diff --git a/.github/workflow-gen/Program.cs b/.github/workflow-gen/Program.cs
index 1db0ee560..8fedae4fa 100644
--- a/.github/workflow-gen/Program.cs
+++ b/.github/workflow-gen/Program.cs
@@ -7,18 +7,29 @@
 
 var products = new Product[]
 {
-    new("aspnetcore-authentication-jwtbearer", "aspnetcore-authentication-jwtbearer.slnf", "aaj"),
-    new("identity-server", "identity-server.slnf", "is"),
-    new("bff", "bff.slnf", "bff", true)
+    new("aspnetcore-authentication-jwtbearer",
+        "aspnetcore-authentication-jwtbearer.slnf",
+        "aaj",
+        [],
+        []),
+    new("identity-server",
+        "identity-server.slnf",
+        "is",
+        [],
+        []),
+    new("bff",
+        "bff.slnf",
+        "bff",
+        ["Bff.Tests", "Bff.Blazor.Client.UnitTests", "Bff.Blazor.UnitTests", "Bff.EntityFramework.Tests"],
+        ["Hosts.Tests"])
 };
 foreach (var product in products)
 {
     GenerateCiWorkflow(product);
     GenerateReleaseWorkflow(product);
-    GenerateCodeQlWorkflow(product, "38 15 * * 0");
 }
 
-GenerateTemplatesReleaseWorkflow(new Product("templates", "../artifacts/templates.csproj", "templates"));
+GenerateTemplatesReleaseWorkflow(new Product("templates", "../artifacts/templates.csproj", "templates", [], []));
 
 
 void GenerateCiWorkflow(Product product)
@@ -42,57 +53,158 @@ void GenerateCiWorkflow(Product product)
 
     workflow.EnvDefaults();
 
-    var job = workflow
-        .Job("build")
+    const string VerifyFormattingJobId = "verify-formatting";
+    const string CodeQlJobId = "codeql";
+    const string PlaywrightJobId = "playwright";
+    const string BuildJobId = "build";
+
+    // Verify formatting
+    var verifyFormattingJob = workflow
+        .Job(VerifyFormattingJobId)
         .RunEitherOnBranchOrAsPR()
-        .Name("Build")
+        .Name("Verify formatting")
         .RunsOn(GitHubHostedRunners.UbuntuLatest)
         .Defaults().Run("bash", product.Name)
         .Job;
 
-    job.Permissions(
+    verifyFormattingJob.Permissions(contents: Permission.Read);
+
+    verifyFormattingJob.TimeoutMinutes(15);
+
+    verifyFormattingJob.Step()
+        .ActionsCheckout();
+
+    verifyFormattingJob.StepSetupDotNet();
+
+    verifyFormattingJob.StepRestore(product.Solution);
+
+    verifyFormattingJob.StepVerifyFormatting(product.Solution);
+
+    // Build
+    var build = workflow
+        .Job(BuildJobId)
+        .RunEitherOnBranchOrAsPR()
+        .Name("Build and test (unit)")
+        .RunsOn(GitHubHostedRunners.UbuntuLatest)
+        .Defaults().Run("bash", product.Name)
+        .Job;
+
+    build.Permissions(
         actions: Permission.Read,
         contents: Permission.Read,
         checks: Permission.Write,
         packages: Permission.Write);
 
-    job.TimeoutMinutes(15);
+    build.TimeoutMinutes(15);
 
-    job.Step()
+    build.Step()
         .ActionsCheckout();
 
-    job.StepSetupDotNet();
-
-    job.StepRestore(product.Solution);
+    build.StepSetupDotNet();
 
-    job.StepVerifyFormatting(product.Solution);
+    build.StepRestore(product.Solution);
 
-    job.StepBuild(product.Solution);
+    build.StepBuild(product.Solution);
 
-    // Devcerts are needed because some tests run start a http server with https. 
-    job.StepDotNetDevCerts();
+    build.StepDotNetDevCerts();
 
-    if (product.EnablePlaywright)
+    foreach (var project in product.UnitTestProjects)
     {
-        job.StepInstallPlayWright();
+        build.StepTest($"test/{project}");
     }
 
-    job.StepTest(product.Solution);
+    // Playwright
+    var playwrightJob = workflow
+        .Job(PlaywrightJobId)
+        .RunEitherOnBranchOrAsPR()
+        .Name("Playwright tests")
+        .RunsOn(GitHubHostedRunners.UbuntuLatest)
+        .Defaults().Run("bash", product.Name)
+        .Job;
+
+    playwrightJob.Permissions(
+        actions: Permission.Read,
+        contents: Permission.Read,
+        checks: Permission.Write);
+
+    playwrightJob.TimeoutMinutes(15);
+
+    playwrightJob.Step()
+        .ActionsCheckout();
 
-    if (product.EnablePlaywright)
+    if (product.PlaywrightTestProjects.Length > 0)
     {
-        job.StepUploadPlaywrightTestTraces(product.Name);
+        playwrightJob.StepSetupDotNet();
+
+        playwrightJob.StepRestore(product.Solution);
+
+        playwrightJob.StepBuild(product.Solution);
+
+        playwrightJob.StepInstallPlayWright();
+
+        playwrightJob.StepDotNetDevCerts();
+
+        foreach (var project in product.PlaywrightTestProjects)
+        {
+            playwrightJob.StepTest($"test/{project}");
+        }
+
+        playwrightJob.StepUploadPlaywrightTestTraces(product.Name);
     }
 
-    job.StepToolRestore();
+    // CodeQL
+    var codeQlJob = workflow
+        .Job(CodeQlJobId)
+        .RunEitherOnBranchOrAsPR()
+        .Name("CodeQL analyze")
+        .RunsOn(GitHubHostedRunners.UbuntuLatest)
+        .Defaults().Run("bash", product.Name)
+        .Job;
 
-    job.StepPack(product.Solution);
+    codeQlJob.Step()
+        .ActionsCheckout();
+
+    codeQlJob.StepInitializeCodeQl();
 
-    job.StepSign();
+    codeQlJob.StepSetupDotNet();
 
-    job.StepPushToGithub(contexts);
+    codeQlJob.StepRestore(product.Solution);
 
-    job.StepUploadArtifacts(product.Name);
+    codeQlJob.StepBuild(product.Solution);
+
+    codeQlJob.StepPerformCodeQlAnalysis();
+
+    // Pack
+    var packJob = workflow
+        .Job("pack")
+        .RunEitherOnBranchOrAsPR()
+        .Name("Pack, sign and push")
+        .RunsOn(GitHubHostedRunners.UbuntuLatest)
+        .Needs(VerifyFormattingJobId, BuildJobId, PlaywrightJobId, CodeQlJobId)
+        .Defaults().Run("bash", product.Name)
+        .Job;
+
+    packJob.Permissions(
+        actions: Permission.Read,
+        contents: Permission.Read,
+        packages: Permission.Write);
+
+    packJob.TimeoutMinutes(15);
+
+    packJob.Step()
+        .ActionsCheckout();
+
+    packJob.StepSetupDotNet();
+
+    packJob.StepToolRestore();
+
+    packJob.StepPack(product.Solution);
+
+    packJob.StepSign();
+
+    packJob.StepPushToGithub(contexts);
+
+    packJob.StepUploadArtifacts(product.Name);
 
     var fileName = $"{product.Name}-ci";
     WriteWorkflow(workflow, fileName);
@@ -158,53 +270,6 @@ void GenerateReleaseWorkflow(Product product)
     WriteWorkflow(workflow, fileName);
 }
 
-void GenerateCodeQlWorkflow(Product system, string cronSchedule)
-{
-    var workflow = new Workflow($"{system.Name}/codeql");
-    var branches = new[] { "main" };
-    var paths = new[] { $"{system.Name}/**" };
-
-    workflow.On
-        .WorkflowDispatch();
-    workflow.On
-        .Push()
-        .Branches(branches)
-        .Paths(paths);
-    workflow.On
-        .PullRequest()
-        .Paths(paths);
-    workflow.On
-        .Schedule(cronSchedule);
-
-    var job = workflow
-        .Job("analyze")
-        .Name("Analyze")
-        .RunsOn(GitHubHostedRunners.UbuntuLatest)
-        .Defaults().Run("bash", system.Name)
-        .Job;
-
-    job.Permissions(
-        actions: Permission.Read,
-        contents: Permission.Read,
-        securityEvents: Permission.Write);
-
-    job.Step()
-        .ActionsCheckout();
-
-    job.StepInitializeCodeQl();
-
-    job.StepSetupDotNet();
-
-    job.StepRestore(system.Solution);
-
-    job.StepBuild(system.Solution);
-
-    job.StepPerformCodeQlAnalysis();
-
-    var fileName = $"{system.Name}-codeql-analysis";
-    WriteWorkflow(workflow, fileName);
-}
-
 void GenerateTemplatesReleaseWorkflow(Product product)
 {
     var workflow = new Workflow($"{product.Name}/release");
@@ -276,4 +341,4 @@ void WriteWorkflow(Workflow workflow, string fileName)
     Console.WriteLine($"Wrote workflow to {filePath}");
 }
 
-record Product(string Name, string Solution, string TagPrefix, bool EnablePlaywright = false);
+record Product(string Name, string Solution, string TagPrefix, string[] UnitTestProjects, string[] PlaywrightTestProjects);
diff --git a/.github/workflow-gen/StepExtensions.cs b/.github/workflow-gen/StepExtensions.cs
index b3d008ce0..60542bf00 100644
--- a/.github/workflow-gen/StepExtensions.cs
+++ b/.github/workflow-gen/StepExtensions.cs
@@ -11,9 +11,16 @@ public static void EnvDefaults(this Workflow workflow)
             ("DOTNET_CLI_TELEMETRY_OPTOUT", "true"));
 
     public static void StepSetupDotNet(this Job job)
-        => job.Step()
+    {
+        job.Step()
+            .Name("List .net sdks")
+            .Run("dotnet --list-sdks");
+
+        job.Step()
             .Name("Setup .NET")
-            .ActionsSetupDotNet("3e891b0cb619bf60e2c25674b222b8940e2c1c25", ["6.0.x", "8.0.x", "9.0.103"]); // v4.1.0
+            .ActionsSetupDotNet("3e891b0cb619bf60e2c25674b222b8940e2c1c25", ["8.0.x", "9.0.103"]);
+        // v4.1.0
+    }
 
     /// <summary>
     /// Only run this for a main build
@@ -63,28 +70,33 @@ public static Step StepBuild(this Job job, string solution)
             .Name("Build")
             .Run($"dotnet build {solution} --no-restore -c Release");
 
-    public static void StepTest(this Job job, string solution)
+    public static void StepTest(this Job job, string project)
     {
-        var logFileName = "Tests.trx";
+        var logFileName = $"{project}-tests.trx";
         var loggingFlags = $"--logger \"console;verbosity=normal\" " +
                            $"--logger \"trx;LogFileName={logFileName}\" " +
                            $"--collect:\"XPlat Code Coverage\"";
 
         job.Step()
-            .Name("Test")
-            .Run($"dotnet test {solution} -c Release --no-build {loggingFlags}");
+            .Name($"Test - {project}")
+            .Run($"dotnet test {project} -c Release --no-build {loggingFlags}");
 
-        job.Step()
-            .Name("Test report")
+        var id = $"test-report-{project.Replace("/", "-").Replace(".", "-")}";
+        job.Step(id)
+            .Name($"Test report - {project}")
             .WorkingDirectory("test")
             .Uses("dorny/test-reporter@31a54ee7ebcacc03a09ea97a7e5465a47b84aea5") // v1.9.1
-            .If("github.event == 'push' && (success() || failure())")
+            .If("github.event_name == 'push' && (success() || failure())")
             .With(
-                ("name", "Test Report"),
-                ("path", "**/Tests.trx"),
+                ("name", $"Test Report - {project}"),
+                ("path", $"**/{logFileName}"),
                 ("reporter", "dotnet-trx"),
                 ("fail-on-error", "true"),
                 ("fail-on-empty", "true"));
+
+        job.Step()
+            .Name("Publish test report link")
+            .Run($"echo \"[Test Results - {project}](${{{{ steps.{id}.outputs.url_html }}}})\" >> $GITHUB_STEP_SUMMARY");
     }
 
     public static Step StepPushToNuget(this Job job, bool pushAlways = false)
@@ -232,7 +244,8 @@ public static void StepInitializeCodeQl(this Job job) =>
             .Uses("github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0") // 3.28.9
             .With(
                 ("languages", "csharp"),
-                ("build-mode", "manual"));
+                ("build-mode", "manual"),
+                ("db-location", "~/.codeql/databases"));
 
     public static void StepPerformCodeQlAnalysis(this Job job) =>
         job.Step()
diff --git a/.github/workflows/aspnetcore-authentication-jwtbearer-ci.yml b/.github/workflows/aspnetcore-authentication-jwtbearer-ci.yml
index c833990ce..e716fb6cc 100644
--- a/.github/workflows/aspnetcore-authentication-jwtbearer-ci.yml
+++ b/.github/workflows/aspnetcore-authentication-jwtbearer-ci.yml
@@ -17,8 +17,36 @@ env:
   DOTNET_NOLOGO: true
   DOTNET_CLI_TELEMETRY_OPTOUT: true
 jobs:
+  verify-formatting:
+    name: Verify formatting
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: aspnetcore-authentication-jwtbearer
+    timeout-minutes: 15
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: List .net sdks
+      run: dotnet --list-sdks
+    - name: Setup Dotnet
+      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
+      with:
+        dotnet-version: |-
+          8.0.x
+          9.0.103
+    - name: Restore
+      run: dotnet restore aspnetcore-authentication-jwtbearer.slnf
+    - name: Verify Formatting
+      run: dotnet format aspnetcore-authentication-jwtbearer.slnf --verify-no-changes --no-restore
   build:
-    name: Build
+    name: Build and test (unit)
     if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-latest
     permissions:
@@ -36,32 +64,104 @@ jobs:
       uses: actions/checkout@v4
       with:
         fetch-depth: 0
+    - name: List .net sdks
+      run: dotnet --list-sdks
     - name: Setup Dotnet
       uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
       with:
         dotnet-version: |-
-          6.0.x
           8.0.x
           9.0.103
     - name: Restore
       run: dotnet restore aspnetcore-authentication-jwtbearer.slnf
-    - name: Verify Formatting
-      run: dotnet format aspnetcore-authentication-jwtbearer.slnf --verify-no-changes --no-restore
     - name: Build
       run: dotnet build aspnetcore-authentication-jwtbearer.slnf --no-restore -c Release
     - name: Dotnet devcerts
       run: dotnet dev-certs https --trust
-    - name: Test
-      run: dotnet test aspnetcore-authentication-jwtbearer.slnf -c Release --no-build --logger "console;verbosity=normal" --logger "trx;LogFileName=Tests.trx" --collect:"XPlat Code Coverage"
-    - name: Test report
-      if: github.event == 'push' && (success() || failure())
-      uses: dorny/test-reporter@31a54ee7ebcacc03a09ea97a7e5465a47b84aea5
+  playwright:
+    name: Playwright tests
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      checks: write
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: aspnetcore-authentication-jwtbearer
+    timeout-minutes: 15
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+  codeql:
+    name: CodeQL analyze
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: aspnetcore-authentication-jwtbearer
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
+      with:
+        languages: csharp
+        build-mode: manual
+        db-location: ~/.codeql/databases
+    - name: List .net sdks
+      run: dotnet --list-sdks
+    - name: Setup Dotnet
+      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
       with:
-        name: Test Report
-        path: '**/Tests.trx'
-        reporter: dotnet-trx
-        fail-on-error: true
-        fail-on-empty: true
+        dotnet-version: |-
+          8.0.x
+          9.0.103
+    - name: Restore
+      run: dotnet restore aspnetcore-authentication-jwtbearer.slnf
+    - name: Build
+      run: dotnet build aspnetcore-authentication-jwtbearer.slnf --no-restore -c Release
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
+      with:
+        category: /language:csharp
+  pack:
+    name: Pack, sign and push
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
+    needs:
+    - verify-formatting
+    - build
+    - playwright
+    - codeql
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    defaults:
+      run:
+        shell: bash
+        working-directory: aspnetcore-authentication-jwtbearer
+    timeout-minutes: 15
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: List .net sdks
+      run: dotnet --list-sdks
+    - name: Setup Dotnet
+      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
+      with:
+        dotnet-version: |-
+          8.0.x
+          9.0.103
     - name: Tool restore
       run: dotnet tool restore
     - name: Pack aspnetcore-authentication-jwtbearer.slnf
diff --git a/.github/workflows/aspnetcore-authentication-jwtbearer-codeql-analysis.yml b/.github/workflows/aspnetcore-authentication-jwtbearer-codeql-analysis.yml
deleted file mode 100644
index c22f85b89..000000000
--- a/.github/workflows/aspnetcore-authentication-jwtbearer-codeql-analysis.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-# This was generated by tool. Edits will be overwritten.
-
-name: aspnetcore-authentication-jwtbearer/codeql
-on:
-  workflow_dispatch:
-  push:
-    branches:
-    - main
-    paths:
-    - aspnetcore-authentication-jwtbearer/**
-  pull_request:
-    paths:
-    - aspnetcore-authentication-jwtbearer/**
-  schedule:
-  - cron: '38 15 * * 0'
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    defaults:
-      run:
-        shell: bash
-        working-directory: aspnetcore-authentication-jwtbearer
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
-      with:
-        languages: csharp
-        build-mode: manual
-    - name: Setup Dotnet
-      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
-      with:
-        dotnet-version: |-
-          6.0.x
-          8.0.x
-          9.0.103
-    - name: Restore
-      run: dotnet restore aspnetcore-authentication-jwtbearer.slnf
-    - name: Build
-      run: dotnet build aspnetcore-authentication-jwtbearer.slnf --no-restore -c Release
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
-      with:
-        category: /language:csharp
diff --git a/.github/workflows/aspnetcore-authentication-jwtbearer-release.yml b/.github/workflows/aspnetcore-authentication-jwtbearer-release.yml
index 159d273e2..2555b07d0 100644
--- a/.github/workflows/aspnetcore-authentication-jwtbearer-release.yml
+++ b/.github/workflows/aspnetcore-authentication-jwtbearer-release.yml
@@ -58,11 +58,12 @@ jobs:
       run: |-
         git tag -a aaj-${{ github.event.inputs.version }} -m "Release v${{ github.event.inputs.version }}"
         git push origin aaj-${{ github.event.inputs.version }}
+    - name: List .net sdks
+      run: dotnet --list-sdks
     - name: Setup Dotnet
       uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
       with:
         dotnet-version: |-
-          6.0.x
           8.0.x
           9.0.103
     - name: Pack aspnetcore-authentication-jwtbearer.slnf
@@ -98,11 +99,12 @@ jobs:
       with:
         name: artifacts
         path: artifacts
+    - name: List .net sdks
+      run: dotnet --list-sdks
     - name: Setup Dotnet
       uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
       with:
         dotnet-version: |-
-          6.0.x
           8.0.x
           9.0.103
     - name: List files
diff --git a/.github/workflows/bff-ci.yml b/.github/workflows/bff-ci.yml
index 4ff7afb56..e0da2da86 100644
--- a/.github/workflows/bff-ci.yml
+++ b/.github/workflows/bff-ci.yml
@@ -17,8 +17,36 @@ env:
   DOTNET_NOLOGO: true
   DOTNET_CLI_TELEMETRY_OPTOUT: true
 jobs:
+  verify-formatting:
+    name: Verify formatting
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: bff
+    timeout-minutes: 15
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: List .net sdks
+      run: dotnet --list-sdks
+    - name: Setup Dotnet
+      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
+      with:
+        dotnet-version: |-
+          8.0.x
+          9.0.103
+    - name: Restore
+      run: dotnet restore bff.slnf
+    - name: Verify Formatting
+      run: dotnet format bff.slnf --verify-no-changes --no-restore
   build:
-    name: Build
+    name: Build and test (unit)
     if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-latest
     permissions:
@@ -36,34 +64,124 @@ jobs:
       uses: actions/checkout@v4
       with:
         fetch-depth: 0
+    - name: List .net sdks
+      run: dotnet --list-sdks
     - name: Setup Dotnet
       uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
       with:
         dotnet-version: |-
-          6.0.x
           8.0.x
           9.0.103
     - name: Restore
       run: dotnet restore bff.slnf
-    - name: Verify Formatting
-      run: dotnet format bff.slnf --verify-no-changes --no-restore
     - name: Build
       run: dotnet build bff.slnf --no-restore -c Release
     - name: Dotnet devcerts
       run: dotnet dev-certs https --trust
+    - name: Test - test/Bff.Tests
+      run: dotnet test test/Bff.Tests -c Release --no-build --logger "console;verbosity=normal" --logger "trx;LogFileName=test/Bff.Tests-tests.trx" --collect:"XPlat Code Coverage"
+    - id: test-report-test-Bff-Tests
+      name: Test report - test/Bff.Tests
+      if: github.event_name == 'push' && (success() || failure())
+      uses: dorny/test-reporter@31a54ee7ebcacc03a09ea97a7e5465a47b84aea5
+      with:
+        name: Test Report - test/Bff.Tests
+        path: '**/test/Bff.Tests-tests.trx'
+        reporter: dotnet-trx
+        fail-on-error: true
+        fail-on-empty: true
+    - name: Publish test report link
+      run: echo "[Test Results - test/Bff.Tests](${{ steps.test-report-test-Bff-Tests.outputs.url_html }})" >> $GITHUB_STEP_SUMMARY
+    - name: Test - test/Bff.Blazor.Client.UnitTests
+      run: dotnet test test/Bff.Blazor.Client.UnitTests -c Release --no-build --logger "console;verbosity=normal" --logger "trx;LogFileName=test/Bff.Blazor.Client.UnitTests-tests.trx" --collect:"XPlat Code Coverage"
+    - id: test-report-test-Bff-Blazor-Client-UnitTests
+      name: Test report - test/Bff.Blazor.Client.UnitTests
+      if: github.event_name == 'push' && (success() || failure())
+      uses: dorny/test-reporter@31a54ee7ebcacc03a09ea97a7e5465a47b84aea5
+      with:
+        name: Test Report - test/Bff.Blazor.Client.UnitTests
+        path: '**/test/Bff.Blazor.Client.UnitTests-tests.trx'
+        reporter: dotnet-trx
+        fail-on-error: true
+        fail-on-empty: true
+    - name: Publish test report link
+      run: echo "[Test Results - test/Bff.Blazor.Client.UnitTests](${{ steps.test-report-test-Bff-Blazor-Client-UnitTests.outputs.url_html }})" >> $GITHUB_STEP_SUMMARY
+    - name: Test - test/Bff.Blazor.UnitTests
+      run: dotnet test test/Bff.Blazor.UnitTests -c Release --no-build --logger "console;verbosity=normal" --logger "trx;LogFileName=test/Bff.Blazor.UnitTests-tests.trx" --collect:"XPlat Code Coverage"
+    - id: test-report-test-Bff-Blazor-UnitTests
+      name: Test report - test/Bff.Blazor.UnitTests
+      if: github.event_name == 'push' && (success() || failure())
+      uses: dorny/test-reporter@31a54ee7ebcacc03a09ea97a7e5465a47b84aea5
+      with:
+        name: Test Report - test/Bff.Blazor.UnitTests
+        path: '**/test/Bff.Blazor.UnitTests-tests.trx'
+        reporter: dotnet-trx
+        fail-on-error: true
+        fail-on-empty: true
+    - name: Publish test report link
+      run: echo "[Test Results - test/Bff.Blazor.UnitTests](${{ steps.test-report-test-Bff-Blazor-UnitTests.outputs.url_html }})" >> $GITHUB_STEP_SUMMARY
+    - name: Test - test/Bff.EntityFramework.Tests
+      run: dotnet test test/Bff.EntityFramework.Tests -c Release --no-build --logger "console;verbosity=normal" --logger "trx;LogFileName=test/Bff.EntityFramework.Tests-tests.trx" --collect:"XPlat Code Coverage"
+    - id: test-report-test-Bff-EntityFramework-Tests
+      name: Test report - test/Bff.EntityFramework.Tests
+      if: github.event_name == 'push' && (success() || failure())
+      uses: dorny/test-reporter@31a54ee7ebcacc03a09ea97a7e5465a47b84aea5
+      with:
+        name: Test Report - test/Bff.EntityFramework.Tests
+        path: '**/test/Bff.EntityFramework.Tests-tests.trx'
+        reporter: dotnet-trx
+        fail-on-error: true
+        fail-on-empty: true
+    - name: Publish test report link
+      run: echo "[Test Results - test/Bff.EntityFramework.Tests](${{ steps.test-report-test-Bff-EntityFramework-Tests.outputs.url_html }})" >> $GITHUB_STEP_SUMMARY
+  playwright:
+    name: Playwright tests
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      checks: write
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: bff
+    timeout-minutes: 15
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: List .net sdks
+      run: dotnet --list-sdks
+    - name: Setup Dotnet
+      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
+      with:
+        dotnet-version: |-
+          8.0.x
+          9.0.103
+    - name: Restore
+      run: dotnet restore bff.slnf
+    - name: Build
+      run: dotnet build bff.slnf --no-restore -c Release
     - name: Install Playwright
       run: pwsh test/Hosts.Tests/bin/Release/net9.0/playwright.ps1 install --with-deps
-    - name: Test
-      run: dotnet test bff.slnf -c Release --no-build --logger "console;verbosity=normal" --logger "trx;LogFileName=Tests.trx" --collect:"XPlat Code Coverage"
-    - name: Test report
-      if: github.event == 'push' && (success() || failure())
+    - name: Dotnet devcerts
+      run: dotnet dev-certs https --trust
+    - name: Test - test/Hosts.Tests
+      run: dotnet test test/Hosts.Tests -c Release --no-build --logger "console;verbosity=normal" --logger "trx;LogFileName=test/Hosts.Tests-tests.trx" --collect:"XPlat Code Coverage"
+    - id: test-report-test-Hosts-Tests
+      name: Test report - test/Hosts.Tests
+      if: github.event_name == 'push' && (success() || failure())
       uses: dorny/test-reporter@31a54ee7ebcacc03a09ea97a7e5465a47b84aea5
       with:
-        name: Test Report
-        path: '**/Tests.trx'
+        name: Test Report - test/Hosts.Tests
+        path: '**/test/Hosts.Tests-tests.trx'
         reporter: dotnet-trx
         fail-on-error: true
         fail-on-empty: true
+    - name: Publish test report link
+      run: echo "[Test Results - test/Hosts.Tests](${{ steps.test-report-test-Hosts-Tests.outputs.url_html }})" >> $GITHUB_STEP_SUMMARY
     - name: Upload playwright traces
       if: success() || failure()
       uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
@@ -72,6 +190,72 @@ jobs:
         path: bff/test/**/playwright-traces/*.zip
         overwrite: true
         retention-days: 15
+  codeql:
+    name: CodeQL analyze
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: bff
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
+      with:
+        languages: csharp
+        build-mode: manual
+        db-location: ~/.codeql/databases
+    - name: List .net sdks
+      run: dotnet --list-sdks
+    - name: Setup Dotnet
+      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
+      with:
+        dotnet-version: |-
+          8.0.x
+          9.0.103
+    - name: Restore
+      run: dotnet restore bff.slnf
+    - name: Build
+      run: dotnet build bff.slnf --no-restore -c Release
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
+      with:
+        category: /language:csharp
+  pack:
+    name: Pack, sign and push
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
+    needs:
+    - verify-formatting
+    - build
+    - playwright
+    - codeql
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    defaults:
+      run:
+        shell: bash
+        working-directory: bff
+    timeout-minutes: 15
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: List .net sdks
+      run: dotnet --list-sdks
+    - name: Setup Dotnet
+      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
+      with:
+        dotnet-version: |-
+          8.0.x
+          9.0.103
     - name: Tool restore
       run: dotnet tool restore
     - name: Pack bff.slnf
diff --git a/.github/workflows/bff-codeql-analysis.yml b/.github/workflows/bff-codeql-analysis.yml
deleted file mode 100644
index d6e204336..000000000
--- a/.github/workflows/bff-codeql-analysis.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-# This was generated by tool. Edits will be overwritten.
-
-name: bff/codeql
-on:
-  workflow_dispatch:
-  push:
-    branches:
-    - main
-    paths:
-    - bff/**
-  pull_request:
-    paths:
-    - bff/**
-  schedule:
-  - cron: '38 15 * * 0'
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    defaults:
-      run:
-        shell: bash
-        working-directory: bff
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
-      with:
-        languages: csharp
-        build-mode: manual
-    - name: Setup Dotnet
-      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
-      with:
-        dotnet-version: |-
-          6.0.x
-          8.0.x
-          9.0.103
-    - name: Restore
-      run: dotnet restore bff.slnf
-    - name: Build
-      run: dotnet build bff.slnf --no-restore -c Release
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
-      with:
-        category: /language:csharp
diff --git a/.github/workflows/bff-release.yml b/.github/workflows/bff-release.yml
index 78eff471c..704e7dd88 100644
--- a/.github/workflows/bff-release.yml
+++ b/.github/workflows/bff-release.yml
@@ -58,11 +58,12 @@ jobs:
       run: |-
         git tag -a bff-${{ github.event.inputs.version }} -m "Release v${{ github.event.inputs.version }}"
         git push origin bff-${{ github.event.inputs.version }}
+    - name: List .net sdks
+      run: dotnet --list-sdks
     - name: Setup Dotnet
       uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
       with:
         dotnet-version: |-
-          6.0.x
           8.0.x
           9.0.103
     - name: Pack bff.slnf
@@ -98,11 +99,12 @@ jobs:
       with:
         name: artifacts
         path: artifacts
+    - name: List .net sdks
+      run: dotnet --list-sdks
     - name: Setup Dotnet
       uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
       with:
         dotnet-version: |-
-          6.0.x
           8.0.x
           9.0.103
     - name: List files
diff --git a/.github/workflows/identity-server-ci.yml b/.github/workflows/identity-server-ci.yml
index ad76a5e1d..8b45d485b 100644
--- a/.github/workflows/identity-server-ci.yml
+++ b/.github/workflows/identity-server-ci.yml
@@ -17,8 +17,36 @@ env:
   DOTNET_NOLOGO: true
   DOTNET_CLI_TELEMETRY_OPTOUT: true
 jobs:
+  verify-formatting:
+    name: Verify formatting
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: identity-server
+    timeout-minutes: 15
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: List .net sdks
+      run: dotnet --list-sdks
+    - name: Setup Dotnet
+      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
+      with:
+        dotnet-version: |-
+          8.0.x
+          9.0.103
+    - name: Restore
+      run: dotnet restore identity-server.slnf
+    - name: Verify Formatting
+      run: dotnet format identity-server.slnf --verify-no-changes --no-restore
   build:
-    name: Build
+    name: Build and test (unit)
     if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-latest
     permissions:
@@ -36,32 +64,104 @@ jobs:
       uses: actions/checkout@v4
       with:
         fetch-depth: 0
+    - name: List .net sdks
+      run: dotnet --list-sdks
     - name: Setup Dotnet
       uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
       with:
         dotnet-version: |-
-          6.0.x
           8.0.x
           9.0.103
     - name: Restore
       run: dotnet restore identity-server.slnf
-    - name: Verify Formatting
-      run: dotnet format identity-server.slnf --verify-no-changes --no-restore
     - name: Build
       run: dotnet build identity-server.slnf --no-restore -c Release
     - name: Dotnet devcerts
       run: dotnet dev-certs https --trust
-    - name: Test
-      run: dotnet test identity-server.slnf -c Release --no-build --logger "console;verbosity=normal" --logger "trx;LogFileName=Tests.trx" --collect:"XPlat Code Coverage"
-    - name: Test report
-      if: github.event == 'push' && (success() || failure())
-      uses: dorny/test-reporter@31a54ee7ebcacc03a09ea97a7e5465a47b84aea5
+  playwright:
+    name: Playwright tests
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      checks: write
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: identity-server
+    timeout-minutes: 15
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+  codeql:
+    name: CodeQL analyze
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: identity-server
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
+      with:
+        languages: csharp
+        build-mode: manual
+        db-location: ~/.codeql/databases
+    - name: List .net sdks
+      run: dotnet --list-sdks
+    - name: Setup Dotnet
+      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
       with:
-        name: Test Report
-        path: '**/Tests.trx'
-        reporter: dotnet-trx
-        fail-on-error: true
-        fail-on-empty: true
+        dotnet-version: |-
+          8.0.x
+          9.0.103
+    - name: Restore
+      run: dotnet restore identity-server.slnf
+    - name: Build
+      run: dotnet build identity-server.slnf --no-restore -c Release
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
+      with:
+        category: /language:csharp
+  pack:
+    name: Pack, sign and push
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'push') || (github.event_name == 'workflow_dispatch')
+    needs:
+    - verify-formatting
+    - build
+    - playwright
+    - codeql
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    defaults:
+      run:
+        shell: bash
+        working-directory: identity-server
+    timeout-minutes: 15
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: List .net sdks
+      run: dotnet --list-sdks
+    - name: Setup Dotnet
+      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
+      with:
+        dotnet-version: |-
+          8.0.x
+          9.0.103
     - name: Tool restore
       run: dotnet tool restore
     - name: Pack identity-server.slnf
diff --git a/.github/workflows/identity-server-codeql-analysis.yml b/.github/workflows/identity-server-codeql-analysis.yml
deleted file mode 100644
index dd78c4f1e..000000000
--- a/.github/workflows/identity-server-codeql-analysis.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-# This was generated by tool. Edits will be overwritten.
-
-name: identity-server/codeql
-on:
-  workflow_dispatch:
-  push:
-    branches:
-    - main
-    paths:
-    - identity-server/**
-  pull_request:
-    paths:
-    - identity-server/**
-  schedule:
-  - cron: '38 15 * * 0'
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    defaults:
-      run:
-        shell: bash
-        working-directory: identity-server
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
-      with:
-        languages: csharp
-        build-mode: manual
-    - name: Setup Dotnet
-      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
-      with:
-        dotnet-version: |-
-          6.0.x
-          8.0.x
-          9.0.103
-    - name: Restore
-      run: dotnet restore identity-server.slnf
-    - name: Build
-      run: dotnet build identity-server.slnf --no-restore -c Release
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0
-      with:
-        category: /language:csharp
diff --git a/.github/workflows/identity-server-release.yml b/.github/workflows/identity-server-release.yml
index 2ff857ffc..265f2d045 100644
--- a/.github/workflows/identity-server-release.yml
+++ b/.github/workflows/identity-server-release.yml
@@ -58,11 +58,12 @@ jobs:
       run: |-
         git tag -a is-${{ github.event.inputs.version }} -m "Release v${{ github.event.inputs.version }}"
         git push origin is-${{ github.event.inputs.version }}
+    - name: List .net sdks
+      run: dotnet --list-sdks
     - name: Setup Dotnet
       uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
       with:
         dotnet-version: |-
-          6.0.x
           8.0.x
           9.0.103
     - name: Pack identity-server.slnf
@@ -98,11 +99,12 @@ jobs:
       with:
         name: artifacts
         path: artifacts
+    - name: List .net sdks
+      run: dotnet --list-sdks
     - name: Setup Dotnet
       uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
       with:
         dotnet-version: |-
-          6.0.x
           8.0.x
           9.0.103
     - name: List files
diff --git a/.github/workflows/templates-release.yml b/.github/workflows/templates-release.yml
index d31373ae5..083babe63 100644
--- a/.github/workflows/templates-release.yml
+++ b/.github/workflows/templates-release.yml
@@ -38,11 +38,12 @@ jobs:
       uses: actions/checkout@v4
       with:
         fetch-depth: 0
+    - name: List .net sdks
+      run: dotnet --list-sdks
     - name: Setup Dotnet
       uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
       with:
         dotnet-version: |-
-          6.0.x
           8.0.x
           9.0.103
     - name: Checkout target branch
@@ -100,11 +101,12 @@ jobs:
       with:
         name: artifacts
         path: artifacts
+    - name: List .net sdks
+      run: dotnet --list-sdks
     - name: Setup Dotnet
       uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25
       with:
         dotnet-version: |-
-          6.0.x
           8.0.x
           9.0.103
     - name: List files