diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
new file mode 100644
index 0000000..c2e80c8
--- /dev/null
+++ b/.github/workflows/integration-tests.yml
@@ -0,0 +1,120 @@
+name: integration-tests
+
+on:
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+    # Manual trigger for integration tests - requires approval via environment protection
+    inputs:
+      skip_integration_tests:
+        description: 'Skip integration tests'
+        required: false
+        type: boolean
+        default: false
+
+# Cancel in-progress runs when a new commit is pushed
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  integration-tests:
+    name: Integration Tests (Java ${{ matrix.java-version }})
+    runs-on: ubuntu-latest
+    environment:
+      name: test-integration-dal
+      deployment: false
+    timeout-minutes: 30
+    strategy:
+      matrix:
+        java-version: ['11', '17']
+    
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Set up Java ${{ matrix.java-version }}
+        uses: actions/setup-java@v5
+        with:
+          java-version: ${{ matrix.java-version }}
+          distribution: 'temurin'
+          cache: 'maven'
+
+      - name: Build project
+        run: mvn clean install -DskipTests --settings build/.github.settings.xml
+
+      - name: Create .env files
+        if: github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && !inputs.skip_integration_tests)
+        env:
+          CLOUD_API_KEY: ${{ secrets.CLOUD_API_KEY }}
+          CD_TOOLCHAIN_URL: ${{ vars.CD_TOOLCHAIN_URL }}
+          CD_TOOLCHAIN_AUTH_TYPE: ${{ vars.CD_TOOLCHAIN_AUTH_TYPE }}
+          CD_TOOLCHAIN_EVENT_NOTIFICATIONS_SERVICE_CRN: ${{ vars.CD_TOOLCHAIN_EVENT_NOTIFICATIONS_SERVICE_CRN }}
+          CD_TOOLCHAIN_RESOURCE_GROUP_ID: ${{ vars.CD_TOOLCHAIN_RESOURCE_GROUP_ID }}
+          CD_TEKTON_PIPELINE_URL: ${{ vars.CD_TEKTON_PIPELINE_URL }}
+          CD_TEKTON_PIPELINE_AUTH_TYPE: ${{ vars.CD_TEKTON_PIPELINE_AUTH_TYPE }}
+          CD_TEKTON_PIPELINE_RESOURCE_GROUP_ID: ${{ vars.CD_TEKTON_PIPELINE_RESOURCE_GROUP_ID }}
+        run: |
+          set -e
+          
+          # Verify all required environment variables are set
+          if [ -z "$CLOUD_API_KEY" ]; then
+            echo "Error: CLOUD_API_KEY secret is not set"
+            exit 1
+          fi
+          
+          if [ -z "$CD_TOOLCHAIN_URL" ] || [ -z "$CD_TOOLCHAIN_AUTH_TYPE" ] || \
+             [ -z "$CD_TOOLCHAIN_RESOURCE_GROUP_ID" ] || [ -z "$CD_TOOLCHAIN_EVENT_NOTIFICATIONS_SERVICE_CRN" ]; then
+            echo "Error: One or more CD_TOOLCHAIN variables are not set"
+            echo "Please configure all required variables in GitHub repository settings"
+            exit 1
+          fi
+          
+          if [ -z "$CD_TEKTON_PIPELINE_URL" ] || [ -z "$CD_TEKTON_PIPELINE_AUTH_TYPE" ] || \
+             [ -z "$CD_TEKTON_PIPELINE_RESOURCE_GROUP_ID" ]; then
+            echo "Error: One or more CD_TEKTON_PIPELINE variables are not set"
+            echo "Please configure all required variables in GitHub repository settings"
+            exit 1
+          fi
+          
+          # cd_toolchain_v2.env
+          cat > cd_toolchain_v2.env << EOF
+          CD_TOOLCHAIN_URL=${CD_TOOLCHAIN_URL}
+          CD_TOOLCHAIN_AUTH_TYPE=${CD_TOOLCHAIN_AUTH_TYPE}
