diff --git a/.github/workflows/Dockerfile.tools b/.github/workflows/Dockerfile.tools
deleted file mode 100644
index df5892618a7820..00000000000000
--- a/.github/workflows/Dockerfile.tools
+++ /dev/null
@@ -1,4 +0,0 @@
-FROM ghcr.io/openwrt/buildbot/buildworker-v3.8.0:v2
-
-COPY --chown=buildbot staging_dir/host /prebuilt_tools/staging_dir/host
-COPY --chown=buildbot build_dir/host /prebuilt_tools/build_dir/host
diff --git a/.github/workflows/build-tools.yml b/.github/workflows/build-tools.yml
deleted file mode 100644
index 9b865f2608f9bd..00000000000000
--- a/.github/workflows/build-tools.yml
+++ /dev/null
@@ -1,72 +0,0 @@
-name: Build host tools
-
-on:
-  workflow_call:
-    inputs:
-      generate_prebuilt_artifacts:
-        type: boolean
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Build tools
-    runs-on: ubuntu-latest
-    container: ghcr.io/openwrt/buildbot/buildworker-v3.8.0:v2
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          path: openwrt
-
-      - name: Fix permission
-        run: chown -R buildbot:buildbot openwrt
-
-      - name: Set configs for tools container
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          touch .config
-          echo CONFIG_DEVEL=y >> .config
-          echo CONFIG_AUTOREMOVE=y >> .config
-          echo CONFIG_CCACHE=y >> .config
-
-      - name: Make prereq
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make defconfig
-
-      - name: Build tools
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make tools/install -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
-
-      - name: Upload logs
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: linux-buildbot-logs
-          path: openwrt/logs
-
-      - name: Upload config
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: linux-buildbot-config
-          path: openwrt/.config
-
-      - name: Archive prebuilt tools
-        if: inputs.generate_prebuilt_artifacts == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: tar -cf tools.tar staging_dir/host build_dir/host
-
-      - name: Upload prebuilt tools
-        if: inputs.generate_prebuilt_artifacts == true
-        uses: actions/upload-artifact@v3
-        with:
-          name: linux-buildbot-prebuilt-tools
-          path: openwrt/tools.tar
-          retention-days: 1
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
deleted file mode 100644
index 816ef6ab3cafbf..00000000000000
--- a/.github/workflows/build.yml
+++ /dev/null
@@ -1,435 +0,0 @@
-name: Build sub target
-
-on:
-  workflow_call:
-    secrets:
-      coverity_api_token:
-    inputs:
-      target:
-        required: true
-        type: string
-      subtarget:
-        required: true
-        type: string
-      testing:
-        type: boolean
-      build_toolchain:
-        type: boolean
-      include_feeds:
-        type: boolean
-      build_full:
-        type: boolean
-      build_kernel:
-        type: boolean
-      build_all_modules:
-        type: boolean
-      build_all_kmods:
-        type: boolean
-      build_all_boards:
-        type: boolean
-      use_openwrt_container:
-        type: boolean
-        default: true
-      coverity_project_name:
-        type: string
-        default: OpenWrt
-      coverity_check_packages:
-        type: string
-      coverity_compiler_template_list:
-        type: string
-        default: >-
-          arm-openwrt-linux-gcc
-      coverity_force_compile_packages:
-        type: string
-        default: >-
-          curl
-          libnl
-          mbedtls
-          wolfssl
-          openssl
-
-permissions:
-  contents: read
-
-jobs:
-  setup_build:
-    name: Setup build ${{ inputs.target }}/${{ inputs.subtarget }}
-    runs-on: ubuntu-latest
-    outputs:
-      owner_lc: ${{ steps.lower_owner.outputs.owner_lc }}
-      ccache_hash: ${{ steps.ccache_hash.outputs.ccache_hash }}
-      container_tag: ${{ steps.determine_tools_container.outputs.container_tag }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Set lower case owner name
-        id: lower_owner
-        run: |
-          OWNER_LC=$(echo "${{ github.repository_owner }}" \
-            | tr '[:upper:]' '[:lower:]')
-
-          if [ ${{ inputs.use_openwrt_container }} == "true" ]; then
-            OWNER_LC=openwrt
-          fi
-
-          echo "owner_lc=$OWNER_LC" >> $GITHUB_OUTPUT
-
-      - name: Generate ccache hash
-        id: ccache_hash
-        run: |
-          CCACHE_HASH=$(md5sum include/kernel-* | awk '{ print $1 }' \
-           | md5sum | awk '{ print $1 }')
-          echo "ccache_hash=$CCACHE_HASH" >> $GITHUB_OUTPUT
-
-      # Per branch tools container tag
-      # By default stick to latest
-      # For official test targetting openwrt stable branch
-      # Get the branch or parse the tag and push dedicated tools containers
-      # For local test to use the correct container for stable release testing
-      # you need to use for the branch name a prefix of openwrt-[0-9][0-9].[0-9][0-9]-
-      - name: Determine tools container tag
-        id: determine_tools_container
-        run: |
-          CONTAINER_TAG=latest
-          if [ -n "${{ github.base_ref }}" ]; then
-            if echo "${{ github.base_ref }}" | grep -q -E '^openwrt-[0-9][0-9]\.[0-9][0-9]$'; then
-              CONTAINER_TAG="${{ github.base_ref }}"
-            fi
-          elif [ ${{ github.ref_type }} == "branch" ]; then
-            if echo "${{ github.ref_name }}" | grep -q -E '^openwrt-[0-9][0-9]\.[0-9][0-9]$'; then
-              CONTAINER_TAG=${{ github.ref_name }}
-            elif echo "${{ github.ref_name }}" | grep -q -E '^openwrt-[0-9][0-9]\.[0-9][0-9]-'; then
-              CONTAINER_TAG="$(echo ${{ github.ref_name }} | sed 's/^\(openwrt-[0-9][0-9]\.[0-9][0-9]\)-.*/\1/')"
-            fi
-          elif [ ${{ github.ref_type }} == "tag" ]; then
-            if echo "${{ github.ref_name }}" | grep -q -E '^v[0-9][0-9]\.[0-9][0-9]\..+'; then
-              CONTAINER_TAG=openwrt-"$(echo ${{ github.ref_name }} | sed 's/^v\([0-9][0-9]\.[0-9][0-9]\)\..\+/\1/')"
