diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index ca70f2617..0bc4ad10e 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,8 +1,10 @@
 metadata/*       @oracle/graalvm-reachability-maintainer
-tests/*          @oracle/graalvm-reachability-maintainer
+tests/src/*      @oracle/graalvm-reachability-maintainer
+tests/tck-build-logic/* @vjovanov
 tests/tck-build-logic/src/main/resources/allowed-docker-images/* @matneu
 library-and-framework-list.json @fniephaus
 .github/* @vjovanov
-docs/*    @vjovanov
+docs/*    @vjovanov @ban-mi
+README.md @vjovanov @ban-mi
 gradle/*  @vjovanov
 /*        @vjovanov
diff --git a/pull_request_template.md b/.github/pull_request_template.md
similarity index 100%
rename from pull_request_template.md
rename to .github/pull_request_template.md
diff --git a/.github/workflows/checkstyle-skip.yml b/.github/workflows/checkstyle-skip.yml
index bed200961..2ae60e70b 100644
--- a/.github/workflows/checkstyle-skip.yml
+++ b/.github/workflows/checkstyle-skip.yml
@@ -3,6 +3,7 @@ name: "Check code style"
 on:
   pull_request:
     paths:
+      - 'docs/**'
       - '**.md'
       - 'library-and-framework-list*.json'
 
diff --git a/.github/workflows/checkstyle.yml b/.github/workflows/checkstyle.yml
index 5ca5ec034..9fcef7915 100644
--- a/.github/workflows/checkstyle.yml
+++ b/.github/workflows/checkstyle.yml
@@ -3,23 +3,25 @@ name: "Check code style"
 on:
   pull_request:
     paths-ignore:
+      - 'docs/**'
       - '**.md'
       - 'library-and-framework-list*.json'
 
 jobs:
   checkstyle:
-    if: github.repository == 'oracle/graalvm-reachability-metadata'
     name: "📋 Check style according to checkstyle.xml"
     runs-on: "ubuntu-22.04"
     timeout-minutes: 15
     steps:
       - name: "☁️ Checkout repository"
         uses: actions/checkout@v4
+
       - uses: actions/setup-python@v4
-      - name: "🔧 Prepare environment"
-        uses: graalvm/setup-graalvm@v1
+
+      - name: "🔧 Setup java"
+        uses: actions/setup-java@v4
         with:
-          java-version: '17'
           distribution: 'graalvm'
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          java-version: '21'
+
       - run: ./gradlew checkstyle
diff --git a/.github/workflows/create-scheduled-release.yml b/.github/workflows/create-scheduled-release.yml
index 693a62166..a26e59e32 100644
--- a/.github/workflows/create-scheduled-release.yml
+++ b/.github/workflows/create-scheduled-release.yml
@@ -12,6 +12,7 @@ permissions:
 jobs:
   get-changed-metadata:
     name: "📋 Get a list of changed metadata"
+    if: github.repository == 'oracle/graalvm-reachability-metadata'
     runs-on: "ubuntu-22.04"
     timeout-minutes: 5
     outputs:
@@ -22,16 +23,18 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+
       - name: "🔧 Setup java"
         uses: actions/setup-java@v4
         with:
           distribution: 'graalvm'
           java-version: '21'
+
       - name: "🕸️ Get changed metadata matrix"
         id: set-matrix
         run: |
           LATEST_TAG=$(git tag --list | sort -V | tail -1)
-          ./gradlew generateMatrixDiffCoordinates -PbaseCommit=$(git show-ref -s $LATEST_TAG) -PnewCommit=$(git rev-parse HEAD)
+          ./gradlew generateChangedCoordinatesMatrix -PbaseCommit=$(git show-ref -s $LATEST_TAG) -PnewCommit=$(git rev-parse HEAD)
 
   release:
     needs: get-changed-metadata
@@ -45,11 +48,13 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+
       - name: "🔧 Setup java"
         uses: actions/setup-java@v4
         with:
           distribution: 'graalvm'
           java-version: '21'
+
       - name: "Get tags"
         run: |
           PREVIOUS_RELEASE_TAG=$(git tag --list | sort -V | tail -1)
@@ -57,15 +62,19 @@ jobs:
 
           CURRENT_RELEASE_TAG=$(sed -E 's/^([0-9]+\.)([0-9]+\.)([0-9]+)/echo \1\2$((\3+1))/e' <<< $PREVIOUS_RELEASE_TAG)
           echo "CURRENT_RELEASE_TAG=$CURRENT_RELEASE_TAG" >> ${GITHUB_ENV}
+
       - name: "⬆️ Update version"
         run: |
           sed -i "s/project.version(\"1.0.0-SNAPSHOT\")/project.version(\"${{ env.CURRENT_RELEASE_TAG }}\")/g" build.gradle
+
       - name: "🔍 Run spotless check"
         run: |
           ./gradlew spotlessCheck
+
       - name: "🏭 Generate release artifacts"
         run: |
           ./gradlew package
+
       - name: "📄 Commit changes"
         run: |
           git config --local user.email "actions@github.com"
@@ -74,6 +83,7 @@ jobs:
           git commit -m "Release version ${{ env.CURRENT_RELEASE_TAG }}"
           git tag ${{ env.CURRENT_RELEASE_TAG }}
           git push origin ${{ env.CURRENT_RELEASE_TAG }}
+
       - name: "📝 Publish a release"
         run: |
           gh release create ${{ env.CURRENT_RELEASE_TAG }} build/graalvm-reachability-metadata-*.zip --generate-notes --notes-start-tag ${{ env.PREVIOUS_RELEASE_TAG }}
diff --git a/.github/workflows/library-and-framework-list-validation.yml b/.github/workflows/library-and-framework-list-validation.yml
index bec665690..a146b16fa 100644
--- a/.github/workflows/library-and-framework-list-validation.yml
+++ b/.github/workflows/library-and-framework-list-validation.yml
@@ -7,16 +7,17 @@ on:
 
 jobs:
   validate-library-and-framework-list-json:
-    if: github.repository == 'oracle/graalvm-reachability-metadata'
     name: "📋 Validate the JSON file"
     runs-on: "ubuntu-22.04"
     timeout-minutes: 5
     steps:
       - name: "☁️ Checkout repository"
         uses: actions/checkout@v4
+
       - uses: actions/setup-python@v4
         with:
           python-version: '3.10'
+
       - name: Check that the JSON file is well-formatted and sorted by artifact
         run: |
           JSON="library-and-framework-list.json"
@@ -29,6 +30,7 @@ jobs:
             echo "'${JSON}' is no longer sorted by artifact key. You can use 'jq' to sort it: 'sorted="$(jq -s '.[] | sort_by(.artifact)' ${JSON})" && echo -E "${sorted}" > ${JSON}"
             exit 8
           fi
+
       - name: Check that the JSON file conforms to the schema
         run: |
           pip install check-jsonschema
diff --git a/.github/workflows/scan-docker-images.yml b/.github/workflows/scan-docker-images.yml
index fbb179262..14d8c9117 100644
--- a/.github/workflows/scan-docker-images.yml
+++ b/.github/workflows/scan-docker-images.yml
@@ -1,11 +1,11 @@
 name: "Scan docker images from the allowed docker images list"
 
 on:
-  # we should run this job if somebody wants to add/update allowed docker images
+  # we run this job if somebody wants to add/update allowed docker images
   pull_request:
     paths:
       - 'tests/tck-build-logic/src/main/resources/allowed-docker-images/**'
-  # we should run this job once a week to check if new vulnerabilities are found in existing images
+  # we run this job once a week to check if new vulnerabilities are found in existing images
   schedule:
     - cron: "0 0 * * 6"
 
