.[^.]*
-      - uses: actions/upload-artifact@v3
-        with:
-          name: source
-          path: source.zip
-
   docker:
-    runs-on: ubuntu-22.04
-    needs: prepare
+    runs-on: ${{ inputs.runner }}
 
     strategy:
       fail-fast: false
       matrix:
         profile:
-          - "${{ needs.prepare.outputs.PROFILE }}"
+          - ${{ inputs.profile }}
         registry:
           - 'docker.io'
           - 'public.ecr.aws'
         os:
           - [debian11, "debian:11-slim", "deploy/docker/Dockerfile"]
-        # NOTE: 'otp' and 'elixir' are to configure emqx-builder image
-        #       only support latest otp and elixir, not a matrix
         builder:
-          - 5.1-3 # update to latest
+          - ${{ inputs.builder_vsn }}
         otp:
-          - 25.3.2-1
+          - ${{ inputs.otp_vsn }}
         elixir:
           - 'no_elixir'
-          - '1.14.5' # update to latest
-        exclude: # TODO: publish enterprise to ecr too?
-          - registry: 'public.ecr.aws'
-            profile: emqx-enterprise
+          - ${{ inputs.elixir_vsn }}
 
     steps:
-    - uses: actions/download-artifact@v3
+    - uses: actions/checkout@v3
       with:
-        name: source
-        path: .
-    - name: unzip source code
-      run: unzip -q source.zip
+        ref: ${{ github.event.inputs.ref }}
+        fetch-depth: 0
 
     - uses: docker/setup-qemu-action@v2
     - uses: docker/setup-buildx-action@v2
@@ -187,18 +149,18 @@ jobs:
           latest=${{ matrix.elixir == 'no_elixir'  }}
           suffix=${{ steps.pre-meta.outputs.img_suffix }}
         tags: |
-          type=semver,pattern={{major}}.{{minor}},value=${{ needs.prepare.outputs.VERSION }}
-          type=semver,pattern={{version}},value=${{ needs.prepare.outputs.VERSION }}
-          type=raw,value=${{ needs.prepare.outputs.VERSION }}
-          type=raw,value=latest,enable=${{ needs.prepare.outputs.IS_LATEST }}
+          type=semver,pattern={{major}}.{{minor}},value=${{ inputs.version }}
+          type=semver,pattern={{version}},value=${{ inputs.version }}
+          type=raw,value=${{ inputs.version }}
+          type=raw,value=latest,enable=${{ inputs.latest }}
         labels: |
           org.opencontainers.image.otp.version=${{ matrix.otp }}
-          org.opencontainers.image.edition=${{ needs.prepare.outputs.EDITION }}
+          org.opencontainers.image.edition=${{ inputs.edition }}
           ${{ steps.pre-meta.outputs.extra_labels }}
 
     - uses: docker/build-push-action@v3
       with:
-        push: ${{ needs.prepare.outputs.IS_EXACT_TAG == 'true' || github.repository_owner != 'emqx' }}
+        push: ${{ inputs.publish == 'true' || github.repository_owner != 'emqx' }}
         pull: true
         no-cache: true
         platforms: linux/amd64,linux/arm64
@@ -208,4 +170,4 @@ jobs:
           EMQX_NAME=${{ matrix.profile }}${{ steps.pre-meta.outputs.img_suffix }}
           EXTRA_DEPS=${{ steps.pre-meta.outputs.extra_deps }}
         file: source/${{ matrix.os[2] }}
-        context: source
+
diff --git a/.github/workflows/build_docker_for_test.yaml b/.github/workflows/build_docker_for_test.yaml
index 756383d7f..e43a651f7 100644
--- a/.github/workflows/build_docker_for_test.yaml
+++ b/.github/workflows/build_docker_for_test.yaml
@@ -19,23 +19,6 @@ on:
       version-emqx-enterprise:
         required: true
         type: string
-# on:
-#   push:
-#     branches:
-#       - master
-#       - release-51
-#   pull_request:
-#     # GitHub pull_request action is by default triggered when
-#     # opened reopened or synchronize,
-#     # we add labeled and unlabeled to the list because
-#     # the mac job dpends on the PR having a 'Mac' label
-#     types:
-#       - labeled
-#       - unlabeled
-#       - opened
-#       - reopened
-#       - synchronize
-#   workflow_dispatch:
 