-            fi
-          fi
-          echo "Tools container to use tools:$CONTAINER_TAG"
-          echo "container_tag=$CONTAINER_TAG" >> $GITHUB_OUTPUT
-
-  build:
-    name: Build ${{ inputs.target }}/${{ inputs.subtarget }}
-    needs: setup_build
-    runs-on: ubuntu-latest
-
-    container: ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }}
-
-    permissions:
-      contents: read
-      packages: read
-
-    steps:
-      - name: Checkout master directory
-        uses: actions/checkout@v3
-        with:
-          path: openwrt
-
-      - name: Checkout packages feed
-        if: inputs.include_feeds == true
-        uses: actions/checkout@v3
-        with:
-          repository: openwrt/packages
-          path: openwrt/feeds/packages
-
-      - name: Checkout luci feed
-        if: inputs.include_feeds == true
-        uses: actions/checkout@v3
-        with:
-          repository: openwrt/luci
-          path: openwrt/feeds/luci
-
-      - name: Checkout routing feed
-        if: inputs.include_feeds == true
-        uses: actions/checkout@v3
-        with:
-          repository: openwrt/routing
-          path: openwrt/feeds/routing
-
-      - name: Checkout telephony feed
-        if: inputs.include_feeds == true
-        uses: actions/checkout@v3
-        with:
-          repository: openwrt/telephony
-          path: openwrt/feeds/telephony
-
-      - name: Parse toolchain file
-        if: inputs.build_toolchain == false
-        id: parse-toolchain
-        working-directory: openwrt
-        run: |
-          TOOLCHAIN_PATH=snapshots
-
-          if [ -n "${{ github.base_ref }}" ]; then
-            if echo "${{ github.base_ref }}" | grep -q -E '^openwrt-[0-9][0-9]\.[0-9][0-9]$'; then
-              major_ver="$(echo ${{ github.base_ref }} | sed 's/^openwrt-/v/')"
-            fi
-          elif [ "${{ github.ref_type }}" = "branch" ]; then
-            if echo "${{ github.ref_name }}" | grep -q -E '^openwrt-[0-9][0-9]\.[0-9][0-9]$'; then
-              major_ver="$(echo ${{ github.ref_name }} | sed 's/^openwrt-/v/')"
-            elif echo "${{ github.ref_name }}" | grep -q -E '^openwrt-[0-9][0-9]\.[0-9][0-9]-'; then
-              major_ver="$(echo ${{ github.ref_name }} | sed 's/^openwrt-\([0-9][0-9]\.[0-9][0-9]\)-.*/v\1/')"
-            fi
-          elif [ "${{ github.ref_type }}" = "tag" ]; then
-            if echo "${{ github.ref_name }}" | grep -q -E '^v[0-9][0-9]\.[0-9][0-9]\..+'; then
-              major_ver="$(echo ${{ github.ref_name }} | sed 's/^\(v[0-9][0-9]\.[0-9][0-9]\)\..\+/\1/')"
-            fi
-          fi
-
-          if [ -n "$major_ver" ]; then
-            git fetch --tags -f
-            latest_tag="$(git tag --sort=-creatordate -l $major_ver* | head -n1)"
-            if [ -n "$latest_tag" ]; then
-              TOOLCHAIN_PATH=releases/$(echo $latest_tag | sed 's/^v//')
-            fi
-          fi
-
-          SUMS_FILE="https://downloads.cdn.openwrt.org/$TOOLCHAIN_PATH/targets/${{ inputs.target }}/${{ inputs.subtarget }}/sha256sums"
-          if curl $SUMS_FILE | grep -q ".*openwrt-toolchain.*tar.xz"; then
-            TOOLCHAIN_STRING="$( curl $SUMS_FILE | grep ".*openwrt-toolchain.*tar.xz")"
-            TOOLCHAIN_FILE=$(echo "$TOOLCHAIN_STRING" | sed -n -e 's/.*\(openwrt-toolchain.*\).tar.xz/\1/p')
-            
-            echo "toolchain-type=external_toolchain" >> $GITHUB_OUTPUT
-          elif curl $SUMS_FILE | grep -q ".*openwrt-sdk.*tar.xz"; then
-            TOOLCHAIN_STRING="$( curl $SUMS_FILE | grep ".*openwrt-sdk.*tar.xz")"
-            TOOLCHAIN_FILE=$(echo "$TOOLCHAIN_STRING" | sed -n -e 's/.*\(openwrt-sdk.*\).tar.xz/\1/p')
-
-            echo "toolchain-type=external_sdk" >> $GITHUB_OUTPUT
-          else
-            echo "toolchain-type=internal" >> $GITHUB_OUTPUT
-          fi
-
-          echo "TOOLCHAIN_FILE=$TOOLCHAIN_FILE" >> "$GITHUB_ENV"
-          echo "TOOLCHAIN_PATH=$TOOLCHAIN_PATH" >> "$GITHUB_ENV"
-
-      - name: Fix permission
-        run: |
-          chown -R buildbot:buildbot openwrt
-
-      - name: Prepare prebuilt tools
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          mkdir -p staging_dir build_dir
-          ln -s /prebuilt_tools/staging_dir/host staging_dir/host
-          ln -s /prebuilt_tools/build_dir/host build_dir/host
-
-          ./scripts/ext-tools.sh --refresh
-
-      - name: Update & Install feeds
-        if: inputs.include_feeds == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          ./scripts/feeds update -a
-          ./scripts/feeds install -a
-
-      - name: Cache ccache
-        uses: actions/cache@v3
-        with:
-          path: openwrt/.ccache
-          key: ccache-kernel-${{ inputs.target }}/${{ inputs.subtarget }}-${{ needs.setup_build.outputs.ccache_hash }}
-          restore-keys: |
-            ccache-kernel-${{ inputs.target }}/${{ inputs.subtarget }}-
-
-      - name: Download external toolchain/sdk
-        if: inputs.build_toolchain == false && steps.parse-toolchain.outputs.toolchain-type != 'internal'
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          wget -O - https://downloads.cdn.openwrt.org/${{ env.TOOLCHAIN_PATH }}/targets/${{ inputs.target }}/${{ inputs.subtarget }}/${{ env.TOOLCHAIN_FILE }}.tar.xz \
-            | tar --xz -xf -
-
-      - name: Configure testing kernel
-        if: inputs.testing == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          echo CONFIG_TESTING_KERNEL=y >> .config
-
-      - name: Configure all kernel modules
-        if: inputs.build_all_kmods == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          echo CONFIG_ALL_KMODS=y >> .config
-
-      - name: Configure all modules
-        if: inputs.build_all_modules == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          echo CONFIG_ALL=y >> .config
-
-      - name: Configure all boards
-        if: inputs.build_all_boards == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          echo CONFIG_TARGET_MULTI_PROFILE=y >> .config