@@ -18,18 +18,22 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: graalvm/setup-graalvm@v1
+
+      - uses: actions/setup-java@v4
         with:
-          java-version: '17'
           distribution: 'graalvm'
+          java-version: '21'
           github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: "Install required tools"
         run: |
-          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sudo sh -s -- -b /usr/local/bin
+          curl -sSfL https://get.anchore.io/grype/v0.104.0/install.sh | sudo sh -s -- -b /usr/local/bin
           sudo apt-get install jq
+
       - name: "🔎 Check changed docker images"
         if: github.event_name == 'pull_request'
         run: ./gradlew checkAllowedDockerImages --baseCommit=${{ github.event.pull_request.base.sha }} --newCommit=${{ github.event.pull_request.head.sha }}
+
       - name: "🔎 Check all docker images"
-        if: github.event_name != 'pull_request' && github.repository == 'oracle/graalvm-reachability-metadata'
+        if: github.event_name == 'schedule' && github.repository == 'oracle/graalvm-reachability-metadata'
         run: ./gradlew checkAllowedDockerImages
diff --git a/.github/workflows/disable-docker.sh b/.github/workflows/scripts/disable-docker.sh
similarity index 100%
rename from .github/workflows/disable-docker.sh
rename to .github/workflows/scripts/disable-docker.sh
diff --git a/.github/workflows/discard-port.conf b/.github/workflows/scripts/discard-port.conf
similarity index 100%
rename from .github/workflows/discard-port.conf
rename to .github/workflows/scripts/discard-port.conf
diff --git a/.github/workflows/dockerd.service b/.github/workflows/scripts/dockerd.service
similarity index 100%
rename from .github/workflows/dockerd.service
rename to .github/workflows/scripts/dockerd.service
diff --git a/.github/workflows/run-consecutive-tests.sh b/.github/workflows/scripts/run-consecutive-tests.sh
similarity index 96%
rename from .github/workflows/run-consecutive-tests.sh
rename to .github/workflows/scripts/run-consecutive-tests.sh
index beaac23a7..26036a4aa 100644
--- a/.github/workflows/run-consecutive-tests.sh
+++ b/.github/workflows/scripts/run-consecutive-tests.sh
@@ -62,7 +62,7 @@ for VERSION in "${VERSIONS[@]}"; do
   echo "$DELIMITER"
 
 
-  if ! run_multiple_attempts "javac compile" 1 javac; then
+  if ! run_multiple_attempts "javac compile" 1 compileTestJava; then
     break
   fi
 
diff --git a/.github/workflows/test-all-metadata-skip.yml b/.github/workflows/test-all-metadata-skip.yml
deleted file mode 100644
index a9289b2b3..000000000
--- a/.github/workflows/test-all-metadata-skip.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-name: "Test all metadata"
-
-on:
-  push:
-    branches:
-      - master
-    paths:
-      - '**.md'
-      - 'library-and-framework-list*.json'
-  workflow_dispatch:
-
-jobs:
-  build:
-    name: "🧪 All metadata tests have passed"
-    runs-on: ubuntu-latest
-    steps:
-      - run: 'echo "No build required"'
diff --git a/.github/workflows/test-all-metadata.yml b/.github/workflows/test-all-metadata.yml
index 9c4490e11..4a87c9d71 100644
--- a/.github/workflows/test-all-metadata.yml
+++ b/.github/workflows/test-all-metadata.yml
@@ -1,13 +1,12 @@
-name: "Test all metadata"
+name: "Test all metadata (one version per test suite)"
 
 on:
-  push:
-    branches:
-      - master
-    paths-ignore:
-      - '**.md'
-      - 'library-and-framework-list*.json'
   workflow_dispatch:
+  pull_request:
+    branches:
+     - master
+    paths:
+      - 'ci.json'
 
 concurrency:
   group: "workflow = ${{ github.workflow }}, ref = ${{ github.event.ref }}, pr = ${{ github.event.pull_request.id }}"
@@ -15,7 +14,7 @@ concurrency:
 
 jobs:
   get-all-metadata:
-    if: github.repository == 'oracle/graalvm-reachability-metadata'
+    if: github.event_name == 'workflow_dispatch' || github.repository == 'oracle/graalvm-reachability-metadata'
     name: "📋 Get list of all supported libraries"
     runs-on: "ubuntu-22.04"
     timeout-minutes: 5
@@ -24,22 +23,22 @@ jobs:
     steps:
       - name: "☁️ Checkout repository"
         uses: actions/checkout@v4
-      - name: "🔧 Prepare environment"
-        uses: graalvm/setup-graalvm@v1
+
+      - name: "🔧 Setup java"
+        uses: actions/setup-java@v4
         with:
-          java-version: '17'
           distribution: 'graalvm'
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          java-version: '21'
+
       - name: "🕸️ Populate matrix"
         id: set-matrix
         run: |
-          ./gradlew generateMatrixMatchingCoordinates -Pcoordinates=all
+          ./gradlew generateMatrixBatchedCoordinates -Pbatches=16
 
   test-all-metadata:
-    if: github.repository == 'oracle/graalvm-reachability-metadata'
     name: "🧪 ${{ matrix.coordinates }} (GraalVM for JDK ${{ matrix.version }} @ ${{ matrix.os }})"
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 20
+    timeout-minutes: 120
     needs: get-all-metadata
     strategy:
       fail-fast: false
@@ -47,24 +46,29 @@ jobs:
     steps:
       - name: "☁️ Checkout repository"
         uses: actions/checkout@v4
+
       - name: "🔧 Setup java"
         uses: actions/setup-java@v4
         with:
-          distribution: 'oracle'
-          java-version: '17'
-      - name: "🔧 Prepare environment"
+          distribution: 'graalvm'
+          java-version: '21'
+
+      - name: "🔧 Download GraalVM for metadata testing"
         uses: graalvm/setup-graalvm@v1
         with:
-          set-java-home: 'false'
-          java-version: ${{ matrix.version }}
           distribution: 'graalvm'
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          java-version: ${{ matrix.version }}
+          set-java-home: 'false'
           native-image-job-reports: 'true'
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: "Pull allowed docker images"
         run: |
-          ./gradlew pullAllowedDockerImages --coordinates=${{ matrix.coordinates }}
+          ./gradlew pullAllowedDockerImages -Pcoordinates=${{ matrix.coordinates }}
+
       - name: "Disable docker networking"
-        run: bash ./.github/workflows/disable-docker.sh
+        run: bash ./.github/workflows/scripts/disable-docker.sh
+
       - name: "🧪 Run '${{ matrix.coordinates }}' tests"
         run: |
           ./gradlew test -Pcoordinates=${{ matrix.coordinates }}
@@ -73,7 +77,6 @@ jobs:
     name: "🧪 All metadata tests have passed"
     runs-on: "ubuntu-22.04"
     timeout-minutes: 1
-    if: ${{ always() }} && github.repository == 'oracle/graalvm-reachability-metadata'
     needs: test-all-metadata
     steps:
       - name: "All tests passed"
diff --git a/.github/workflows/test-changed-infrastructure-skip.yml b/.github/workflows/test-changed-infrastructure-skip.yml
new file mode 100644
index 000000000..e85f2aa23
--- /dev/null
+++ b/.github/workflows/test-changed-infrastructure-skip.yml
@@ -0,0 +1,25 @@
+name: "Test changed build logic"
+
+on:
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - "tests/tck-build-logic/**"
+      - "gradle/**"
+      - "build.gradle"
+      - "settings.gradle"
+      - "gradle.properties"
+
+jobs:
+  get-changed-infrastructure:
+    name: "📋 Get a list of libraries to test for build-logic changes"
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
+
+  all-infrastructure-passed:
+    name: "🧪 All build-logic triggered tests have passed"
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No build required"'
diff --git a/.github/workflows/test-changed-infrastructure.yml b/.github/workflows/test-changed-infrastructure.yml
new file mode 100644
index 000000000..5eac2ed13
--- /dev/null
+++ b/.github/workflows/test-changed-infrastructure.yml
@@ -0,0 +1,100 @@
+name: "Test changed build logic"
+
+on:
+  pull_request:
+    branches:
+      - master
+    paths:
+      - "tests/tck-build-logic/**"
+      - "gradle/**"
+      - "build.gradle"
+      - "settings.gradle"
+      - "gradle.properties"
+
+concurrency:
+  group: "workflow = ${{ github.workflow }}, ref = ${{ github.event.ref }}, pr = ${{ github.event.pull_request.id }}"
+  cancel-in-progress: true
+
+jobs:
+  get-changed-infrastructure:
+    name: "📋 Get a list of libraries to test for build-logic changes"
+    runs-on: "ubuntu-22.04"
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+      none-found: ${{ steps.set-matrix.outputs.none-found }}
+    steps:
+      - name: "☁️ Checkout repository"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: "🔧 Setup java"
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'graalvm'
+          java-version: '21'
+
+      - name: "🕸️ Populate matrix"
+        id: set-matrix
+        run: |
+          ./gradlew generateInfrastructureChangedCoordinatesMatrix -PbaseCommit=${{ github.event.pull_request.base.sha }} -PnewCommit=${{ github.event.pull_request.head.sha }}
+
+  test-changed-infrastructure:
+    name: "🧪 ${{ matrix.coordinates }} (GraalVM for JDK ${{ matrix.version }} @ ${{ matrix.os }})"
+    if: needs.get-changed-infrastructure.result == 'success' && needs.get-changed-infrastructure.outputs.none-found != 'true' && github.repository == 'oracle/graalvm-reachability-metadata'
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    needs: get-changed-infrastructure
+
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.get-changed-infrastructure.outputs.matrix) }}
+
+    steps:
+      - name: "☁️ Checkout repository"
+        uses: actions/checkout@v4
+
+      - name: "🔧 Setup java"
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'graalvm'
+          java-version: '21'
+
+      - name: "🔧 Download GraalVM for metadata testing"
+        uses: graalvm/setup-graalvm@v1
+        with:
+          distribution: "graalvm"
+          java-version: ${{ matrix.version }}
+          set-java-home: "false"
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          native-image-job-reports: "true"
+
+      - name: "Pull allowed docker images"
+        run: |
+          ./gradlew pullAllowedDockerImages -Pcoordinates=${{ matrix.coordinates }}
+
+      - name: "Disable docker networking"
+        run: bash ./.github/workflows/scripts/disable-docker.sh
+
+      - name: "🔎 Check metadata files content"
+        run: |
+          ./gradlew checkMetadataFiles -Pcoordinates=${{ matrix.coordinates }}
+
+      - name: "🧪 Run '${{ matrix.coordinates }}' tests"
+        run: |
+          ./gradlew test -Pcoordinates=${{ matrix.coordinates }}
+
+  all-infrastructure-passed:
+    name: "🧪 All build-logic triggered tests have passed"
+    runs-on: "ubuntu-22.04"
+    timeout-minutes: 1
+    needs: test-changed-infrastructure
+    steps:
+      - name: "All tests passed"
+        if: needs.test-changed-infrastructure.result == 'success'
+        run: exit 0
+
+      - name: "Some tests failed"
+        if: needs.test-changed-infrastructure.result == 'failure'
+        run: exit 1
diff --git a/.github/workflows/test-changed-metadata-skip.yml b/.github/workflows/test-changed-metadata-skip.yml
index 81bfd24b3..82d07a247 100644
--- a/.github/workflows/test-changed-metadata-skip.yml
+++ b/.github/workflows/test-changed-metadata-skip.yml
@@ -4,9 +4,9 @@ on:
   pull_request:
     branches:
       - master
-    paths:
-      - '**.md'
-      - 'library-and-framework-list*.json'
+    paths-ignore:
+      - 'metadata/*'
+      - 'tests/src/*'
 