 jobs:
   docker:
diff --git a/.github/workflows/build_packages.yaml b/.github/workflows/build_packages.yaml
index c65b05677..20b64038d 100644
--- a/.github/workflows/build_packages.yaml
+++ b/.github/workflows/build_packages.yaml
@@ -1,83 +1,61 @@
 name: Cross build packages
 
 concurrency:
-  group: build-${{ github.event_name }}-${{ github.ref }}
+  group: build-packages-${{ github.event_name }}-${{ github.sha }}
   cancel-in-progress: true
 
 on:
   workflow_call:
-# on:
-#   push:
-#     branches:
-#     - 'ci/**'
-#     tags:
-#     - v*
-#     - e*
+    inputs:
+      profile:
+        required: true
+        type: string
+      publish:
+        required: true
+        type: string
+      otp_vsn:
+        required: true
+        type: string
+      elixir_vsn:
+        required: true
+        type: string
+      runner:
+        required: true
+        type: string
+      builder_vsn:
+        required: true
+        type: string
   workflow_dispatch:
     inputs:
-      branch_or_tag:
+      ref:
         required: false
       profile:
         required: false
+      publish:
+        required: false
+        type: boolean
+        default: false
+      otp_vsn:
+        required: false
+        type: string
+        default: '25.3.2-1'
+      elixir_vsn:
+        required: false
+        type: string
+        default: '1.14.5'
+      runner:
+        required: false
+        type: string
+        default: 'ubuntu-22.04'
+      builder_vsn:
+        required: false
+        type: string
+        default: '5.1-3'
 
 jobs:
-  prepare:
-    runs-on: ubuntu-22.04
-    container: ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04
-    outputs:
-      BUILD_PROFILE: ${{ steps.get_profile.outputs.BUILD_PROFILE }}
-      IS_EXACT_TAG: ${{ steps.get_profile.outputs.IS_EXACT_TAG }}
-      VERSION: ${{ steps.get_profile.outputs.VERSION }}
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          ref: ${{ github.event.inputs.branch_or_tag }} # when input is not given, the event tag is used
-          fetch-depth: 0
-
-      - name: Get profile to build
-        id: get_profile
-        run: |
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          tag=${{ github.ref }}
-          if git describe --tags --match "[v|e]*" --exact; then
-            echo "WARN: This is an exact git tag, will publish release"
-            is_exact_tag='true'
-          else
-            echo "WARN: This is NOT an exact git tag, will not publish release"
-            is_exact_tag='false'
-          fi
-          echo "IS_EXACT_TAG=${is_exact_tag}" >> $GITHUB_OUTPUT
-          case $tag in
-            refs/tags/v*)
-              PROFILE='emqx'
-              ;;
-            refs/tags/e*)
-              PROFILE=emqx-enterprise
-              ;;
-            *)
-              PROFILE=${{ github.event.inputs.profile }}
-              case "$PROFILE" in
-                emqx)
-                  true
-                  ;;
-                emqx-enterprise)
-                  true
-                  ;;
-                *)
-                  # maybe triggered from schedule
-                  echo "WARN: \"$PROFILE\" is not a valid profile."
-                  echo "building the default profile 'emqx' instead"
-                  PROFILE='emqx'
-                  ;;
-              esac
-              ;;
-          esac
-          echo "BUILD_PROFILE=$PROFILE" >> $GITHUB_OUTPUT
-          echo "VERSION=$(./pkg-vsn.sh $PROFILE)" >> $GITHUB_OUTPUT
-
   windows:
     runs-on: windows-2019
-    if: startsWith(github.ref_name, 'v')
+    if: inputs.profile == 'emqx'
     strategy:
       fail-fast: false
       matrix:
@@ -86,7 +64,7 @@ jobs:
     steps:
     - uses: actions/checkout@v3
       with:
-        ref: ${{ github.event.inputs.branch_or_tag }}
+        ref: ${{ github.event.inputs.ref }}
         fetch-depth: 0
 