-          echo CONFIG_TARGET_PER_DEVICE_ROOTFS=y >> .config
-          echo CONFIG_TARGET_ALL_PROFILES=y >> .config
-
-      - name: Configure external toolchain
-        if: inputs.build_toolchain == false && steps.parse-toolchain.outputs.toolchain-type == 'external_toolchain'
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          echo CONFIG_DEVEL=y >> .config
-          echo CONFIG_AUTOREMOVE=y >> .config
-          echo CONFIG_CCACHE=y >> .config
-
-          ./scripts/ext-toolchain.sh \
-            --toolchain ${{ env.TOOLCHAIN_FILE }}/toolchain-* \
-            --overwrite-config \
-            --config ${{ inputs.target }}/${{ inputs.subtarget }}
-
-      - name: Adapt external sdk to external toolchain format
-        if: inputs.build_toolchain == false && steps.parse-toolchain.outputs.toolchain-type == 'external_sdk'
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          TOOLCHAIN_DIR=${{ env.TOOLCHAIN_FILE }}/staging_dir/$(ls ${{ env.TOOLCHAIN_FILE }}/staging_dir | grep toolchain)
-          TOOLCHAIN_BIN=$TOOLCHAIN_DIR/bin
-          OPENWRT_DIR=$(pwd)
-
-          # Find target name from toolchain info.mk
-          GNU_TARGET_NAME=$(cat $TOOLCHAIN_DIR/info.mk | grep TARGET_CROSS | sed 's/^TARGET_CROSS=\(.*\)-$/\1/')
-
-          cd $TOOLCHAIN_BIN
-
-          # Revert sdk wrapper scripts applied to all the bins
-          for app in $(find . -name "*.bin"); do
-            TARGET_APP=$(echo $app | sed 's/\.\/\.\(.*\)\.bin/\1/')
-            rm $TARGET_APP
-            mv .$TARGET_APP.bin $TARGET_APP
-          done
-
-          # Setup the wrapper script in the sdk toolchain dir simulating an external toolchain build
-          cp $OPENWRT_DIR/target/toolchain/files/wrapper.sh $GNU_TARGET_NAME-wrapper.sh
-          for app in cc gcc g++ c++ cpp ld as ; do
-            [ -f $GNU_TARGET_NAME-$app ] && mv $GNU_TARGET_NAME-$app $GNU_TARGET_NAME-$app.bin
-            ln -sf $GNU_TARGET_NAME-wrapper.sh $GNU_TARGET_NAME-$app
-          done
-
-      - name: Configure external toolchain with sdk
-        if: inputs.build_toolchain == false && steps.parse-toolchain.outputs.toolchain-type == 'external_sdk'
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          echo CONFIG_DEVEL=y >> .config
-          echo CONFIG_AUTOREMOVE=y >> .config
-          echo CONFIG_CCACHE=y >> .config
-
-          ./scripts/ext-toolchain.sh \
-            --toolchain ${{ env.TOOLCHAIN_FILE }}/staging_dir/toolchain-* \
-            --overwrite-config \
-            --config ${{ inputs.target }}/${{ inputs.subtarget }}
-
-      - name: Configure internal toolchain
-        if: inputs.build_toolchain == true || steps.parse-toolchain.outputs.toolchain-type == 'internal'
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          echo CONFIG_DEVEL=y >> .config
-          echo CONFIG_AUTOREMOVE=y >> .config
-          echo CONFIG_CCACHE=y >> .config
-
-          echo "CONFIG_TARGET_${{ inputs.target }}=y" >> .config
-          echo "CONFIG_TARGET_${{ inputs.target }}_${{ inputs.subtarget }}=y" >> .config
-
-          make defconfig
-
-      - name: Show configuration
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: ./scripts/diffconfig.sh
-
-      - name: Build tools
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make tools/install -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
-
-      - name: Build toolchain
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make toolchain/install -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
-
-      - name: Build Kernel
-        if: inputs.build_kernel == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make target/compile -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
-
-      - name: Build Kernel Kmods
-        if: inputs.build_kernel == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make package/linux/compile -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
-
-      - name: Build everything
-        if: inputs.build_full == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
-
-      - name: Coverity prepare toolchain
-        if: inputs.coverity_check_packages != ''
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          wget -q https://scan.coverity.com/download/linux64 --post-data "token=${{ secrets.coverity_api_token }}&project=${{ inputs.coverity_project_name }}" -O coverity.tar.gz
-          wget -q https://scan.coverity.com/download/linux64 --post-data "token=${{ secrets.coverity_api_token }}&project=${{ inputs.coverity_project_name }}&md5=1" -O coverity.tar.gz.md5
-          echo ' coverity.tar.gz' >> coverity.tar.gz.md5
-          md5sum -c coverity.tar.gz.md5
-
-          mkdir cov-analysis-linux64
-          tar xzf coverity.tar.gz --strip 1 -C cov-analysis-linux64
-          export PATH=$(pwd)/cov-analysis-linux64/bin:$PATH
-
-          for template in ${{ inputs.coverity_compiler_template_list }}; do
-            cov-configure --template --comptype gcc --compiler "$template"
-          done
-
-      - name: Clean and recompile packages with Coverity toolchain
-        if: inputs.coverity_check_packages != ''
-        shell: su buildbot -c "bash {0}"
-        working-directory: openwrt
-        run: |
-          set -o pipefail -o errexit
-
-          coverity_check_packages=(${{ inputs.coverity_check_packages }})
-          printf -v clean_packages "package/%s/clean " "${coverity_check_packages[@]}"
-          make -j$(nproc) BUILD_LOG=1 $clean_packages || ret=$? .github/workflows/scripts/show_build_failures.sh
-
-          coverity_force_compile_packages=(${{ inputs.coverity_force_compile_packages }})
-          printf -v force_compile_packages "package/%s/compile " "${coverity_force_compile_packages[@]}"
-          make -j$(nproc) BUILD_LOG=1 $force_compile_packages || ret=$? .github/workflows/scripts/show_build_failures.sh
-
-          printf -v compile_packages "package/%s/compile " "${coverity_check_packages[@]}"
-          export PATH=$(pwd)/cov-analysis-linux64/bin:$PATH
