diff --git a/.github/workflows/autofmt.yml b/.github/workflows/autofmt.yml
index ac377c7eac..6c928e0c9e 100644
--- a/.github/workflows/autofmt.yml
+++ b/.github/workflows/autofmt.yml
@@ -15,12 +15,12 @@ jobs:
         with:
           ref: ${{ github.head_ref }}
       - name: Init Hermit
-        run: ./bin/hermit env -r >> $GITHUB_ENV
+        run: ./bin/hermit env -r >> "$GITHUB_ENV"
       - name: Auto format
         run: autofmt
       - name: Check for modified files
         id: git-check
-        run: echo "modified=$(if git diff-index --quiet HEAD --; then echo "false"; else echo "true"; fi)" >> $GITHUB_OUTPUT
+        run: echo "modified=$(if git diff-index --quiet HEAD --; then echo "false"; else echo "true"; fi)" >> "$GITHUB_OUTPUT"
       - name: Switch to main
         if: github.ref == 'refs/heads/main'
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 30bda54045..46524b5a89 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,8 +16,10 @@ jobs:
         uses: actions/checkout@v4
       - name: Init Hermit
         uses: cashapp/activate-hermit@v1
+      - name: Build Cache
+        uses: ./.github/actions/build-cache
       - name: Test
-        run: mvn test
+        run: mvn test --batch-mode
   test:
     name: Test Go
     runs-on: ubuntu-latest
@@ -40,6 +42,8 @@ jobs:
         uses: actions/checkout@v4
       - name: Init Hermit
         uses: cashapp/activate-hermit@v1
+      - name: Build Cache
+        uses: ./.github/actions/build-cache
       - name: Docker Compose
         run: docker compose up -d --wait
       - name: Initialise database
@@ -60,6 +64,8 @@ jobs:
         run: golangci-lint run
       - name: go-check-sumtype
         run: go-check-sumtype ./...
+      - name: actionlint
+        run: actionlint --oneline
       # Too annoying to disable individual warnings
       # - name: staticcheck
       #   run: staticcheck ./...
@@ -94,6 +100,8 @@ jobs:
         uses: actions/checkout@v4
       - name: Init Hermit
         uses: cashapp/activate-hermit@v1
+      - name: Build Cache
+        uses: ./.github/actions/build-cache
       - name: Console NPM Install
         working-directory: frontend
         run: npm install
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 6188af11d7..b4632ebf33 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -9,7 +9,7 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     outputs:
-      matrix: ${{ steps.set-tests.outputs.matrix }}
+      matrix: ${{ steps.extract-tests.outputs.matrix }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -18,14 +18,8 @@ jobs:
       - name: Extract test cases
         id: extract-tests
         run: |
-          echo "cases=$(go test -v -list . -tags integration ./integration | grep '^Test' | awk '{print $1}' | cut -d '(' -f1 | tr '\n' ',' | sed 's/,$//')" >> "$GITHUB_OUTPUT"
-      - name: Format test matrix
-        id: set-tests
-        run: |
-          IFS=',' read -ra TESTS <<< "${{ steps.extract-tests.outputs.cases }}"
-          TEST_JSON=$(printf ',"%s"' "${TESTS[@]}")
-          TEST_JSON="[${TEST_JSON:1}]"
-          echo "matrix={\"test\": $TEST_JSON}" >> "$GITHUB_OUTPUT"
+          # shellcheck disable=SC2046
+          echo "matrix={\"test\":$(jq -c -n '$ARGS.positional' --args $(grep '^func Test' integration/*_test.go | awk '{print $2}' | cut -d'(' -f1))}" >> "$GITHUB_OUTPUT"
   integration:
     needs: prepare
     runs-on: ubuntu-latest
@@ -37,6 +31,8 @@ jobs:
         uses: actions/checkout@v4
       - name: Init Hermit
         uses: cashapp/activate-hermit@v1
+        with:
+          cache: true
       - name: Build Cache
         uses: ./.github/actions/build-cache
       - name: Docker Compose
@@ -44,4 +40,4 @@ jobs:
       - name: Download Go Modules
         run: go mod download
       - name: Run ${{ matrix.test }}
-        run: go test -v -tags integration -run ${{ matrix.test }} ./integration
\ No newline at end of file
+        run: go test -v -tags integration -run ${{ matrix.test }} ./integration
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d822c93c62..ac8121e1ca 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,7 +15,7 @@ jobs:
         uses: cashapp/activate-hermit@v1
       - name: Build
         run: |
-          docker build -t ghcr.io/tbd54566975/ftl-runner:$GITHUB_SHA -t ghcr.io/tbd54566975/ftl-runner:latest -f Dockerfile.runner .
