diff --git a/.github/workflows/node-python-matrix.yaml b/.github/workflows/node-python-matrix.yaml
new file mode 100644
index 00000000..6200e88d
--- /dev/null
+++ b/.github/workflows/node-python-matrix.yaml
@@ -0,0 +1,794 @@
+# This workflow will build and test pframes component (core, nodejs, wasm)
+
+name: Build and Test PFrames component
+
+on:
+  workflow_call:
+    inputs:
+      #
+      # Common settings
+      #
+      app-name:
+        description: |
+          Application name in human-readable form.
+          As it is supposed to be shown in messages
+        type: string
+        required: false
+        default: ${{ github.repository }}
+
+      app-name-slug:
+        description: |
+          Application name slug (part of release file name)
+        type: string
+        required: true
+
+      #
+      # Checkout settings
+      #
+      checkout-submodules:
+        description: |
+          'Submodules' mode for 'actions/checkout' action
+          '', 'false' - disable submodules support
+          'true' - checkout submodules
+          'recursive' - checkout submodules recursive
+        type: string
+        required: false
+        default: ""
+
+      #
+      # Environment settings
+      #
+      env:
+        description: |
+          custom environment variables to set for all jobs in workflow
+          as JSON-encoded map:
+            { "MY_VAR_1": "awesome value",
+              "VARIABLE_2": "not so awesome :)" }
+
+          This input's envs are merged with secrets.env
+          This input's envs have lower priority compared than secrets.env
+        type: string
+        required: false
+        default: "{}"
+
+      #
+      # Node settings
+      #
+      node-version:
+        description: |
+          Node version to use
+        type: string
+        required: true
+
+      #
+      # Python settings
+      #
+      python-version:
+        description: |
+          Python version to use: i.e. '3.12'
+        type: string
+        required: true
+
+      #
+      # Cache control
+      #
+      cache-version:
+        description: |
+          Simple hack, that allows to 'reset' cache for particular job.
+
+          Just change the value of this parameter and the next run will
+          not find build cache and will have to start from scratch.
+
+        type: string
+        required: false
+        default: "v1"
+
+      cache-paths:
+        description: |
+          Additional paths to be cached after build
+        type: string
+        required: false
+        default: ""
+
+      #
+      # Matrix control
+      #
+      matrix:
+        description: |
+          List of agents to run CI jobs: [ {"os": "ubuntu-latest", "arch": "amd64"}, ... ]
+        type: string
+        required: false
+        default: |
+          [ 
+            {"os":"windows-latest", "arch":"amd64"},
+
+            {"os":"ubuntu-22.04",   "arch":"amd64"},
+            {"os":"ubuntu-arm64",   "arch":"arm64"},
+
+            {"os":"macos-13",       "arch":"amd64"},
+            {"os":"macos-14",       "arch":"arm64"}
+          ]
+
+      #
+      # Build control
+      #
+      build-script-name:
+        description: |
+          The name of a build script
+        type: string
+        required: true
+        default: "build"
+
+      build-artifacts:
+        description: |
+          List of paths to collect as build artifacts after 'build' step.
+          Supports globbing (**/my-file.bin, **/*.bin).
+        type: string
+        required: false
+        default: ""
+
+      #
+      # Test control
+      #
+      test:
+        description: |
+          Run unit tests
+        type: boolean
+        required: false
+        default: false
+
+      test-script-name:
+        description: |
+          The name of npm test script
+          e.g. 'test:e2e', 'test:main' etc.
+        type: string
+        required: false
+        default: "test"
+
+      #
+      # NPM registry settings
+      #
+
+      registry-url:
+        description: |
+          The npm registry url to set up for auth
+          and publication of the node js package.
+        type: string
+        required: false
+        default: "https://npm.pkg.github.com"
+
+      scope:
+        description: |
+          Scope for authenticating against npm registries.
+        type: string
+        required: false
+        default: ${{ format('{0}{1}', '@', github.repository_owner) }}
+
+      always-auth:
+        description: |
+          Set always-auth in npmrc.
+        type: string
+        required: false
+        default: "false"
+
+      npmrc-config:
+        description: |
+          Generates a .npmrc file based on provided configuration.
+        type: string
+        required: false
+
+      #
+      # Codesign control
+      #
+
+      sign-binaries:
+        description: |
+          List of globbing patterns that match files to be signed after build step.
+          When built, the selected files will be signed with methods appropriate for current operating system.
+        type: string
+        required: false
+        default: ""
+
+      notarize-paths:
+        description: |
+          List of globbing patterns that match files and directories to be notarized.
+          Matched files would be notarized for releases.
+        type: string
+        required: false
+        default: ""
+
+      #
+      # Distribution control
+      #
+
+      publish-script-name:
+        description: |
+          Run 'npm run <script>' instead of 'npm publish'
+        type: string
+        required: false
+        default: ""
+
+      publish-to-public:
+        description: |
+          Whether or not the npm package should be published as public.
+        type: boolean
+        required: false
+        default: false
+
+      #
+      # AWS S3 Bucket registry control
+      #
+      aws-login-enable:
+        description: |
+          Enables the creation of AWS credentials during the GitHub Action workflow.
+        type: boolean
+        required: false
+        default: false
+
+      #
+      # GCP sign control
+      #
+      gcp-login-enable:
+        description: |
+          Enables the creation of Google cloud credentials during the GitHub Action workflow.
+        type: boolean
+        required: false
+        default: false
+
+      gcp-sdk-version:
+        description: |
+          Version or version constraint of the gcloud SDK to install. If
+          unspecified, it will accept any installed version of the gcloud SDK. If
+          set to "latest", it will download the latest available SDK. If set to a
+          version constraint, it will download the latest available version that
+          matches the constraint. Examples: "290.0.1" or ">= 197.0.1".
+        type: string
+        required: false
+        default: "latest"
+
+      gcp-timestamping-mode:
+        description: |
+          Timestamping mode to use when working with certificates and signatures
+          (i.e. when signing the code)
+        type: string
+        required: false
+
+      # We do not put version into secrets because it has very short value.
+      #  '1' in secrets may cause '1' to be replaced with '*' everywhere in github workflow logs
+      gcp-kms-key-version:
+        description: |
+          Version of KMS key.
+        type: string
+        required: false
+        default: "1"
+
+      gcp-kms-digest-algorithm:
+        description: |
+          The algorithm to digest the input.
+          Must be one of: sha256, sha384, sha512.
+        type: string
+        required: false
+        default: "sha256"
+
+      #
+      # Notifications
+      #
+      notify-telegram:
+        description: |
+          Enable Telegram notifications
+        required: false
+        type: boolean
+        default: true
+
+      notify-build:
+        description: |
+          Enable notifications about build status (build ready/failed)
+          Possible values are:
+           - 'true' - send all notifications about build status (both success and failed)
+           - 'failure-only' - send notification about failed builds, don't notify on success
+           - 'success-only' - send notification about success builds, don't notify on failures
+           - 'false' - don't send notifications about build results at all.
+        required: false
+        type: string
+        default: "true"
+
+      notify-tests:
+        description: |
+          Enable notifications about tests status (ready/failed)
+          Possible values are:
+           - 'true' - send all notifications about tests status (both success and failed)
+           - 'failure-only' - send notification about failed tests, don't notify on success
+           - 'success-only' - send notification about success tests, don't notify on failures
+           - 'false' - don't send notifications about tests results at all.
+        required: false
+        type: string
+        default: "true"
+
+    secrets:
+      env:
+        description: |
+          custom environment variables to set for all jobs in workflow
+          as JSON-encoded map:
+            { "MY_VAR_1": "awesome value",
+              "VARIABLE_2": "not so awesome :)" }
+
+          This input's envs are merged with inputs.env
+          This input's envs have HIGHER priority compared than inputs.env
+        required: false
+
+      TELEGRAM_NOTIFICATION_TARGET:
+        description: |
+          ID of Telegram Channel or User to notify on build results.
+        required: false
+
+      TELEGRAM_API_TOKEN:
+        description: |
+          Telegram Bot API authorization token
+        required: false
+
+      MAC_SIGN_CERT_ID:
+        description: |
+          The Apple's certificate id. e.g: '5MXXYYZZFF'
+        required: false
+      MAC_SIGN_CERT:
+        description: |
+          base64-encoded p12 signing certificate file for the macOS
+          (more info here https://www.electron.build/code-signing)
+        required: false