-          cov-build --dir cov-int make -j $(nproc) BUILD_LOG=1 $compile_packages || ret=$? .github/workflows/scripts/show_build_failures.sh
-
-      - name: Upload build to Coverity for analysis
-        if: inputs.coverity_check_packages != ''
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          tar czf cov-int.tar.gz ./cov-int
-          curl \
-            --form token="${{ secrets.coverity_api_token }}" \
-            --form email="contact@openwrt.org" \
-            --form file=@cov-int.tar.gz \
-            --form version="${{ github.ref_name }}-${{ github.sha }}" \
-            --form description="OpenWrt ${{ github.ref_name }}-${{ github.sha }}" \
-            "https://scan.coverity.com/builds?project=${{ inputs.coverity_project_name }}"
-
-      - name: Upload logs
-        if: failure()
-        uses: actions/upload-artifact@v3
-        with:
-          name: ${{ inputs.target }}-${{ inputs.subtarget }}-logs
-          path: "openwrt/logs"
diff --git a/.github/workflows/check-kernel-patches.yml b/.github/workflows/check-kernel-patches.yml
deleted file mode 100644
index 1ab4a361f5355e..00000000000000
--- a/.github/workflows/check-kernel-patches.yml
+++ /dev/null
@@ -1,155 +0,0 @@
-name: Refresh kernel for target
-
-on:
-  workflow_call:
-    inputs:
-      target:
-        required: true
-        type: string
-      subtarget:
-        required: true
-        type: string
-      testing:
-        type: boolean
-      use_openwrt_container:
-        type: boolean
-        default: true
-
-permissions:
-  contents: read
-
-jobs:
-  setup_build:
-    name: Setup build
-    runs-on: ubuntu-latest
-    outputs:
-      owner_lc: ${{ steps.lower_owner.outputs.owner_lc }}
-      container_tag: ${{ steps.determine_tools_container.outputs.container_tag }}
-
-    steps:
-      - name: Set lower case owner name
-        id: lower_owner
-        run: |
-          OWNER_LC=$(echo "${{ github.repository_owner }}" \
-            | tr '[:upper:]' '[:lower:]')
-
-          if [ ${{ inputs.use_openwrt_container }} == "true" ]; then
-            OWNER_LC=openwrt
-          fi
-
-          echo "owner_lc=$OWNER_LC" >> $GITHUB_OUTPUT
-
-      # Per branch tools container tag
-      # By default stick to latest
-      # For official test targetting openwrt stable branch
-      # Get the branch or parse the tag and push dedicated tools containers
-      # For local test to use the correct container for stable release testing
-      # you need to use for the branch name a prefix of openwrt-[0-9][0-9].[0-9][0-9]-
-      - name: Determine tools container tag
-        id: determine_tools_container
-        run: |
-          CONTAINER_TAG=latest
-          if [ -n "${{ github.base_ref }}" ]; then
-            if echo "${{ github.base_ref }}" | grep -q -E '^openwrt-[0-9][0-9]\.[0-9][0-9]$'; then
-              CONTAINER_TAG="${{ github.base_ref }}"
-            fi
-          elif [ ${{ github.ref_type }} == "branch" ]; then
-            if echo "${{ github.ref_name }}" | grep -q -E '^openwrt-[0-9][0-9]\.[0-9][0-9]$'; then
-              CONTAINER_TAG=${{ github.ref_name }}
-            elif echo "${{ github.ref_name }}" | grep -q -E '^openwrt-[0-9][0-9]\.[0-9][0-9]-'; then
-              CONTAINER_TAG="$(echo ${{ github.ref_name }} | sed 's/^\(openwrt-[0-9][0-9]\.[0-9][0-9]\)-.*/\1/')"
-            fi
-          elif [ ${{ github.ref_type }} == "tag" ]; then
-            if echo "${{ github.ref_name }}" | grep -q -E '^v[0-9][0-9]\.[0-9][0-9]\..+'; then
-              CONTAINER_TAG=openwrt-"$(echo ${{ github.ref_name }} | sed 's/^v\([0-9][0-9]\.[0-9][0-9]\)\..\+/\1/')"
-            fi
-          fi
-          echo "Tools container to use tools:$CONTAINER_TAG"
-          echo "container_tag=$CONTAINER_TAG" >> $GITHUB_OUTPUT
-
-  check-patch:
-    name: Check Kernel patches
-    needs: setup_build
-    runs-on: ubuntu-latest
-
-    container: ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }}
-
-    permissions:
-      contents: read
-      packages: read
-
-    steps:
-      - name: Checkout master directory
-        uses: actions/checkout@v3
-        with:
-          path: openwrt
-
-      - name: Fix permission
-        run: |
-          chown -R buildbot:buildbot openwrt
-
-      - name: Prepare prebuilt tools
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          mkdir -p staging_dir build_dir
-          ln -sf /prebuilt_tools/staging_dir/host staging_dir/host
-          ln -sf /prebuilt_tools/build_dir/host build_dir/host
-
-          ./scripts/ext-tools.sh --refresh
-
-      - name: Configure testing kernel
-        if: inputs.testing == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          echo CONFIG_TESTING_KERNEL=y >> .config
-
-      - name: Configure system
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          echo CONFIG_ALL_KMODS=y >> .config
-          echo CONFIG_DEVEL=y >> .config
-          echo CONFIG_AUTOREMOVE=y >> .config
-          echo CONFIG_CCACHE=y >> .config
-
-          echo "CONFIG_TARGET_${{ inputs.target }}=y" >> .config
-          echo "CONFIG_TARGET_${{ inputs.target }}_${{ inputs.subtarget }}=y" >> .config
-
-          make defconfig
-
-      - name: Build tools
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make tools/quilt/compile -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
-
-      - name: Refresh Kernel patches
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make target/linux/refresh V=s
-
-      - name: Validate Refreshed Kernel Patches
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: |
-          . .github/workflows/scripts/ci_helpers.sh
-
-          if git diff --name-only --exit-code; then
-            success "Kernel patches for ${{ inputs.target }}/${{ inputs.subtarget }} seems ok"
-          else
-            err "Kernel patches for ${{ inputs.target }}/${{ inputs.subtarget }} require refresh. (run 'make target/linux/refresh' and force push this pr)"
-            err "You can also check the provided artifacts with the refreshed patch from this CI run."
