diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index f040665b..ee55ee90 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -9,19 +9,19 @@ runs:
   using: composite
   steps:
     - name: Set up Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: 24
         package-manager-cache: false
         registry-url: ${{ inputs.registry-url }}
     - name: Set up pnpm
-      uses: pnpm/action-setup@v6
+      uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
     - name: Locate dependency cache
       id: store
       shell: bash
       run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
     - name: Cache dependencies
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.store.outputs.path }}
         key: pnpm-store-${{ runner.os }}-${{ runner.arch }}-node24-${{ hashFiles('pnpm-lock.yaml') }}
diff --git a/.github/workflows/api-sync.yml b/.github/workflows/api-sync.yml
index 68574dee..ed380d42 100644
--- a/.github/workflows/api-sync.yml
+++ b/.github/workflows/api-sync.yml
@@ -15,7 +15,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup workspace
         uses: ./.github/actions/setup
       - name: Run API sync check
@@ -48,7 +48,7 @@ jobs:
             echo "$MISSING_LIST" > missing-endpoints.txt
           fi
       - name: Upload sync report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: syncReport
           path: |
@@ -57,7 +57,7 @@ jobs:
           retention-days: 30
       - name: Check for new endpoints and create issue
         if: steps.sync.outputs.missing_count > 0
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/biome.yml b/.github/workflows/biome.yml
deleted file mode 100644
index 41a52470..00000000
--- a/.github/workflows/biome.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: Biome
-'on':
-  workflow_call:
-    inputs:
-      since:
-        description: Base commit to compare against. Empty runs everything.
-        type: string
-        default: ''
-permissions:
-  contents: read
-jobs:
-  biome:
-    name: Lint & format (biome ci)
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-      - name: Setup workspace
-        uses: ./.github/actions/setup
-      - name: Lint & format (biome ci)
-        if: inputs.since == ''
-        run: pnpm check:ci
-      - name: Lint & format changed files (biome ci)
-        if: inputs.since != ''
-        env:
-          SINCE: ${{ inputs.since }}
-        run: pnpm exec biome ci --changed --since="$SINCE" --no-errors-on-unmatched
-    timeout-minutes: 15
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
deleted file mode 100644
index 4b3083a5..00000000
--- a/.github/workflows/build.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-name: Build
-'on':
-  workflow_call: null
-permissions:
-  contents: read
-jobs:
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-      - name: Setup workspace
-        uses: ./.github/actions/setup
-      - name: Build
-        run: pnpm build
-    timeout-minutes: 15
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f82cda4f..dc62f050 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,81 +1,95 @@
 name: CI
 'on':
-  push:
+  pull_request:
     branches:
       - main
-  pull_request:
+  push:
     branches:
       - main
+    paths-ignore:
+      - '**/*.md'
   workflow_dispatch: null
 permissions:
   contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   changes:
     name: Changes
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
     outputs:
       since: ${{ steps.filter.outputs.everything != 'true' && github.event.pull_request.base.sha || '' }}
+      code: ${{ github.event_name != 'pull_request' || steps.filter.outputs.code == 'true' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         if: github.event_name == 'pull_request'
         with:
           token: ''
           filters: |
-            everything:
+            everything: &everything
               - pnpm-lock.yaml
-              - biome.json
+              - package.json
               - 'tsconfig*.json'
               - 'mcp-apps/tsconfig.json'
               - 'vitest*.cts'
               - '.github/**'
-              - package.json
-    timeout-minutes: 5
-  biome:
-    needs: changes
-    uses: ./.github/workflows/biome.yml
-    with:
-      since: ${{ needs.changes.outputs.since }}
-  typecheck:
-    uses: ./.github/workflows/typecheck.yml
-  test:
+            code:
+              - *everything
+              - 'src/**'
+              - 'mcp-apps/**'
+              - 'tests/**'
+              - 'public/**'
+  verify:
+    name: Test and build
     needs: changes
-    uses: ./.github/workflows/test.yml
-    with:
-      since: ${{ needs.changes.outputs.since }}
-  build:
-    uses: ./.github/workflows/build.yml
+    if: needs.changes.outputs.code == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: Setup workspace
+        uses: ./.github/actions/setup
+      - name: Run integration tests
+        if: needs.changes.outputs.since == ''
+        run: pnpm test:integration
+      - name: Run unit tests with the coverage gate
+        if: needs.changes.outputs.since == ''
+        run: pnpm test:coverage
+      - name: Run integration tests for changed files
+        if: needs.changes.outputs.since != ''
+        env:
+          SINCE: ${{ needs.changes.outputs.since }}
+        run: pnpm exec vitest run --config vitest.integration.config.cts --changed "$SINCE"
+      - name: Run unit tests for changed files
+        if: needs.changes.outputs.since != ''
+        env:
+          SINCE: ${{ needs.changes.outputs.since }}
+        run: pnpm exec vitest run --changed "$SINCE"
+      - name: Build
+        run: pnpm build
   gate:
     name: CI Gate
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
     needs:
       - changes
-      - biome
-      - typecheck
-      - test
-      - build
+      - verify
     if: always()
-    runs-on: ubuntu-slim
     steps:
-      - name: Require every gate to pass
-        run: |
-          echo "biome=${{ needs.biome.result }} typecheck=${{ needs.typecheck.result }} test=${{ needs.test.result }} build=${{ needs.build.result }}"
-          test "${{ needs.biome.result }}" = "success" \
-            && test "${{ needs.typecheck.result }}" = "success" \
-            && test "${{ needs.test.result }}" = "success" \
-            && test "${{ needs.build.result }}" = "success"
-    timeout-minutes: 5
+      - name: Require every check to pass
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1
   report-failure:
     name: Open issue on main failure
     needs:
       - changes
-      - biome
-      - typecheck
-      - test
-      - build
+      - verify
     if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
       contents: read
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 382e8c39..930d0261 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -19,7 +19,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Setup workspace
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 01bb9c19..f6843419 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
       RELEASE_TITLE: ${{ github.event.pull_request.title || 'Manual release' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           fetch-depth: 0
@@ -133,7 +133,7 @@ jobs:
           git push origin "refs/tags/${TAG}"
       - name: Create GitHub Release
         if: steps.skip_check.outputs.skip != 'true'
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
         with:
           tag_name: ${{ steps.version.outputs.tag }}
           name: ${{ steps.version.outputs.tag }} - ${{ env.RELEASE_TITLE }}
diff --git a/.github/workflows/report-failure.yml b/.github/workflows/report-failure.yml
index 01545a15..2e31fdf7 100644
--- a/.github/workflows/report-failure.yml
+++ b/.github/workflows/report-failure.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: File or update a ci-failure issue with the captured error
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const { owner, repo } = context.repo;
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
deleted file mode 100644
index 6a3cc59f..00000000
--- a/.github/workflows/test.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-name: Test
-'on':
-  workflow_call:
-    inputs:
-      since:
-        description: Base commit to compare against. Empty runs everything.
-        type: string
-        default: ''
-permissions:
-  contents: read
-jobs:
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-      - name: Setup workspace
-        uses: ./.github/actions/setup
-      - name: Run integration tests
-        if: inputs.since == ''
-        run: pnpm test:integration
-      - name: Run unit tests with the coverage gate
-        if: inputs.since == ''
-        run: pnpm test:coverage
-      - name: Run integration tests for changed files
-        if: inputs.since != ''
-        env:
-          SINCE: ${{ inputs.since }}
-        run: pnpm exec vitest run --config vitest.integration.config.cts --changed "$SINCE"
-      - name: Run unit tests for changed files
-        if: inputs.since != ''
-        env:
-          SINCE: ${{ inputs.since }}
-        run: pnpm exec vitest run --changed "$SINCE"
-    timeout-minutes: 20
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
deleted file mode 100644
index 6836ed79..00000000
--- a/.github/workflows/typecheck.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-name: Typecheck
-'on':
-  workflow_call: null
-permissions:
-  contents: read
-jobs:
-  typecheck:
-    name: Type check
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-      - name: Setup workspace
-        uses: ./.github/actions/setup
-      - name: Type check (src)
-        run: pnpm typecheck
-      - name: Type check (mcp-apps)
-        run: pnpm typecheck:mcp-apps
-    timeout-minutes: 15
diff --git a/.husky/pre-push b/.husky/pre-push
index 822e3ce6..466c0e02 100755
--- a/.husky/pre-push
+++ b/.husky/pre-push
@@ -1,4 +1,6 @@
 CI=1 pnpm install --frozen-lockfile
+pnpm run check:ci
 pnpm run typecheck
+pnpm run typecheck:mcp-apps
 pnpm run test
 pnpm run build