diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml
index d648b38b2..5b5818539 100644
--- a/.github/workflows/analysis.yml
+++ b/.github/workflows/analysis.yml
@@ -6,6 +6,7 @@ on:
     tags-ignore:
       - '**'
   pull_request:
+    types: [opened, synchronize, reopened]
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}-${{ github.ref }}
   cancel-in-progress: true
@@ -19,7 +20,7 @@ jobs:
     runs-on: ${{ matrix.os }}-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -35,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Source
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Setup Go with cache
         uses: jfrog/.github/actions/install-go-with-cache@main
@@ -55,7 +56,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Source
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Setup Go with cache
         uses: jfrog/.github/actions/install-go-with-cache@main
@@ -69,7 +70,7 @@ jobs:
     name: Spell Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Check spelling
         uses: crate-ci/typos@master
diff --git a/.github/workflows/build-gate.yml b/.github/workflows/build-gate.yml
new file mode 100644
index 000000000..1c64df99b
--- /dev/null
+++ b/.github/workflows/build-gate.yml
@@ -0,0 +1,52 @@
+name: Build Gate
+# Single approval gate for fork/PR runs: a maintainer approves the `build-gate`
+# environment deployment once, releasing frogbot and the test suite.
+# Replaces the per-workflow 'safe to test' label mechanism.
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches: [dev]
+  push:
+    branches: [dev, main]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions:
+  actions: read
+  pull-requests: write
+  contents: read
+
+jobs:
+  # The single approval point. `build-gate` carries the Required-reviewers rule.
+  # Trusted push & manual dispatch skip approval (empty environment name = no gate).
+  gate:
+    runs-on: ubuntu-latest
+    environment: ${{ github.event_name == 'pull_request_target' && 'build-gate' || '' }}
+    steps:
+      - run: echo "Approved — releasing frogbot and test suite."
+
+  tests:
+    needs: gate
+    uses: ./.github/workflows/test.yml
+    secrets: inherit
+
+  # Single, stable required status check. Point branch protection at
+  # "Build Gate / build-gate-success" instead of the matrix-expanded suite checks.
+  build-gate-success:
+    name: build-gate-success
+    if: always()
+    needs:
+      - gate
+      - tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify no suite failed or was cancelled
+        run: |
+          if ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}; then
+            echo "::error::One or more suites failed or were cancelled."
+            exit 1
+          fi
+          echo "All suites succeeded (skipped suites are allowed)."
diff --git a/.github/workflows/embedded-jar-test.yml b/.github/workflows/embedded-jar-test.yml
index 2a9ee7fac..b84607099 100644
--- a/.github/workflows/embedded-jar-test.yml
+++ b/.github/workflows/embedded-jar-test.yml
@@ -13,7 +13,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Download JARs
         run: buildscripts/download-jars.sh
diff --git a/.github/workflows/frogbot-scan-pull-request.yml b/.github/workflows/frogbot-scan-pull-request.yml
deleted file mode 100644
index 4afd0486d..000000000
--- a/.github/workflows/frogbot-scan-pull-request.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-name: "Frogbot Scan Pull Request"
-on:
-  pull_request_target:
-    types: [ opened, synchronize ]
-permissions:
-  pull-requests: write
-  contents: read
-jobs:
-  scan-pull-request:
-    runs-on: ubuntu-latest
-    # A pull request needs to be approved before Frogbot scans it. Any GitHub user who is associated with the
-    # "frogbot" GitHub environment can approve the pull request to be scanned.
-    environment: frogbot
-    steps:
-      - uses: jfrog/frogbot@v2
-        env:
-          JFROG_CLI_LOG_LEVEL: "DEBUG"
-          # [Mandatory]
-          # JFrog platform URL (This functionality requires version 3.29.0 or above of Xray)
-          JF_URL: ${{ secrets.FROGBOT_URL }}
-
-          # [Mandatory if JF_USER and JF_PASSWORD are not provided]
-          # JFrog access token with 'read' permissions on Xray service
-          JF_ACCESS_TOKEN: ${{ secrets.FROGBOT_ACCESS_TOKEN }}
-
-          # [Mandatory]
-          # The GitHub token is automatically generated for the job
-          JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-          # [Optional]
-          # Configure the SMTP server to enable Frogbot to send emails with detected secrets in pull request scans.
-          # SMTP server URL including should the relevant port: (Example: smtp.server.com:8080)
-          JF_SMTP_SERVER: ${{ secrets.JF_SMTP_SERVER }}
-
-          # [Mandatory if JF_SMTP_SERVER is set]