+      MAC_SIGN_CERT_PWD:
+        description: |
+          password to decrypt the p12 signing certificate for the macOS
+        required: false
+
+      MAC_NOTR_API_KEY:
+        description: |
+          base64-encoded content of an API key file
+        required: false
+      MAC_NOTR_API_KEY_ID:
+        description: |
+          Key ID found on App Store Connect for the API key file
+        required: false
+      MAC_NOTR_API_KEY_ISSUER_ID:
+        description: |
+          Issuer ID found on App Store Connect for the API key file
+        required: false
+
+      WIN_SIGN_CERT:
+        description: |
+          base64-encoded p12 certificate file for the Windows
+          (more info here https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/code-signing-cert-manage)
+        required: false
+      WIN_SIGN_CERT_PWD:
+        description: |
+          password to decrypt the p12 signing certificate for the Windows
+        required: false
+
+      AWS_ASSUME_ROLE:
+        description: |
+          Role to assume in AWS to assume during CI run.
+        required: false
+      AWS_ASSUME_REGION:
+        description: |
+          The AWS region for AWS role assumption
+        required: false
+
+      GCP_TIMESTAMPING_URL:
+        description: |
+          Timestamping URL of certificate issuer.
+        required: false
+      GCP_KMS_WORKLOAD_IDENTITY_PROVIDER:
+        description: |
+          Tha name of the GCP workload identity federation provider.
+        required: false
+      GCP_KMS_SERVICE_ACCOUNT:
+        description: |
+          The name of the GCP service account
+        required: false
+      GCP_KMS_LOCATION:
+        description: |
+          KMS key and keyring location
+        required: false
+      GCP_KMS_KEYRING:
+        description: |
+          KMS keyring name in Google Cloud Platform.
+        required: false
+      GCP_KMS_KEY_NAME:
+        description: |
+          KMS key name in Google Cloud Platform.
+        required: false
+
+jobs:
+  init:
+    name: Init
+    runs-on: ubuntu-latest
+    steps:
+      - id: context
+        uses: milaboratory/github-ci/actions/context@v4
+
+    outputs:
+      is-release: ${{ fromJSON(steps.context.outputs.is-release) }}
+
+  build-and-test:
+    name: :build-and-test
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(inputs.matrix) }}
+
+    permissions:
+      id-token: write
+      packages: read
+      contents: read
+
+    needs:
+      - init
+
+    steps:
+      - uses: milaboratory/github-ci/actions/env@v4
+        with:
+          inputs: ${{ inputs.env }}
+          secrets: ${{ secrets.env }}
+
+      - uses: actions/checkout@v4
+        with:
+          submodules: ${{ inputs.checkout-submodules }}
+
+      - uses: milaboratory/github-ci/actions/python/prepare@v4
+        with:
+          python-version: ${{ inputs.python-version }}
+          cache-version: ${{ inputs.cache-version }}
+
+      - name: Cache additional paths
+        uses: actions/cache@v4
+        if: inputs.cache-paths != ''
+        with:
+          path: ${{ inputs.cache-paths }}
+          key: ${{ runner.os }}-${{ runner.arch }}-cache-additional-${{ inputs.cache-version }}
+
+      - uses: milaboratory/github-ci/blocks/node/test@v4
+        with:
+          node-version: ${{ inputs.node-version }}
+          cache-version: ${{ inputs.cache-version }}
+          is-electron-application: false
+          registry-url: ${{ inputs.registry-url }}
+          scope: ${{ inputs.scope }}
+          always-auth: ${{ inputs.always-auth }}
+          npm-auth-token: ${{ secrets.GITHUB_TOKEN }}
+
+          build-script-name: ${{ inputs.build-script-name }}
+          build-before-run-test: true
+          test-name: ${{ inputs.test-script-name }}
+          npmrc-config: ${{ inputs.npmrc-config }}
+
+      - name: CodeSign binary on macOS
+        uses: milaboratory/github-ci/blocks/signing-tools/macos-sign@v4
+        if: runner.os == 'macOS'
+          && inputs.sign-binaries != ''
+        with:
+          binaries: ${{ inputs.sign-binaries }}
+          mac-cert-id: ${{ secrets.MAC_SIGN_CERT_ID }}
+          mac-cert-base64: ${{ secrets.MAC_SIGN_CERT }}
+          mac-cert-passwd: ${{ secrets.MAC_SIGN_CERT_PWD }}
+
+      - name: Get GoogleCloud access token for CodeSign on Windows
+        uses: google-github-actions/auth@v2
+        id: gcp-auth
+        if: runner.os == 'Windows'
+          && inputs.sign-binaries != ''
+          && inputs.gcp-login-enable
+        with:
+          workload_identity_provider: ${{ secrets.GCP_KMS_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ secrets.GCP_KMS_SERVICE_ACCOUNT }}
+          token_format: "access_token"
+
+      - name: CodeSign binary on Windows
+        if: runner.os == 'Windows'
+          && inputs.sign-binaries != ''
+        uses: milaboratory/github-ci/blocks/signing-tools/windows-sign@v4
+        with:
+          binaries: ${{ inputs.sign-binaries }}
+          timestamping-mode: ${{ inputs.gcp-timestamping-mode }}
+          timestamping-url: ${{ secrets.GCP_TIMESTAMPING_URL }}
+          code-sign-chain: ${{ secrets.WIN_SIGN_CERT }}
+          kms-keyring: ${{ secrets.GCP_KMS_KEYRING }}
+          kms-keyname: ${{ secrets.GCP_KMS_KEY_NAME }}
+          access-token: ${{ steps.gcp-auth.outputs.access_token }}
+
+      - name: Saving build artifacts for publish step
+        uses: milaboratory/github-ci/actions/artifact/save@v4
+        id: build-artifacts
+        if: inputs.build-artifacts != ''
+        with:
+          name: build-artifacts-${{ matrix.os }}-${{ matrix.arch }}
+          path: ${{ inputs.build-artifacts }}
+
+    outputs:
+      # Even constant outputs become initialized only after job start.
+      # All outputs of skipped jobs are always empty.
+      started: "true"
+
+  notify-build:
+    name: Notify build and test
+    runs-on: ubuntu-latest
+
+    if: always()
+      && inputs.notify-telegram
+      && inputs.notify-build != 'false'
+      && needs.build-and-test.outputs.started == 'true'
+
+    needs:
+      - build-and-test
+
+    steps:
+      - id: search-tags
+        if: always()
+        uses: milaboratory/github-ci/actions/strings/json-list@v4
+        with:
+          input: |
+            build
+
+      - uses: milaboratory/github-ci/blocks/notify/build@v4
+        with:
+          telegram-target: ${{ secrets.TELEGRAM_NOTIFICATION_TARGET }}
+          telegram-token: ${{ secrets.TELEGRAM_API_TOKEN }}
+          build-status: |
+            ${{ needs.build-and-test.result }}
+          product-name: ${{ inputs.app-name }}
+          search-tags: ${{ steps.search-tags.outputs.result }}
+
+  can-release:
+    name: Can release
+    runs-on: ubuntu-latest
+    needs:
+      - init
+      - build-and-test
+
+    if: always()
+      && needs.init.outputs.is-release
+      && needs.build-and-test.result == 'success'
+
+    steps:
+      - shell: bash
+        run: "true"
+
+  notify-release-review:
+    name: Notify review required
+    runs-on: ubuntu-latest
+    if: always()
+      && needs.can-release.result == 'success'
+
+    needs:
+      - can-release
+    steps:
+      - uses: milaboratory/github-ci/blocks/notify/review-required@v4
+        with:
+          telegram-target: ${{ secrets.TELEGRAM_NOTIFICATION_TARGET }}
+          telegram-token: ${{ secrets.TELEGRAM_API_TOKEN }}
+          message: new version of pframes is ready for release.
+          product-name: ${{ inputs.app-name }}
+
+  release:
+    name: Confirm release
+    runs-on: ubuntu-latest
+
+    needs:
+      - can-release
+
+    if: always() && needs.can-release.result == 'success'
+
+    environment: release
+
+    steps:
+      - uses: milaboratory/github-ci/actions/env@v4
+        with:
+          inputs: ${{ inputs.env }}
+          secrets: ${{ secrets.env }}
+
+      - uses: actions/checkout@v4
+        with:
+          submodules: ${{ inputs.checkout-submodules }}
+
+      - id: npm-pkg-status
+        uses: milaboratory/github-ci/actions/node/npm-pkg-status@v4
+        with:
+          package-json-path: "${{ github.workspace }}/package.json"
+          registry-url: ${{ inputs.registry-url }}
+          npm-auth-token: ${{ env.NPMJS_TOKEN || secrets.GITHUB_TOKEN }}
+
+    outputs:
+      # Even constant outputs become initialized only after job start.
+      # All outputs of skipped jobs are always empty.
+      package-exists: ${{ steps.npm-pkg-status.outputs.exist != '0' }}
+      package-version: ${{ steps.npm-pkg-status.outputs.pkg-version }}
+      started: "true"
+
+  notarize:
+    name: Notarize
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(inputs.matrix) }}
+
+    if: always()
+      && needs.release.result == 'success'
+      && needs.release.outputs.package-exists
+      && inputs.notarize-paths != ''
+
+    needs:
+      - release
+
+    steps:
+      - uses: milaboratory/github-ci/actions/env@v4
+        with:
+          inputs: ${{ inputs.env }}
+          secrets: ${{ secrets.env }}
+
+      - uses: milaboratory/github-ci/actions/artifact/restore@v4
+        id: build-artifacts
+        if: inputs.build-artifacts != ''
+        with:
+          pattern: build-artifacts-${{ matrix.os }}-${{ matrix.arch }}
+
+      - name: Notarize binary on macOS
+        uses: milaboratory/github-ci/blocks/signing-tools/macos-notarize@v4
+        if: runner.os == 'macOS'
+        with:
+          paths: ${{ inputs.notarize-paths }}
+          mac-api-key-base64: ${{ secrets.MAC_NOTR_API_KEY }}
+          mac-api-key-id: ${{ secrets.MAC_NOTR_API_KEY_ID }}
+          mac-api-key-issuer-id: ${{ secrets.MAC_NOTR_API_KEY_ISSUER_ID }}
+
+  publish-to-npm:
+    name: npm publish
+    runs-on: ubuntu-latest
+
+    if: always()
+      && needs.release.result == 'success'
+      && needs.release.outputs.package-exists
+      && needs.init.outputs.is-release
+
+    needs:
+      - init
+      - release
+
+    permissions:
+      id-token: write
+      packages: read
+      contents: read
+
+    steps:
+      - uses: milaboratory/github-ci/actions/env@v4