 jobs:
   get-changed-metadata:
diff --git a/.github/workflows/test-changed-metadata.yml b/.github/workflows/test-changed-metadata.yml
index d29dceebb..3e104005e 100644
--- a/.github/workflows/test-changed-metadata.yml
+++ b/.github/workflows/test-changed-metadata.yml
@@ -4,9 +4,9 @@ on:
   pull_request:
     branches:
       - master
-    paths-ignore:
-      - '**.md'
-      - 'library-and-framework-list*.json'
+    paths:
+      - 'metadata/**'
+      - 'tests/src/**'
 
 concurrency:
   group: "workflow = ${{ github.workflow }}, ref = ${{ github.event.ref }}, pr = ${{ github.event.pull_request.id }}"
@@ -14,7 +14,6 @@ concurrency:
 
 jobs:
   get-changed-metadata:
-    if: github.repository == 'oracle/graalvm-reachability-metadata'
     name: "📋 Get a list of all changed libraries"
     runs-on: "ubuntu-22.04"
     timeout-minutes: 5
@@ -26,16 +25,16 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: "🔧 Prepare environment"
-        uses: graalvm/setup-graalvm@v1
+      - name: "🔧 Setup Java"
+        uses: actions/setup-java@v4
         with:
-          java-version: '17'
           distribution: 'graalvm'
+          java-version: '21'
           github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: "🕸️ Populate matrix"
         id: set-matrix
         run: |
-          ./gradlew generateMatrixDiffCoordinates -PbaseCommit=${{ github.event.pull_request.base.sha }} -PnewCommit=${{ github.event.pull_request.head.sha }}
+          ./gradlew generateChangedCoordinatesMatrix -PbaseCommit=${{ github.event.pull_request.base.sha }} -PnewCommit=${{ github.event.pull_request.head.sha }}
 
   test-changed-metadata:
     name: "🧪 ${{ matrix.coordinates }} (GraalVM for JDK ${{ matrix.version }} @ ${{ matrix.os }})"
@@ -50,27 +49,33 @@ jobs:
     steps:
       - name: "☁️ Checkout repository"
         uses: actions/checkout@v4
+
       - name: "🔧 Setup java"
         uses: actions/setup-java@v4
         with:
-          distribution: 'oracle'
-          java-version: '17'
-      - name: "🔧 Prepare environment"
+          distribution: 'graalvm'
+          java-version: '21'
+
+      - name: "🔧 Download GraalVM for metadata testing"
         uses: graalvm/setup-graalvm@v1
         with:
-          set-java-home: 'false'
-          java-version: ${{ matrix.version }}
           distribution: 'graalvm'
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          java-version: ${{ matrix.version }}
+          set-java-home: 'false'
           native-image-job-reports: 'true'
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: "Pull allowed docker images"
         run: |
-          ./gradlew pullAllowedDockerImages --coordinates=${{ matrix.coordinates }}
+          ./gradlew pullAllowedDockerImages -Pcoordinates=${{ matrix.coordinates }}
+
       - name: "Disable docker networking"
-        run: bash ./.github/workflows/disable-docker.sh
-      - name: "🔎 Check metadata config files content"
+        run: bash ./.github/workflows/scripts/disable-docker.sh
+
+      - name: "🔎 Check metadata files content"
         run: |
-          ./gradlew checkConfigFiles --coordinates=${{ matrix.coordinates }}
+          ./gradlew checkMetadataFiles -Pcoordinates=${{ matrix.coordinates }}
+
       - name: "🧪 Run '${{ matrix.coordinates }}' tests"
         run: |
           ./gradlew test -Pcoordinates=${{ matrix.coordinates }}
@@ -79,7 +84,6 @@ jobs:
     name: "🧪 All metadata tests have passed"
     runs-on: "ubuntu-22.04"
     timeout-minutes: 1
-    if: ${{ always() }} && github.repository == 'oracle/graalvm-reachability-metadata'
     needs: test-changed-metadata
     steps:
       - name: "All tests passed"
diff --git a/.github/workflows/verify-new-library-version-compatibility.yml b/.github/workflows/verify-new-library-version-compatibility.yml
index 46e6e90e5..652f56fc8 100644
--- a/.github/workflows/verify-new-library-version-compatibility.yml
+++ b/.github/workflows/verify-new-library-version-compatibility.yml
@@ -16,6 +16,7 @@ concurrency:
 jobs:
   get-all-libraries:
     name: "📋 Get list of all supported libraries with newer versions"
+    # Opens PRs, with labels and assignees. Works only on the main repo.
     if: github.repository == 'oracle/graalvm-reachability-metadata'
     runs-on: ubuntu-22.04
     timeout-minutes: 5
@@ -27,12 +28,11 @@ jobs:
       - name: "☁️ Checkout repository"
         uses: actions/checkout@v4
 
-      - name: "🔧 Prepare environment"
-        uses: graalvm/setup-graalvm@v1
+      - name: "🔧 Setup java"
+        uses: actions/setup-java@v4
         with:
-          java-version: '21'
           distribution: 'graalvm'
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          java-version: '21'
 
       - name: "📅 Set branch name"
         id: set-branch-name
@@ -74,17 +74,17 @@ jobs:
       - name: "🔧 Setup java"
         uses: actions/setup-java@v4
         with:
-          distribution: 'oracle'
+          distribution: 'graalvm'
           java-version: '21'
 
-      - name: "🔧 Prepare environment"
+      - name: "🔧 Download GraalVM for metadata testing"
         uses: graalvm/setup-graalvm@v1
         with:
-          set-java-home: 'false'
-          java-version: 21
           distribution: 'graalvm'
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          java-version: 25
+          set-java-home: 'false'
           native-image-job-reports: 'true'
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: "Check for an existing issue and skip further testing if found"
         id: check_existing_issue
@@ -122,17 +122,17 @@ jobs:
 
       - name: "Pull allowed docker images"
         if: steps.check_existing_issue.outputs.skip != 'true'
-        run: ./gradlew pullAllowedDockerImages --coordinates="${{ env.TEST_COORDINATES }}"
+        run: ./gradlew pullAllowedDockerImages -Pcoordinates="${{ env.TEST_COORDINATES }}"
 
       - name: "Disable docker networking"
         if: steps.check_existing_issue.outputs.skip != 'true'
-        run: bash ./.github/workflows/disable-docker.sh
+        run: bash ./.github/workflows/scripts/disable-docker.sh
 
       - name: "🧪 Run '${{ env.TEST_COORDINATES }}' tests"
         if: steps.check_existing_issue.outputs.skip != 'true'
         id: runtests
         run: |
-          bash ./.github/workflows/run-consecutive-tests.sh "${{ env.TEST_COORDINATES }}" '${{ toJson(matrix.item.versions) }}' 2>&1 | tee test_results.txt || true
+          bash ./.github/workflows/scripts/run-consecutive-tests.sh "${{ env.TEST_COORDINATES }}" '${{ toJson(matrix.item.versions) }}' 2>&1 | tee test_results.txt || true
           
           # Extract successful versions
           grep "^PASSED:" test_results.txt | sed 's/PASSED://g' > successful_versions.txt
@@ -174,7 +174,7 @@ jobs:
           update_new_versions() {
             while read version; do
               if [ -n "$version" ]; then
-                ./gradlew addTestedVersion --coordinates="${{ matrix.item.name }}:$version" --lastSupportedVersion="${{ env.LATEST_VERSION }}"
+                ./gradlew addTestedVersion -Pcoordinates="${{ matrix.item.name }}:$version" --lastSupportedVersion="${{ env.LATEST_VERSION }}"
               fi
             done < successful_versions.txt
           }
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 000000000..62a30bd90
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,64 @@
+# Development Cheat Sheet
+
+## Prerequisites (assume exists)
+- JAVA_HOME set to JDK 21 (GraalVM recommended to match CI)
+- Docker
+- grype v0.104.0 (install: curl -sSfL https://get.anchore.io/grype/v0.104.0/install.sh | sudo sh -s -- -b /usr/local/bin)
+
+## Setup
+- Always use Gradle wrapper from repo root:
+  - Unix: ./gradlew <task> [options]
+  - Windows: gradlew.bat <task> [options]
+- Tip: add --stacktrace for debugging
+
+## One command for complete testing (use at the end of the task to verify)
+./gradlew testAllParallel -Pparallelism=4
+
+## Code Style
+- Always try to reuse existing code.
+- Be assertive in code.
+- Write type annotations in all functions and most variables.
+- Document code without being too verbose.
+- In java, always import classes and use them without qualified names.
+
+## Testing individual components
+
+- Clean previous build outputs for the selected coordinates: ./gradlew clean -Pcoordinates=[group:artifact:version|k/n|all]
+- Pre-fetch Docker images allowed by metadata (used in tests) for the selected coordinates: ./gradlew pullAllowedDockerImages -Pcoordinates=[group:artifact:version|k/n|all]
+- Validate reachability metadata files for the selected coordinates: ./gradlew checkMetadataFiles -Pcoordinates=[group:artifact:version|k/n|all]
+- Run Checkstyle for the selected coordinates: ./gradlew checkstyle -Pcoordinates=[group:artifact:version|k/n|all]
+- Compile test sources for the selected coordinates: ./gradlew compileTestJava -Pcoordinates=[group:artifact:version|k/n|all]
+- Run JVM-based tests for the selected coordinates: ./gradlew javaTest -Pcoordinates=[group:artifact:version|k/n|all]
+- Build native images used by native tests (compile-only) for the selected coordinates: ./gradlew nativeTestCompile -Pcoordinates=[group:artifact:version|k/n|all]
+- Run all tests for the selected coordinates: ./gradlew test -Pcoordinates=[group:artifact:version|k/n|all]
+
+
+## Check style and formatting
+- Style check: ./gradlew checkstyle
+- Format check: ./gradlew spotlessCheck
+
+## Testing the metadata
+- Single library (replace with group:artifact:version):
+  - ./gradlew pullAllowedDockerImages -Pcoordinates=group:artifact:version
+  - ./gradlew checkMetadataFiles -Pcoordinates=group:artifact:version
+  - ./gradlew test -Pcoordinates=group:artifact:version
+- Sharded example (1/64):
+  - ./gradlew pullAllowedDockerImages -Pcoordinates=1/64
+  - ./gradlew checkMetadataFiles -Pcoordinates=1/64
+  - ./gradlew test -Pcoordinates=1/64
+
+## Docker Image Vulnerability Scanning
+- Changed images between commits:
+  - ./gradlew checkAllowedDockerImages --baseCommit=$(git rev-parse origin/master) --newCommit=$(git rev-parse HEAD)
+- All allowed images:
+  - ./gradlew checkAllowedDockerImages
+
+##s Compatibility Automation (latest library versions)
+- List libs with newer upstream versions:
+  - ./gradlew fetchExistingLibrariesWithNewerVersions --quiet
+- Record a newly tested version:
+  - ./gradlew addTestedVersion -Pcoordinates="group:artifact:newVersion" --lastSupportedVersion="oldVersion"
+  - Example: ./gradlew addTestedVersion -Pcoordinates="org.postgresql:postgresql:42.7.4" --lastSupportedVersion="42.7.3"
+
+## Releases and Packaging
+- Package artifacts: ./gradlew package
diff --git a/README.md b/README.md
index f87d710fe..894fe49cc 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ you can enable automatic use of the metadata repository for [Gradle projects](ht
 
 [This web page](https://www.graalvm.org/native-image/libraries-and-frameworks/) provides an overview of libraries and frameworks that are tested and thus ready for GraalVM Native Image.
 If you would like to see your library or framework in the list too, please open a pull request and extend [this JSON file](https://github.com/oracle/graalvm-reachability-metadata/blob/master/library-and-framework-list.json).
-Before submitting a pull request, please read [this guide](./CONTRIBUTING.md#tested-libraries-and-frameworks).
+Before submitting a pull request, please read [this guide](docs/CONTRIBUTING.md#tested-libraries-and-frameworks).
 
 ## Rationale
 
@@ -25,4 +25,10 @@ Please visit [this web page](https://www.graalvm.org/latest/reference-manual/nat
 ## Contributing
 
 We welcome contributions from the community.
-Before submitting a pull request, please [review our contribution guide](./CONTRIBUTING.md).
+Before submitting a pull request, please [review our contribution guide](docs/CONTRIBUTING.md).
+
+## Further Information
+
+1. Continuous integration is described in [CI.md](docs/CI.md).  
+2. PR Reviewing guides are described in [REVIEWING.md](docs/REVIEWING.md).
+3. Development is described in [DEVELOPING.md](docs/DEVELOPING.md).  
diff --git a/build.gradle b/build.gradle
index d043c1cff..ee694bc4c 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1,3 +1,6 @@
+import java.util.concurrent.Executors
+import java.util.concurrent.TimeUnit
+
 /*
  * Copyright and related rights waived via CC0
  *
@@ -8,7 +11,7 @@
 plugins {
     id 'base'
     id "com.diffplug.spotless" version "6.3.0"
-    id "org.graalvm.internal.tck-harness"
+    id "org.graalvm.internal.tck-base"
 }
 
 allprojects {
@@ -25,17 +28,17 @@ project.version("1.0.0-SNAPSHOT")
 spotless {
     json {
         target(
-                tck.metadataRoot.map { it.toString() +  '/**/*.json' }.get(),
+                tck.metadataRoot.map { it.toString() + '/**/*.json' }.get(),
                 tck.testRoot.map { it.toString() + '/**/*.json' }
         )
         targetExclude(
-                tck.testRoot.map { it.toString()  + '/**/build/**/*.json' },
+                tck.testRoot.map { it.toString() + '/**/build/**/*.json' },
                 tck.repoRoot.map { it.toString() + '/.github/**/*.json' }
         )
         gson()
-            .indentWithSpaces(2)
-            .sortByKeys()
-            .version("2.9.0")
+                .indentWithSpaces(2)
+                .sortByKeys()
+                .version("2.9.0")
     }
 }
 
@@ -54,3 +57,146 @@ tasks.register('package', Zip) { task ->
         include("library-and-framework-list.json")
     }
 }
+
+tasks.register('test') { t ->
+    t.setDescription("Aggregates tests configured by the TCK harness")
+    t.setGroup("verification")
+}
+
+// Apply the harness after creating the 'test' aggregator to avoid missing property,
+// and without applying the 'java' plugin to avoid task name conflicts.
+apply plugin: "org.graalvm.internal.tck-harness"
+
+ext.runLoggedCommand = { List<String> args, String label, File logFile, File workingDir ->
+    def header = "==== BEGIN ${label}"
+    println(header)
+    logFile.text = header + System.lineSeparator()
+
+    def pb = new ProcessBuilder(args as String[])
+    pb.directory(workingDir)
+    pb.redirectErrorStream(true)
+    pb.redirectOutput(ProcessBuilder.Redirect.appendTo(logFile))
+    def proc = pb.start()
+    int exit = proc.waitFor()
+
+    def footer = exit != 0
+            ? "==== END ${label} FAILURE (exit ${exit})"
+            : "==== END ${label} SUCCESS"
+    logFile.append(footer + System.lineSeparator())
+    println(footer)
+    return exit
+}
+
+static List<Map> testAllCommands(String gradleCmd, String target) {
+    def taskNames = [
+            "checkstyle",
+            "spotlessCheck",
+            "checkMetadataFiles",
+            "fetchExistingLibrariesWithNewerVersions",
+            "test"
+    ]
+    return taskNames.collect { name ->
+        [name: name, args: [gradleCmd, name, "-Pcoordinates=${target}"]]
+    }
+}
+
+tasks.register('testAllParallel') { t ->
+    t.group = "verification"
+    t.setDescription("For each target, run clean and pullAllowedDockerImages first (sequentially), then run style checks and individual testing stages (checkstyle, spotlessCheck, checkMetadataFiles, fetchExistingLibrariesWithNewerVersions, test) concurrently with isolated logs. Options: -Pcoordinates to specify a single coordinate or 1/64 for the pull step; -Pparallelism to control the number of concurrent tasks.")
+
+    doLast {
+        def selectedArtifact = "org.postgresql:postgresql:42.7.3"
+        def selectedBatch = "1/64"
+
+        def gradleCmd = System.getProperty("os.name").toLowerCase().contains("windows") ? "gradlew.bat" : "./gradlew"
+        def parallelismProp = (project.findProperty('parallelism') ?: '').toString().trim()
+        int parallelism = 4
+        if (!parallelismProp.isEmpty()) {
+            try {
+                parallelism = Integer.parseInt(parallelismProp)
+            } catch (NumberFormatException ignored) {
+                throw new GradleException("Invalid -Pparallelism='${parallelismProp}': must be a positive integer.")
+            }
+            if (parallelism <= 0) {
+                throw new GradleException("Invalid -Pparallelism='${parallelismProp}': must be >= 1.")
+            }
+        }
+        println("Using parallelism=${parallelism} for testAllParallel.")
+
+        def logsDir = layout.buildDirectory.dir("command-logs").get().asFile
+        logsDir.mkdirs()
+
+        // Helper to run pull + command set for a given target (artifact or coordinates)
+        def runPhaseForCoordinate = { String coordinate ->
+            // Clean project before pulling Docker images for this coordinate
+            def cleanLogsDir = new File(project.rootDir, "command-logs-clean")
+            cleanLogsDir.mkdirs()
+
+            def fileSuffix = coordinate.replaceAll(File.separator, "-")
+            def cleanLogFile = new File(cleanLogsDir, "clean-${fileSuffix}.log")
+            int cleanExit = project.ext.runLoggedCommand([gradleCmd, "clean", "-Pcoordinates=${coordinate}"], "clean (${coordinate})", cleanLogFile, project.rootDir)
+            if (cleanExit != 0) {
+                throw new GradleException("clean failed with exit code ${cleanExit} (see ${cleanLogFile})")
+            }
+            // Ensure logsDir exists after clean
+            logsDir.mkdirs()
+
+            // Pull Docker images sequentially for this coordinate
+            def pullArgs = [gradleCmd, "pullAllowedDockerImages", "-Pcoordinates=${coordinate}"]
+            def pullLogFile = new File(logsDir, "pullAllowedDockerImages-${fileSuffix}.log")
+            int pullExit = project.ext.runLoggedCommand(pullArgs, "pullAllowedDockerImages (${coordinate})", pullLogFile, project.rootDir)
+            if (pullExit != 0) {
+                throw new GradleException("pullAllowedDockerImages failed with exit code ${pullExit} (see ${pullLogFile})")
+            }
+
+            def commands = testAllCommands(gradleCmd, coordinate)
+            int effectiveParallelism = Math.min(parallelism, commands.size())
+            def pool = Executors.newFixedThreadPool(effectiveParallelism)
+            def failures = Collections.synchronizedList(new ArrayList<Map>())
+            def futures = []
+
+            commands.each { cmd ->
+                futures << pool.submit {
+                    def label = "${cmd.name} (${coordinate})"
+                    def logFile = new File(logsDir, "${cmd.name}-${fileSuffix}.log")
+                    int exit = project.ext.runLoggedCommand(cmd.args, label, logFile, project.rootDir)
+                    if (exit != 0) {
+                        failures.add([label: label, logFile: logFile, exit: exit])
+                    }
+                }
+            }
+
+            futures.each { it.get() }
+            pool.shutdown()
+            pool.awaitTermination(1, TimeUnit.HOURS)
+
+            if (!failures.isEmpty()) {
+                println("Some commands failed (coordinates=${coordinate}). Logs in: ${logsDir}")
+                failures.each { f ->
+                    println(" - ${f.label} failed with exit code ${f.exit} (see ${f.logFile})")
+                }
+                println("==== BEGIN FAILED TASK LOGS (${coordinate})")
+                failures.each { f ->
+                    println("---- LOG: ${f.logFile}")
+                    try {
+                        if (f.logFile?.exists()) {
+                            f.logFile.eachLine { println(it) }
+                        } else {
+                            println("(log file not found)")
+                        }
+                    } catch (Throwable e) {
+                        println("Error reading ${f.logFile}: ${e.message}")
+                    }
+                }
+                println("==== END FAILED TASK LOGS (${coordinate})")
+                throw new GradleException("Failures encountered. See logs above. Logs directory: ${logsDir}")
+            } else {
+                println("All commands succeeded for coordinates=${coordinate}. Logs in: ${logsDir}")
+            }
+        }
+
+        // Run parallel phases sequentially: first the selectedArtifact, then the selectedBatch
+        runPhaseForCoordinate(selectedArtifact)
+        runPhaseForCoordinate(selectedBatch)
+    }
+}
diff --git a/ci.json b/ci.json
new file mode 100644
index 000000000..0af01f0b1
--- /dev/null
+++ b/ci.json
@@ -0,0 +1,19 @@
+{
+  "buildArgs": ["-verbose", "-Ob", "-H:+ReportExceptionStackTraces"],
+  "generateMatrixBatchedCoordinates": {
+    "java": ["21", "25", "latest-ea"],
+    "os": ["ubuntu-latest"]
+  },
+  "generateChangedCoordinatesMatrix": {
+    "java": ["21", "25", "latest-ea"],
+    "os": ["ubuntu-latest"]
+  },
+  "generateInfrastructureChangedCoordinatesMatrix": {
+    "java": ["21", "25", "latest-ea"],
+    "os": ["ubuntu-latest"]
+  },
+  "generateMatrixMatchingCoordinates": {
+    "java": ["21", "25","latest-ea"],
+    "os": ["ubuntu-latest"]
+  }
+}
diff --git a/docs/CI.md b/docs/CI.md
new file mode 100644
index 000000000..4d5e42588
--- /dev/null
+++ b/docs/CI.md
@@ -0,0 +1,37 @@
+# Continuous Integration (CI)
+
+This repository uses GitHub Actions and Gradle-based checks to ensure metadata quality, stability, and automated releases.
+Below is an overview of the CI pipelines and the configuration they rely on.
+
+- GitHub Actions workflows: [.github/workflows](../.github/workflows)/*.yml
+- Source of truth for style checks: [gradle/checkstyle.xml](../gradle/checkstyle.xml)
+
+CI prefetches docker images and temporarily disables Docker networking for test isolation via [`.github/workflows/disable-docker.sh`](../.github/workflows/scripts/disable-docker.sh). 
+You usually do not need this locally.
+
+## Types of jobs in the CI
+
+The release is made every two weeks if there are metadata changes: [.github/workflows/create-scheduled-release.yml](../.github/workflows/create-scheduled-release.yml).
+
+The test matrx definition starts with [ci.json](../ci.json):
+- A single source of truth for which Java versions and OS runners to test on.
+- Gradle tasks read it to generate GitHub Actions matrices consumed by the workflows below.
+- Way to define build arguments for the build. If this file is changed everything is re-run.
+
+Workflows testing metadata using [ci.json](../ci.json):
+- Test all metadata ([.github/workflows/test-all-metadata.yml](../.github/workflows/test-all-metadata.yml))
+  - Triggers: manual (workflow_dispatch) and PRs that touch [ci.json](../ci.json).
+  - Uses: generateMatrixBatchedCoordinates to build a matrix (java + os). Runs full tests, pulls only allowed Docker images, then disables Docker networking for deterministic runs.
+- Test changed metadata ([.github/workflows/test-changed-metadata.yml](../.github/workflows/test-changed-metadata.yml))
+  - Triggers: PRs to master touching [metadata/](metadata/) or [tests/src/](tests/src/).
+  - Uses: generateChangedCoordinatesMatrix with base/head SHAs to test only what changed. Pulls allowed images, disables Docker networking, validates config, then runs tests.
+- Test changed build logic ([.github/workflows/test-changed-infrastructure.yml](../.github/workflows/test-changed-infrastructure.yml))
+  - Triggers: PRs to master touching [tests/tck-build-logic/](tests/tck-build-logic/), [gradle/](gradle/), [build.gradle](../build.gradle), [settings.gradle](../settings.gradle), or [gradle.properties](../gradle.properties).
+  - Uses: generateInfrastructureChangedCoordinatesMatrix. Pulls allowed images, disables Docker networking, validates config, then runs tests.
+
+Workflow for testing latest library versions from Maven: [.github/workflows/verify-new-library-version-compatibility.yml](../.github/workflows/verify-new-library-version-compatibility.yml): scheduled verifier for newer upstream library versions; uses pinned Java/OS in the workflow.
+
+Workflows for style and security:
+- [.github/workflows/checkstyle.yml](../.github/workflows/checkstyle.yml) / [.github/workflows/checkstyle-skip.yml](../.github/workflows/checkstyle-skip.yml): code style checks.
+- [.github/workflows/library-and-framework-list-validation.yml](../.github/workflows/library-and-framework-list-validation.yml) / [.github/workflows/library-and-framework-list-validation-skip.yml](../.github/workflows/library-and-framework-list-validation-skip.yml): validates and sorts [library-and-framework-list.json](../library-and-framework-list.json), checks schema.
+- [.github/workflows/scan-docker-images.yml](../.github/workflows/scan-docker-images.yml) / [.github/workflows/scan-docker-images-skip.yml](../.github/workflows/scan-docker-images-skip.yml): scans allowed Docker images on PR/schedule.
diff --git a/CONTRIBUTING.md b/docs/CONTRIBUTING.md
similarity index 99%
rename from CONTRIBUTING.md
rename to docs/CONTRIBUTING.md
index b01c8db88..f53c3949e 100644
--- a/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -52,9 +52,9 @@ not be included as it does not compose and can break code in unpredictable ways.
 * Make sure that you are using [Conditional Configuration](https://www.graalvm.org/latest/reference-manual/native-image/metadata/#specifying-reflection-metadata-in-json)
 in order to precisely define the metadata scope. This is a hard requirement as it prevents unnecessary bloating of
 images.
-* Once you want to create a pull request, you will be asked to fill out the [following list](./pull_request_template.md).
+* Once you want to create a pull request, you will be asked to fill out the [following list](../.github/pull_request_template.md).
 
-ℹ️ To learn more about collecting metadata, see [How To Collect Metadata](docs/CollectingMetadata.md).
+ℹ️ To learn more about collecting metadata, see [How To Collect Metadata](CollectingMetadata.md).
 
 ### Generate Metadata and Test
 
diff --git a/docs/CollectingMetadata.md b/docs/CollectingMetadata.md
index 16670a652..60d21250a 100644
--- a/docs/CollectingMetadata.md
+++ b/docs/CollectingMetadata.md
@@ -81,4 +81,4 @@ The best thing for the community is to include the generated metadata and build
  - Copy the metadata to the project sources under META-INF/native-image/artifact.id with `metadataCopy`.
  - Introduce a CI task that tests the library with the newly added metadata.
 
-If the library maintainers do not accept the change, the next best thing is to open a ticket on the library’s issue tracker so the community can upvote this feature. In the meantime, you can open a PR to this repository. See [how to contribute](../CONTRIBUTING.md).
+If the library maintainers do not accept the change, the next best thing is to open a ticket on the library’s issue tracker so the community can upvote this feature. In the meantime, you can open a PR to this repository. See [how to contribute](CONTRIBUTING.md).
diff --git a/docs/DEVELOPING.md b/docs/DEVELOPING.md
new file mode 100644
index 000000000..51bfd38c0
--- /dev/null
+++ b/docs/DEVELOPING.md
@@ -0,0 +1,138 @@
+# Developing the Repository Infrastructure
+
+This document summarizes those commands that you need to perform development tasks.
+
+This repo is developed with IntelliJ. To initialize use:
+```console
+intellij-idea-community ./
+```
+
+Always use the Gradle wrapper from the repository root:
+- Unix: `./gradlew <task> [options]`
+- Windows: `gradlew.bat <task> [options]`
+
+Prerequisites for most commands:
+- `JAVA_HOME` should be set to JDK 21 or later. GraalVM is recommended to match CI.
+- Docker (required for pulling/using allowed images during tests). Needs to work without `sudo`: `sudo usermod -aG docker $USER` and reboot.
+- [`grype`](https://github.com/anchore/grype) version `0.104.0` for scanning docker images:
+    ```console
+    curl -sSfL https://get.anchore.io/grype/v0.104.0/install.sh | sudo sh -s -- -b /usr/local/bin
+    ```
+
+Tip: When debugging locally, add `--stacktrace` for better error output.
+
+### End-to-end testing before the commit
+```console
+./gradlew testAllParallel --stacktrace
+```
+
+### Style and formatting
+
+1. To check style use
+    ```console 
+    ./gradlew checkstyle
+   ```
+   This will run Checkstyle using `gradle/checkstyle.xml`.
+
+2. Spotless Verifies formatting (used in release workflow prior to packaging): 
+    ```console
+   ./gradlew spotlessCheck
+    ```
+
+### Testing one library locally
+
+For a single coordinate, CI runs three steps in this order: 
+1. Pull Docker images:
+    ```console
+   ./gradlew pullAllowedDockerImages -Pcoordinates=org.postgresql:postgresql:42.7.3
+    ```
+2. Validate metadata:
+    ```console
+   ./gradlew checkMetadataFiles -Pcoordinates=org.postgresql:postgresql:42.7.3
+    ```
+3. Then run tests:
+    ```console
+   ./gradlew test -Pcoordinates=org.postgresql:postgresql:42.7.3
+   ```
+
+### Testing libraries in bulk
+
+To exercise many tests at once, you can target all coordinates or a slice of the test space via the N/M shard syntax.
+
+All coordinates:
+1. Test the whole repo:
+    ```console
+    ./gradlew pullAllowedDockerImages -Pcoordinates=all
+    ./gradlew checkMetadataFiles -Pcoordinates=all
+    ./gradlew test -Pcoordinates=all
+    ```
+
+2. Splitting the tests in batches (e.g., batch 1 of 16):
+    ```console
+    ./gradlew pullAllowedDockerImages -Pcoordinates=1/16
+    ./gradlew checkMetadataFiles -Pcoordinates=1/16
+    ./gradlew test -Pcoordinates=1/16
+    ```
+
+### Testing individual stages
+
+Each stage of the testing can be run with `-Pcoordinates=[group:artifact:version|k/n|all]`. Here are the examples:
+```console
+./gradlew clean -Pcoordinates=[group:artifact:version|k/n|all]
+./gradlew pullAllowedDockerImages -Pcoordinates=[group:artifact:version|k/n|all]
+./gradlew checkMetadataFiles -Pcoordinates=[group:artifact:version|k/n|all]
+./gradlew checkstyle -Pcoordinates=[group:artifact:version|k/n|all]
+./gradlew compileTestJava -Pcoordinates=[group:artifact:version|k/n|all]
+./gradlew javaTest -Pcoordinates=[group:artifact:version|k/n|all]
+./gradlew nativeTestCompile -Pcoordinates=[group:artifact:version|k/n|all]
+./gradlew test -Pcoordinates=[group:artifact:version|k/n|all]
+```
+
+### Docker image vulnerability scanning
+
+1. Scan only images affected in a commit range:
+   ```console
+   ./gradlew checkAllowedDockerImages --baseCommit=$(git rev-parse origin/master) --newCommit=$(git rev-parse HEAD)
+   ```
+
+2. Scan all allowed images
+   ```console
+   ./gradlew checkAllowedDockerImages
+   ```
+
+### Compatibility automation with latest library versions
+
+These tasks support the scheduled workflow that checks newer upstream library versions and updates our metadata accordingly.
+
+1. List supported libraries that have newer upstream versions
+    ```console
+    ./gradlew fetchExistingLibrariesWithNewerVersions --quiet
+    ```
+
+2. Mark a new tested version for a library
+    ```console
+    ./gradlew addTestedVersion -Pcoordinates="group:artifact:newVersion" --lastSupportedVersion="oldVersion"
+    ```
+    For example:
+    ```console
+    ./gradlew addTestedVersion -Pcoordinates="org.postgresql:postgresql:42.7.4" --lastSupportedVersion="42.7.3"
+    ```
+
+### Releases and Packaging
+
+```console
+./gradlew package
+```
+
+### Quick reference (copy/paste)
+
+- Style: `./gradlew checkstyle`
+- Format check: `./gradlew spotlessCheck`
+- Pull images (single lib): `./gradlew pullAllowedDockerImages -Pcoordinates=[group:artifact:version|k/n|all]`
+- Check metadata (single lib): `./gradlew checkMetadataFiles -Pcoordinates=[group:artifact:version|k/n|all]`
+- Test (single lib): `./gradlew test -Pcoordinates=[group:artifact:version|k/n|all]`
+- Scan changed Docker images: `./gradlew checkAllowedDockerImages --baseCommit=<sha1> --newCommit=<sha2>`
+- Scan all Docker images: `./gradlew checkAllowedDockerImages`
+- List libs with newer versions: `./gradlew fetchExistingLibrariesWithNewerVersions --quiet`
+- Record a newly tested version: `./gradlew addTestedVersion -Pcoordinates="group:artifact:newVersion" --lastSupportedVersion="oldVersion"`
+- Package release artifacts: `./gradlew package`
diff --git a/docs/Infrastructure/check-new-versions-of-libraries.md b/docs/Infrastructure/check-new-versions-of-libraries.md
deleted file mode 100644
index 79c97e54b..000000000
--- a/docs/Infrastructure/check-new-versions-of-libraries.md
+++ /dev/null
@@ -1,51 +0,0 @@
-# Check new versions of existing libraries in the repository
-
-As the number of libraries in the repository grow fast, it is hard to track new library versions for every library manually.
-Instead of doing this process manually, we provided a mechanism (through [a GitHub workflow](https://github.com/oracle/graalvm-reachability-metadata/blob/master/.github/workflows/check-new-library-versions.yml)) 
-that automatically scans MavenCentral repository for new versions of the libraries that we currently have.
-
-## How it works
-
-The workflow gets triggered every two weeks automatically (alternating to the automatic release weeks). Besides that, the job can be triggered manually from the GitHub actions.
-The whole process consists of the following parts:
-* Scanning of the MavenCentral
-* Running existing tests with newer versions of the library
-* Creating a pull-request that updates `tested-versions` field of the `index.json` file for libraries that passed tests with a new version
-* Creating an issue that lists all versions of libraries that failed their existing tests.
-
-As a preparation for the whole process, we are creating a branch for all successful tests, and a single issue for all failed tests.
-
-### Scanning the MavenCentral 
-
-At first, the workflow runs gradle task called `fetchExistingLibrariesWithNewerVersions`.
-The task itself does the following:
-1. Gets the list of all existing libraries in the repository
-2. For each library, it searches for the latest tested version in the corresponding library `index.json` file
-3. For the given library name, it fetches `maven-metadata.xml` file from the MavenCentral repository
-4. In the fetched `maven-metadata.xml` file, it finds the position of the latest tested version (gathered in the step 3) and returns all the versions after it
-5. As a last step, the task returns list of maven coordinates of libraries with newer versions (alongside java version and os version required for testing)
-
-### Running existing tests with newer versions
-
-Now that we have coordinates list, we are spawning a new job in GitHub workflow for each coordinate in the list.
-Each of the spawned jobs:
-1. Extracts the following parts from the given maven coordinates:
-   1. Latest version that we have tests written for 
-   2. Path to the latest tests we have
-   3. Maven coordinates of the latest tests
-2. Sets `GVM_TCK_LV` env variable to the version we want to test. This way the executed tests will use library version specified in the env variable.
-3. Run the latest test with `./gradlew test -Pcoordinates=<testCoordinates>` (with `testCoordinates` calculated in the step 1)
-
-### Aggregating results of the tests
-
-Based on the outcome of the test we:
-* Update the list of `tested-versions` in the proper library `index.json` file and commit changes to the previously created branch, if the test passed
-* Add a comment that explains which library version cannot pass the tests, in the issue we previously created
-
-Note: since the spawned jobs run tests in parallel, we have to make some kind of synchronization to avoid merge conflicts if two tests are populating the same `index.json` file.
-The whole process of synchronization is driven by the [tryPushVersionsUpdate](https://github.com/oracle/graalvm-reachability-metadata/blob/master/.github/workflows/tryPushVersionsUpdate.sh) script.
-
-At the end, when all jobs have finished their executions, the workflow just creates a pull-request based on a branch the jobs committed to.
-As a final result, we have:
-* a pull-request with updates of all new tested versions
-* an issue with list of all versions that doesn't work with existing metadata
diff --git a/REVIEWING.md b/docs/REVIEWING.md
similarity index 95%
rename from REVIEWING.md
rename to docs/REVIEWING.md
index e8156c64a..b65f34cf7 100644
--- a/REVIEWING.md
+++ b/docs/REVIEWING.md
@@ -6,7 +6,7 @@ This document should serve as a guideline for reviewers to simplify and harmoniz
 
 ## Checklist
 First step of every review is to verify the checklist from the pull request description.
-Once the contributor wants to open a pull request [this checklist](pull_request_template.md) will be automatically added to the pull request description.
+Once the contributor wants to open a pull request [this checklist](../.github/pull_request_template.md) will be automatically added to the pull request description.
 * If the PR does not contain such a list, it **should not be reviewed**
 * If any of the items is not checked, the reviewer should ask for an explanation from the contributor
 
@@ -60,5 +60,5 @@ All metadata files **must** be covered by the tests. Every metadata file should:
 * not have entries that describes classes that serve only for tests 
 