     - uses: ilammy/msvc-dev-cmd@v1.12.0
@@ -127,14 +105,13 @@ jobs:
         path: _packages/${{ matrix.profile }}/
 
   mac:
-    needs: prepare
     strategy:
       fail-fast: false
       matrix:
         profile:
-          - ${{ needs.prepare.outputs.BUILD_PROFILE }}
+          - ${{ inputs.profile }}
         otp:
-          - 25.3.2-1
+          - ${{ inputs.otp_vsn }}
         os:
           - macos-11
           - macos-12
@@ -144,7 +121,7 @@ jobs:
     - uses: emqx/self-hosted-cleanup-action@v1.0.3
     - uses: actions/checkout@v3
       with:
-        ref: ${{ github.event.inputs.branch_or_tag }}
+        ref: ${{ github.event.inputs.ref }}
         fetch-depth: 0
     - uses: ./.github/actions/package-macos
       with:
@@ -162,7 +139,6 @@ jobs:
         path: _packages/${{ matrix.profile }}/
 
   linux:
-    needs: prepare
     runs-on: ${{ matrix.build_machine }}
     # always run in builder container because the host might have the wrong OTP version etc.
     # otherwise buildx.sh does not run docker if arch and os matches the target arch and os.
@@ -173,9 +149,9 @@ jobs:
       fail-fast: false
       matrix:
         profile:
-          - ${{ needs.prepare.outputs.BUILD_PROFILE }}
+          - ${{ inputs.profile }}
         otp:
-          - 25.3.2-1
+          - ${{ inputs.otp_vsn }}
         arch:
           - amd64
           - arm64
@@ -195,9 +171,9 @@ jobs:
           - aws-arm64
           - aws-amd64
         builder:
-          - 5.1-3
+          - ${{ inputs.builder_vsn }}
         elixir:
-          - 1.14.5
+          - ${{ inputs.elixir_vsn }}
         with_elixir:
           - 'no'
         exclude:
@@ -207,12 +183,12 @@ jobs:
             build_machine: aws-arm64
         include:
           - profile: emqx
-            otp: 25.3.2-1
+            otp: ${{ inputs.otp_vsn }}
             arch: amd64
             os: ubuntu22.04
             build_machine: aws-amd64
-            builder: 5.1-3
-            elixir: 1.14.5
+            builder: ${{ inputs.builder_vsn }}
+            elixir: ${{ inputs.elixir_vsn }}
             with_elixir: 'yes'
 
     defaults:
@@ -224,7 +200,7 @@ jobs:
 
     - uses: actions/checkout@v3
       with:
-        ref: ${{ github.event.inputs.branch_or_tag }}
+        ref: ${{ github.event.inputs.ref }}
         fetch-depth: 0
 
     - name: fix workdir
@@ -269,14 +245,16 @@ jobs:
         path: _packages/${{ matrix.profile }}/
 
   publish_artifacts:
-    runs-on: ubuntu-22.04
-    needs: [prepare, mac, linux]
-    if: needs.prepare.outputs.IS_EXACT_TAG == 'true'
+    runs-on: ${{ inputs.runner }}
+    needs:
+      - mac
+      - linux
+    if: ${{ inputs.publish == 'true' }}
     strategy:
       fail-fast: false
       matrix:
         profile:
-          - ${{ needs.prepare.outputs.BUILD_PROFILE }}
+          - ${{ inputs.profile }}
     steps:
     - uses: actions/download-artifact@v3
       with:
@@ -286,7 +264,7 @@ jobs:
       run: sudo apt-get update && sudo apt install -y dos2unix
     - name: get packages
       run: |
-        set -e -u
+        set -eu
         cd packages/${{ matrix.profile }}
         # fix the .sha256 file format
         for var in $(ls | grep emqx | grep -v sha256); do
diff --git a/.github/workflows/build_slim_packages.yaml b/.github/workflows/build_slim_packages.yaml
index a1de84728..483ab88ec 100644
--- a/.github/workflows/build_slim_packages.yaml
+++ b/.github/workflows/build_slim_packages.yaml
@@ -22,23 +22,31 @@ on:
       elixir_vsn:
         required: true
         type: string
-# on:
-#   push:
-#     branches:
-#       - master
-#       - release-51
-#   pull_request:
-#     # GitHub pull_request action is by default triggered when
-#     # opened reopened or synchronize,
-#     # we add labeled and unlabeled to the list because
-#     # the mac job dpends on the PR having a 'Mac' label
-#     types:
-#       - labeled
-#       - unlabeled
-#       - opened
-#       - reopened
-#       - synchronize
+
   workflow_dispatch:
+    inputs:
+      ref:
+        required: false
+      runner:
+        required: false
+        type: string
+        default: 'ubuntu-22.04'
+      builder:
+        required: false
+        type: string
+        default: 'ghcr.io/emqx/emqx-builder/5.1-3:1.14.5-25.3.2-1-ubuntu22.04'
+      builder_vsn:
+        required: false
+        type: string
+        default: '5.1-3'
+      otp_vsn:
+        required: false
+        type: string
+        default: '25.3.2-1'
+      elixir_vsn:
+        required: false
+        type: string
+        default: '1.14.5'
 
