diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 593b966..2102c34 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -18,7 +18,7 @@
       "DOCKER_GROUP_ID": "${localEnv:DOCKER_GROUP_ID}",
       "INTERACTIVE": "true",
       "UPSTREAM_REPO": "microsoft/AzureTRE",
-      "UPSTREAM_REPO_VERSION": "v0.28.0",
+      "UPSTREAM_REPO_VERSION": "v0.29.0",
       "GITHUB_TOKEN": ""
     }
   },
diff --git a/.github/actions/devcontainer_run_command/action.yml b/.github/actions/devcontainer_run_command/action.yml
index fd0e992..c6673f8 100644
--- a/.github/actions/devcontainer_run_command/action.yml
+++ b/.github/actions/devcontainer_run_command/action.yml
@@ -27,12 +27,21 @@ inputs:
   AAD_TENANT_ID:
     description: "The Tenant Id where the App is registered and the Test User is registered for the E2E Tests."
     required: false
+  TEST_APP_ID:
+    description: "The Test Application Id used to interact with the API."
+    required: false
   TEST_ACCOUNT_CLIENT_ID:
     description: "The Test Automation Account Client Id used to interact with the API."
     required: false
   TEST_ACCOUNT_CLIENT_SECRET:
     description: "The Test Automation Account Client Secret used to interact with the API."
     required: false
+  TEST_WORKSPACE_APP_ID:
+    description: "The Test Workspace application Id used to interact with the API."
+    required: false
+  TEST_WORKSPACE_APP_SECRET:
+    description: "The Test Workspace application secret used to interact with the API."
+    required: false
   TRE_ID:
     description: "The TRE Id."
     required: false
@@ -107,6 +116,9 @@ inputs:
     description: "The AppService plan sku used by tests"
     required: false
     default: ""
+  RESOURCE_PROCESSOR_VMSS_SKU:
+    description: "The SKU of the resource processor VMSS."
+    required: false
   RESOURCE_PROCESSOR_NUMBER_PROCESSES_PER_INSTANCE:
     description: "The number of resource processor processes to create for parallel operations"
     required: false
@@ -181,7 +193,7 @@ runs:
         echo "AZURE_ENVIRONMENT=$azure_env" >> $GITHUB_ENV
 
     - name: Azure Login
-      uses: azure/login@v2
+      uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
       if: contains(inputs.COMMAND, 'make bootstrap') != true
       with:
         client-id: ${{ inputs.AZURE_CLIENT_ID }}
@@ -198,14 +210,14 @@ runs:
     - name: Construct TRE_URL
       shell: bash
       run: |
-        source .github/scripts/construct_tre_url.sh
+        source devops/scripts/construct_tre_url.sh
         tre_url=$(construct_tre_url "${{ inputs.TRE_ID }}" "${{ inputs.LOCATION }}" "${{ env.AZURE_ENVIRONMENT }}")
         echo "TRE_URL=$tre_url" >> $GITHUB_ENV
 
     - name: Construct ARM_ENVIRONMENT
       shell: bash
       run: |
-        source .github/scripts/convert_azure_env_to_arm_env.sh
+        source devops/scripts/convert_azure_env_to_arm_env.sh
         arm_environment=$(convert_azure_env_to_arm_env "${{ env.AZURE_ENVIRONMENT }}")
         echo "ARM_ENVIRONMENT=$arm_environment" >> $GITHUB_ENV
 
@@ -275,6 +287,9 @@ runs:
           -e TRE_ID="${{ inputs.TRE_ID }}" \
           -e TF_VAR_tre_id="${{ inputs.TRE_ID }}" \
           -e TRE_URL="${{ env.TRE_URL }}" \
+          -e TEST_WORKSPACE_APP_ID="${{ inputs.TEST_WORKSPACE_APP_ID }}" \
+          -e TEST_WORKSPACE_APP_SECRET="${{ inputs.TEST_WORKSPACE_APP_SECRET }}" \
+          -e TEST_APP_ID="${{ inputs.TEST_APP_ID }}" \
           -e TEST_ACCOUNT_CLIENT_ID="${{ inputs.TEST_ACCOUNT_CLIENT_ID }}" \
           -e TEST_ACCOUNT_CLIENT_SECRET="${{ inputs.TEST_ACCOUNT_CLIENT_SECRET }}" \
           -e IS_API_SECURED=${{ inputs.IS_API_SECURED }} \
@@ -291,6 +306,8 @@ runs:
             && inputs.RP_BUNDLE_VALUES) || '{}' }}' \
           -e UI_SITE_NAME="${{ inputs.UI_SITE_NAME }}" \
           -e UI_FOOTER_TEXT="${{ inputs.UI_FOOTER_TEXT }}" \
+          -e TF_VAR_resource_processor_vmss_sku="${{ (inputs.RESOURCE_PROCESSOR_VMSS_SKU != ''
+            && inputs.RESOURCE_PROCESSOR_VMSS_SKU) || 'Standard_B2s' }}" \
           -e TF_VAR_resource_processor_number_processes_per_instance="${{ (inputs.RESOURCE_PROCESSOR_NUMBER_PROCESSES_PER_INSTANCE != ''
             && inputs.RESOURCE_PROCESSOR_NUMBER_PROCESSES_PER_INSTANCE) || 5 }}" \
           -e FIREWALL_SKU=${{ inputs.FIREWALL_SKU != '' && inputs.FIREWALL_SKU || 'Standard' }} \
diff --git a/.github/linters/.tflint.hcl b/.github/linters/.tflint.hcl
index bedc549..357c6d3 100644
--- a/.github/linters/.tflint.hcl
+++ b/.github/linters/.tflint.hcl
@@ -1,10 +1,12 @@
 config {
-  module = true
+  call_module_type = "local"
   force = false
 }
 
 plugin "azurerm" {
     enabled = true
+    version = "0.30.0"
+    source  = "github.com/terraform-linters/tflint-ruleset-azurerm"
 }
 
 rule "terraform_unused_declarations" {
@@ -30,3 +32,11 @@ rule "terraform_naming_convention" {
 rule "terraform_standard_module_structure" {
   enabled = true
 }
+
+rule "terraform_required_version" {
+  enabled = false
+}
+
+rule "azurerm_resources_missing_prevent_destroy" {
+  enabled = false
+}
diff --git a/.github/linters/.tflint_core.hcl b/.github/linters/.tflint_core.hcl
index 85e6944..4f93e54 100644
--- a/.github/linters/.tflint_core.hcl
+++ b/.github/linters/.tflint_core.hcl
@@ -1,19 +1,25 @@
 # This is used for TRE tags validation only.
 