+        with:
+          inputs: ${{ inputs.env }}
+          secrets: ${{ secrets.env }}
+
+      - uses: actions/checkout@v4
+        with:
+          submodules: ${{ inputs.checkout-submodules }}
+
+      - name: Prepare environment for building a NodeJS application
+        uses: milaboratory/github-ci/actions/node/prepare@v4
+        with:
+          node-version: ${{ inputs.node-version }}
+          cache-version: ${{ inputs.cache-version }}
+          is-electron-application: false
+          registry-url: ${{ inputs.registry-url }}
+          scope: ${{ inputs.scope }}
+          always-auth: ${{ inputs.always-auth }}
+          npmrc-config: ${{ inputs.npmrc-config }}
+          update-npm: true
+          install-deps: true
+
+      - uses: milaboratory/github-ci/actions/python/prepare@v4
+        with:
+          python-version: ${{ inputs.python-version }}
+          cache-version: ${{ inputs.cache-version }}
+
+      - uses: milaboratory/github-ci/actions/artifact/restore@v4
+        id: build-artifacts
+        if: inputs.build-artifacts != ''
+        with:
+          pattern: build-artifacts-*
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        if: inputs.aws-login-enable
+        with:
+          role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
+          aws-region: ${{ secrets.AWS_ASSUME_REGION }}
+
+      - name: Configure GCP credentials
+        uses: google-github-actions/auth@v2
+        if: inputs.gcp-login-enable
+        with:
+          workload_identity_provider: ${{ secrets.GCP_KMS_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ secrets.GCP_KMS_SERVICE_ACCOUNT }}
+          token_format: "access_token"
+
+      - name: Set up GCloud SDK
+        uses: google-github-actions/setup-gcloud@v2
+        if: inputs.gcp-login-enable
+        with:
+          version: ${{ inputs.gcp-sdk-version }}
+
+      - name: Add MiLab shell utils to PATH
+        if: inputs.gcp-login-enable
+        uses: milaboratory/github-ci/actions/milab-shell-utils@v4
+
+      - name: Publish npm package
+        uses: milaboratory/github-ci/actions/shell@v4
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPMJS_TOKEN: ${{ env.NPMJS_TOKEN }}
+          PUBLISH_SCRIPT: ${{ inputs.publish-script-name }}
+          PUBLISH_TO_PUBLIC: ${{ inputs.publish-to-public }}
+          GCP_KMS_KEY_VERSION: ${{ inputs.gcp-kms-key-version }}
+          GCP_KMS_KEY_NAME: ${{ secrets.GCP_KMS_KEY_NAME }}
+          GCP_KMS_KEYRING: ${{ secrets.GCP_KMS_KEYRING }}
+          GCP_KMS_LOCATION: ${{ secrets.GCP_KMS_LOCATION }}
+          GCP_KMS_DIGEST_ALGORITHM: ${{ inputs.gcp-kms-digest-algorithm }}
+        with:
+          run: |
+            if [ -z "${PUBLISH_SCRIPT}" ]; then
+              if [ "${PUBLISH_TO_PUBLIC}" == "true" ]; then
+                npm publish --access public
+              else
+                npm publish
+              fi
+            else
+              npm run "${PUBLISH_SCRIPT}"
+            fi
+
+      - name: Create release with tag
+        uses: milaboratory/github-ci/actions/release/create-with-tag@v4
+        env:
+          NPM_PKG_VERSION: ${{ needs.release.outputs.package-version }}
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          name: ${{ format('v{0}', env.NPM_PKG_VERSION) }}
+          tag: ${{ format('v{0}', env.NPM_PKG_VERSION) }}
+          commit: ${{ github.sha }}
+          draft: false
+          prerelease: false
+
+    outputs:
+      # Even constant outputs become initialized only after job start.
+      # All outputs of skipped jobs are always empty.
+      started: "true"
+
+  notify-release:
+    name: notify release
+    runs-on: ubuntu-latest
+
+    if: always()
+      && needs.release.result == 'success'
+    needs:
+      - release
+      - publish-to-npm
+
+    steps:
+      - id: search-tags
+        if: always()
+        uses: milaboratory/github-ci/actions/strings/json-list@v4
+        with:
+          input: |
+            release
+
+      - uses: milaboratory/github-ci/blocks/notify/release@v4
+        env:
+          NPM_PKG_VERSION: ${{ needs.release.outputs.package-version }}
+        with:
+          telegram-target: ${{ secrets.TELEGRAM_NOTIFICATION_TARGET }}
+          telegram-token: ${{ secrets.TELEGRAM_API_TOKEN }}
+
+          job-status: |
+            ${{ needs.release.result }}
+            ${{ needs.publish-to-npm.result }}
+
+          product-name: ${{ inputs.app-name }}
+          override-version: ${{ format('{0}', env.NPM_PKG_VERSION) }}
+          override-tag: ${{ format('v{0}', env.NPM_PKG_VERSION) }}
+          search-tags: ${{ steps.search-tags.outputs.result }}
diff --git a/actions/artifact/restore/action.yaml b/actions/artifact/restore/action.yaml
new file mode 100644
index 00000000..1685ad33
--- /dev/null
+++ b/actions/artifact/restore/action.yaml
@@ -0,0 +1,97 @@
+name: Restore artifact, saved with actions/artifact/save
+author: "MiLaboratories"
+description: |
+  Restore the artifact saved with actions/artifact/save. No path transforations are
+  performed: the contents of artifact are restored like the data was initially created
+  on current agent, keeping all permissions and paths (relative to current WD)
+
+inputs:
+  name:
+    description: |
+      Name of the artifact to download.
+      Optional. When empty, causes all artifacts to be downloaded.
+    required: false
+
+  pattern:
+    description: |
+      Pattern for artifacts to download.
+      Optional. Causes action to restore several artifacts, selected by their names.
+    required: false
+
+  github-token:
+    description: |
+      The GitHub token used to authenticate with the GitHub API.
+      This is required when downloading artifacts from a different repository or from a different workflow run.
+      Optional. If unspecified, the action will download artifacts from the current repo and the current workflow run.
+    required: false
+
+  repository:
+    description: |
+      The repository owner and the repository name joined together by "/".
+      If github-token is specified, this is the repository that artifacts will be downloaded from.
+      Optional. Default is {{ github.repository }}
+    required: false
+
+  run-id:
+    description: |
+      The id of the workflow run where the desired download artifact was uploaded from.
+      If github-token is specified, this is the run that artifacts will be downloaded from.
+      Optional. Default is {{ github.run_id }}
+    required: false
+
+runs:
+  using: "composite"
+
+  steps:
+    - name: Generate archive name
+      id: archive-name
+      shell: bash
+      env:
+        ARTIFACT_NAME: ${{ inputs.name }}
+      run: |
+        # We need unique archive name here to not overwrite any existing file in workdir.
+        # We also need static name to simplify 'restore' action logic.
+        # This name is an attempt to meet both criteria.
+        if [ -z "ARTIFACT_NAME" ]; then
+          echo "::error::Empty 'name' input. Specify artifact name" >&2
+          exit 1
+        fi
+
+        archive_name="artifact-5b3513f5"
+        echo "name=${archive_name}" >> "${GITHUB_OUTPUT}"
+
+    - uses: actions/download-artifact@v4
+      with:
+        name: ${{ inputs.name }}
+        pattern: ${{ inputs.pattern }}
+        github-token: ${{ inputs.github-token }}
+        repository: ${{ inputs.repository }}
+        run-id: ${{ inputs.run-id }}
+        path: "artifacts-restore-5b3513f5"
+
+    - name: Extract tar
+      shell: bash
+      env:
+        ARTIFACT_NAME: ${{ inputs.name }}
+        ARCHIVE_NAME: ${{ steps.archive-name.outputs.name }}
+      run: |
+        if ! [ -d "./artifacts-restore-5b3513f5" ]; then
+          echo "::error::No artifacts were restored by the action. Is 'name'/'pattern' input correct?" >&2
+          exit 1
+        fi
+
+        at_least_one_found=""
+        while read -r file; do
+          at_least_one_found="true"
+          tar -x -f "${file}"
+        done < <(
+          find \
+            "./artifacts-restore-5b3513f5" \
+            -type f \
+            -name "${ARCHIVE_NAME}.tar"
+        )
+
+        if [ -z "${at_least_one_found}" ]; then
+          echo "::error::No artifacts were restored by the action. Only artifacts saved with 'artifact/save' action can be restored by 'artifact/restore'" >&2
+          exit 1
+        fi
diff --git a/actions/artifact/save/action.yaml b/actions/artifact/save/action.yaml
new file mode 100644
index 00000000..3280ad32
--- /dev/null
+++ b/actions/artifact/save/action.yaml
@@ -0,0 +1,141 @@
+name: Pack tar archive and save it as artifact
+author: "MiLaboratories"
+description: |
+  Get all files mathing globbing rules, pack them into single tar archive and 
+  save this archive as artifact. The standard upload-artifact does not preserve
+  permissions. This action helps to bypass this limitation.
+
+inputs:
+  name:
+    description: |
+      Name of the artifact to upload.
+      Optional. Default is 'artifact'
+    required: false
+    default: "artifact"
+
+  path:
+    description: |
+      A file, directory or wildcard pattern that describes what to upload
+      Required.
+    required: true
+
+  if-no-files-found:
+    description: |
+      The desired behavior if no files are found using the provided path.
+      Available Options:
+        warn: Output a warning but do not fail the action
+        error: Fail the action with an error message
+        ignore: Do not output any warnings or errors, the action does not fail
+      Optional. Default is 'error'
+    required: false
+    default: "error"
+
+  retention-days:
+    description: |
+      Duration after which artifact will expire in days. 0 means using default retention.
+      Minimum 1 day.
+      Maximum 90 days unless changed from the repository settings page.
+      Optional. Defaults to repository settings.
+    required: false
+    default: "0"
+
+  compression-level:
+    description: |
+      The level of compression for Zlib to be applied to the artifact archive.