-            mkdir ${{ inputs.target }}-${{ inputs.subtarget }}-refreshed
-            for f in $(git diff --name-only); do
-              cp --parents $f ${{ inputs.target }}-${{ inputs.subtarget }}-refreshed/
-            done
-            exit 1
-          fi
-
-      - name: Upload Refreshed Patches
-        if: failure()
-        uses: actions/upload-artifact@v3
-        with:
-          name: ${{ inputs.target }}-${{ inputs.subtarget }}-refreshed
-          path: openwrt/${{ inputs.target }}-${{ inputs.subtarget }}-refreshed
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index db59ef8ca68e86..f54695986daace 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -15,51 +15,5 @@ jobs:
     permissions:
       contents: read
       packages: read
-    uses: ./.github/workflows/build.yml
-    with:
-      target: x86
-      subtarget: 64
-      build_full: true
-      include_feeds: true
-      coverity_compiler_template_list: >-
-        x86_64-openwrt-linux-gcc
-        x86_64-openwrt-linux-musl-gcc
-      #  qosify fails to build with cov-build
-      coverity_check_packages: >-
-        cgi-io
-        dnsmasq
-        dropbear
-        firewall
-        fstools
-        fwtool
-        iwinfo
-        jsonfilter
-        libnl-tiny
-        libubox
-        mtd
-        netifd
-        odhcp6c
-        odhcpd
-        opkg
-        procd
-        relayd
-        rpcd
-        swconfig
-        ubox
-        ubus
-        ucert
-        uci
-        uclient
-        ucode
-        ugps
-        uhttpd
-        umbim
-        umdns
-        unetd
-        uqmi
-        urngd
-        usbmode
-        usign
-        usteer
-        ustp
-        ustream-ssl
+      actions: write
+    uses: openwrt/actions-shared-workflows/.github/workflows/coverity.yml@main
diff --git a/.github/workflows/kernel.yml b/.github/workflows/kernel.yml
index 02aee8b27cc8ad..43c610ab4f00cb 100644
--- a/.github/workflows/kernel.yml
+++ b/.github/workflows/kernel.yml
@@ -17,6 +17,8 @@ on:
       - 'include/kernel*'
       - 'package/kernel/**'
       - 'target/linux/**'
+    branches-ignore:
+      - master
 
 permissions:
   contents: read
@@ -26,106 +28,15 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  determine_targets:
-    name: Set targets
-    runs-on: ubuntu-latest
-    outputs:
-      targets_subtargets: ${{ steps.find_targets.outputs.targets_subtargets }}
-      targets: ${{ steps.find_targets.outputs.targets }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 2
-
-      - name: Get changed files
-        id: changed-files
-        uses: tj-actions/changed-files@v35
-
-      - name: Set targets
-        id: find_targets
-        run: |
-          ALL_TARGETS="$(perl ./scripts/dump-target-info.pl targets 2>/dev/null)"
-          CHANGED_FILES="$(echo ${{ steps.changed-files.outputs.all_changed_files }} | tr ' ' '\n')"
-
-          TARGETS_SUBTARGETS="$(echo "$ALL_TARGETS" | sort -u -t '/' -k1 | awk '{ print $1 }')"
-          TARGETS="$(echo "$ALL_TARGETS" | sort -u -t '/' -k1,1 | awk '{ print $1 }')"
-
-          # On testing non-specific target, skip testing each subtarget
-          if echo "$CHANGED_FILES" | grep -v -q target/linux ||
-            echo "$CHANGED_FILES" | grep -q target/linux/generic; then
-            TARGETS_SUBTARGETS=$TARGETS
-          fi
-
-          JSON_TARGETS_SUBTARGETS='['
-          FIRST=1
-          for TARGET in $TARGETS_SUBTARGETS; do
-            if echo "$CHANGED_FILES" | grep -v -q target/linux ||
-              echo "$CHANGED_FILES" | grep -q target/linux/generic ||
-              echo "$CHANGED_FILES" | grep -q $(echo $TARGET | cut -d "/" -f 1); then
-              TUPLE='{"target":"'"$(echo $TARGET | cut -d "/" -f 1)"'","subtarget":"'"$(echo $TARGET | cut -d "/" -f 2)"'"}'
-              [[ $FIRST -ne 1 ]] && JSON_TARGETS_SUBTARGETS="$JSON_TARGETS_SUBTARGETS"','
-              JSON_TARGETS_SUBTARGETS="$JSON_TARGETS_SUBTARGETS""$TUPLE"
-              FIRST=0
-            fi
-          done
-          JSON_TARGETS_SUBTARGETS="$JSON_TARGETS_SUBTARGETS"']'
-
-          JSON_TARGETS='['
-          FIRST=1
-          for TARGET in $TARGETS; do
-            if echo "$CHANGED_FILES" | grep -v -q target/linux ||
-              echo "$CHANGED_FILES" | grep -q target/linux/generic ||
-              echo "$CHANGED_FILES" | grep -q $(echo $TARGET | cut -d "/" -f 1); then