 config {
-  module = true
+  call_module_type = "local"
   force = false
 }
 
 plugin "azurerm" {
     enabled = true
-}
-
-rule "terraform_typed_variables" {
-  enabled = false
+    version = "0.30.0"
+    source  = "github.com/terraform-linters/tflint-ruleset-azurerm"
 }
 
 rule "azurerm_resource_missing_tags" {
   enabled = true
   tags = ["tre_id"]
 }
+
+rule "terraform_required_version" {
+  enabled = false
+}
+
+rule "azurerm_resources_missing_prevent_destroy" {
+  enabled = false
+}
diff --git a/.github/linters/.tflint_shared_services.hcl b/.github/linters/.tflint_shared_services.hcl
index 8b65d92..8b36918 100644
--- a/.github/linters/.tflint_shared_services.hcl
+++ b/.github/linters/.tflint_shared_services.hcl
@@ -1,15 +1,25 @@
 # This is used for TRE tags validation only.
 
 config {
-  module = true
+  call_module_type = "local"
   force = false
 }
 
 plugin "azurerm" {
     enabled = true
+    version = "0.30.0"
+    source  = "github.com/terraform-linters/tflint-ruleset-azurerm"
 }
 
 rule "azurerm_resource_missing_tags" {
   enabled = true
   tags = ["tre_id", "tre_shared_service_id"]
 }
+
+rule "terraform_required_version" {
+  enabled = false
+}
+
+rule "azurerm_resources_missing_prevent_destroy" {
+  enabled = false
+}
diff --git a/.github/linters/.tflint_user_resources.hcl b/.github/linters/.tflint_user_resources.hcl
index ce0442f..5c3e92b 100644
--- a/.github/linters/.tflint_user_resources.hcl
+++ b/.github/linters/.tflint_user_resources.hcl
@@ -1,15 +1,25 @@
 # This is used for TRE tags validation only.
 
 config {
-  module = true
+  call_module_type = "local"
   force = false
 }
 
 plugin "azurerm" {
     enabled = true
+    version = "0.30.0"
+    source  = "github.com/terraform-linters/tflint-ruleset-azurerm"
 }
 
 rule "azurerm_resource_missing_tags" {
   enabled = true
   tags = ["tre_id", "tre_workspace_id", "tre_workspace_service_id", "tre_user_resource_id"]
 }
+
+rule "terraform_required_version" {
+  enabled = false
+}
+
+rule "azurerm_resources_missing_prevent_destroy" {
+  enabled = false
+}
diff --git a/.github/linters/.tflint_workspace_services.hcl b/.github/linters/.tflint_workspace_services.hcl
index 553359e..7bfbdcf 100644
--- a/.github/linters/.tflint_workspace_services.hcl
+++ b/.github/linters/.tflint_workspace_services.hcl
@@ -1,15 +1,25 @@
 # This is used for TRE tags validation only.
 
 config {
-  module = true
+  call_module_type = "local"
   force = false
 }
 
 plugin "azurerm" {
     enabled = true
+    version = "0.30.0"
+    source  = "github.com/terraform-linters/tflint-ruleset-azurerm"
 }
 
 rule "azurerm_resource_missing_tags" {
   enabled = true
   tags = ["tre_id", "tre_workspace_id", "tre_workspace_service_id"]
 }
+
+rule "terraform_required_version" {
+  enabled = false
+}
+
+rule "azurerm_resources_missing_prevent_destroy" {
+  enabled = false
+}
diff --git a/.github/linters/.tflint_workspaces.hcl b/.github/linters/.tflint_workspaces.hcl
index 497f084..86862b4 100644
--- a/.github/linters/.tflint_workspaces.hcl
+++ b/.github/linters/.tflint_workspaces.hcl
@@ -1,19 +1,25 @@
 # This is used for TRE tags validation only.
 
 config {
-  module = true
+  call_module_type = "local"
   force = false
 }
 
 plugin "azurerm" {
     enabled = true
-}
-
-rule "terraform_typed_variables" {
-  enabled = false
+    version = "0.30.0"
+    source  = "github.com/terraform-linters/tflint-ruleset-azurerm"
 }
 
 rule "azurerm_resource_missing_tags" {
   enabled = true
   tags = ["tre_id", "tre_workspace_id"]
 }
+
+rule "terraform_required_version" {
+  enabled = false
+}
+
+rule "azurerm_resources_missing_prevent_destroy" {
+  enabled = false
+}
diff --git a/.github/workflows/build_validation_develop.yml b/.github/workflows/build_validation_develop.yml
index 319ad05..ad69f45 100644
--- a/.github/workflows/build_validation_develop.yml
+++ b/.github/workflows/build_validation_develop.yml
@@ -13,38 +13,79 @@ concurrency:
   group: "${{ github.workflow }}-${{ github.head_ref }}"
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read # For paths-filter and super-linter
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           # Full git history is needed to get a proper list of
           # changed files within `super-linter`
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: hashicorp/setup-terraform@v3
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: filter
+        with:
+          filters: |
+            terraform:
+              # our Terraform uses more than just *.tf files, so need to check changes in the folder
+              - '**/terraform/**/*'
+            core:
+              - 'core/**/*'
+            core_version:
+              - 'core/version.txt'
+            docs:
+              - 'docs/**/*'
+
+            terraform_core:
+              - core/**/terraform/**/*.tf
+
+            terraform_workspaces:
+              - templates/workspaces/**/terraform/**/*.tf
+
+            terraform_shared_services:
+              - templates/shared_services/**/terraform/**/*.tf
+
+            terraform_workspace_services:
+              - templates/workspace_services/**/terraform/**/*.tf
+
+      - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
+        if: ${{ steps.filter.outputs.terraform == 'true' }}
         with:
           terraform_version: "1.14.3"
+
       - name: Terraform format check
+        if: ${{ steps.filter.outputs.terraform == 'true' }}
         run: terraform fmt -check -recursive
 