 jobs:
   linux:
diff --git a/.github/workflows/run_conf_tests.yaml b/.github/workflows/run_conf_tests.yaml
index 8b2388c79..5ffa24946 100644
--- a/.github/workflows/run_conf_tests.yaml
+++ b/.github/workflows/run_conf_tests.yaml
@@ -14,16 +14,6 @@ on:
         required: true
         type: string
 
-# on:
-#   push:
-#     branches:
-#       - master
-#       - 'ci/**'
-#     tags:
-#       - v*
-#       - e*
-#   pull_request:
-
 jobs:
   run_conf_tests:
     runs-on: ${{ inputs.runner }}
diff --git a/.github/workflows/run_docker_tests.yaml b/.github/workflows/run_docker_tests.yaml
index 774dd4690..4188378d0 100644
--- a/.github/workflows/run_docker_tests.yaml
+++ b/.github/workflows/run_docker_tests.yaml
@@ -17,15 +17,6 @@ on:
         required: true
         type: string
 
-# on:
-#   push:
-#     branches:
-#       - master
-#       - 'ci/**'
-#     tags:
-#       - v*
-#   pull_request:
-
 jobs:
   basic-tests:
     runs-on: ${{ inputs.runner }}
diff --git a/.github/workflows/run_helm_tests.yaml b/.github/workflows/run_helm_tests.yaml
index fbd45bc5b..85e748da4 100644
--- a/.github/workflows/run_helm_tests.yaml
+++ b/.github/workflows/run_helm_tests.yaml
@@ -14,15 +14,6 @@ on:
         required: true
         type: string
 
-# on:
-#   push:
-#     branches:
-#       - master
-#       - 'ci/**'
-#     tags:
-#       - v*
-#   pull_request:
-
 jobs:
   helm_test:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/run_jmeter_tests.yaml b/.github/workflows/run_jmeter_tests.yaml
index 7ca3363de..d45b66324 100644
--- a/.github/workflows/run_jmeter_tests.yaml
+++ b/.github/workflows/run_jmeter_tests.yaml
@@ -6,13 +6,6 @@ on:
       version-emqx:
         required: true
         type: string
-# on:
-#   push:
-#     tags:
-#       - "v5.*"
-#   pull_request:
-#     branches:
-#       - "master"
 
 jobs:
   jmeter_artifact:
diff --git a/.github/workflows/run_relup_tests.yaml b/.github/workflows/run_relup_tests.yaml
index 166fca513..3958d5b00 100644
--- a/.github/workflows/run_relup_tests.yaml
+++ b/.github/workflows/run_relup_tests.yaml
@@ -13,13 +13,6 @@ on:
       builder:
         required: true
         type: string
-# on:
-#   push:
-#     branches:
-#       - '**'
-#     tags:
-#       - e*
-#   pull_request:
 
 jobs:
   relup_test_plan:
diff --git a/.github/workflows/run_test_cases.yaml b/.github/workflows/run_test_cases.yaml
index e2d2a0abf..325a9ec9c 100644
--- a/.github/workflows/run_test_cases.yaml
+++ b/.github/workflows/run_test_cases.yaml
@@ -23,16 +23,6 @@ on:
         required: true
         type: string
 
