diff --git a/.github/renovate.json5 b/.github/renovate.json5
deleted file mode 100644
index 9348c6b09f..0000000000
--- a/.github/renovate.json5
+++ /dev/null
@@ -1,111 +0,0 @@
-{
-  extends: ['config:base'],
-  timezone: 'Europe/Zurich',
-  schedule: 'after 5pm on the first day of the month',
-  labels: ['dependencies'],
-  separateMajorMinor: true,
-  separateMinorPatch: true,
-  prHourlyLimit: 0,
-  prConcurrentLimit: 0,
-  lockFileMaintenance: {
-    enabled: true,
-    automerge: true,
-    schedule: 'after 5pm on the first day of the month',
-  },
-  semanticCommits: 'disabled',
-  baseBranches: ['master', '3.27', '3.28', '3.29'],
-  // Upgrade the tool versions
-  regexManagers: [
-    {
-      fileMatch: ['^build.gradle$', '.*/build.gradle$'],
-      matchStrings: ['toolVersion = "(?<currentValue>.*)" // (?<depName>.*)'],
-      datasourceTemplate: 'maven',
-    },
-  ],
-  packageRules: [
-    /** Docker images versioning */
-    {
-      matchDatasources: ['docker'],
-      versioning: 'loose',
-    },
-    {
-      matchDatasources: ['docker'],
-      matchPackageNames: ['gradle', 'tomcat'],
-      versioning: 'regex:^(?<major>\\d+)\\.(?<minor>\\d+)(\\.(?<patch>\\d+))?(-(?<compatibility>.*))$',
-    },
-    /** Automerge the patch, the minor and the dev dependency */
-    {
-      matchBaseBranches: ['master'],
-      matchUpdateTypes: ['minor', 'patch'],
-      automerge: true,
-    },
-    {
-      matchDepTypes: ['devDependencies'],
-      automerge: true,
-    },
-    /** Group the patch and the minor */
-    {
-      matchUpdateTypes: ['patch'],
-      groupName: 'all patch versions',
-      automerge: true,
-    },
-    {
-      matchUpdateTypes: ['minor'],
-      groupName: 'all minor versions',
-      automerge: true,
-    },
-    /** Define the groups */
-    {
-      matchPackageNames: ['gradle'],
-      groupName: 'gradle',
-      automerge: true,
-    },
-    {
-      matchDatasources: ['docker'],
-      matchPackageNames: ['camptocamp/geoserver'],
-      groupName: 'geoserver',
-      automerge: true,
-    },
-    {
-      matchPackagePrefixes: ['org.springframework:', 'org.springframework.security:'],
-      groupName: 'spring',
-      automerge: true,
-    },
-    {
-      matchPackagePrefixes: ['net.sf.jasperreports:'],
-      groupName: 'jasperreports',
-      automerge: true,
-    },
-    {
-      matchPackagePrefixes: ['org.slf4j:'],
-      groupName: 'slf4j',
-      automerge: true,
-    },
-    {
-      matchPackagePrefixes: ['io.dropwizard.metrics:'],
-      groupName: 'metrics',
-      automerge: true,
-    },
-    {
-      matchPackagePrefixes: ['org.geotools.', 'org.geotools:'],
-      groupName: 'geotools',
-      automerge: true,
-    },
-    {
-      matchPackagePrefixes: ['ch.qos.logback:'],
-      groupName: 'logback',
-      automerge: true,
-    },
-    {
-      matchPackagePrefixes: ['org.apache.xmlgraphics:batik-'],
-      groupName: 'batik',
-      automerge: true,
-    },
-    /** Accept only the patch on the stabilization branches */
-    {
-      matchBaseBranches: ['/3\\..*/'],
-      matchUpdateTypes: ['major', 'minor', 'pin', 'digest', 'lockFileMaintenance', 'rollback', 'bump'],
-      enabled: false,
-    },
-  ],
-}
diff --git a/.github/workflows/audit.yaml b/.github/workflows/audit.yaml
deleted file mode 100644
index b447fdfe16..0000000000
--- a/.github/workflows/audit.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: Audit
-
-on:
-  schedule:
-    - cron: '30 2 * * *'
-
-jobs:
-  audit:
-    runs-on: ubuntu-22.04
-    name: Audit
-    timeout-minutes: 20
-
-    strategy:
-      fail-fast: false
-      matrix:
-        branch:
-          - '3.27'