       # find all terraform folders and run validate to catch
       # configuration errors
       - name: Terraform validation
+        if: ${{ steps.filter.outputs.terraform == 'true' }}
         run: |
           find . -type d -name 'terraform' -not -path '*cnab*' -print0 \
           | xargs -0 -I{} sh -c 'echo "***** Validating: {} *****"; \
           terraform -chdir={} init -backend=false; terraform -chdir={} validate'
 
+      - name: "Stale version: core"
+        if: ${{ steps.filter.outputs.core == 'true' &&
+          steps.filter.outputs.core_version == 'false' }}
+        run: echo "::error::Code update without version change" && exit 1
+
       - name: Lint code base
         # the slim image is 2GB smaller and we don't use the extra stuff
         # Moved this after the Terraform checks above due something similar to this issue:
         # https://github.com/github/super-linter/issues/2433
-        uses: github/super-linter/slim@v5.0.0
+        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
         env:
           VALIDATE_ALL_CODEBASE: false
           DEFAULT_BRANCH: main
@@ -53,13 +94,37 @@ jobs:
           VALIDATE_PYTHON_FLAKE8: true
           VALIDATE_YAML: true
           VALIDATE_TERRAFORM_TFLINT: true
+          VALIDATE_JAVA: true
+          JAVA_FILE_NAME: checkstyle.xml
           VALIDATE_BASH: true
           VALIDATE_BASH_EXEC: true
           VALIDATE_GITHUB_ACTIONS: true
           VALIDATE_DOCKERFILE_HADOLINT: true
+          VALIDATE_TSX: true
+          VALIDATE_TYPESCRIPT_ES: true
+          TYPESCRIPT_ES_CONFIG_FILE: ../../ui/app/eslint.config.js
+          TSX_CONFIG_FILE: ../../ui/app/eslint.config.js
+
+      - name: Docs validation
+        if: ${{ steps.filter.outputs.docs == 'true' }}
+        run: |
+          pip install -r docs/requirements.txt
+          mkdocs build --strict
+
+      - name: Core Tags
+        if: ${{ steps.filter.outputs.terraform_core == 'true' }}
+        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
+        env:
+          VALIDATE_ALL_CODEBASE: false
+          DEFAULT_BRANCH: main
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VALIDATE_TERRAFORM_TFLINT: true
+          TERRAFORM_TFLINT_CONFIG_FILE: .tflint_core.hcl
+          FILTER_REGEX_INCLUDE: "./core/.*"
 
       - name: Workspace Tags
-        uses: github/super-linter/slim@v5.0.0
+        if: ${{ steps.filter.outputs.terraform_workspaces == 'true' }}
+        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
         env:
           VALIDATE_ALL_CODEBASE: false
           DEFAULT_BRANCH: main
@@ -69,18 +134,20 @@ jobs:
           FILTER_REGEX_INCLUDE: "./templates/workspaces/.*"
 
       - name: Workspace Services Tags
-        uses: github/super-linter/slim@v5.0.0
+        if: ${{ steps.filter.outputs.terraform_workspace_services == 'true' }}
+        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
         env:
           VALIDATE_ALL_CODEBASE: false
           DEFAULT_BRANCH: main
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VALIDATE_TERRAFORM_TFLINT: true
           TERRAFORM_TFLINT_CONFIG_FILE: .tflint_workspace_services.hcl
-          FILTER_REGEX_INCLUDE: "./templates/workspaces/.*"
+          FILTER_REGEX_INCLUDE: "./templates/workspace_services/.*"
           FILTER_REGEX_EXCLUDE: ".*user_resource.*"
 
       - name: User Resources Tags
-        uses: github/super-linter/slim@v5.0.0
+        if: ${{ steps.filter.outputs.terraform_workspace_services == 'true' }}
+        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
         env:
           VALIDATE_ALL_CODEBASE: false
           DEFAULT_BRANCH: main
@@ -90,7 +157,8 @@ jobs:
           FILTER_REGEX_INCLUDE: "./templates/workspace_services/.*/user_resources/.*"
 
       - name: Shared Services Tags
-        uses: github/super-linter/slim@v5.0.0
+        if: ${{ steps.filter.outputs.terraform_shared_services == 'true' }}
+        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
         env:
           VALIDATE_ALL_CODEBASE: false
           DEFAULT_BRANCH: main
diff --git a/.github/workflows/clean_validation_envs.yml b/.github/workflows/clean_validation_envs.yml
index 0cae184..4069d1d 100644
--- a/.github/workflows/clean_validation_envs.yml
+++ b/.github/workflows/clean_validation_envs.yml
@@ -1,30 +1,35 @@
 ---
 name: Clean Validation Environments
 
-on:  # yamllint disable-line rule:truthy
+on: # yamllint disable-line rule:truthy
   schedule:
     # Every 2 hours
     - cron: "0 */1 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   clean:
     name: Clean
     runs-on: ubuntu-latest
+    environment: CICD
+    timeout-minutes: 30
     permissions:
       id-token: write
       contents: read
-    environment: Dev
-    timeout-minutes: 30
+      pull-requests: read # For checking PRs
+      actions: read # For checking workflow runs
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           # This is CRITICAL since we're making decisions based on branch existence
           fetch-depth: 0
           persist-credentials: false
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -38,4 +43,4 @@ jobs:
           GITHUB_REPOSITORY: ${{ github.repository}}
           BRANCH_LAST_ACTIVITY_IN_HOURS_FOR_STOP: 4
           BRANCH_LAST_ACTIVITY_IN_HOURS_FOR_DESTROY: 48
-        run: .github/scripts/clean_ci_validation_envs.sh
+        run: devops/scripts/clean_ci_validation_envs.sh
diff --git a/.github/workflows/deploy_tre.yml b/.github/workflows/deploy_tre.yml
index 68f5fb5..4092a66 100644
--- a/.github/workflows/deploy_tre.yml
+++ b/.github/workflows/deploy_tre.yml
@@ -3,7 +3,7 @@ name: Deploy Azure TRE
 # This workflow is the integration build run for pushes to the main branch
 # It also runs on a schedule, serving as the nightly build
 
