diff --git a/.github/workflows/build-ami-with-packer.yml b/.github/workflows/build-ami-with-packer.yml
index ee5392338b..4b3fd62b64 100644
--- a/.github/workflows/build-ami-with-packer.yml
+++ b/.github/workflows/build-ami-with-packer.yml
@@ -12,7 +12,8 @@ name: Build AMI With Packer Workflow
 
 on:
   push:
-    tags: ["v[0-9].[0-9]+.[0-9]+"]
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
 
 env:
   PACKER_LOG: 1
@@ -28,7 +29,6 @@ jobs:
       - name: Checkout code into the directory
         uses: actions/checkout@v3
 
-
       - name: Environment version target
         run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
         # run: echo ${{ env.RELEASE_VERSION }}
diff --git a/.github/workflows/build-dependencies.yml b/.github/workflows/build-dependencies.yml
index 4eeb238726..e442f8dc89 100644
--- a/.github/workflows/build-dependencies.yml
+++ b/.github/workflows/build-dependencies.yml
@@ -12,10 +12,13 @@ name: Build Dependencies Workflow
 
 on:
   pull_request:
+    branches:
+      - master
+      - develop
 
   push:
     tags:
-      - v*
+      - 'v[0-9]+.[0-9]+.[0-9]+'
     branches:
       - master
       - develop
diff --git a/.github/workflows/code-test-coverage.yml b/.github/workflows/code-test-coverage.yml
index bb1be36296..4f87bf8335 100644
--- a/.github/workflows/code-test-coverage.yml
+++ b/.github/workflows/code-test-coverage.yml
@@ -12,9 +12,16 @@ name: Code Test Coverage Workflow
 
 on:
   pull_request:
+    branches:
+      - master
+      - Develop
 
   push:
-
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+    branches:
+      - master
+      - Develop
 
 jobs:
   code-test-coverage:
@@ -25,10 +32,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
-        with:
-          fetch-depth: 2
 
-      - name: Setup Go
+      - name: Setup Go environment explicitly
         uses: actions/setup-go@v3
         with:
           go-version: "1.19"
@@ -37,13 +42,33 @@ jobs:
       - name: Generate full test coverage report using go-acc
         run: make test:coverage
 
-      - name: Upload coverage to Codecov
+      - name: Upload coverage to Codecov without token, retry on failure
+        env: 
+          codecov_secret: ${{ secrets.CODECOV_TOKEN }}
+        if: env.codecov_secret == ''
+        uses: Wandalen/wretry.action@v1.0.36
+        with:
+          attempt_limit: 5
+          attempt_delay: 10000
+          action: codecov/codecov-action@v3
+          with: |
+            fail_ci_if_error: true
+            files: ./coverage.txt
+            flags: defradb-tests
+            name: codecov-report-no-token
+            verbose: true
+
+      - name: Upload coverage to Codecov with token
+        env: 
+          codecov_secret: ${{ secrets.CODECOV_TOKEN }}
+        if: env.codecov_secret != ''
         uses: codecov/codecov-action@v3
         with:
-          fail_ci_if_error: true
+          token: ${{ env.codecov_secret }}
           files: ./coverage.txt
-          flags: defra-tests
-          name: codecov-umbrella
+          flags: defradb-tests
+          name: codecov-report-token
+          fail_ci_if_error: true
           verbose: true
           # path_to_write_report: ./coverage/codecov_report.txt
           # directory: ./coverage/reports/
diff --git a/.github/workflows/deploy-ami-with-terraform.yml b/.github/workflows/deploy-ami-with-terraform.yml
index 3ec9d074ab..80a0daefde 100644
--- a/.github/workflows/deploy-ami-with-terraform.yml
+++ b/.github/workflows/deploy-ami-with-terraform.yml
@@ -28,6 +28,9 @@ on:
       - completed
 
   pull_request:
+    branches:
+      - master
+      - develop
 
 jobs:
   deploy-ami-with-terraform:
diff --git a/.github/workflows/detect-change.yml b/.github/workflows/detect-change.yml
index 65238e78da..f17a4d80ba 100644
--- a/.github/workflows/detect-change.yml
+++ b/.github/workflows/detect-change.yml
@@ -12,10 +12,13 @@ name: Detect Change Workflow
 
 on:
   pull_request:
+    branches:
+      - master
+      - develop
 
   push:
     tags:
-      - v*
+      - 'v[0-9]+.[0-9]+.[0-9]+'
     branches:
       - master
       - develop
diff --git a/.github/workflows/generate-code-coverage.yml b/.github/workflows/generate-code-coverage.yml
new file mode 100644
index 0000000000..e93852f18b
--- /dev/null
+++ b/.github/workflows/generate-code-coverage.yml
@@ -0,0 +1,67 @@
+# Copyright 2023 Democratized Data Foundation
+#
+# Use of this software is governed by the Business Source License
+# included in the file licenses/BSL.txt.
+#
+# As of the Change Date specified in that file, in accordance with
+# the Business Source License, use of this software will be governed
+# by the Apache License, Version 2.0, included in the file
+# licenses/APL.txt.
+
+name: Generate Code Coverage Workflow
+
+on:
+  pull_request:
+    branches:
+      - master
+      - Develop
+
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+    branches:
+      - master
+      - Develop
+
+env:
+  # Note: latest head on PR is different (on pull_request) than the head on merge commit
+  # that triggers this (on push).
+  # Reference: https://github.com/orgs/community/discussions/26325
+  COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+
+jobs:
+  generate-code-coverage:
+    name: Generate code coverage job
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Print pull_request head and github SHA
+        run: |
+          echo "COMMIT_SHA=[${COMMIT_SHA}]\n"
+          echo "github.event.pull_request.head.sha=[${{github.event.pull_request.head.sha}}]\n"
+          echo "github.sha=[${{github.sha}}]\n"
+
+      - name: Dump GitHub context
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github.event.workflow_run) }}
+        run: echo "$GITHUB_CONTEXT"
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Setup Go environment explicitly
+        uses: actions/setup-go@v3
+        with:
+          go-version: "1.19"
+          check-latest: true
+
+      - name: Generate full test coverage report
+        run: make test:coverage
+
+      - name: Save coverage report as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: coverage-report-artifact-${{ env.COMMIT_SHA }}
+          path: coverage.txt
+          retention-days: 90
diff --git a/.github/workflows/lint-then-benchmark.yml b/.github/workflows/lint-then-benchmark.yml
index 9c1bdf42eb..172df4d6b8 100644
--- a/.github/workflows/lint-then-benchmark.yml
+++ b/.github/workflows/lint-then-benchmark.yml
@@ -15,7 +15,7 @@ on:
 