-          # The username required for authenticating with the SMTP server.
-          JF_SMTP_USER: ${{ secrets.JF_SMTP_USER }}
-
-          # [Mandatory if JF_SMTP_SERVER is set]
-          # The password associated with the username required for authentication with the SMTP server.
-          JF_SMTP_PASSWORD: ${{ secrets.JF_SMTP_PASSWORD }}
-
-          # [Optional]
-          # List of comma separated email addresses to receive email notifications about secrets
-          # detected during pull request scanning. The notification is also sent to the email set
-          # in the committer git profile regardless of whether this variable is set or not.
-          JF_EMAIL_RECEIVERS: "eco-system@jfrog.com"
\ No newline at end of file
diff --git a/.github/workflows/frogbot-scan-repository.yml b/.github/workflows/frogbot-scan-repository.yml
deleted file mode 100644
index cb41bb516..000000000
--- a/.github/workflows/frogbot-scan-repository.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-name: "Frogbot Scan Repository"
-on:
-  workflow_dispatch:
-  schedule:
-    # The repository will be scanned once a day at 00:00 GMT.
-    - cron: "0 0 * * *"
-permissions:
-  contents: write
-  pull-requests: write
-  security-events: write
-jobs:
-  scan-repository:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        # The repository scanning will be triggered periodically on the following branches.
-        branch: [ "dev" ]
-    steps:
-      - uses: jfrog/frogbot@v2
-        env:
-          JFROG_CLI_LOG_LEVEL: "DEBUG"
-          # [Mandatory]
-          # JFrog platform URL (This functionality requires version 3.29.0 or above of Xray)
-          JF_URL: ${{ secrets.FROGBOT_URL }}
-
-          # [Mandatory if JF_USER and JF_PASSWORD are not provided]
-          # JFrog access token with 'read' permissions on Xray service
-          JF_ACCESS_TOKEN: ${{ secrets.FROGBOT_ACCESS_TOKEN }}
-
-          # [Mandatory]
-          # The GitHub token is automatically generated for the job
-          JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-          # [Mandatory]
-          # The name of the branch on which Frogbot will perform the scan
-          JF_GIT_BASE_BRANCH: ${{ matrix.branch }}
\ No newline at end of file
diff --git a/.github/workflows/frogbot-scan.yml b/.github/workflows/frogbot-scan.yml
new file mode 100644
index 000000000..a8ac7ad9e
--- /dev/null
+++ b/.github/workflows/frogbot-scan.yml
@@ -0,0 +1,54 @@
+name: "Frogbot Scan"
+on:
+  pull_request_target:
+    types: [ opened, synchronize ]
+    branches: [ dev, main ]
+  push:
+    branches: [ dev, main ]
+  workflow_dispatch:
+  schedule:
+    # The repository will be scanned once a day at 00:00 GMT.
+    - cron: "0 0 * * *"
+
+permissions:
+  contents: write
+  pull-requests: write
+  security-events: write
+
+jobs:
+  frogbot-scan:
+    runs-on: ubuntu-latest
+    # A pull request needs to be approved before Frogbot scans it. Any GitHub user who is associated with the
+    # "frogbot" GitHub environment can approve the pull request to be scanned.
+    environment: ${{ github.event_name == 'pull_request_target' && 'frogbot' || '' }}
+    strategy:
+      matrix:
+        # Repository scans cover these branches; job `if` collapses push/PR to a single arm.
+        branch: [ dev, main ]
+    # schedule / dispatch → both arms; push → matching branch only; PR → base branch only (one PR scan).
+    if: |
+      github.event_name == 'schedule' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' && matrix.branch == github.ref_name) ||
+      (github.event_name == 'pull_request_target' && matrix.branch == github.event.pull_request.base.ref)
+    steps:
+      # No checkout: Frogbot checks out the right refs itself. Avoids checking out untrusted PR
+      # heads under pull_request_target (secrets available).
+      - uses: jfrog/frogbot@v3
+        env:
+          JFROG_CLI_LOG_LEVEL: "DEBUG"
+          # [Mandatory]
+          # JFrog platform URL (This functionality requires version 3.29.0 or above of Xray)
+          JF_URL: ${{ secrets.FROGBOT_URL }}
+
+          # [Mandatory if JF_USER and JF_PASSWORD are not provided]
+          # JFrog access token with 'read' permissions on Xray service
+          JF_ACCESS_TOKEN: ${{ secrets.FROGBOT_ACCESS_TOKEN }}
+
+          # [Mandatory]
+          # The GitHub token is automatically generated for the job
+          JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+          # [Mandatory for repository scan]
+          # The name of the branch on which Frogbot will perform the scan
+          JF_GIT_BASE_BRANCH: ${{ github.event_name != 'pull_request_target' && matrix.branch || '' }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ab83df579..a33bb24a8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,7 +31,7 @@ jobs:
           echo "CI=true" >> $GITHUB_ENV
 