-on:  # yamllint disable-line rule:truthy
+on: # yamllint disable-line rule:truthy
   schedule:
     # midnight every day https://crontab.guru/#0_0_*_*_*
     - cron: "0 0 * * *"
@@ -14,23 +14,26 @@ on:  # yamllint disable-line rule:truthy
       environment:
         description: The environment to run this workflow in
         type: environment
-        default: Dev
+        default: CICD
         required: true
 
 # This will prevent multiple runs of this entire workflow.
 # We should NOT cancel in progress runs as that can destabilize the environment.
 concurrency: "${{ github.workflow }}-${{ github.ref }}"
 
+permissions:
+  contents: read
+
 jobs:
   run-deploy-tre-main:
     name: "Deploy main"
     if: github.ref == 'refs/heads/main'
     uses: ./.github/workflows/deploy_tre_reusable.yml
     permissions:
+      id-token: write
       checks: write
       contents: read
       pull-requests: write
-      id-token: write
     with:
       ciGitRef: ${{ github.ref }}
       e2eTestsCustomSelector: >-
@@ -40,11 +43,11 @@ jobs:
       E2E_TESTS_NUMBER_PROCESSES: 1
       DEVCONTAINER_TAG: "latest"
     secrets:
-      AAD_TENANT_ID: ${{ secrets.AAD_TENANT_ID }}
-      ACR_NAME: ${{ secrets.ACR_NAME }}
       AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
       AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
       AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      AAD_TENANT_ID: ${{ secrets.AAD_TENANT_ID }}
+      ACR_NAME: ${{ secrets.ACR_NAME }}
       API_CLIENT_ID: ${{ secrets.API_CLIENT_ID }}
       API_CLIENT_SECRET: ${{ secrets.API_CLIENT_SECRET }}
       APPLICATION_ADMIN_CLIENT_ID: ${{ secrets.APPLICATION_ADMIN_CLIENT_ID }}
@@ -52,6 +55,9 @@ jobs:
       MGMT_RESOURCE_GROUP_NAME: ${{ secrets.MGMT_RESOURCE_GROUP_NAME }}
       MGMT_STORAGE_ACCOUNT_NAME: ${{ secrets.MGMT_STORAGE_ACCOUNT_NAME }}
       SWAGGER_UI_CLIENT_ID: ${{ secrets.SWAGGER_UI_CLIENT_ID }}
+      TEST_APP_ID: ${{ secrets.TEST_APP_ID }}
+      TEST_WORKSPACE_APP_ID: ${{ secrets.TEST_WORKSPACE_APP_ID }}
+      TEST_WORKSPACE_APP_SECRET: "${{ secrets.TEST_WORKSPACE_APP_SECRET }}"
       TEST_ACCOUNT_CLIENT_ID: "${{ secrets.TEST_ACCOUNT_CLIENT_ID }}"
       TEST_ACCOUNT_CLIENT_SECRET: "${{ secrets.TEST_ACCOUNT_CLIENT_SECRET }}"
       TRE_ID: ${{ secrets.TRE_ID }}
diff --git a/.github/workflows/deploy_tre_branch.yml b/.github/workflows/deploy_tre_branch.yml
index 29a02ba..3523cbe 100644
--- a/.github/workflows/deploy_tre_branch.yml
+++ b/.github/workflows/deploy_tre_branch.yml
@@ -6,7 +6,7 @@ name: Deploy Azure TRE (branch)
 # Note that the branch must be in the main repo as secrets are not passed
 # to workflows run from forks
 
-on:  # yamllint disable-line rule:truthy
+on: # yamllint disable-line rule:truthy
   workflow_dispatch:
     inputs:
       e2eTestsCustomSelector:
@@ -17,7 +17,7 @@ on:  # yamllint disable-line rule:truthy
       environment:
         description: The environment to run this workflow in
         type: environment
-        default: Dev
+        default: CICD
         required: true
       e2eProcesses:
         description: The number of E2E processes/tests running in parallel
@@ -29,14 +29,19 @@ on:  # yamllint disable-line rule:truthy
 # We should NOT cancel in progress runs as that can destabilize the environment.
 concurrency: "${{ github.workflow }}-${{ github.ref }}"
 