-              TUPLE='{"target":"'"$(echo $TARGET | cut -d "/" -f 1)"'","subtarget":"'"$(echo $TARGET | cut -d "/" -f 2)"'"}'
-              [[ $FIRST -ne 1 ]] && JSON_TARGETS="$JSON_TARGETS"','
-              JSON_TARGETS="$JSON_TARGETS""$TUPLE"
-              FIRST=0
-            fi
-          done
-          JSON_TARGETS="$JSON_TARGETS"']'
-
-          echo -e "\n---- targets to build ----\n"
-          echo "$JSON_TARGETS_SUBTARGETS"
-          echo -e "\n---- targets to build ----\n"
-
-          echo -e "\n---- targets to check patch ----\n"
-          echo "$JSON_TARGETS"
-          echo -e "\n---- targets to check patch ----\n"
-
-          echo "targets_subtargets=$JSON_TARGETS_SUBTARGETS" >> $GITHUB_OUTPUT
-          echo "targets=$JSON_TARGETS" >> $GITHUB_OUTPUT
-
-  build:
-    name: Build Kernel with external toolchain
-    needs: determine_targets
-    permissions:
-      contents: read
-      packages: read
-    strategy:
-       fail-fast: False
-       matrix:
-         include: ${{fromJson(needs.determine_targets.outputs.targets_subtargets)}}
-    uses: ./.github/workflows/build.yml
-    with:
-      target: ${{ matrix.target }}
-      subtarget: ${{ matrix.subtarget }}
-      build_kernel: true
-      build_all_kmods: true
-
-  check-kernel-patches:
-    name: Check Kernel patches
-    needs: determine_targets
+  build-kernels:
+    name: Build all affected Kernels
     permissions:
       contents: read
       packages: read
-    strategy:
-       fail-fast: False
-       matrix:
-         include: ${{fromJson(needs.determine_targets.outputs.targets)}}
-    uses: ./.github/workflows/check-kernel-patches.yml
-    with:
-      target: ${{ matrix.target }}
-      subtarget: ${{ matrix.subtarget }}
-
+      actions: write
+    secrets:
+      ccache_s3_endpoint: ${{ secrets.CCACHE_S3_ENDPOINT }}
+      ccache_s3_bucket: ${{ secrets.CCACHE_S3_BUCKET }}
+      ccache_s3_access_key: ${{ secrets.CCACHE_S3_ACCESS_KEY }}
+      ccache_s3_secret_key: ${{ secrets.CCACHE_S3_SECRET_KEY }}
+    uses: openwrt/actions-shared-workflows/.github/workflows/kernel.yml@main
diff --git a/.github/workflows/label-kernel.yml b/.github/workflows/label-kernel.yml
index 67faaddfcdfce4..655d7d6ff371b5 100644
--- a/.github/workflows/label-kernel.yml
+++ b/.github/workflows/label-kernel.yml
@@ -7,44 +7,10 @@ on:
       - labeled
 
 jobs:
-  set_target:
-    if: startsWith(github.event.label.name, 'ci:kernel:')
-    name: Set target
-    runs-on: ubuntu-latest
-    outputs:
-      target: ${{ steps.set_target.outputs.target }}
-      subtarget: ${{ steps.set_target.outputs.subtarget }}
-
-    steps:
-      - name: Set target
-        id: set_target
-        env:
-          CI_EVENT_LABEL_NAME: ${{ github.event.label.name }}
-        run: |
-          echo "$CI_EVENT_LABEL_NAME" | sed -n 's/.*:\(.*\):\(.*\)$/target=\1/p' | tee --append $GITHUB_OUTPUT
-          echo "$CI_EVENT_LABEL_NAME" | sed -n 's/.*:\(.*\):\(.*\)$/subtarget=\2/p' | tee --append $GITHUB_OUTPUT
-
-  build_kernel:
-    name: Build Kernel with external toolchain
-    needs: set_target
-    permissions:
-      contents: read
-      packages: read
-    uses: ./.github/workflows/build.yml
-    with:
-      container_name: toolchain
-      target: ${{ needs.set_target.outputs.target }}
-      subtarget: ${{ needs.set_target.outputs.subtarget }}
-      build_kernel: true
-      build_all_kmods: true
-
-  check-kernel-patches:
-    name: Check Kernel patches
-    needs: set_target
+  build-kernels-label:
+    name: Build all affected Kernels from defined label
     permissions:
       contents: read
       packages: read
-    uses: ./.github/workflows/check-kernel-patches.yml
-    with:
-      target: ${{ needs.set_target.outputs.target }}
-      subtarget: ${{ needs.set_target.outputs.subtarget }}
+      actions: write
+    uses: openwrt/actions-shared-workflows/.github/workflows/label-kernel.yml@main
diff --git a/.github/workflows/label-target.yml b/.github/workflows/label-target.yml
index 78aea28b106b80..989ee9fcb43491 100644
--- a/.github/workflows/label-target.yml
+++ b/.github/workflows/label-target.yml
@@ -7,35 +7,10 @@ on:
       - labeled
 
 jobs:
-  set_target:
-    if: startsWith(github.event.label.name, 'ci:target:')
-    name: Set target
-    runs-on: ubuntu-latest
-    outputs:
-      target: ${{ steps.set_target.outputs.target }}
-      subtarget: ${{ steps.set_target.outputs.subtarget }}
-
-    steps:
-      - name: Set target
-        id: set_target