-          - '3.28'
-          - '3.29'
-
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          ref: ${{ matrix.branch }}
-          token: ${{ secrets.GOPASS_CI_GITHUB_TOKEN }}
-
-      - uses: camptocamp/initialise-gopass-summon-action@v2
-        with:
-          ci-gpg-private-key: ${{secrets.CI_GPG_PRIVATE_KEY}}
-          github-gopass-ci-token: ${{secrets.GOPASS_CI_GITHUB_TOKEN}}
-
-      - run: python3 -m venv ~/.venv
-      - run: ~/.venv/bin/pip install --pre c2cciutils[audit]
-      - run: python3 -m pip install --pre c2cciutils[audit]
-
-      - name: Audit
-        run: ~/.venv/bin/c2cciutils-audit --branch=${{ matrix.branch }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GOPASS_CI_GITHUB_TOKEN }}
diff --git a/.github/workflows/auto-review.yaml b/.github/workflows/auto-review.yaml
deleted file mode 100644
index 5df8b8c8fe..0000000000
--- a/.github/workflows/auto-review.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: Auto reviews updates
-
-on:
-  pull_request:
-  workflow_run:
-    workflows:
-      - None
-    types:
-      - completed
-
-jobs:
-  auto-merge:
-    name: Auto reviews updates
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-
-    steps:
-      - name: Auto reviews updates
-        uses: golfzaptw/action-auto-reviews-from-branches@1.2.3
-        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          AUTHOR: renovate[bot]
diff --git a/.github/workflows/changelog.yaml b/.github/workflows/changelog.yaml
index f201142ca2..cfd5cc44f3 100644
--- a/.github/workflows/changelog.yaml
+++ b/.github/workflows/changelog.yaml
@@ -2,7 +2,7 @@ name: Changelog Generator
 
 on:
   schedule:
-    - cron: '0 0 * * 1'
+    - cron: 0 0 * * 1,4
   push:
     tags:
       - '*.*.*'
@@ -14,20 +14,30 @@ jobs:
     timeout-minutes: 30
 
     steps:
+      - uses: actions/checkout@v4
+        if: github.event_name == 'push' && github.ref_type == 'tag'
+      - name: Create release
+        run: |-
+          if [[ ${{ github.ref_name }} =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            gh release create ${{ github.ref_name }} --generate-notes || true
+          fi
+        if: github.event_name == 'push' && github.ref_type == 'tag'
+        env:
+          GH_TOKEN: ${{ secrets.GOPASS_CI_GITHUB_TOKEN }}
+
       - name: Get Date
         id: get-date
-        run: |
-          echo "date=$(/bin/date -u "+%Y%m%d%H%M%S")" >> $GITHUB_OUTPUT
+        run: echo "date=$(/bin/date -u "+%Y%m%d%H%M%S")" >> $GITHUB_OUTPUT
       - uses: actions/cache@v3
         with:
           path: .cache
           key: automation-${{ steps.get-date.outputs.date }}
-          restore-keys: |
+          restore-keys: |+
             automation-
 
       - run: docker pull aeonphp/automation
       - name: Generate changelog
-        run: >
+        run: >-
           docker run --env=AEON_AUTOMATION_GH_TOKEN --rm --volume=$(pwd)/.cache:/cache aeonphp/automation
           changelog:generate:all
           ${{ github.repository }}
@@ -36,7 +46,6 @@ jobs:
           --skip-from=dependabot-preview[bot]
           --skip-from=dependabot[bot]
           --skip-from=renovate[bot]
-          --tag-skip=3.23.0
           -v
         env:
           AEON_AUTOMATION_GH_TOKEN: ${{ secrets.GOPASS_CI_GITHUB_TOKEN }}
diff --git a/.github/workflows/clean.yaml b/.github/workflows/clean.yaml
index 11906947e8..211c32e3ad 100644
--- a/.github/workflows/clean.yaml
+++ b/.github/workflows/clean.yaml
@@ -5,6 +5,7 @@ on:
   pull_request:
     types:
       - closed
+
 jobs:
   clean:
     runs-on: ubuntu-22.04
@@ -22,5 +23,5 @@ jobs:
       - run: echo "${HOME}/.local/bin" >> ${GITHUB_PATH}