+permissions:
+  contents: read
+
 jobs:
   prepare-not-main:
     name: Preparation
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     if: |
       github.ref != 'refs/heads/main'
     outputs:
       refid: ${{ steps.run-id.outputs.refid }}
+    permissions:
+      contents: read
     steps:
       - id: run-id
         name: Get run id
@@ -59,10 +64,10 @@ jobs:
     needs: [prepare-not-main]
     uses: ./.github/workflows/deploy_tre_reusable.yml
     permissions:
+      id-token: write
       checks: write
       contents: read
       pull-requests: write
-      id-token: write
     with:
       ciGitRef: ${{ github.ref }}
       prHeadSha: ${{ github.sha }}
@@ -71,11 +76,11 @@ jobs:
       E2E_TESTS_NUMBER_PROCESSES: ${{ fromJSON(github.event.inputs.e2eProcesses) }}
       DEVCONTAINER_TAG: ${{ needs.prepare-not-main.outputs.refid }}
     secrets:
-      AAD_TENANT_ID: ${{ secrets.AAD_TENANT_ID }}
-      ACR_NAME: ${{ format('tre{0}', needs.prepare-not-main.outputs.refid) }}
       AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
       AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
       AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      AAD_TENANT_ID: ${{ secrets.AAD_TENANT_ID }}
+      ACR_NAME: ${{ format('tre{0}', needs.prepare-not-main.outputs.refid) }}
       API_CLIENT_ID: ${{ secrets.API_CLIENT_ID }}
       API_CLIENT_SECRET: ${{ secrets.API_CLIENT_SECRET }}
       APPLICATION_ADMIN_CLIENT_ID: ${{ secrets.APPLICATION_ADMIN_CLIENT_ID }}
@@ -83,6 +88,9 @@ jobs:
       MGMT_RESOURCE_GROUP_NAME: ${{ format('rg-tre{0}-mgmt', needs.prepare-not-main.outputs.refid) }}
       MGMT_STORAGE_ACCOUNT_NAME: ${{ format('tre{0}mgmt', needs.prepare-not-main.outputs.refid) }}
       SWAGGER_UI_CLIENT_ID: ${{ secrets.SWAGGER_UI_CLIENT_ID }}
+      TEST_APP_ID: ${{ secrets.TEST_APP_ID }}
+      TEST_WORKSPACE_APP_ID: ${{ secrets.TEST_WORKSPACE_APP_ID }}
+      TEST_WORKSPACE_APP_SECRET: ${{ secrets.TEST_WORKSPACE_APP_SECRET }}
       TEST_ACCOUNT_CLIENT_ID: "${{ secrets.TEST_ACCOUNT_CLIENT_ID }}"
       TEST_ACCOUNT_CLIENT_SECRET: "${{ secrets.TEST_ACCOUNT_CLIENT_SECRET }}"
       TRE_ID: ${{ format('tre{0}', needs.prepare-not-main.outputs.refid) }}
diff --git a/.github/workflows/deploy_tre_reusable.yml b/.github/workflows/deploy_tre_reusable.yml
index 143db6a..2141aea 100644
--- a/.github/workflows/deploy_tre_reusable.yml
+++ b/.github/workflows/deploy_tre_reusable.yml
@@ -1,6 +1,5 @@
 ---
 name: Deploy Azure TRE Reusable
-# yamllint disable rule:line-length rule:comments-indentation
 
 on: # yamllint disable-line rule:truthy
   workflow_call:
@@ -74,11 +73,20 @@ on: # yamllint disable-line rule:truthy
       SWAGGER_UI_CLIENT_ID:
         description: ""
         required: true
+      TEST_APP_ID:
+        description: ""
+        required: true
+      TEST_WORKSPACE_APP_ID:
+        description: ""
+        required: true
+      TEST_WORKSPACE_APP_SECRET:
+        description: ""
+        required: true
       TEST_ACCOUNT_CLIENT_ID:
-        description: Client ID for test automation account used for unattended bundle registration
+        description: ""
         required: true
       TEST_ACCOUNT_CLIENT_SECRET:
-        description: Client secret for test automation account used for unattended bundle registration
+        description: ""
         required: true
       TRE_ID:
         description: ""
@@ -114,9 +122,9 @@ jobs:
     name: Deploy Management
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
       checks: write
       contents: read
-      id-token: write
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Show inputs
@@ -159,6 +167,15 @@ jobs:
           if [ "${{ secrets.SWAGGER_UI_CLIENT_ID }}" == '' ]; then
             echo "Missing secret: SWAGGER_UI_CLIENT_ID" && exit 1
           fi
+          if [ "${{ secrets.TEST_APP_ID }}" == '' ]; then
+            echo "Missing secret: TEST_APP_ID" && exit 1
+          fi
+          if [ "${{ secrets.TEST_WORKSPACE_APP_ID }}" == '' ]; then
+            echo "Missing secret: TEST_WORKSPACE_APP_ID" && exit 1
+          fi
+          if [ "${{ secrets.TEST_WORKSPACE_APP_SECRET }}" == '' ]; then
+            echo "Missing secret: TEST_WORKSPACE_APP_SECRET" && exit 1
+          fi
           if [ "${{ secrets.TEST_ACCOUNT_CLIENT_ID }}" == '' ]; then
             echo "Missing secret: TEST_ACCOUNT_CLIENT_ID" && exit 1
           fi
@@ -171,6 +188,12 @@ jobs:
           if [ "${{ secrets.AZURE_CLIENT_ID }}" == '' ]; then
             echo "Missing secret: AZURE_CLIENT_ID" && exit 1
           fi
+          if [ "${{ secrets.AZURE_TENANT_ID }}" == '' ]; then
+            echo "Missing secret: AZURE_TENANT_ID" && exit 1
+          fi
+          if [ "${{ secrets.AZURE_SUBSCRIPTION_ID }}" == '' ]; then
+            echo "Missing secret: AZURE_SUBSCRIPTION_ID" && exit 1
+          fi
 
           if [ "${{ inputs.DEVCONTAINER_TAG }}" == '' ]; then
             echo "Missing input: DEVCONTAINER_TAG" && exit 1
@@ -180,8 +203,22 @@ jobs:
             echo "Missing variable: LOCATION" && exit 1
           fi
 
+          if [ "${{ secrets.CI_CACHE_ACR_NAME }}" == '' ]; then
+            echo "CI_CACHE_ACR_NAME is not set. Please run the workflow on the main branch first." && exit 1
+          fi
+
+      - name: Report check status start
+        if: inputs.prHeadSha != ''
+        uses: LouisBrunner/checks-action@dfcbcf801bff1ea7f1414824fc28f2cd697b35da # v3.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          sha: ${{ inputs.prHeadSha }}
+          name: "Deploy PR / Run E2E Tests (Smoke)"
+          status: "in_progress"
+          details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -189,10 +226,10 @@ jobs:
           ref: ${{ inputs.prRef }}
 
       - name: Set up Docker BuildKit
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -260,8 +297,7 @@ jobs:
             az acr login --name "${{ secrets.CI_CACHE_ACR_NAME }}" && ec=0 && break || ec="$?" && sleep 10
           done
           if [ "$ec" != 0 ]; then
-            echo "::error::Failed to login to ACR after 3 attempts. Make sure to run the" \
-                 "pipleline on the main branch first."
+            echo "::error::Failed to login to ACR after 3 attempts. Make sure to run the pipleline on the main branch first."
           fi
           # shellcheck disable=SC2242
           (exit "$ec")
@@ -278,11 +314,16 @@ jobs:
     strategy:
       fail-fast: true
       matrix:
-        target: [build-and-push-api, build-and-push-resource-processor, build-and-push-airlock-processor]
+        target:
+          [
+            build-and-push-api,
+            build-and-push-resource-processor,
+            build-and-push-airlock-processor,
+          ]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -308,7 +349,7 @@ jobs:
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -334,7 +375,7 @@ jobs:
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -369,6 +410,7 @@ jobs:
           STATEFUL_RESOURCES_LOCKED: "${{ github.ref == 'refs/heads/main' && inputs.prRef == '' && true || false }}"
           KV_PURGE_PROTECTION_ENABLED: ${{ vars.KV_PURGE_PROTECTION_ENABLED || true }}
           CORE_APP_SERVICE_PLAN_SKU: ${{ vars.CORE_APP_SERVICE_PLAN_SKU }}
+          RESOURCE_PROCESSOR_VMSS_SKU: ${{ vars.RESOURCE_PROCESSOR_VMSS_SKU }}
           RESOURCE_PROCESSOR_NUMBER_PROCESSES_PER_INSTANCE: ${{ vars.RESOURCE_PROCESSOR_NUMBER_PROCESSES_PER_INSTANCE }}
           RP_BUNDLE_VALUES: ${{ vars.RP_BUNDLE_VALUES }}
           FIREWALL_SKU: ${{ vars.FIREWALL_SKU}}
@@ -402,43 +444,42 @@ jobs:
     strategy:
       matrix:
         include:
-          - {BUNDLE_TYPE: "workspace",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspaces/base"}
-          - {BUNDLE_TYPE: "workspace",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspaces/unrestricted"}
-          - {BUNDLE_TYPE: "workspace",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspaces/airlock-import-review"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/guacamole"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/azureml"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/gitea"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/mysql"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/health-services"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/databricks"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/ohdsi"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/azuresql"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/openai"}
-          - {BUNDLE_TYPE: "user_resource",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm"}
-          - {BUNDLE_TYPE: "user_resource",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm"}
-          - {BUNDLE_TYPE: "user_resource",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm"}
-          - {BUNDLE_TYPE: "user_resource",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm"}
-            # Add your custom Bundles below this
+          - BUNDLE_TYPE: "workspace"
+            BUNDLE_DIR: "./templates/workspaces/base"
+          - BUNDLE_TYPE: "workspace"
+            BUNDLE_DIR: "./templates/workspaces/unrestricted"
+          - BUNDLE_TYPE: "workspace"
+            BUNDLE_DIR: "./templates/workspaces/airlock-import-review"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/guacamole"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/azureml"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/gitea"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/mysql"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/health-services"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/databricks"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/ohdsi"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/azuresql"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/openai"
+          - BUNDLE_TYPE: "user_resource"
+            BUNDLE_DIR: "./templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm"
+          - BUNDLE_TYPE: "user_resource"
+            BUNDLE_DIR: "./templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm"
+          - BUNDLE_TYPE: "user_resource"
+            BUNDLE_DIR: "./templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm"
+          - BUNDLE_TYPE: "user_resource"
+            BUNDLE_DIR: "./templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm"
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -472,26 +513,26 @@ jobs:
     strategy:
       matrix:
         include:
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/firewall/"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/gitea/"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/admin-vm/"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/airlock_notifier/"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/certs/"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/cyclecloud/"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/sonatype-nexus-vm/"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/databricks-auth/"}
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/firewall/"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/gitea/"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/admin-vm/"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/airlock_notifier/"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/certs/"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/cyclecloud/"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/sonatype-nexus-vm/"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/databricks-auth/"
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -525,26 +566,26 @@ jobs:
     strategy:
       matrix:
         include:
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/firewall"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/gitea"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/admin-vm/"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/airlock_notifier/"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/certs/"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/cyclecloud/"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/sonatype-nexus-vm/"}