-        env:
-          CI_EVENT_LABEL_NAME: ${{ github.event.label.name }}
-        run: |
-          echo "$CI_EVENT_LABEL_NAME" | sed -n 's/.*:\(.*\):\(.*\)$/target=\1/p' | tee --append $GITHUB_OUTPUT
-          echo "$CI_EVENT_LABEL_NAME" | sed -n 's/.*:\(.*\):\(.*\)$/subtarget=\2/p' | tee --append $GITHUB_OUTPUT
-
-  build_target:
-    name: Build target
-    needs: set_target
+  build-target-label:
+    name: Build target from defined label
     permissions:
       contents: read
       packages: read
-    uses: ./.github/workflows/build.yml
-    with:
-      container_name: toolchain
-      target: ${{ needs.set_target.outputs.target }}
-      subtarget: ${{ needs.set_target.outputs.subtarget }}
-      build_full: true
-      build_all_kmods: true
-      build_all_boards: true
-      build_all_modules: true
+      actions: write
+    uses: openwrt/actions-shared-workflows/.github/workflows/label-target.yml@main
diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
index e2f932b1ba3d42..f061c1cd371a5d 100644
--- a/.github/workflows/packages.yml
+++ b/.github/workflows/packages.yml
@@ -3,7 +3,6 @@ name: Build all core packages
 on:
   pull_request:
     paths:
-      - '.github/workflows/build.yml'
       - '.github/workflows/packages.yml'
       - 'config/**'
       - 'include/**'
@@ -12,13 +11,14 @@ on:
       - 'toolchain/**'
   push:
     paths:
-      - '.github/workflows/build.yml'
       - '.github/workflows/packages.yml'
       - 'config/**'
       - 'include/**'
       - 'package/**'
       - 'target/linux/generic/**'
       - 'toolchain/**'
+    branches-ignore:
+      - master
 
 permissions:
   contents: read
@@ -28,25 +28,15 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  build:
-    name: Build Packages with external toolchain
+  build-packages:
+    name: Build all core packages for selected target
     permissions:
       contents: read
       packages: read
-    strategy:
-      fail-fast: False
-      matrix:
-        include:
-          - target: malta
-            subtarget: be
-          - target: x86
-            subtarget: 64
-    uses: ./.github/workflows/build.yml
-    with:
-      target: ${{ matrix.target }}
-      subtarget: ${{ matrix.subtarget }}
-      build_kernel: true
-      build_all_kmods: true
-      build_all_modules: true
-      build_full: true
-
+      actions: write
+    secrets:
+      ccache_s3_endpoint: ${{ secrets.CCACHE_S3_ENDPOINT }}
+      ccache_s3_bucket: ${{ secrets.CCACHE_S3_BUCKET }}
+      ccache_s3_access_key: ${{ secrets.CCACHE_S3_ACCESS_KEY }}
+      ccache_s3_secret_key: ${{ secrets.CCACHE_S3_SECRET_KEY }}
+    uses: openwrt/actions-shared-workflows/.github/workflows/packages.yml@main
diff --git a/.github/workflows/push-containers.yml b/.github/workflows/push-containers.yml
index e74e7c22167833..74f534d57a4a40 100644
--- a/.github/workflows/push-containers.yml
+++ b/.github/workflows/push-containers.yml
@@ -6,9 +6,10 @@ on:
       - 'include/version.mk'
       - 'include/cmake.mk'
       - 'tools/**'
-      - '.github/workflows/build-tools.yml'
       - '.github/workflows/push-containers.yml'
-      - '.github/workflows/Dockerfile.tools'
+      - 'toolchain/**'
+    branches-ignore:
+      - master
 
 permissions:
   contents: read
@@ -18,81 +19,10 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  build-linux-buildbot:
-    name: Build tools with buildbot container
-    if: ${{ github.repository_owner  == 'openwrt' }}
-    uses: ./.github/workflows/build-tools.yml
-    with:
-      generate_prebuilt_artifacts: true
-
-  push-tools-container:
-    needs: build-linux-buildbot
-    name: Push prebuilt tools container
-    if: ${{ github.repository_owner  == 'openwrt' }}
-    runs-on: ubuntu-latest
-
+  build-push-containers:
+    name: Build and Push all prebuilt containers
     permissions:
       contents: read
       packages: write
-
-    steps:
-      - name: Set lower case owner name
-        env:
-          OWNER: ${{ github.repository_owner }}
-        run: |
-          echo "OWNER_LC=${OWNER,,}" >> "$GITHUB_ENV"
-
-      # Per branch tools container tag
-      # By default stick to latest
-      # For official test targetting openwrt stable branch
-      # Get the branch or parse the tag and push dedicated tools containers
-      # Any branch that will match this pattern openwrt-[0-9][0-9].[0-9][0-9]
-      # will refresh the tools container with the matching tag.