   push:
     tags:
-      - v*
+      - 'v[0-9]+.[0-9]+.[0-9]+'
     branches:
       - master
       - develop
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index 1bab3e5a05..e078dfcfec 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -12,6 +12,9 @@ name: Run Tests Workflow
 
 on:
   pull_request:
+    branches:
+      - master
+      - develop
 
   push:
 
diff --git a/.github/workflows/start-binary.yml b/.github/workflows/start-binary.yml
index 97db056df9..6061b1c59e 100644
--- a/.github/workflows/start-binary.yml
+++ b/.github/workflows/start-binary.yml
@@ -12,10 +12,13 @@ name: Start Binary Workflow
 
 on:
   pull_request:
+    branches:
+      - master
+      - develop
 
   push:
     tags:
-      - v*
+      - 'v[0-9]+.[0-9]+.[0-9]+'
     branches:
       - master
       - develop
diff --git a/.github/workflows/upload-code-coverage.yml b/.github/workflows/upload-code-coverage.yml
new file mode 100644
index 0000000000..4dd3796f49
--- /dev/null
+++ b/.github/workflows/upload-code-coverage.yml
@@ -0,0 +1,94 @@
+# Copyright 2023 Democratized Data Foundation
+#
+# Use of this software is governed by the Business Source License
+# included in the file licenses/BSL.txt.
+#
+# As of the Change Date specified in that file, in accordance with
+# the Business Source License, use of this software will be governed
+# by the Apache License, Version 2.0, included in the file
+# licenses/APL.txt.
+
+name: Upload Code Coverage Workflow
+
+on:
+  workflow_run:
+    # Warning: this workflow must NOT:
+    # - interact with any new code.
+    # - checkout new code.
+    # - build/compile/run any thing
+    # - make any indirect calls (i.e. make xyz, or npm install, etc.)
+    # Note this workflow:
+    # - will use the base's workflow file state.
+    # - doesn't run on the PR or the branch coming in, it runs on the default branch.
+    # - has read-write repo token
+    # - has access to secrets
+    workflows: ["Generate Code Coverage Workflow"]
+    types:
+      - completed
+
+env:
+  # Note: Since this runs on the state of workflow on the default branch, the
+  # HEAD i.e. `github.sha` is always the default branch, so we try to fetch the
+  # head sha whose workflow triggered this action by `github.event.workflow_run.head_sha`.
+  COMMIT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+
+jobs:
+  upload-code-coverage:
+    name: Upload code coverage job
+
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Print workflow_run head and github SHA
+        run: |
+          echo "COMMIT_SHA=[${COMMIT_SHA}]\n"
+          echo "github.event.workflow_run.head_sha=[${{github.event.workflow_run.head_sha}}]\n"
+          echo "github.sha=[${{github.sha}}]\n"
+
+      - name: Load the coverage report stored as an artifact
+        uses: dawidd6/action-download-artifact@v2
+        with:
+          repo: ${{ github.repository }}
+          workflow: generate-code-coverage.yml
+          workflow_conclusion: success
+          commit: ${{ env.COMMIT_SHA }}
+          name: coverage-report-artifact-${{ env.COMMIT_SHA }}
+          name_is_regexp: false
+          search_artifacts: false
+          check_artifacts: false
+          if_no_artifact_found: fail
+
+      - name: Upload coverage to Codecov without token, retry on failure
+        env:
+          CODECOV_SECRET: ${{ secrets.CODECOV_TOKEN }}
+        if: env.CODECOV_SECRET == ''
+        uses: Wandalen/wretry.action@v1.0.36
+        with:
+          attempt_limit: 5
+          attempt_delay: 10000
+          action: codecov/codecov-action@v3
+          with: |
+            files: ./coverage.txt
+            flags: defradb-tests
+            name: codecov-report
+            sha: ${{ env.COMMIT_SHA }}
+            fail_ci_if_error: true
+            verbose: true
+
+      - name: Upload coverage to Codecov with token
+        env:
+          CODECOV_SECRET: ${{ secrets.CODECOV_TOKEN }}
+        if: env.CODECOV_SECRET != ''
+        uses: codecov/codecov-action@v3
+        with:
+          token: ${{ env.CODECOV_SECRET }}
+          files: ./coverage.txt
+          flags: defradb-tests
+          name: codecov-report
+          sha: ${{ env.COMMIT_SHA }}
+          fail_ci_if_error: true
+          verbose: true
+          # path_to_write_report: ./coverage/codecov_report.txt
+          # directory: ./coverage/reports/