-# on:
-#   push:
-#     branches:
-#       - master
-#       - 'ci/**'
-#     tags:
-#       - v*
-#       - e*
-#   pull_request:
-
 env:
   IS_CI: "yes"
 
diff --git a/.github/workflows/spellcheck.yaml b/.github/workflows/spellcheck.yaml
index 07308e1a6..440233705 100644
--- a/.github/workflows/spellcheck.yaml
+++ b/.github/workflows/spellcheck.yaml
@@ -10,23 +10,6 @@ on:
       runner:
         required: true
         type: string
-# on:
-#   push:
-#     branches:
-#       - master
-#       - release-51
-#   pull_request:
-#     # GitHub pull_request action is by default triggered when
-#     # opened reopened or synchronize,
-#     # we add labeled and unlabeled to the list because
-#     # the mac job dpends on the PR having a 'Mac' label
-#     types:
-#       - labeled
-#       - unlabeled
-#       - opened
-#       - reopened
-#       - synchronize
-#   workflow_dispatch:
 
 jobs:
   spellcheck:
diff --git a/.github/workflows/static_checks.yaml b/.github/workflows/static_checks.yaml
index b7fc2444b..2c36fc5fd 100644
--- a/.github/workflows/static_checks.yaml
+++ b/.github/workflows/static_checks.yaml
@@ -17,16 +17,6 @@ on:
         required: true
         type: string
 
-# on:
-#   push:
-#     branches:
-#       - master
-#       - 'ci/**'
-#     tags:
-#       - v*
-#       - e*
-#   pull_request:
-
 env:
   IS_CI: "yes"
 
diff --git a/scripts/parse-git-ref.sh b/scripts/parse-git-ref.sh
new file mode 100755
index 000000000..9591f7b34
--- /dev/null
+++ b/scripts/parse-git-ref.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# $1 is fully qualified git ref name, e.g. refs/tags/v5.1.0 or refs/heads/master
+
+if [[ $1 =~ ^refs/tags/v[5-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    PROFILE=emqx
+    EDITION=Opensource
+    RELEASE=true
+    LATEST=true
+elif [[ $1 =~ ^refs/tags/e[5-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    PROFILE=emqx-enterprise
+    EDITION=Enterprise
+    RELEASE=true
+    LATEST=true
+elif [[ $1 =~ ^refs/tags/v[5-9]+\.[0-9]+\.[0-9]+-(alpha|beta|rc)\.[0-9]+$ ]]; then
+    PROFILE=emqx
+    EDITION=Opensource
+    RELEASE=true
+    LATEST=false
+elif [[ $1 =~ ^refs/tags/e[5-9]+\.[0-9]+\.[0-9]+-(alpha|beta|rc)\.[0-9]+$ ]]; then
+    PROFILE=emqx-enterprise
+    EDITION=Enterprise
+    RELEASE=true
+    LATEST=false
+elif [[ $1 =~ ^refs/tags/.+ ]]; then
+    echo "Unrecognized tag: $1"
+    exit 1
+elif [[ $1 =~ ^refs/heads/master$ ]]; then
+    PROFILE=emqx
+    EDITION=Opensource
+    RELEASE=false
+    LATEST=false
+elif [[ $1 =~ ^refs/heads/release-[5-9]+$ ]]; then
+    PROFILE=emqx-enterprise
+    EDITION=Enterprise
+    RELEASE=false
+    LATEST=false
+else
+    echo "Unrecognized git ref: $1"
+    exit 1
+fi
+
+cat <<EOF
+{"profile": "$PROFILE", "edition": "$EDITION", "release": $RELEASE, "latest": $LATEST}
+EOF
diff --git a/.ci/pr-sanity-checks.sh b/scripts/pr-sanity-checks.sh
similarity index 95%
rename from .ci/pr-sanity-checks.sh
rename to scripts/pr-sanity-checks.sh
index bdd4b3d48..c4d255941 100755
--- a/.ci/pr-sanity-checks.sh
+++ b/scripts/pr-sanity-checks.sh
@@ -12,7 +12,7 @@ if ! type "yq" > /dev/null; then
     exit 1
 fi
 
-EMQX_BUILDER_VERSION=${EMQX_BUILDER_VERSION:-5.1-1}
+EMQX_BUILDER_VERSION=${EMQX_BUILDER_VERSION:-5.1-3}
 EMQX_BUILDER_OTP=${EMQX_BUILDER_OTP:-25.3.2-1}
 EMQX_BUILDER_ELIXIR=${EMQX_BUILDER_ELIXIR:-1.14.5}
 EMQX_BUILDER_PLATFORM=${EMQX_BUILDER_PLATFORM:-ubuntu22.04}