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0  # fetch all branches so we can checkout main and merge dev
           token: ${{ secrets.RELEASE_GIT_TOKEN }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8822748c9..0db55dd25 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,19 +6,8 @@ permissions:
   pull-requests: write
 
 on:
-  push:
-    branches:
-      - '**'
-    tags-ignore:
-      - '**'
-  # Triggers the workflow on labeled PRs only.
-  pull_request_target:
-    types: [ labeled ]
-
-# Ensures that only the latest commit is running for each PR at a time.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}-${{ github.ref }}
-  cancel-in-progress: true
+  workflow_call:
+  workflow_dispatch:
 
 # Environment variables shared across all jobs.
 env:
@@ -33,19 +22,14 @@ env:
   
 jobs:
   Pretest:
-    if: contains(github.event.pull_request.labels.*.name, 'safe to test') || github.event_name == 'push'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - name: Remove 'safe to test' label
-        uses: actions-ecosystem/action-remove-labels@v1
-        if: ${{ github.event_name != 'push' }}
-        with:
-          labels: "safe to test"
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          allow-unsafe-pr-checkout: true
           
       - name: Start FastCI Optimization
         if: env.ENABLE_FASTCI_BOOST == 'true'
@@ -72,9 +56,11 @@ jobs:
     steps:
       # Prepare the environment
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Start FastCI Optimization
         if: env.ENABLE_FASTCI_BOOST == 'true'
@@ -124,9 +110,11 @@ jobs:
     steps:
       # Prepare the environment
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Start FastCI Optimization
         if: env.ENABLE_FASTCI_BOOST == 'true'
@@ -154,9 +142,11 @@ jobs:
     steps:
       # Prepare the environment
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Start FastCI Optimization
         if: env.ENABLE_FASTCI_BOOST == 'true'
@@ -182,14 +172,18 @@ jobs:
     steps:
       # Prepare the environment
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          allow-unsafe-pr-checkout: true
+
       - name: Start FastCI Optimization
         if: env.ENABLE_FASTCI_BOOST == 'true'
         uses: jfrog/boost@v0
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
+
       - name: Install and Setup Dependencies
         uses: ./.github/actions/install-and-setup
 
@@ -208,14 +202,18 @@ jobs:
     steps:
       # Prepare the environment
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          allow-unsafe-pr-checkout: true
+
       - name: Start FastCI Optimization
         if: env.ENABLE_FASTCI_BOOST == 'true'
         uses: jfrog/boost@v0
         with:
           github_token: ${{secrets.GITHUB_TOKEN}}
+
       - name: Install and Setup Dependencies
         uses: ./.github/actions/install-and-setup
 
@@ -234,9 +232,11 @@ jobs:
     steps:
       # Prepare the environment
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Start FastCI Optimization
         if: env.ENABLE_FASTCI_BOOST == 'true'
@@ -262,9 +262,11 @@ jobs:
     steps:
       # Prepare the environment
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Start FastCI Optimization
         if: env.ENABLE_FASTCI_BOOST == 'true'
@@ -290,9 +292,11 @@ jobs:
     steps:
       # Prepare the environment
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Start FastCI Optimization
         if: env.ENABLE_FASTCI_BOOST == 'true'
@@ -318,9 +322,11 @@ jobs:
     steps:
       # Prepare the environment
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Start FastCI Optimization
         if: env.ENABLE_FASTCI_BOOST == 'true'
@@ -346,9 +352,11 @@ jobs:
     steps:
       # Prepare the environment
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Start FastCI Optimization
         if: env.ENABLE_FASTCI_BOOST == 'true'