-          - {BUNDLE_TYPE: "shared_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/shared_services/databricks-auth/"}
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/firewall"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/gitea"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/admin-vm/"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/airlock_notifier/"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/certs/"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/cyclecloud/"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/sonatype-nexus-vm/"
+          - BUNDLE_TYPE: "shared_service"
+            BUNDLE_DIR: "./templates/shared_services/databricks-auth/"
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -570,6 +611,7 @@ jobs:
           ACR_NAME: ${{ secrets.ACR_NAME }}
           API_CLIENT_ID: "${{ secrets.API_CLIENT_ID }}"
           AAD_TENANT_ID: "${{ secrets.AAD_TENANT_ID }}"
+          TEST_APP_ID: "${{ secrets.TEST_APP_ID }}"
           TEST_ACCOUNT_CLIENT_ID: "${{ secrets.TEST_ACCOUNT_CLIENT_ID }}"
           TEST_ACCOUNT_CLIENT_SECRET: "${{ secrets.TEST_ACCOUNT_CLIENT_SECRET }}"
           TRE_ID: ${{ secrets.TRE_ID }}
@@ -584,33 +626,33 @@ jobs:
       matrix:
         include:
           # bundles type can be inferred from the bundle dir (but this is more explicit)
-          - {BUNDLE_TYPE: "workspace",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspaces/base"}
-          - {BUNDLE_TYPE: "workspace",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspaces/unrestricted"}
-          - {BUNDLE_TYPE: "workspace",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspaces/airlock-import-review"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/guacamole"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/azureml"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/gitea"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/mysql"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/health-services"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/databricks"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/ohdsi"}
-          - {BUNDLE_TYPE: "workspace_service",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/azuresql"}
-        # Add your bundles here
+          - BUNDLE_TYPE: "workspace"
+            BUNDLE_DIR: "./templates/workspaces/base"
+          - BUNDLE_TYPE: "workspace"
+            BUNDLE_DIR: "./templates/workspaces/unrestricted"
+          - BUNDLE_TYPE: "workspace"
+            BUNDLE_DIR: "./templates/workspaces/airlock-import-review"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/guacamole"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/azureml"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/gitea"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/mysql"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/health-services"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/databricks"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/ohdsi"
+          - BUNDLE_TYPE: "workspace_service"
+            BUNDLE_DIR: "./templates/workspace_services/azuresql"
+
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -636,6 +678,7 @@ jobs:
           ACR_NAME: ${{ secrets.ACR_NAME }}
           API_CLIENT_ID: "${{ secrets.API_CLIENT_ID }}"
           AAD_TENANT_ID: "${{ secrets.AAD_TENANT_ID }}"
+          TEST_APP_ID: "${{ secrets.TEST_APP_ID }}"
           TEST_ACCOUNT_CLIENT_ID: "${{ secrets.TEST_ACCOUNT_CLIENT_ID }}"
           TEST_ACCOUNT_CLIENT_SECRET: "${{ secrets.TEST_ACCOUNT_CLIENT_SECRET }}"
           TRE_ID: ${{ secrets.TRE_ID }}
@@ -650,23 +693,22 @@ jobs:
     strategy:
       matrix:
         include:
-          - {BUNDLE_TYPE: "user_resource",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm",
-             WORKSPACE_SERVICE_NAME: "tre-service-guacamole"}
-          - {BUNDLE_TYPE: "user_resource",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm",
-             WORKSPACE_SERVICE_NAME: "tre-service-guacamole"}
-          - {BUNDLE_TYPE: "user_resource",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm",
-             WORKSPACE_SERVICE_NAME: "tre-service-guacamole"}
-          - {BUNDLE_TYPE: "user_resource",
-             BUNDLE_DIR: "\\${AZURETRE_HOME}/templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm",
-             WORKSPACE_SERVICE_NAME: "tre-service-guacamole"}
-             # Add your bundles here
+          - BUNDLE_TYPE: "user_resource"
+            BUNDLE_DIR: "./templates/workspace_services/guacamole/user_resources/guacamole-azure-windowsvm"
+            WORKSPACE_SERVICE_NAME: "tre-service-guacamole"
+          - BUNDLE_TYPE: "user_resource"
+            BUNDLE_DIR: "./templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm"
+            WORKSPACE_SERVICE_NAME: "tre-service-guacamole"
+          - BUNDLE_TYPE: "user_resource"
+            BUNDLE_DIR: "./templates/workspace_services/guacamole/user_resources/guacamole-azure-export-reviewvm"
+            WORKSPACE_SERVICE_NAME: "tre-service-guacamole"
+          - BUNDLE_TYPE: "user_resource"
+            BUNDLE_DIR: "./templates/workspace_services/guacamole/user_resources/guacamole-azure-import-reviewvm"
+            WORKSPACE_SERVICE_NAME: "tre-service-guacamole"
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -692,6 +734,7 @@ jobs:
           ACR_NAME: ${{ secrets.ACR_NAME }}
           API_CLIENT_ID: "${{ secrets.API_CLIENT_ID }}"
           AAD_TENANT_ID: "${{ secrets.AAD_TENANT_ID }}"
+          TEST_APP_ID: "${{ secrets.TEST_APP_ID }}"
           TEST_ACCOUNT_CLIENT_ID: "${{ secrets.TEST_ACCOUNT_CLIENT_ID }}"
           TEST_ACCOUNT_CLIENT_SECRET: "${{ secrets.TEST_ACCOUNT_CLIENT_SECRET }}"
           TRE_ID: ${{ secrets.TRE_ID }}
@@ -706,7 +749,7 @@ jobs:
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -716,7 +759,7 @@ jobs:
       - name: Deploy firewall
         uses: ./.github/actions/devcontainer_run_command
         with:
-          COMMAND: "make deploy-shared-service DIR=\\${AZURETRE_HOME}/templates/shared_services/firewall/ BUNDLE_TYPE=shared_service"
+          COMMAND: "make deploy-shared-service DIR=./templates/shared_services/firewall/ BUNDLE_TYPE=shared_service"
           DEVCONTAINER_TAG: ${{ inputs.DEVCONTAINER_TAG }}
           CI_CACHE_ACR_NAME: ${{ secrets.CI_CACHE_ACR_NAME}}
           AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
@@ -725,6 +768,7 @@ jobs:
           AZURE_ENVIRONMENT: ${{ vars.AZURE_ENVIRONMENT }}
           API_CLIENT_ID: "${{ secrets.API_CLIENT_ID }}"
           AAD_TENANT_ID: "${{ secrets.AAD_TENANT_ID }}"
+          TEST_APP_ID: "${{ secrets.TEST_APP_ID }}"
           TEST_ACCOUNT_CLIENT_ID: "${{ secrets.TEST_ACCOUNT_CLIENT_ID }}"
           TEST_ACCOUNT_CLIENT_SECRET: "${{ secrets.TEST_ACCOUNT_CLIENT_SECRET }}"
           TRE_ID: ${{ secrets.TRE_ID }}
@@ -742,6 +786,7 @@ jobs:
           AZURE_ENVIRONMENT: ${{ vars.AZURE_ENVIRONMENT }}
           API_CLIENT_ID: "${{ secrets.API_CLIENT_ID }}"
           AAD_TENANT_ID: "${{ secrets.AAD_TENANT_ID }}"
+          TEST_APP_ID: "${{ secrets.TEST_APP_ID }}"
           TEST_ACCOUNT_CLIENT_ID: "${{ secrets.TEST_ACCOUNT_CLIENT_ID }}"
           TEST_ACCOUNT_CLIENT_SECRET: "${{ secrets.TEST_ACCOUNT_CLIENT_SECRET }}"
           TRE_ID: ${{ secrets.TRE_ID }}
@@ -757,7 +802,7 @@ jobs:
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -784,3 +829,135 @@ jobs:
           USER_MANAGEMENT_ENABLED: ${{ vars.USER_MANAGEMENT_ENABLED }}
           UI_SITE_NAME: "${{ inputs.UI_SITE_NAME || vars.UI_SITE_NAME }}"
           UI_FOOTER_TEXT: "${{ inputs.UI_FOOTER_TEXT || vars.UI_FOOTER_TEXT }}"
+
+  e2e_tests_smoke:
+    name: "Run E2E Tests (Smoke)"
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environmentName }}
+    needs: [deploy_shared_services, register_bundles, deploy_ui]
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          # if the following values are missing (i.e. not triggered via comment workflow)
+          # then the default checkout will apply
+          ref: ${{ inputs.prRef }}
+
+      - name: Run E2E Tests (Smoke)
+        uses: ./.github/actions/devcontainer_run_command
+        with:
+          COMMAND: "make test-e2e-smoke"
+          DEVCONTAINER_TAG: ${{ inputs.DEVCONTAINER_TAG }}
+          CI_CACHE_ACR_NAME: ${{ secrets.CI_CACHE_ACR_NAME}}
+          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+          AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          AZURE_ENVIRONMENT: ${{ vars.AZURE_ENVIRONMENT }}
+          LOCATION: ${{ vars.LOCATION }}
+          API_CLIENT_ID: "${{ secrets.API_CLIENT_ID }}"
+          AAD_TENANT_ID: "${{ secrets.AAD_TENANT_ID }}"
+          TEST_APP_ID: "${{ secrets.TEST_APP_ID }}"
+          TEST_WORKSPACE_APP_ID: "${{ secrets.TEST_WORKSPACE_APP_ID }}"
+          TEST_WORKSPACE_APP_SECRET: "${{ secrets.TEST_WORKSPACE_APP_SECRET }}"
+          TEST_ACCOUNT_CLIENT_ID: "${{ secrets.TEST_ACCOUNT_CLIENT_ID }}"
+          TEST_ACCOUNT_CLIENT_SECRET: "${{ secrets.TEST_ACCOUNT_CLIENT_SECRET }}"
+          TRE_ID: ${{ secrets.TRE_ID }}
+          IS_API_SECURED: false
+          WORKSPACE_APP_SERVICE_PLAN_SKU: ${{ vars.WORKSPACE_APP_SERVICE_PLAN_SKU }}
+
+      - name: Upload Test Results
+        if: always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: E2E Test (Smoke) Results
+          path: "./e2e_tests/pytest_e2e_smoke.xml"
+
+  e2e_tests_custom:
+    name: "Run E2E Tests"
+    if: ${{ inputs.e2eTestsCustomSelector != '' }}
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environmentName }}
+    needs:
+      [deploy_shared_services, register_bundles, register_user_resource_bundles]
+    timeout-minutes: 300
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          # if the following values are missing (i.e. not triggered via comment workflow)
+          # then the default checkout will apply
+          ref: ${{ inputs.prRef }}
+
+      - name: Run E2E Tests
+        uses: ./.github/actions/devcontainer_run_command
+        with:
+          COMMAND: "make test-e2e-custom SELECTOR='${{ inputs.e2eTestsCustomSelector }}'"
+          DEVCONTAINER_TAG: ${{ inputs.DEVCONTAINER_TAG }}
+          CI_CACHE_ACR_NAME: ${{ secrets.CI_CACHE_ACR_NAME}}
+          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+          AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          AZURE_ENVIRONMENT: ${{ vars.AZURE_ENVIRONMENT }}
+          LOCATION: ${{ vars.LOCATION }}
+          API_CLIENT_ID: "${{ secrets.API_CLIENT_ID }}"
+          AAD_TENANT_ID: "${{ secrets.AAD_TENANT_ID }}"
+          TEST_APP_ID: "${{ secrets.TEST_APP_ID }}"
+          TEST_WORKSPACE_APP_ID: "${{ secrets.TEST_WORKSPACE_APP_ID }}"
+          TEST_WORKSPACE_APP_SECRET: "${{ secrets.TEST_WORKSPACE_APP_SECRET }}"
+          TEST_ACCOUNT_CLIENT_ID: "${{ secrets.TEST_ACCOUNT_CLIENT_ID }}"
+          TEST_ACCOUNT_CLIENT_SECRET: "${{ secrets.TEST_ACCOUNT_CLIENT_SECRET }}"
+          TRE_ID: ${{ secrets.TRE_ID }}
+          IS_API_SECURED: false
+          WORKSPACE_APP_SERVICE_PLAN_SKU: ${{ vars.WORKSPACE_APP_SERVICE_PLAN_SKU }}
+          E2E_TESTS_NUMBER_PROCESSES: ${{ inputs.E2E_TESTS_NUMBER_PROCESSES }}
+
+      - name: Upload Test Results
+        if: always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: E2E Test Results
+          path: "./e2e_tests/pytest_e2e_custom.xml"
+
+  summary:
+    name: Summary
+    needs: [e2e_tests_smoke, e2e_tests_custom]
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      contents: read
+    if: always()
+    environment: ${{ inputs.environmentName }}
+    steps:
+      - uses: im-open/workflow-conclusion@fce18569e28a9f2ed1feca1e6d4251e6a7365fdc # v2.2.4
+        id: conclusion
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      # For PR builds triggered from comment builds, the GITHUB_REF is set to main
+      # so the checks aren't automatically associated with the PR
+      # If prHeadSha is specified then explicity mark the checks for that SHA
+      - name: Report check status
+        if: inputs.prHeadSha != ''
+        uses: LouisBrunner/checks-action@dfcbcf801bff1ea7f1414824fc28f2cd697b35da # v3.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # the name must be identical to the one received by the real job
+          sha: ${{ inputs.prHeadSha }}
+          name: "Deploy PR / Run E2E Tests (Smoke)"
+          status: "completed"
+          conclusion: ${{ env.WORKFLOW_CONCLUSION }}
+          details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+      - name: Download Artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: artifacts
+
+      - name: Publish E2E Test Results
+        uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2.23.0
+        with:
+          files: "artifacts/**/*.xml"
+          check_name: "E2E Test Results"
+          comment_mode: off