+          CD_TOOLCHAIN_APIKEY=${CLOUD_API_KEY}
+          CD_TOOLCHAIN_EVENT_NOTIFICATIONS_SERVICE_CRN=${CD_TOOLCHAIN_EVENT_NOTIFICATIONS_SERVICE_CRN}
+          CD_TOOLCHAIN_RESOURCE_GROUP_ID=${CD_TOOLCHAIN_RESOURCE_GROUP_ID}
+          EOF
+
+          # cd_tekton_pipeline_v2.env
+          cat > cd_tekton_pipeline_v2.env << EOF
+          CD_TEKTON_PIPELINE_URL=${CD_TEKTON_PIPELINE_URL}
+          CD_TEKTON_PIPELINE_AUTH_TYPE=${CD_TEKTON_PIPELINE_AUTH_TYPE}
+          CD_TEKTON_PIPELINE_APIKEY=${CLOUD_API_KEY}
+          CD_TEKTON_PIPELINE_RESOURCE_GROUP_ID=${CD_TEKTON_PIPELINE_RESOURCE_GROUP_ID}
+          CD_TOOLCHAIN_URL=${CD_TOOLCHAIN_URL}
+          CD_TOOLCHAIN_AUTH_TYPE=${CD_TOOLCHAIN_AUTH_TYPE}
+          CD_TOOLCHAIN_APIKEY=${CLOUD_API_KEY}
+          CD_TOOLCHAIN_RESOURCE_GROUP_ID=${CD_TOOLCHAIN_RESOURCE_GROUP_ID}
+          EOF
+          
+          # Verify files were created successfully
+          if [ ! -f cd_toolchain_v2.env ] || [ ! -f cd_tekton_pipeline_v2.env ]; then
+            echo "Error: Failed to create .env files"
+            exit 1
+          fi
+          
+          echo "✓ Environment files created successfully"
+          echo "✓ cd_toolchain_v2.env: $(wc -l < cd_toolchain_v2.env) lines"
+          echo "✓ cd_tekton_pipeline_v2.env: $(wc -l < cd_tekton_pipeline_v2.env) lines"
+
+      - name: Run integration tests
+        if: github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && !inputs.skip_integration_tests)
+        run: mvn verify -DskipTests --settings build/.github.settings.xml
+
+      - name: Cleanup .env files
+        if: always() && (github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && !inputs.skip_integration_tests))
+        run: |
+          rm -f cd_tekton_pipeline_v2.env cd_toolchain_v2.env
+          echo "✓ Environment files cleaned up"
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index c39d74e..05e7563 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -5,8 +5,8 @@ on:
     branches:
       - main
   workflow_dispatch:
-    # Allow workflow to be triggered manually.
 
+# Cancel in-progress runs when a new commit is pushed
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -24,7 +24,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: 3.12
+          python-version: 3.14
 
       - name: Install detect-secrets
         run: |
@@ -35,8 +35,8 @@ jobs:
           detect-secrets scan --update .secrets.baseline --exclude-files 'build/signing\.key\.enc'
           detect-secrets -v audit --report --fail-on-unaudited --fail-on-live --fail-on-audited-real .secrets.baseline
 
-  build-test:
-    name: Build and Test (Java ${{ matrix.java-version }})
+  unit-tests:
+    name: Unit Tests (Java ${{ matrix.java-version }})
     needs: detect-secrets
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -55,5 +55,11 @@ jobs:
           distribution: 'temurin'
           cache: 'maven'
 
-      - name: Build and test
-        run: mvn verify -fae -DskipITs --settings build/.github.settings.xml
+      - name: Build project
+        run: mvn clean install -DskipTests --settings build/.github.settings.xml
+
+      - name: Run unit tests
+        run: mvn test -DskipITs --settings build/.github.settings.xml
+
+      - name: Run linter
+        run: mvn checkstyle:check --settings build/.github.settings.xml