       - run: python3 -m pip install --user --requirement=ci/requirements.txt
 
-      - name: Clean docker hub tags
+      - name: Clean Docker hub tags
         run: c2cciutils-clean
diff --git a/.github/workflows/dependency-auto-review.yaml b/.github/workflows/dependency-auto-review.yaml
new file mode 100644
index 0000000000..d09719021d
--- /dev/null
+++ b/.github/workflows/dependency-auto-review.yaml
@@ -0,0 +1,25 @@
+name: Auto reviews updates
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+
+jobs:
+  auto-merge:
+    name: Auto reviews updates
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+
+    steps:
+      - uses: actions/github-script@v6
+        with:
+          script: |-
+            github.rest.pulls.createReview({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+              event: 'APPROVE',
+            })
+    if: github.event.pull_request.user.login == 'renovate[bot]'
diff --git a/.github/workflows/pr-checks.yaml b/.github/workflows/pr-checks.yaml
index 3b1f154885..875115877f 100644
--- a/.github/workflows/pr-checks.yaml
+++ b/.github/workflows/pr-checks.yaml
@@ -27,4 +27,4 @@ jobs:
         run: c2cciutils-pull-request-checks
         env:
           GITHUB_EVENT: ${{ toJson(github) }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GOPASS_CI_GITHUB_TOKEN }}
diff --git a/.github/workflows/rebuild.yaml b/.github/workflows/rebuild.yaml
deleted file mode 100644
index 8ca7b3ac22..0000000000
--- a/.github/workflows/rebuild.yaml
+++ /dev/null
@@ -1,164 +0,0 @@
-name: Rebuild
-
-on:
-  schedule:
-    - cron: 0 0 * * *
-
-jobs:
-  rebuild:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 25
-    name: Rebuild
-
-    strategy:
-      fail-fast: false
-      matrix:
-        branch:
-          - '3.27'
-          - '3.28'
-          - '3.29'
-          - master
-
-    steps:
-      - run: docker system prune --all --force
-      - uses: actions/checkout@v3
-        with:
-          ref: ${{ matrix.branch }}
-
-      - name: Get tag
-        id: tag2
-        uses: frabert/replace-string-action@v2.4
-        with:
-          pattern: refs/tags/(.*)
-          string: '{{ github.ref }}'
-          replace-with: $1
-        if: startsWith(github.ref, 'refs/tags/')
-      - run: echo --${{ steps.tag2.outputs.replaced }}--
-
-      - uses: camptocamp/initialise-gopass-summon-action@v2
-        with:
-          ci-gpg-private-key: ${{secrets.CI_GPG_PRIVATE_KEY}}
-          github-gopass-ci-token: ${{secrets.GOPASS_CI_GITHUB_TOKEN}}
-          patterns: docker
-
-      - run: gpg --export-secret-keys --armor D121AF2DFA8E140688BD968930C9B913FD42EF13 > CI.asc
-
-      - id: last-tag
-        run: echo "tag=$(git describe --tags --abbrev=0)" > $GITHUB_OUTPUT
-      - id: no-tag
-        run: echo "nb=$(git log --oneline ${{ steps.last-tag.outputs.tag }}..HEAD|wc -l)" > $GITHUB_OUTPUT
-      - run: sed --in-place 's/version = .*/version = "${{ steps.last-tag.outputs.tag }}"/g' build.gradle
-        if: steps.no-tag.outputs.nb == 0
-      - run:
-          sed --in-place 's/version = .*/version = "${{ steps.last-tag.outputs.tag }}+${{ steps.no-tag.outputs.nb
-          }}"/g' build.gradle
-        if: steps.no-tag.outputs.nb > 0
-
-      - run: echo "enablePublishing=true" > gradle.properties
-      - run: git diff
-
-      - run: echo "${HOME}/.local/bin" >> ${GITHUB_PATH}
-      - run: python3 -m pip install --user --requirement=ci/requirements.txt
-
-      - run: make build
-
-        # Extract artifacts
-      - run: docker run --rm --detach --name=builder mapfish_print_builder
-        if: always()
-      - run: docker cp builder:/src/core/build/ core/build/
-        if: always()
-