-      # (example branch openwrt-22.03 -> tools:openwrt-22.03)
-      # (example branch openwrt-22.03-test -> tools:openwrt-22.03)
-      - name: Determine tools container tag
-        run: |
-          CONTAINER_TAG=latest
-
-          if [ ${{ github.ref_type }} == "branch" ]; then
-            if echo "${{ github.ref_name }}" | grep -q -E 'openwrt-[0-9][0-9]\.[0-9][0-9]'; then
-              CONTAINER_TAG="$(echo ${{ github.ref_name }} | sed 's/^\(openwrt-[0-9][0-9]\.[0-9][0-9]\).*/\1/')"
-            fi
-          elif [ ${{ github.ref_type }} == "tag" ]; then
-            if echo "${{ github.ref_name }}" | grep -q -E 'v[0-9][0-9]\.[0-9][0-9]\..+'; then
-              CONTAINER_TAG=openwrt-"$(echo ${{ github.ref_name }} | sed 's/v\([0-9][0-9]\.[0-9][0-9]\)\..\+/\1/')"
-            fi
-          fi
-
-          echo "Tools container to push tools:$CONTAINER_TAG"
-          echo "CONTAINER_TAG=$CONTAINER_TAG" >> "$GITHUB_ENV"
-
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          path: 'openwrt'
-
-      - name: Download prebuilt tools from build job
-        uses: actions/download-artifact@v3
-        with:
-          name: linux-buildbot-prebuilt-tools
-          path: openwrt
-
-      - name: Extract prebuild tools
-        working-directory: openwrt
-        run: tar -xf tools.tar
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v3
-        with:
-          context: openwrt
-          push: true
-          tags: ghcr.io/${{ env.OWNER_LC }}/tools:${{ env.CONTAINER_TAG }}
-          file: openwrt/.github/workflows/Dockerfile.tools
+      actions: write
+    uses: openwrt/actions-shared-workflows/.github/workflows/push-containers.yml@main
diff --git a/.github/workflows/toolchain.yml b/.github/workflows/toolchain.yml
index 5755ca25b9db4a..0bc9fec1795f76 100644
--- a/.github/workflows/toolchain.yml
+++ b/.github/workflows/toolchain.yml
@@ -3,14 +3,14 @@ name: Build Toolchains
 on:
   pull_request:
     paths:
-      - '.github/workflows/build.yml'
       - '.github/workflows/toolchain.yml'
       - 'toolchain/**'
   push:
     paths:
-      - '.github/workflows/build.yml'
       - '.github/workflows/toolchain.yml'
       - 'toolchain/**'
+    branches-ignore:
+      - master
 
 permissions:
   contents: read
@@ -20,51 +20,10 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  determine_targets:
-    name: Set targets
-    runs-on: ubuntu-latest
-    outputs:
-      target: ${{ steps.find_targets.outputs.target }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Set targets
-        id: find_targets
-        run: |
-          export TARGETS="$(perl ./scripts/dump-target-info.pl targets 2>/dev/null \
-            | sort -u -t '/' -k1,1 \
-            | awk '{ print $1 }')"
-
-          JSON='['
-          FIRST=1
-          for TARGET in $TARGETS; do
-            TUPLE='{"target":"'"$(echo $TARGET | cut -d "/" -f 1)"'","subtarget":"'"$(echo $TARGET | cut -d "/" -f 2)"'"}'
-            [[ $FIRST -ne 1 ]] && JSON="$JSON"','
-            JSON="$JSON""$TUPLE"
-            FIRST=0
-          done
-          JSON="$JSON"']'
-
-           echo -e "\n---- targets ----\n"
-           echo "$JSON"
-           echo -e "\n---- targets ----\n"
-
-           echo "target=$JSON" >> $GITHUB_OUTPUT
-
-  build:
-    name: Build Target Toolchain
-    needs: determine_targets
+  build-toolchains:
+    name: Build Toolchains for each target
     permissions:
       contents: read
       packages: read
-    strategy:
-       fail-fast: False
-       matrix:
-         include: ${{fromJson(needs.determine_targets.outputs.target)}}
-    uses: ./.github/workflows/build.yml
-    with:
-      target: ${{ matrix.target }}
-      subtarget: ${{ matrix.subtarget }}
-      build_toolchain: true
+      actions: write
+    uses: openwrt/actions-shared-workflows/.github/workflows/toolchain.yml@main
diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
index 76ebdc664b89ae..35904a5e564f65 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/tools.yml
@@ -5,14 +5,14 @@ on:
     paths:
       - 'include/**'
       - 'tools/**'
-      - '.github/workflows/build-tools.yml'
       - '.github/workflows/tools.yml'
   push:
     paths:
       - 'include/**'
       - 'tools/**'
-      - '.github/workflows/build-tools.yml'
       - '.github/workflows/tools.yml'
+    branches-ignore:
+      - master
 
 permissions:
   contents: read
@@ -22,72 +22,6 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  build-macos-latest:
-    name: Build tools with macos latest
-    runs-on: macos-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          path: openwrt
-
-      - name: Setup MacOS
-        run: |
-          echo "WORKPATH=/Volumes/OpenWrt" >> "$GITHUB_ENV"
-          hdiutil create -size 20g -type SPARSE -fs "Case-sensitive HFS+" -volname OpenWrt OpenWrt.sparseimage
-          hdiutil attach OpenWrt.sparseimage
-          mv "$GITHUB_WORKSPACE/openwrt" /Volumes/OpenWrt/
-
-      - name: Install required prereq on MacOS
-        working-directory: ${{ env.WORKPATH }}/openwrt
-        run: |
-          brew install \
-            automake \
-            coreutils \
-            diffutils \
-            findutils \
-            gawk \
-            git-extras \
-            gnu-getopt \
-            gnu-sed \
-            grep \
-            make
-
-            echo "/bin" >> "$GITHUB_PATH"
-            echo "/sbin/Library/Apple/usr/bin" >> "$GITHUB_PATH"
-            echo "/usr/bin" >> "$GITHUB_PATH"
-            echo "/usr/local/bin" >> "$GITHUB_PATH"
-            echo "/usr/local/opt/coreutils/bin" >> "$GITHUB_PATH"
-            echo "/usr/local/opt/findutils/libexec/gnubin" >> "$GITHUB_PATH"
-            echo "/usr/local/opt/gettext/bin" >> "$GITHUB_PATH"
-            echo "/usr/local/opt/gnu-getopt/bin" >> "$GITHUB_PATH"
-            echo "/usr/local/opt/make/libexec/gnubin" >> "$GITHUB_PATH"
-            echo "/usr/local/opt/make/libexec/gnubin" >> "$GITHUB_PATH"
-            echo "/usr/sbin" >> "$GITHUB_PATH"
-
-      - name: Make prereq
-        working-directory: ${{ env.WORKPATH }}/openwrt
-        run: make defconfig
-
-      - name: Build tools MacOS
-        working-directory: ${{ env.WORKPATH }}/openwrt
-        run: make tools/install -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
-
-      - name: Upload logs
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: macos-latest-logs
-          path: ${{ env.WORKPATH }}/openwrt/logs
-
-      - name: Upload config
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: macos-latest-config
-          path: ${{ env.WORKPATH }}/openwrt/.config
-
-  build-linux-buildbot:
-    name: Build tools with buildbot container
-    uses: ./.github/workflows/build-tools.yml
+  build-tools:
+    name: Build host tools for linux and macos based systems
+    uses: openwrt/actions-shared-workflows/.github/workflows/tools.yml@main