+      The value can range from 0 to 9.
+      For large files that are not easily compressed, a value of 0 is recommended for significantly faster uploads.
+      The compression is applied to the zip archive, where tar is stored. The tar file itself will not be compressed.
+      Optional. Default is '6'
+    required: false
+    default: "6"
+
+  overwrite:
+    description: |
+      If true, an artifact with a matching name will be deleted before a new one is uploaded.
+      If false, the action will fail if an artifact for the given name already exists.
+      Does not fail if the artifact does not exist.
+      Optional. Default is 'false'
+    required: false
+    default: "false"
+
+  include-hidden-files:
+    description: |
+      Whether to include hidden files in the provided path in the artifact
+      The file contents of any hidden files in the path should be validated before
+      enabled this to avoid uploading sensitive information.
+      Optional. Default is 'false'
+    required: false
+    default: "false"
+
+  # interactive-debug:
+  #   description: |
+  #     Break execution and start interactive debugging session with server VSCode right on agent
+  #   required: false
+  #   default: "false"
+
+runs:
+  using: "composite"
+
+  steps:
+    - name: Generate archive name
+      id: archive-name
+      shell: bash
+      env:
+        ARTIFACT_NAME: ${{ inputs.name }}
+      run: |
+        if [ -z "ARTIFACT_NAME" ]; then
+          echo "::error::Empty 'name' input. Specify artifact name." >&2
+          exit 1
+        fi
+
+        # We need unique archive name here to not overwrite any existing file in workdir.
+        # We also need static name to simplify 'restore' action logic.
+        # This name is an attempt to meet both criteria.
+        archive_name="artifact-5b3513f5"
+        echo "name=${archive_name}" >> "${GITHUB_OUTPUT}"
+
+    - uses: milaboratory/github-ci/actions/files/list@v4
+      id: artifact-files
+      with:
+        patterns: ${{ inputs.path }}
+        exclude-hidden-files: ${{ ! fromJSON(inputs.include-hidden-files) }}
+        implicit-descendants: false
+        relative: true
+
+    - name: Create tar
+      shell: bash
+      env:
+        ARCHIVE_NAME: ${{ steps.archive-name.outputs.name }}
+        ARTIFACT_PATHS: ${{ steps.artifact-files.outputs.paths }}
+        ARCHIVE_IS_EMPTY: ${{ steps.artifact-files.outputs.is-empty }}
+        RUNNER_OS: ${{ runner.os }}
+      run: |
+        if [ "${ARCHIVE_IS_EMPTY}" == "true" ]; then
+          // do not create archive to let actions/upload-artifact decide how to react on 'nothing found' case
+          return
+        fi
+
+        if [ "${RUNNER_OS}" == "Windows" ]; then
+          ARTIFACT_PATHS="${ARTIFACT_PATHS//\\/\\\\}" # escape windows delimiters to not confuse tar
+        fi
+
+        echo "${ARTIFACT_PATHS}" > "${ARCHIVE_NAME}.files"
+        echo "Paths to be archived:"
+        cat "${ARCHIVE_NAME}.files"
+
+        tar -T "${ARCHIVE_NAME}.files" -c -f "${ARCHIVE_NAME}.tar"
+
+    # - uses: fawazahmed0/action-debug-vscode@main
+    #   if: inputs.interactive-debug == 'true'
+
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ inputs.name }}
+        if-no-files-found: ${{ inputs.if-no-files-found }}
+        retention-days: ${{ inputs.retention-days }}
+        compression-level: ${{ inputs.compression-level }}
+        overwrite: ${{ inputs.overwrite }}
+        include-hidden-files: ${{ inputs.include-hidden-files }}
+
+        path: |
+          ${{ steps.archive-name.outputs.name }}.tar
diff --git a/actions/utils/list-files/.eslintignore b/actions/files/list/.eslintignore
similarity index 100%
rename from actions/utils/list-files/.eslintignore
rename to actions/files/list/.eslintignore
diff --git a/actions/utils/list-files/.eslintrc.json b/actions/files/list/.eslintrc.json
similarity index 100%
rename from actions/utils/list-files/.eslintrc.json
rename to actions/files/list/.eslintrc.json
diff --git a/actions/utils/list-files/.prettierignore b/actions/files/list/.prettierignore
similarity index 100%
rename from actions/utils/list-files/.prettierignore
rename to actions/files/list/.prettierignore
diff --git a/actions/utils/list-files/.prettierrc b/actions/files/list/.prettierrc
similarity index 100%
rename from actions/utils/list-files/.prettierrc
rename to actions/files/list/.prettierrc
diff --git a/actions/files/list/action.yaml b/actions/files/list/action.yaml
new file mode 100644
index 00000000..ada83ad6
--- /dev/null
+++ b/actions/files/list/action.yaml
@@ -0,0 +1,49 @@
+name: 'File Globber'
+description: 'A GitHub Action to perform globbing operations to find files based on patterns.'
+author: 'MiLaboratories'
+
+inputs:
+  patterns:
+    description: |
+      Glob patterns to search for files.
+      More information about globbing options:
+      https://github.com/actions/toolkit/tree/main/packages/glob
+    required: true
+
+  target-file:
+    description: |
+      Put the resulting list into file instead of setting the output.
+      Allows to prevent errors on large list sizes, like
+        'The template is not valid. System.InvalidOperationException: Maximum object size exceeded'
+    required: false
+    default: ''
+
+  relative:
+    description: |
+      Return relative paths instead of absolute
+    required: false
+    default: 'false'
+
+  follow-symbolic-links:
+    description: 'Indicates whether to follow symbolic links.'
+    default: 'true'
+
+  exclude-hidden-files:
+    description: Do not include hidden files into the match, even if they are covered by <patterns>
+    default: 'false'
+
+  match-directories:
+    description: Match directories as well as files. When false, only files would be included into globbing result.
+    default: 'true'
+
+  implicit-descendants:
+    description: When matching a directory, extend the match to all its contents
+    default: 'false'
+
+outputs:
+  files:
+    description: 'Newline-delimited string of matched file paths.'
+
+runs:
+  using: 'node20'
+  main: 'dist/index.js'
diff --git a/actions/utils/list-files/dist/index.js b/actions/files/list/dist/index.js
similarity index 99%
rename from actions/utils/list-files/dist/index.js
rename to actions/files/list/dist/index.js
index c9a5b798..059199ce 100644
--- a/actions/utils/list-files/dist/index.js
+++ b/actions/files/list/dist/index.js
@@ -27442,29 +27442,85 @@ var __importStar = (this && this.__importStar) || function (mod) {
     __setModuleDefault(result, mod);
     return result;
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 const core = __importStar(__nccwpck_require__(2186));
 const glob = __importStar(__nccwpck_require__(8090));
+const path_1 = __importDefault(__nccwpck_require__(1017));
+const fs_1 = __importDefault(__nccwpck_require__(7147));
+function readInputBool(name) {
+    return core.getInput(name).toUpperCase() === 'TRUE';
+}
 async function run() {
     try {
         const patterns = core.getInput('patterns', { required: true });
-        const followSymbolicLinks = core.getInput('follow-symbolic-links').toUpperCase() !== 'FALSE';
-        const globOptions = { followSymbolicLinks };
+        const targetFile = core.getInput('target-file', { required: false });
+        const followSymbolicLinks = readInputBool('follow-symbolic-links');
+        const excludeHiddenFiles = readInputBool('exclude-hidden-files');
+        const relative = readInputBool('relative');
+        const matchDirectories = readInputBool('match-directories');
+        const implicitDescendants = readInputBool('implicit-descendants');
+        const globOptions = {
+            followSymbolicLinks,
+            excludeHiddenFiles,
+            matchDirectories,
+            implicitDescendants,
+        };
         const globber = await glob.create(patterns, globOptions);
-        // Initialize an array to collect files
-        const files = [];
-        // Using async iterator to process files one by one
-        for await (const file of globber.globGenerator()) {
-            console.log(`Processing file: ${file}`);
-            files.push(file);
+        var lines;
+        if (targetFile !== "") {
+            console.log(`Found paths:\n`);
+            lines = await writeToFile(globber.globGenerator(), targetFile, relative);
+            core.setOutput('paths', '');
+            core.setOutput('file', targetFile);
         }
-        console.log(`Found files: ${files.join(', ')}`);
-        core.setOutput('files', files.join('\n'));
+        else {
+            const matchedPaths = await writeToArray(globber.globGenerator(), relative);
+            lines = matchedPaths.length;
+            console.log(`Found paths:\n\t${matchedPaths.join('\n\t')}`);
+            core.setOutput('paths', matchedPaths.join('\n'));
+            core.setOutput('file', '');
+        }
+        core.setOutput('has-matches', lines > 0);
+        core.setOutput('is-empty', lines === 0);
     }
     catch (error) {
         core.setFailed(error instanceof Error ? error.message : 'Unknown error occurred');
     }
 }
+function transformPath(p, relative) {
+    if (relative) {
+        return `.${path_1.default.sep}${path_1.default.relative('.', p)}`;
+    }
+    return p;
+}
+async function writeToFile(items, filePath, relative) {
+    const fileStream = fs_1.default.createWriteStream(filePath, { flags: 'a' });
+    var linesCount = 0;
+    try {
+        for await (const item of items) {
+            const p = transformPath(item, relative);
+            if (!fileStream.write(`${p}\n`)) {
+                await new Promise((resolve) => fileStream.once('drain', resolve));
+            }
+            linesCount++;
+            console.log(`\t${p}`);
+        }
+    }
+    finally {
+        fileStream.end();
+    }
+    return linesCount;
+}
+async function writeToArray(items, relative) {
+    const result = [];
+    for await (const item of items) {
+        result.push(transformPath(item, relative));
+    }
+    return result;
+}
 run();
 
