diff --git a/.github/workflows/ci.yml b/.github/workflows/pr-check.yml
similarity index 68%
rename from .github/workflows/ci.yml
rename to .github/workflows/pr-check.yml
index e1ec413..0a55f8c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/pr-check.yml
@@ -1,14 +1,19 @@
-name: CI
+name: PR Merge Check - Codeoid
 
 on:
-  push:
-    branches: [main]
   pull_request:
-    branches: [main]
+    types:
+      - opened
+      - synchronize
+      - reopened
+    branches:
+      - "main"
+  merge_group:
+    types:
+      - checks_requested
 
-# Cancel superseded runs on the same branch/PR.
 concurrency:
-  group: ci-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
 jobs:
@@ -24,16 +29,23 @@ jobs:
           bun-version: latest
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        shell: bash
+        run: |-
+           bun install --frozen-lockfile
 
       - name: Lint
-        run: bun run lint
+        run: |-
+          bun run lint
 
       - name: Typecheck
-        run: bun run typecheck
+        shell: bash
+        run: |-
+          bun run typecheck
 
       - name: Test (coverage + junit)
-        run: bun run test:coverage
+        shell: bash
+        run: |-
+           bun run test:coverage
 
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v5
@@ -53,7 +65,9 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
 
       - name: Build
-        run: bun run build
+        shell: bash
+        run: |-
+          bun run build
 
   web:
     name: web
@@ -77,19 +91,25 @@ jobs:
       # build:web).
       - name: Install workspace dependencies
         working-directory: .
-        run: bun install --frozen-lockfile
+        run: |-
+          bun install --frozen-lockfile
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: |-
+          bun install --frozen-lockfile
 
       - name: Lint
-        run: bun run lint
+        run: |-
+          bun run lint
 
       - name: Typecheck
-        run: bun run typecheck
+        run: |-
+          bun run typecheck
 
       - name: Test
-        run: bun run test
+        run: |- 
+          bun run test
 
       - name: Build
-        run: bun run build
+        run: |-
+          bun run build
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 41a2b8e..cd2cf1b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,19 +1,35 @@
 name: Release
 
 on:
-  push:
-    tags: ["v*"]
+  release:
+    types:
+      - published
 
-permissions:
-  contents: write # create the GitHub Release
-  id-token: write # npm provenance (public repo)
+env:
+  REGEX_PATTERN: "^v[0-9]+\\.[0-9]+\\.[0-9]+$"
+  RELEASE_TAG: ${{ github.event.release.tag_name }}
 
 jobs:
   npm:
-    name: Publish to npm
+    name: Publish to npm   
+    permissions:
+      contents: write # create the GitHub Release
+      id-token: write # npm provenance (public repo)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Validate Release Tag
+        id: validate_tag
+        shell: bash
+        run: |-
+          if [[ "${{ env.RELEASE_TAG }}" =~ ${{ env.REGEX_PATTERN }} ]] ; then
+            echo "Valid version format: ${{ env.RELEASE_TAG }}"
+          else
+            echo "Invalid version format: ${{ env.RELEASE_TAG }}"
+            exit 1
+          fi
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -29,19 +45,28 @@ jobs:
       # OIDC Trusted Publishing requires the npm CLI >= 11.5.1; node 22 ships
       # an older 10.x. No token after this — auth is the GitHub OIDC id-token.
       - name: Upgrade npm for Trusted Publishing
-        run: npm install -g npm@latest
+        shell: bash
+        run: |-
+          npm install -g npm@latest
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        shell: bash
+        run: |- 
+          bun install --frozen-lockfile
 
       - name: Build web UI
-        run: cd web && bun install --frozen-lockfile && bun run build
+        shell: bash
+        run: |-
+          cd web && bun install --frozen-lockfile && bun run build
 
       - name: Test
-        run: bun run test
+        shell: bash
+        run: |-
+          bun run test
 
       - name: Verify package version matches the tag
-        run: |
+        shell: bash
+        run: |-
           PKG="$(node -p "require('./package.json').version")"
           TAG="${GITHUB_REF_NAME#v}"
           if [ "$PKG" != "$TAG" ]; then
@@ -55,7 +80,8 @@ jobs:
       # @codeoid/protocol at npmjs.com (same OIDC setup as codeoid) before the
       # first release that introduces a new protocol version.
       - name: Publish @codeoid/protocol (OIDC) — only if version is new
-        run: |
+        shell: bash
+        run: |-
           cd packages/protocol
           VER="$(node -p "require('./package.json').version")"
           if npm view "@codeoid/protocol@$VER" version >/dev/null 2>&1; then
@@ -69,7 +95,8 @@ jobs:
       # after protocol (its peer dep) and needs its own Trusted Publisher +
       # one-time manual bootstrap publish, same as protocol.
       - name: Publish @codeoid/core (OIDC) — only if version is new
-        run: |
+        shell: bash
+        run: |-
           cd packages/core
           VER="$(node -p "require('./package.json').version")"
           if npm view "@codeoid/core@$VER" version >/dev/null 2>&1; then
@@ -82,7 +109,9 @@ jobs:
       # Trusted Publisher (configured on the package at npmjs.com). Provenance
       # is generated automatically from the same OIDC identity.
       - name: Publish codeoid to npm (OIDC Trusted Publishing)
-        run: npm publish --provenance --access public
+        shell: bash
+        run: |-
+           npm publish --provenance --access public
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2