-      - uses: actions/upload-artifact@v3
-        with:
-          name: Test results
-          path: core/build/resources/actual
-        if: failure()
-      - uses: actions/upload-artifact@v3
-        with:
-          name: Reports core
-          path: core/build/reports
-        if: failure()
-
-      - name: Collect test results
-        run: |
-          mkdir -p /tmp/test_results/junit
-          find . -name '*TEST-*.xml' -exec cp -v {} /tmp/test_results/junit/ \;
-        if: failure()
-      - uses: actions/upload-artifact@v3
-        with:
-          name: Test results
-          path: /tmp/test_results
-        if: failure()
-
-      - name: Publish
-        run: c2cciutils-publish --type=rebuild --branch=${{ matrix.branch }}
-
-      - run: ./gradlew :core:libSourcesJar
-        if: startsWith(github.ref, 'refs/tags/')
-      - run: ./gradlew :core:libJavadocJar
-        if: startsWith(github.ref, 'refs/tags/')
-      - id: version
-        run: echo "version=$(grep version build.gradle|sed "s/ \+version = .\(.*\)./\1/g")" > $GITHUB_OUTPUT
-      - id: tag
-        run: echo "tag=$(echo github.ref|sed 's%refs/tags/%%g')" > $GITHUB_OUTPUT
-      - name: Create Release
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ github.ref }}
-          release_name: Release ${{ steps.tag.outputs.tag }}
-          draft: false
-          prerelease: false
-        if: startsWith(github.ref, 'refs/tags/')
-      - name: Upload Release Asset
-        uses: actions/upload-release-asset@v1.0.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./core/build/libs/print-servlet-${{ steps.version.outputs.version }}.war
-          asset_name: print-servlet-${{ steps.version.outputs.version }}.war
-          asset_content_type: application/java-archive
-        if: startsWith(github.ref, 'refs/tags/')
-      - name: Upload Release Asset
-        uses: actions/upload-release-asset@v1.0.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./core/build/distributions/core-${{ steps.version.outputs.version }}.zip
-          asset_name: print-cli-${{ steps.version.outputs.version }}.zip
-          asset_content_type: application/zip
-        if: startsWith(github.ref, 'refs/tags/')
-      - name: Upload Release Asset
-        uses: actions/upload-release-asset@v1.0.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./core/build/libs/print-lib-${{ steps.version.outputs.version }}.jar
-          asset_name: print-lib-${{ steps.version.outputs.version }}.jar
-          asset_content_type: application/java-archive
-        if: startsWith(github.ref, 'refs/tags/')
-      - name: Upload Release Asset
-        uses: actions/upload-release-asset@v1.0.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./core/build/libs/print-lib-${{ steps.version.outputs.version }}-sources.jar
-          asset_name: print-lib-${{ steps.version.outputs.version }}-sources.jar
-          asset_content_type: application/java-archive
-        if: startsWith(github.ref, 'refs/tags/')
-      - name: Upload Release Asset
-        uses: actions/upload-release-asset@v1.0.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./core/build/libs/print-lib-${{ steps.version.outputs.version }}-javadoc.jar
-          asset_name: print-lib-${{ steps.version.outputs.version }}-javadoc.jar
-          asset_content_type: application/java-archive
-        if: startsWith(github.ref, 'refs/tags/')
diff --git a/ci/config.yaml b/ci/config.yaml
index f433a8b0db..3e31dcc8a8 100644
--- a/ci/config.yaml
+++ b/ci/config.yaml
@@ -1,3 +1,5 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/camptocamp/c2cciutils/1.4.13/c2cciutils/schema.json
+
 checks:
   codespell:
     ignore_re: