diff --git a/.github/workflows/clang-tidy-check.yaml b/.github/workflows/clang-tidy-check.yaml
index 93f6aeba..4fbafa07 100644
--- a/.github/workflows/clang-tidy-check.yaml
+++ b/.github/workflows/clang-tidy-check.yaml
@@ -81,7 +81,7 @@ jobs:
       shell: bash
       run: |
         . /entrypoint.sh
-        cd $GITHUB_WORKSPACE/phlex-build
+        cd "$GITHUB_WORKSPACE/phlex-build"
 
         echo "➡️ Running clang-tidy checks..."
         cmake --build . --target clang-tidy-check -- --export-fixes clang-tidy-fixes.yaml > clang-tidy.log 2>&1 || true
diff --git a/.github/workflows/clang-tidy-fix.yaml b/.github/workflows/clang-tidy-fix.yaml
index 990ae8fe..40947bc1 100644
--- a/.github/workflows/clang-tidy-fix.yaml
+++ b/.github/workflows/clang-tidy-fix.yaml
@@ -27,11 +27,13 @@ jobs:
     steps:
       - id: parse_comment
         name: Parse comment for tidy checks
+        env:
+          COMMENT_BODY: ${{ github.event.comment.body }}
         run: |
-          checks_line=$(echo "${{ github.event.comment.body }}" | sed -nE 's/^@phlexbot[[:space:]]+tidy-fix[[:space:]]+(.*)/\1/p' | tr -d '\r')
+          checks_line=$(echo "$COMMENT_BODY" | sed -nE 's/^@phlexbot[[:space:]]+tidy-fix[[:space:]]+(.*)/\1/p' | tr -d '\r')
           if [ -n "$checks_line" ]; then
-            tidy_checks=$(echo "$checks_line" | tr ',' ' ' | xargs -n1 | paste -sd, -)
-            echo "tidy_checks=$tidy_checks" >> $GITHUB_OUTPUT
+            tidy_checks="$(echo "$checks_line" | tr ',' ' ' | xargs -n1 | paste -sd, -)"
+            echo "tidy_checks=$tidy_checks" >> "$GITHUB_OUTPUT"
           fi
       - name: Get PR Info
         id: get_pr
@@ -69,7 +71,7 @@ jobs:
           PHLEX_TIDY_CHECKS: ${{ needs.parse-command.outputs.tidy_checks }}
         run: |
           . /entrypoint.sh
-          cd $GITHUB_WORKSPACE/phlex-build
+          cd "$GITHUB_WORKSPACE/phlex-build"
 
           echo "Applying clang-tidy fixes using CMake target..."
           cmake --build . --target clang-tidy-fix -- --export-fixes clang-tidy-fixes.yaml || true
diff --git a/.github/workflows/cmake-build.yaml b/.github/workflows/cmake-build.yaml
index aefa827e..28efc3d6 100644
--- a/.github/workflows/cmake-build.yaml
+++ b/.github/workflows/cmake-build.yaml
@@ -78,15 +78,13 @@ jobs:
     needs: pre-check
     if: >
       needs.pre-check.result == 'success' &&
-      github.event_name != 'workflow_dispatch' &&
+      (github.event_name == 'pull_request' || github.event_name == 'push') &&
       needs.pre-check.outputs.is_act != 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: read
     outputs:
       has_changes: ${{ steps.filter.outputs.matched }}
-      matrix: ${{ steps.generate.outputs.matrix }}
 
     steps:
       - name: Check out source code
@@ -100,8 +98,8 @@ jobs:
         uses: Framework-R-D/phlex/.github/actions/detect-relevant-changes@main
         with:
           repo-path: phlex-src
-          base-ref: ${{ github.event_name == 'issue_comment' && fromJSON(needs.pre-check.outputs.pr_details).base_sha || github.event.pull_request.base.sha || github.event.before }}
-          head-ref: ${{ github.event_name == 'issue_comment' && fromJSON(needs.pre-check.outputs.pr_details).sha || github.event.pull_request.head.sha || github.sha }}
+          base-ref: ${{ github.event.pull_request.base.sha || github.event.before }}
+          head-ref: ${{ github.event.pull_request.head.sha || github.sha }}
           file-type: |
             cpp
             cmake
@@ -116,6 +114,13 @@ jobs:
             echo "::endgroup::"
           fi
 
+  generate-matrix:
+    needs: pre-check
+    if: needs.pre-check.result == 'success'
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.generate.outputs.matrix }}
+    steps:
       - id: generate
         uses: Framework-R-D/phlex/.github/actions/generate-build-matrix@main
         with:
@@ -123,18 +128,14 @@ jobs:
           comment-body: ${{ github.event.comment.body }}
 
   build:
-    needs: [pre-check, detect-changes]
+    needs: [pre-check, detect-changes, generate-matrix]
     if: >
       needs.pre-check.result == 'success' &&
       (
         github.event_name == 'workflow_dispatch' ||
+        github.event_name == 'issue_comment' ||
         needs.pre-check.outputs.is_act == 'true' ||
         (needs.detect-changes.result == 'success' && needs.detect-changes.outputs.has_changes == 'true')
-      ) &&
-      (
-        github.event_name != 'issue_comment' ||
-        github.event.comment.author_association == 'COLLABORATOR' ||
-        github.event.comment.author_association == 'OWNER'
       )
     runs-on: ubuntu-24.04
     strategy:
@@ -149,7 +150,8 @@ jobs:
       uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       with:
         path: phlex-src
-        ref: ${{ github.event_name == 'issue_comment' && fromJSON(needs.build-pre-check.outputs.pr_details).sha || github.ref }}
+        ref: ${{ needs.pre-check.outputs.sha }}
+        repository: ${{ needs.pre-check.outputs.repo }}
 
     - name: Setup build environment
       uses: Framework-R-D/phlex/.github/actions/setup-build-env@main
@@ -175,11 +177,11 @@ jobs:
       if: matrix.sanitizer != 'valgrind'
       run: |
         . /entrypoint.sh
-        cd $GITHUB_WORKSPACE/phlex-build
+        cd "$GITHUB_WORKSPACE/phlex-build"
 
         echo "➡️ Running tests..."
         echo "::group::Running ctest"
-        if ctest --progress --output-on-failure -j $(nproc); then
+        if ctest --progress --output-on-failure -j "$(nproc)"; then
           echo "::endgroup::"
           echo "✅ All tests passed."
         else
@@ -192,7 +194,7 @@ jobs:
       if: matrix.sanitizer == 'valgrind'
       run: |
         . /entrypoint.sh
-        cd $GITHUB_WORKSPACE/phlex-build
+        cd "$GITHUB_WORKSPACE/phlex-build"
 
         echo "➡️ Running Valgrind tests..."
         echo "::group::Running ctest -T memcheck"
diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index b6c30405..69908003 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -151,7 +151,7 @@ jobs:
     - name: Run tests with coverage
       run: |
         . /entrypoint.sh
-        cd $GITHUB_WORKSPACE/phlex-build
+        cd "$GITHUB_WORKSPACE/phlex-build"
 
         echo "➡️ Running tests with coverage..."
         PROFILE_ROOT="$GITHUB_WORKSPACE/phlex-build/test/profraw"
@@ -161,7 +161,7 @@ jobs:
         export LLVM_PROFILE_FILE="$PROFILE_ROOT/%m-%p.profraw"
 
         echo "::group::Running ctest for coverage"
-        if ctest --progress --output-on-failure -j $(nproc); then
+        if ctest --progress --output-on-failure -j "$(nproc)"; then
           echo "::endgroup::"
           echo "✅ All tests passed."
         else
@@ -176,7 +176,7 @@ jobs:
       shell: bash
       run: |
         . /entrypoint.sh
-        cd $GITHUB_WORKSPACE/phlex-build
+        cd "$GITHUB_WORKSPACE/phlex-build"
 
         echo "➡️ Generating coverage reports for GCC..."
         echo "::group::Running coverage-gcov target"
@@ -195,7 +195,7 @@ jobs:
       shell: bash
       run: |
         . /entrypoint.sh
-        cd $GITHUB_WORKSPACE/phlex-build
+        cd "$GITHUB_WORKSPACE/phlex-build"
 
         echo "➡️ Generating coverage reports for Clang..."
         echo "::group::Running coverage-llvm target"