 
diff --git a/actions/utils/list-files/package-lock.json b/actions/files/list/package-lock.json
similarity index 100%
rename from actions/utils/list-files/package-lock.json
rename to actions/files/list/package-lock.json
diff --git a/actions/utils/list-files/package.json b/actions/files/list/package.json
similarity index 100%
rename from actions/utils/list-files/package.json
rename to actions/files/list/package.json
diff --git a/actions/utils/list-files/pnpm-lock.yaml b/actions/files/list/pnpm-lock.yaml
similarity index 100%
rename from actions/utils/list-files/pnpm-lock.yaml
rename to actions/files/list/pnpm-lock.yaml
diff --git a/actions/files/list/src/index.ts b/actions/files/list/src/index.ts
new file mode 100644
index 00000000..5de985a3
--- /dev/null
+++ b/actions/files/list/src/index.ts
@@ -0,0 +1,90 @@
+import * as core from '@actions/core';
+import * as glob from '@actions/glob';
+import path from 'path';
+import fs from 'fs';
+
+function readInputBool(name: string): boolean {
+  return core.getInput(name).toUpperCase() === 'TRUE';
+}
+
+async function run(): Promise<void> {
+  try {
+    const patterns: string = core.getInput('patterns', { required: true });
+    const targetFile: string = core.getInput('target-file', { required: false });
+    const followSymbolicLinks: boolean = readInputBool('follow-symbolic-links');
+    const excludeHiddenFiles: boolean = readInputBool('exclude-hidden-files');
+    const relative: boolean = readInputBool('relative');
+    const matchDirectories: boolean = readInputBool('match-directories');
+    const implicitDescendants: boolean = readInputBool('implicit-descendants');
+
+    const globOptions: glob.GlobOptions = {
+      followSymbolicLinks,
+      excludeHiddenFiles,
+      matchDirectories,
+      implicitDescendants,
+    };
+
+    const globber = await glob.create(patterns, globOptions);
+
+    var lines: number
+    if (targetFile !== "") {
+      console.log(`Found paths:\n`)
+      lines = await writeToFile(globber.globGenerator(), targetFile, relative)
+
+      core.setOutput('paths', '');
+      core.setOutput('file', targetFile)
+
+    } else {
+      const matchedPaths = await writeToArray(globber.globGenerator(), relative)
+      lines = matchedPaths.length
+      console.log(`Found paths:\n\t${matchedPaths.join('\n\t')}`);
+
+      core.setOutput('paths', matchedPaths.join('\n'));
+      core.setOutput('file', '')
+    }
+
+    core.setOutput('has-matches', lines > 0);
+    core.setOutput('is-empty', lines === 0);
+  } catch (error) {
+    core.setFailed(error instanceof Error ? error.message : 'Unknown error occurred');
+  }
+}
+
+function transformPath(p: string, relative: boolean): string {
+  if (relative) {
+    return `.${path.sep}${path.relative('.', p)}`
+  }
+
+  return p
+}
+
+async function writeToFile(items: AsyncGenerator<string, void>, filePath: string, relative: boolean): Promise<number> {
+  const fileStream = fs.createWriteStream(filePath, { flags: 'a' });
+  var linesCount: number = 0
+  try {
+    for await (const item of items) {
+      const p = transformPath(item, relative)
+      if (!fileStream.write(`${p}\n`)) {
+        await new Promise<void>((resolve) => fileStream.once('drain', resolve));
+      }
+      linesCount++
+      console.log(`\t${p}`)
+    }
+  } finally {
+    fileStream.end();
+  }
+
+  return linesCount
+}
+
+async function writeToArray(items: AsyncGenerator<string, void>, relative: boolean): Promise<string[]> {
+  const result: string[] = [];
+
+  for await (const item of items) {
+    result.push(transformPath(item, relative))
+  }
+
+  return result
+}
+
+run();
diff --git a/actions/utils/list-files/tsconfig.json b/actions/files/list/tsconfig.json
similarity index 100%
rename from actions/utils/list-files/tsconfig.json
rename to actions/files/list/tsconfig.json
diff --git a/actions/node/npm-pkg-status/action.yaml b/actions/node/npm-pkg-status/action.yaml
index 52afd8cb..cc40f60f 100644
--- a/actions/node/npm-pkg-status/action.yaml
+++ b/actions/node/npm-pkg-status/action.yaml
@@ -1,5 +1,5 @@
 name: Check NPM package status in a registry
-author: 'MiLaboratories'
+author: "MiLaboratories"
 description: |
   Check the status of a NPM package within a registry
 
@@ -14,12 +14,17 @@ inputs:
       Version for a `npm-pkg-name` to check in a `registry-url`.
     required: false
 
+  package-json-path:
+    description: |
+      Path to package.json to use to obtain npm-pkg-name and npm-pkg-version values.
+    required: false
+
   registry-url:
     description: |
       The npm registry url to set up for auth
       and publication of the node js package.
     required: false
-    default: 'https://npm.pkg.github.com'
+    default: "https://npm.pkg.github.com"
 
   npm-auth-token:
     description: |
@@ -34,75 +39,114 @@ outputs:
       '0' doesn't exist
     value: ${{ steps.set-status.outputs.stdout }}
 
+  pkg-name:
+    description: |
+      Name of npm package (<npm-pkg-name> input or name extracted from <package-json-path> file)
+    value: ${{ fromJSON(steps.package.outputs.data).name }}
+
+  pkg-version:
+    description: |
+      Version of npm package (<npm-pkg-version> input or version extracted from <package-json-path> file)
+    value: ${{ fromJSON(steps.package.outputs.data).version }}
+
 runs:
   using: "composite"
 
   steps:
-    - name: Check NPM package status in a registry
+    - name: Read package name and version
+      if: inputs.package-json-path != '0'
       uses: milaboratory/github-ci/actions/shell@v4
-      id: npm-pkg-status
+      id: package
       env:
         NPM_PKG_NAME: ${{ inputs.npm-pkg-name }}
         NPM_PKG_VERSION: ${{ inputs.npm-pkg-version }}
+        PACKAGE_JSON_PATH: ${{ inputs.package-json-path }}
+      with:
+        run: |
+          if [ -z "${NPM_PKG_NAME}" ]; then
+            if [ -z "${PACKAGE_JSON_PATH}" ]; then
+              ghwa_error "Cannot check package presence in remote registry: neither 'npm-pkg-name', nor 'package-json-path' inputs are set"
+              exit 1
+            fi
+            NPM_PKG_NAME="$(jq --raw-output '.name' "${PACKAGE_JSON_PATH}")"
+          fi
+
+          if [ -z "${NPM_PKG_VERSION}" ]; then
+            if [ -z "${PACKAGE_JSON_PATH}" ]; then
+              ghwa_error "Cannot check package presence in remote registry: neither 'npm-pkg-version', nor 'package-json-path' inputs are set"
+              exit 1
+            fi
+            NPM_PKG_VERSION="$(jq --raw-output '.version' "${PACKAGE_JSON_PATH}")"
+          fi
+
+          ghwa_set_output name "${NPM_PKG_NAME}"
+          ghwa_set_output version "${NPM_PKG_VERSION}"
+
+    - name: Check NPM package status in a registry
+      uses: milaboratory/github-ci/actions/shell@v4
+      id: npm-pkg-status
+      env:
+        NPM_PKG_NAME: ${{ fromJSON(steps.package.outputs.data).name }}
+        NPM_PKG_VERSION: ${{ fromJSON(steps.package.outputs.data).version }}
         NPM_REGISTRY: ${{ inputs.registry-url }}
         NODE_AUTH_TOKEN: ${{ inputs.npm-auth-token }}
       with:
         run: |
           NPM_PKG_NAME_URLENCODED="$(mish_urlencode "${NPM_PKG_NAME}")"
-          
+
           RES_JSON=$(curl -s \
             -H "Accept: application/json" \
             -H "Authorization: Bearer ${NODE_AUTH_TOKEN}" \
             "${NPM_REGISTRY}/${NPM_PKG_NAME_URLENCODED}")
-          
+
           if ! mish_is_json <<<"${RES_JSON}"; then
             echo "NPM registry '${NPM_REGISTRY}' responded with non-json output for package ${NPM_PKG_NAME}"
             echo "  original request: '${NPM_REGISTRY}/${NPM_PKG_NAME_URLENCODED}'"
             echo "  response: ${RES_JSON}"
-          
+
             exit 1
           fi
-          
+
           has_error=$( jq 'has("error")' <<<"${RES_JSON}" )
-          
+
           if [ "${has_error}" = "true" ]; then
-          
+
             echo "GitHub NPM registry '${NPM_REGISTRY}' response for '${NPM_PKG_NAME}' contains error"
             jq <<<"${RES_JSON}"
-          
+
             if ! jq --raw-output '.error' <<<"${RES_JSON}" |
               grep -q -E 'npm package .* does not exist|Not found'; then
-          
+
               # When package is built for the first time, we get 'npm package <package name> does not exist'
               # error from GitHub. This error should be ignored. Any other error should lead to action fail.
               exit 1
-          
+
             fi
           fi
-          
+
           # The GitHub NPM registry response format for package is:
           #  { ..., "versions": { "<version name>": { <package info> } } }
           # or
           #  { "error": ... }
           # In any case, to check the given version of package existence we just need to be sure
           # the response has '.versions[<version name>]' key.
-          
+
           version_exists=$(
             jq \
               --arg version "${NPM_PKG_VERSION}" \
               '.versions | has($version)' \
               <<<"${RES_JSON}" \
           )
-          
+
           if [ "${version_exists}" = "true" ] ; then
-          
+
             echo "Package: ${NPM_PKG_NAME}@${NPM_PKG_VERSION} found in registry."
             ghwa_set_output exist "1"
-          
+
             exit 0
-          
+
           fi
-          
+
           echo "Package: ${NPM_PKG_NAME}@${NPM_PKG_VERSION} not found in registry."
           ghwa_set_output exist "0"
 
diff --git a/actions/node/prepare/action.yaml b/actions/node/prepare/action.yaml
index cfbafe2e..c277c356 100644
--- a/actions/node/prepare/action.yaml
+++ b/actions/node/prepare/action.yaml
@@ -39,6 +39,18 @@ inputs:
     required: false
     default: 'true'
 
+  update-npm:
+    description: |
+      Update npm util to the latest available version
+    required: false
+    default: 'false'
+
+  install-deps:
+    description: |
+      run 'npm ci' as part of preparation process
+    required: false
+    default: 'false'
+
   registry-url:
     description: |
       The npm registry url to set up for auth
@@ -89,3 +101,17 @@ runs:
         cache-version: ${{ inputs.cache-version }}
         cache-save-always: ${{ inputs.cache-save-always }}
         local-cache: 'on'
+
+    - name: Update npm to latest available version
+      if: inputs.update-npm == 'true'
+      uses: milaboratory/github-ci/actions/shell@v4
+      with:
+        run: |
+          npm i -g npm@latest
+
+    - name: Install dependencies
+      if: inputs.install-deps == 'true'
+      uses: milaboratory/github-ci/actions/shell@v4
+      with:
+        run: |
+          npm ci
diff --git a/actions/utils/list-files/action.yaml b/actions/utils/list-files/action.yaml
deleted file mode 100644
index 4875e1a6..00000000
--- a/actions/utils/list-files/action.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-name: 'File Globber'
-description: 'A GitHub Action to perform globbing operations to find files based on patterns.'
-author: 'MiLaboratories'
-
-inputs:
-  patterns:
-    description: |
-      Glob patterns to search for files.
-      More information about globbing options:
-      https://github.com/actions/toolkit/tree/main/packages/glob
-    required: true
-  follow-symbolic-links:
-    description: 'Indicates whether to follow symbolic links.'
-    default: 'true'
-outputs:
-  files:
-    description: 'Newline-delimited string of matched file paths.'
-
-runs:
-  using: 'node20'
-  main: 'dist/index.js'
diff --git a/actions/utils/list-files/src/index.ts b/actions/utils/list-files/src/index.ts
deleted file mode 100644
index 728d3503..00000000
--- a/actions/utils/list-files/src/index.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-import * as core from '@actions/core';
-import * as glob from '@actions/glob';
-
-async function run(): Promise<void> {
-  try {
-    const patterns: string = core.getInput('patterns', { required: true });
-    const followSymbolicLinks: boolean =
-      core.getInput('follow-symbolic-links').toUpperCase() !== 'FALSE';
-    const globOptions = { followSymbolicLinks };
-
-    const globber = await glob.create(patterns, globOptions);
-
-    // Initialize an array to collect files
-    const files: string[] = [];
-
-    // Using async iterator to process files one by one
-    for await (const file of globber.globGenerator()) {
-      console.log(`Processing file: ${file}`);
-      files.push(file);
-    }
-
-    console.log(`Found files: ${files.join(', ')}`);
-
-    core.setOutput('files', files.join('\n'));
-  } catch (error) {
-    core.setFailed(error instanceof Error ? error.message : 'Unknown error occurred');
-  }
-}
-
-run();
diff --git a/blocks/node/build-and-test-pnpm/action.yaml b/blocks/node/build-and-test-pnpm/action.yaml
index 2dfe2ab0..1e43ab39 100644
--- a/blocks/node/build-and-test-pnpm/action.yaml
+++ b/blocks/node/build-and-test-pnpm/action.yaml
@@ -94,6 +94,7 @@ runs:
     - name: Install NodeJS packages with pnpm
       uses: milaboratory/github-ci/actions/shell@v4
       with:
+        dump-stdout: false
         run: |
           pnpm install --frozen-lockfile --prefer-offline
 
@@ -103,6 +104,7 @@ runs:
         PNPM_R: ${{ inputs.pnpm-recursive-build }}
         PNPM_ARGS: ${{ inputs.pnpm-build-args }}
       with:
+        dump-stdout: false
         run: |
           if [ "${PNPM_R}" == "true" ];then
             pnpm run -r ${{ inputs.build-script-name }}
@@ -124,6 +126,7 @@ runs:
         PNPM_R: ${{ inputs.pnpm-recursive-tests }}
         PNPM_ARGS: ${{ inputs.pnpm-tests-args }}
       with:
+        dump-stdout: false
         run: |
           if [ "${PNPM_R}" == "true" ];then
             pnpm run -r ${{ inputs.test-script-name }}
diff --git a/blocks/node/build/generic/action.yaml b/blocks/node/build/generic/action.yaml
index 5f6ed73e..26908e25 100644
--- a/blocks/node/build/generic/action.yaml
+++ b/blocks/node/build/generic/action.yaml
@@ -81,6 +81,8 @@ runs:
   steps:
     - name: Prepare environment for building a NodeJS application
       uses: milaboratory/github-ci/actions/node/prepare@v4
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.npm-auth-token }}
       with:
         node-version: ${{ inputs.node-version }}
         cache-version: ${{ inputs.cache-version }}
@@ -90,23 +92,12 @@ runs:
         scope: ${{ inputs.scope }}
         always-auth: ${{ inputs.always-auth }}
         npmrc-config: ${{ inputs.npmrc-config }}
-
-    - name: Update npm to latest available version
-      uses: milaboratory/github-ci/actions/shell@v4
-      with:
-        run: |
-          npm i -g npm@latest
-
-    - name: Install NodeJS packages with npm
-      uses: milaboratory/github-ci/actions/shell@v4
-      env:
-        NODE_AUTH_TOKEN: ${{ inputs.npm-auth-token }}
-      with:
-        run: |
-          npm ci
+        update-npm: true
+        install-deps: true
 
     - name: Patch package version
       uses: milaboratory/github-ci/actions/node/patch-version@v4
+      if: inputs.build-version != ''
       with:
         version: ${{ inputs.build-version }}
 
@@ -120,5 +111,6 @@ runs:
       uses: milaboratory/github-ci/actions/shell@v4
       if: runner.os == 'macOS' || runner.os == 'Linux'
       with:
+        dump-stdout: false
         run: |
           npm run ${{ inputs.build-script-name }}
diff --git a/blocks/node/test/action.yaml b/blocks/node/test/action.yaml
index f8187fa4..0c3ac91a 100644
--- a/blocks/node/test/action.yaml
+++ b/blocks/node/test/action.yaml
@@ -1,26 +1,33 @@
 name: Run a test for a Node project with npm
-author: 'MiLaboratories'
+author: "MiLaboratories"
 description: |
   Prepare agent for running a npm test for the NodeJS project.
   Install NodeJS specific version, download package, create cache e.t.c
 
 inputs:
+  package-version:
+    description: |
+      Set version number in 'package.json' file to given value.
+      Empty value disables version patching
+    required: false
+    default: ""
+
   test-name:
     description: |
-      Provide a name of a test to run via npm
+      Provide a name of the test script to run via npm
     required: true
 
   build-script-name:
     description: |
       Name of script for application build
     required: true
-    default: 'build'
+    default: "build"
 
   build-before-run-test:
     description: |
-      Run `build-command` before executing `test-name`.
+      Run `build-script-name` before executing `test-name`.
     required: false
-    default: 'false'
+    default: "false"
 
   node-version:
     description: |
@@ -36,27 +43,27 @@ inputs:
       not find build cache and will have to start from scratch.
 
     required: false
-    default: 'v1'
+    default: "v1"
 
   hashfiles-search-path:
     description: |
       Hashfiles search path for package-lock.json
     required: false
-    default: '**/package-lock.json'
+    default: "**/package-lock.json"
 
   is-electron-application:
     description: |
       If 'true' enables cache for an Electron application,
       if 'false', enables cache for a generic NodeJS application.
     required: false
-    default: 'true'
+    default: "true"
 
   registry-url:
     description: |
       The npm registry url to set up for auth
       and publication of the node js package.
     required: false
-    default: 'https://npm.pkg.github.com'
+    default: "https://npm.pkg.github.com"
 
   scope:
     description: |
@@ -73,65 +80,78 @@ inputs:
     description: |
       Set always-auth in npmrc.
     required: false
-    default: 'false'
+    default: "false"
 
   npmrc-config:
     description: |
       Generates a .npmrc file based on provided configuration.
     required: false
 
+  # interactive-debug:
+  #   description: |
+  #     Break execution and start interactive debugging session with server VSCode right on agent
+  #   required: false
+  #   default: 'false'
+
 runs:
   using: "composite"
 
   steps:
-      - name: Prepare environment for running a NodeJS application tests
-        uses: milaboratory/github-ci/actions/node/prepare@v4
-        with:
-          node-version: ${{ inputs.node-version }}
-          cache-version: ${{ inputs.cache-version }}
-          hashfiles-search-path: ${{ inputs.hashfiles-search-path }}
-          is-electron-application: ${{ inputs.is-electron-application }}
-          registry-url: ${{ inputs.registry-url }}
-          scope: ${{ inputs.scope }}
-          always-auth: ${{ inputs.always-auth }}
-          npmrc-config: ${{ inputs.npmrc-config }}
-
-      - name: Install NodeJS packages with npm
-        uses: milaboratory/github-ci/actions/shell@v4
-        env:
-          NODE_AUTH_TOKEN: ${{ inputs.npm-auth-token }}
-        with:
-          run: |
-           npm ci
-
-      - name: Run build - ${{ inputs.build-script-name }} - (macOS and Linux)
-        uses: milaboratory/github-ci/actions/shell@v4
-        if: inputs.build-before-run-test != 'false'
-          && (runner.os == 'macOS' || runner.os == 'Linux')
-        with:
-          run: |
-            npm run ${{ inputs.build-script-name}}
-
-      - name: Run build - ${{ inputs.build-script-name }} - (Windows)
-        if: inputs.build-before-run-test != 'false'
-          && runner.os == 'Windows'
-        shell: pwsh
+    - name: Prepare environment for running a NodeJS application tests
+      uses: milaboratory/github-ci/actions/node/prepare@v4
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.npm-auth-token }}
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache-version: ${{ inputs.cache-version }}
+        hashfiles-search-path: ${{ inputs.hashfiles-search-path }}
+        is-electron-application: ${{ inputs.is-electron-application }}
+        registry-url: ${{ inputs.registry-url }}
+        scope: ${{ inputs.scope }}
+        always-auth: ${{ inputs.always-auth }}
+        npmrc-config: ${{ inputs.npmrc-config }}
+        update-npm: true
+        install-deps: true
+
+    - name: Patch package version
+      uses: milaboratory/github-ci/actions/node/patch-version@v4
+      if: inputs.package-version != ''
+      with:
+        version: ${{ inputs.package-version }}
+
+    # - uses: fawazahmed0/action-debug-vscode@main
+    #   if: inputs.interactive-debug == 'true'
+
+    - name: Run build - ${{ inputs.build-script-name }} - (macOS and Linux)
+      uses: milaboratory/github-ci/actions/shell@v4
+      if: inputs.build-before-run-test != 'false'
+        && (runner.os == 'macOS' || runner.os == 'Linux')
+      with:
+        dump-stdout: false
         run: |
-          npm run ${{ inputs.build-script-name }}
-
-      - name: Run test - ${{ inputs.test-name }} - (macOS and Linux)
-        uses: milaboratory/github-ci/actions/shell@v4
-        if: runner.os == 'macOS' || runner.os == 'Linux'
-        env:
-          NODE_AUTH_TOKEN: ${{ inputs.npm-auth-token }}
-        with:
-          run: |
-           npm run ${{ inputs.test-name }} --if-present
-
-      - name: Run test - ${{ inputs.test-name }} - (Windows)
-        if: runner.os == 'Windows'
-        shell: pwsh
-        env:
-          NODE_AUTH_TOKEN: ${{ inputs.npm-auth-token }}
+          npm run ${{ inputs.build-script-name}}
+
+    - name: Run build - ${{ inputs.build-script-name }} - (Windows)
+      if: inputs.build-before-run-test != 'false'
+        && runner.os == 'Windows'
+      shell: pwsh
+      run: |
+        npm run ${{ inputs.build-script-name }}
+
+    - name: Run test - ${{ inputs.test-name }} - (macOS and Linux)
+      uses: milaboratory/github-ci/actions/shell@v4
+      if: runner.os == 'macOS' || runner.os == 'Linux'
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.npm-auth-token }}
+      with:
+        dump-stdout: false
         run: |
           npm run ${{ inputs.test-name }} --if-present
+
+    - name: Run test - ${{ inputs.test-name }} - (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.npm-auth-token }}
+      run: |
+        npm run ${{ inputs.test-name }} --if-present
diff --git a/blocks/signing-tools/macos-notarize/action.yaml b/blocks/signing-tools/macos-notarize/action.yaml
new file mode 100644
index 00000000..9ecaea54
--- /dev/null
+++ b/blocks/signing-tools/macos-notarize/action.yaml
@@ -0,0 +1,89 @@
+name: Notarize Binary on macOS
+author: "MiLaboratories"
+description: |
+  The Notarize Binary Action facilitates the automation of notarizing macOS artifacts using Apple's notarytool.
+  This GitHub Action is crucial for developers who distribute their applications outside the Mac App Store,
+  as notarization scans the software for malicious content and certifies its safety, complying with macOS security policies
+
+  Created based on https://github.com/ddev/signing_tools
+
+inputs:
+  paths:
+    description: |
+      List of paths or path globbing patterns, that should be notarized.
+      Each line is notarized as independent artifact: directories are
+      archived into .zip archive and notarized as whole following apple
+      notarization logic (2 levels nesting)
+    required: true
+
+  mac-api-key-base64:
+    description: |
+      The base64-encoded content of an API key file.
+    required: true
+
+  mac-api-key-id:
+    description: |
+      The Key ID found on App Store Connect for the API key file.
+    required: true
+
+  mac-api-key-issuer-id:
+    description: |
+      The Issuer ID found on App Store Connect for the API key file.
+    required: true
+
+runs:
+  using: "composite"
+
+  steps:
+    - uses: milaboratory/github-ci/actions/files/list@v4
+      id: artifacts-list
+      with:
+        patterns: ${{ inputs.paths }}
+        relative: true
+
+    - uses: milaboratory/github-ci/actions/shell@v4
+      env:
+        ARTIFACTS: ${{ steps.artifacts-list.outputs.paths }}
+        API_KEY_BASE64: ${{ inputs.mac-api-key-base64 }}
+        API_KEY_ID: ${{ inputs.mac-api-key-id }}
+        API_KEY_ISSUER_ID: ${{ inputs.mac-api-key-issuer-id }}
+        API_KEY_FILE: ${{ format('AuthKey_{0}.p8', inputs.mac-api-key-id) }}
+      with:
+        dump-stdout: false
+        run: |
+          echo "${API_KEY_BASE64}" | base64 -d > "${GITHUB_WORKSPACE}/${API_KEY_FILE}"
+
+          while IFS= read -r ARTIFACT_PATH; do
+
+            /usr/bin/ditto -c -k ${ARTIFACT_PATH} ${ARTIFACT_PATH}.zip ;
+
+            # Submit the zipball and wait for response
+            xcrun notarytool submit \
+              -f json \
+              --key-id "${API_KEY_ID}" \
+              --issuer "${API_KEY_ISSUER_ID}" \
+              --key "${API_KEY_FILE}" \
+              --wait \
+              ${ARTIFACT_PATH}.zip 2>&1 |
+              tee /tmp/notarization_info.json
+
+            status=$(jq -r .status </tmp/notarization_info.json)
+            id=$(jq -r .id </tmp/notarization_info.json)
+
+            echo "status=${status} id=${id}"
+
+            xcrun notarytool log \
+              --key-id "${API_KEY_ID}" \
+              --issuer "${API_KEY_ISSUER_ID}" \
+              --key "${API_KEY_FILE}" \
+              "${id}" \
+              -f json >/tmp/notarization_log.json
+
+            issues=$(jq -r .issues </tmp/notarization_log.json)
+            if [ "$issues" != "null" ]; then
+                printf "There are issues with the notarization (${issues})\n"
+                printf "=== Log output === \n$(cat /tmp/notarization_log.json)\n"
+                exit 7;
+            fi;
+
+          done <<< "${ARTIFACTS}"
diff --git a/blocks/signing-tools/macos-sign/action.yaml b/blocks/signing-tools/macos-sign/action.yaml
new file mode 100644
index 00000000..b05505aa
--- /dev/null
+++ b/blocks/signing-tools/macos-sign/action.yaml
@@ -0,0 +1,86 @@
+name: CodeSign Binary on macOS
+author: "MiLaboratories"
+description: |
+  The CodeSign Binary Action is a GitHub Action designed to automate the process
+  of signing software binaries on macOS using the codesign utility.
+  This action ensures that the binary conforms to Apple's security requirements,
+  making it suitable for distribution or deployment on macOS systems.
+
+  Created based on https://github.com/ddev/signing_tools
+
+inputs:
+  binaries:
+    description: |
+      List of paths (one per line) to the binary files that need to be signed.
+      Each line may be a globbing pattern, that is expanded into list of lines.
+    required: true
+
+  mac-cert-id:
+    description: |
+      The Apple's certificate id. e.g: '5MXXYYZZFF'
+    required: true
+
+  mac-cert-base64:
+    description: |
+      The base64-encoded p12 signing certificate.
+    required: true
+
+  mac-cert-passwd:
+    description: |
+      The password to decrypt the p12 signing certificate.
+    required: true
+
+runs:
+  using: "composite"
+
+  steps:
+    - uses: milaboratory/github-ci/actions/files/list@v4
+      id: binaries-list
+      with:
+        patterns: ${{ inputs.binaries }}
+        relative: true
+        match-directories: false
+
+    - uses: milaboratory/github-ci/actions/shell@v4
+      env:
+        BINARIES: ${{ steps.binaries-list.outputs.paths }}
+        CERT_ID: ${{ inputs.mac-cert-id }}
+        CERT_BASE64: ${{ inputs.mac-cert-base64 }}
+        CERT_PWD: ${{ inputs.mac-cert-passwd }}
+        CERT_FILE: ${{ format('{0}.p12', inputs.mac-cert-id) }}
+      with:
+        dump-stdout: false
+        run: |
+          function cleanup {
+              if [ ! -z "${default_keychain:-}" ]; then
+                  security default-keychain -s "$default_keychain" && security list-keychains -s "$default_keychain"
+              fi
+              security delete-keychain buildagent || true
+          }
+          trap cleanup EXIT
+
+          if [-z "${BINARIES}" ]; then
+            ghwa_warning "List of binaries to sign for Mac OS X is empty. Nothing matched the globbing patterns from <binaries> input."
+            exit 0
+          fi
+
+          echo "${CERT_BASE64}" | base64 -d > "${GITHUB_WORKSPACE}/${CERT_FILE}"
+
+          echo "Preparing keychain..."
+          security create-keychain -p "${CERT_PWD}" buildagent
+          security unlock-keychain -p "${CERT_PWD}" buildagent
+          default_keychain=$(security default-keychain | xargs)
+          security list-keychains -s buildagent && security default-keychain -s buildagent
+          security import ${CERT_FILE} -k buildagent -P "${CERT_PWD}" -T /usr/bin/codesign >/dev/null
+          security set-key-partition-list -S apple-tool:,apple: -s -k "${CERT_PWD}" buildagent >/dev/null
+
+          while IFS= read -r BINARY_PATH; do
+            echo "Signing ${BINARY_PATH}"
+
+            # In case target is already signed, remove existing sig as it causes failure
+            codesign --remove-signature ${BINARY_PATH} || true
+            codesign --keychain buildagent -s "${CERT_ID}" --timestamp --options runtime ${BINARY_PATH}
+            codesign -vv -d ${BINARY_PATH}
+
+            echo "Signed ${BINARY_PATH} with ${CERT_ID}"
+          done <<< "${BINARIES}"
diff --git a/blocks/signing-tools/windows-sign/action.yaml b/blocks/signing-tools/windows-sign/action.yaml
new file mode 100644
index 00000000..bbc86c44
--- /dev/null
+++ b/blocks/signing-tools/windows-sign/action.yaml
@@ -0,0 +1,170 @@
+name: Sign application on Windows
+author: 'MiLaboratories'
+description: |
+  Sign Windows executable
+
+inputs:
+  #
+  # jsign control
+  #
+  java-version:
+    description: |
+      Version of JAVA to to launch ebourg/jsign.
+    required: false
+    default: '11'
+
+  java-distribution:
+    description: |
+      Java distribution to use.
+      Example: 'temurin', 'zulu', ...
+      See 'https://github.com/actions/setup-java#supported-distributions'
+      for complete list of supported distributions.
+    required: false
+    default: 'temurin'
+
+  jsign-version:
+    description: |
+      Version of jsign
+    required: false
+    default: '5.0'
+
+  store-type:
+    description: |
+      type of the store with certificate (the cloud service to use)
+    required: false
+    default: GOOGLECLOUD
+
+  timestamping-mode:
+    description: |
+      Timestamping mode
+    required: false
+    default: 'RFC3161'
+
+  timestamping-url:
+    description: |
+      Timestamping url, must be from the organization that issued code sign certificate
+    required: true
+
+  binaries:
+    description: |
+      Files to sign with jsign. One per line
+      Each path can be a globbing pattern.
+      Only files are matched, implicit-descendants is disabled
+      (use /* or /** pattern ending to match all files inside directory)
+    required: false
+
+  code-sign-chain:
+    description: |
+      base64-encoded code sign chain pem file for the Windows
+    required: false
+
+  kms-keyring:
+    description: |
+       KMS keyring name in GCP
+    required: true
+
+  kms-keyname:
+    description: |
+      KMS key name in GCP
+    required: true
+
+  access-token:
+    description: |
+      Access token for certificate store
+    required: true
+
+  # interactive-debug:
+  #   description: |
+  #     Break execution and start interactive debugging session with server VSCode right on agent
+  #   required: false
+  #   default: 'false'
+
+runs:
+  using: "composite"
+
+  steps:
+    - uses: milaboratory/github-ci/actions/files/list@v4
+      id: binaries-list
+      with:
+        patterns: ${{ inputs.binaries }}
+        relative: true
+        match-directories: false
+
+    # - uses: fawazahmed0/action-debug-vscode@main
+    #   if: inputs.interactive-debug == 'true'
+
+    - name: Install Java
+      if: steps.binaries-list.outputs.has-matches == 'true'
+      uses: actions/setup-java@v4
+      with:
+        distribution: ${{ inputs.java-distribution }}
+        java-version: ${{ inputs.java-version }}
+
+    - name: Install ebourg/jsign
+      if: steps.binaries-list.outputs.has-matches == 'true'
+      env:
+        JSIGN_VERSION: ${{ inputs.jsign-version }}
+      shell: pwsh
+      run: |
+        choco install jsign --version "${{ env.JSIGN_VERSION }}"
+
+    - name: Prepare for siging
+      id: pre-sign
+      if: steps.binaries-list.outputs.has-matches == 'true'
+      env:
+        CODE_SIGN_CHAIN: ${{ inputs.code-sign-chain }}
+        BINARIES: ${{ steps.binaries-list.outputs.paths }}
+        GH_WORKSPACE: ${{ github.workspace }}
+      shell: pwsh
+      run: |
+        $CODE_SIGN_CHAIN_PEM="codesign-chain.pem"
+        $DECODED_CODE_SIGN_CHAIN = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("${{ env.CODE_SIGN_CHAIN }}"))
+        $DECODED_CODE_SIGN_CHAIN | Out-File -FilePath "$CODE_SIGN_CHAIN_PEM"
+
+        $SANITIZED_FILE_PATHS = @()
+
+        foreach ($FILE_PATH in $env:BINARIES -split "`n") {
+            $FILE_PATH = $FILE_PATH.Trim()
+
+            if (-not $FILE_PATH) {
+              continue
+            }
+
+            $FILE_PARENT_PATH = Split-Path -Path $FILE_PATH
+            $FILE_RESOLVED_NAME = Split-Path -Path $FILE_PATH -Leaf -Resolve
+            $FILE_RESOLVED_NAME_SANITIZED = $FILE_RESOLVED_NAME -replace " ", "-"
+
+            if ($FILE_RESOLVED_NAME_SANITIZED -ne $FILE_RESOLVED_NAME) {
+                Rename-Item -Path "${env:GH_WORKSPACE}\$FILE_PARENT_PATH\$FILE_RESOLVED_NAME" -NewName "${env:GH_WORKSPACE}\$FILE_PARENT_PATH\$FILE_RESOLVED_NAME_SANITIZED"
+            }
+
+            $SANITIZED_FILE_PATHS += "$FILE_PARENT_PATH/$FILE_RESOLVED_NAME_SANITIZED"
+        }
+
+        $SANITIZED_FILE_PATHS_STRING = $SANITIZED_FILE_PATHS -join "%0A" # %0A is interpreted as '\n' by GITHUB_OUTPUT
+
+        echo "code-sign-chain-pem=$CODE_SIGN_CHAIN_PEM" >> $env:GITHUB_OUTPUT
+        echo "binaries=$SANITIZED_FILE_PATHS_STRING" >> $env:GITHUB_OUTPUT
+
+    - name: Sign app with jsign
+      if: steps.binaries-list.outputs.has-matches == 'true'
+      env:
+        CODE_SIGN_CHAIN: ${{ inputs.code-sign-chain }}
+        BINARIES: ${{ steps.pre-sign.outputs.binaries }}
+        CERT_FILE: ${{ steps.pre-sign.outputs.code-sign-chain-pem }}
+      shell: pwsh
+      run: |
+        foreach ($BIN_PATH in $env:BINARIES -split "`n") {
+          echo "Signing $BIN_PATH..."
+
+          jsign --storetype "${{ inputs.store-type }}" `
+            --storepass "${{ inputs.access-token }}" `
+            --keystore "${{ inputs.kms-keyring }}" `
+            --alias "${{ inputs.kms-keyname }}" `
+            --certfile "$env:CERT_FILE" `
+            --tsmode "${{ inputs.timestamping-mode }}" `
+            --tsaurl "${{ inputs.timestamping-url }}" `
+            "$BIN_PATH"
+        }
+
+