+          docker build -t ghcr.io/tbd54566975/ftl-runner:"$GITHUB_SHA" -t ghcr.io/tbd54566975/ftl-runner:latest -f Dockerfile.runner .
           mkdir -p artifacts/ftl-runner
           docker save -o artifacts/ftl-runner/ftl-runner.tar ghcr.io/tbd54566975/ftl-runner:latest
       - name: Temporarily save Docker image
@@ -34,7 +34,7 @@ jobs:
         uses: cashapp/activate-hermit@v1
       - name: Build
         run: |
-          docker build -t ghcr.io/tbd54566975/ftl-controller:$GITHUB_SHA -t ghcr.io/tbd54566975/ftl-controller:latest -f Dockerfile.controller .
+          docker build -t ghcr.io/tbd54566975/ftl-controller:"$GITHUB_SHA" -t ghcr.io/tbd54566975/ftl-controller:latest -f Dockerfile.controller .
           mkdir -p artifacts/ftl-controller
           docker save -o artifacts/ftl-controller/ftl-controller.tar ghcr.io/tbd54566975/ftl-controller:latest
       - name: Temporarily save Docker image
@@ -79,12 +79,12 @@ jobs:
           password: ${{ github.token }}
       - name: Push Docker Images
         run: |
-          version=$(git describe --tags --abbrev=0)
-          docker tag ghcr.io/tbd54566975/ftl-runner:latest ghcr.io/tbd54566975/ftl-runner:$GITHUB_SHA
-          docker tag ghcr.io/tbd54566975/ftl-runner:latest ghcr.io/tbd54566975/ftl-runner:$version
+          version="$(git describe --tags --abbrev=0)"
+          docker tag ghcr.io/tbd54566975/ftl-runner:latest ghcr.io/tbd54566975/ftl-runner:"$GITHUB_SHA"
+          docker tag ghcr.io/tbd54566975/ftl-runner:latest ghcr.io/tbd54566975/ftl-runner:"$version"
           docker push -a ghcr.io/tbd54566975/ftl-runner
-          docker tag ghcr.io/tbd54566975/ftl-controller:latest ghcr.io/tbd54566975/ftl-controller:$GITHUB_SHA
-          docker tag ghcr.io/tbd54566975/ftl-controller:latest ghcr.io/tbd54566975/ftl-controller:$version
+          docker tag ghcr.io/tbd54566975/ftl-controller:latest ghcr.io/tbd54566975/ftl-controller:"$GITHUB_SHA"
+          docker tag ghcr.io/tbd54566975/ftl-controller:latest ghcr.io/tbd54566975/ftl-controller:"$version"
           docker push -a ghcr.io/tbd54566975/ftl-controller
   release-jars:
     name: Release JARs
@@ -113,9 +113,9 @@ jobs:
       - name: Publish JARs # Snapshots are published first, then the tagged release
         run: |
           mvn -U -B clean deploy -P release
-          mvn -B versions:set -DnewVersion=$(git describe --tags --abbrev=0 | cut -c2-) -DprocessAllModules -DgenerateBackupPoms=false
+          mvn -B versions:set -DnewVersion="$(git describe --tags --abbrev=0 | cut -c2-)" -DprocessAllModules -DgenerateBackupPoms=false
           mvn -U -B clean deploy -P release
-          git clean -f *.flattened_pom.xml
+          git clean -f ./*.flattened_pom.xml
         env:
           SIGN_KEY_PASS: ${{ secrets.GPG_PASSPHRASE }}
           OSSRH_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
diff --git a/bin/.actionlint-1.6.26.pkg b/bin/.actionlint-1.6.26.pkg
new file mode 120000
index 0000000000..383f4511d4
--- /dev/null
+++ b/bin/.actionlint-1.6.26.pkg
@@ -0,0 +1 @@
+hermit
\ No newline at end of file
diff --git a/bin/actionlint b/bin/actionlint
new file mode 120000
index 0000000000..40c81b8915
--- /dev/null
+++ b/bin/actionlint
@@ -0,0 +1 @@
+.actionlint-1.6.26.pkg
\ No newline at end of file