 There are various tools that could help checking the content of all json files we are collecting.
-To run these checks automatically, top-level metadata index file must contain `allowed-packages` properly set ([see this](./CONTRIBUTING.md#metadata-structure)).
-If this field is properly configured, our GitHub workflows will automatically check `typeReachable` and origin of all entries in all config files.
\ No newline at end of file
+To run these checks automatically, top-level metadata index file must contain `allowed-packages` properly set ([see this](CONTRIBUTING.md#metadata-structure)).
+If this field is properly configured, our GitHub workflows will automatically check `typeReachable` and origin of all entries in all config files.
diff --git a/SECURITY.md b/docs/SECURITY.md
similarity index 100%
rename from SECURITY.md
rename to docs/SECURITY.md
diff --git a/tests/src/org.jetbrains.kotlin/kotlin-reflect/1.7.10/build.gradle b/tests/src/org.jetbrains.kotlin/kotlin-reflect/1.7.10/build.gradle
index ef291d685..c7428d0fe 100644
--- a/tests/src/org.jetbrains.kotlin/kotlin-reflect/1.7.10/build.gradle
+++ b/tests/src/org.jetbrains.kotlin/kotlin-reflect/1.7.10/build.gradle
@@ -17,7 +17,7 @@ dependencies {
 }
 
 compileTestKotlin {
-    kotlinOptions.jvmTarget = "17"
+    kotlinOptions.jvmTarget = "21"
 }
 
 graalvmNative {
diff --git a/tests/src/org.jetbrains.kotlin/kotlin-stdlib/1.7.10/build.gradle b/tests/src/org.jetbrains.kotlin/kotlin-stdlib/1.7.10/build.gradle
index 9aeda18a0..154997eb5 100644
--- a/tests/src/org.jetbrains.kotlin/kotlin-stdlib/1.7.10/build.gradle
+++ b/tests/src/org.jetbrains.kotlin/kotlin-stdlib/1.7.10/build.gradle
@@ -20,7 +20,7 @@ dependencies {
 }
 
 compileTestKotlin {
-    kotlinOptions.jvmTarget = "17"
+    kotlinOptions.jvmTarget = "21"
 }
 
 graalvmNative {
diff --git a/tests/src/org.thymeleaf.extras/thymeleaf-extras-springsecurity6/3.1.0.M1/build.gradle b/tests/src/org.thymeleaf.extras/thymeleaf-extras-springsecurity6/3.1.0.M1/build.gradle
index e8728bc17..4d60de9e9 100644
--- a/tests/src/org.thymeleaf.extras/thymeleaf-extras-springsecurity6/3.1.0.M1/build.gradle
+++ b/tests/src/org.thymeleaf.extras/thymeleaf-extras-springsecurity6/3.1.0.M1/build.gradle
@@ -11,7 +11,7 @@ plugins {
 String libraryVersion = tck.testedLibraryVersion.get()
 
 tasks.withType(JavaCompile) {
-    options.release = 17
+    options.release = 21
 }
 
 dependencies {
diff --git a/tests/src/org.thymeleaf/thymeleaf-spring6/3.1.0.M2/build.gradle b/tests/src/org.thymeleaf/thymeleaf-spring6/3.1.0.M2/build.gradle
index e175d23ec..5a8ea8013 100644
--- a/tests/src/org.thymeleaf/thymeleaf-spring6/3.1.0.M2/build.gradle
+++ b/tests/src/org.thymeleaf/thymeleaf-spring6/3.1.0.M2/build.gradle
@@ -11,7 +11,7 @@ plugins {
 String libraryVersion = tck.testedLibraryVersion.get()
 
 tasks.withType(JavaCompile) {
-    options.release = 17
+    options.release = 21
 }
 
 dependencies {
diff --git a/tests/tck-build-logic/src/main/groovy/org.graalvm.internal.tck-harness.gradle b/tests/tck-build-logic/src/main/groovy/org.graalvm.internal.tck-harness.gradle
index 63b6e3ca7..2b0ed2dd0 100644
--- a/tests/tck-build-logic/src/main/groovy/org.graalvm.internal.tck-harness.gradle
+++ b/tests/tck-build-logic/src/main/groovy/org.graalvm.internal.tck-harness.gradle
@@ -10,20 +10,24 @@ plugins {
 }
 
 import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
 import org.graalvm.internal.tck.ContributionTask
 import org.graalvm.internal.tck.DockerTask
-import org.graalvm.internal.tck.ConfigFilesChecker
+import org.graalvm.internal.tck.MetadataFilesCheckerTask
+import org.graalvm.internal.tck.DockerUtils
 import org.graalvm.internal.tck.ScaffoldTask
 import org.graalvm.internal.tck.GrypeTask
 import org.graalvm.internal.tck.TestedVersionUpdaterTask
 import org.graalvm.internal.tck.harness.tasks.TestInvocationTask
 import org.graalvm.internal.tck.harness.tasks.CheckstyleInvocationTask
 import org.graalvm.internal.tck.harness.tasks.CleanInvocationTask
-import org.graalvm.internal.tck.harness.tasks.JavacInvocationTask
+import org.graalvm.internal.tck.harness.tasks.CompileTestJavaInvocationTask
 import org.graalvm.internal.tck.harness.tasks.JavaTestInvocationTask
 import org.graalvm.internal.tck.harness.tasks.NativeTestCompileInvocationTask
-import org.graalvm.internal.tck.updaters.FetchExistingLibrariesWithNewerVersionsTask
-import org.graalvm.internal.tck.updaters.GroupUnsupportedLibraries
+import org.graalvm.internal.tck.harness.tasks.FetchExistingLibrariesWithNewerVersionsTask
+import org.gradle.util.internal.VersionNumber
+import org.graalvm.internal.tck.harness.tasks.ComputeAndPullAllowedDockerImagesTask
+import org.graalvm.internal.tck.utils.CoordinateUtils
 
 
 import static org.graalvm.internal.tck.Utils.generateTaskName
@@ -31,92 +35,109 @@ import static org.graalvm.internal.tck.Utils.generateTaskName
 logger.lifecycle("GraalVM Reachability Metadata TCK")
 logger.lifecycle("---------------------------------")
 
+final String METADATA_GROUP = "Metadata"
+
+def writeGithubOutput(String key, String value) {
+    def path = System.getenv("GITHUB_OUTPUT")
+    if (path == null || path.trim().isEmpty()) {
+        println "${key}=${value}"
+    } else {
+        new File(path).append("${key}=${value}\n")
+    }
+}
+
 String coordinateFilter = Objects.requireNonNullElse(project.findProperty("coordinates"), "")
-List<String> matchingCoordinates = tck.getMatchingCoordinates(coordinateFilter)
 
-// gradle test -Pcoordinates=<maven-coordinates>
-Provider<Task> test = tasks.register("test", DefaultTask) { task ->
-    task.setDescription("Tests GraalVM Reflection Metadata that matches given coordinates")
-    task.setGroup(JavaBasePlugin.VERIFICATION_GROUP)
+
+List<String> matchingCoordinates
+if (CoordinateUtils.isFractionalBatch(coordinateFilter)) {
+    def frac = CoordinateUtils.parseFraction(coordinateFilter)
+    List<String> all = tck.getMatchingCoordinates("all")
+    matchingCoordinates = CoordinateUtils.computeBatchedCoordinates(all, frac[0], frac[1])
+} else {
+    matchingCoordinates = tck.getMatchingCoordinates(coordinateFilter)
 }
+matchingCoordinates = matchingCoordinates.findAll { !it.startsWith("samples:") }
+
 
 // gradle checkstyle -Pcoordinates=<maven-coordinates>
 Provider<Task> checkstyle = tasks.register("checkstyle") { task ->
     task.setDescription("Runs checkstyle on all subprojects")
     task.setGroup(JavaBasePlugin.VERIFICATION_GROUP)
-}
+} as Provider<Task>
 
- // gradle javac -Pcoordinates=<maven-coordinates>
-Provider<Task> javac = tasks.register("javac") { task ->
+ // gradle compileTestJava -Pcoordinates=<maven-coordinates>
+Provider<Task> compileTestJava = tasks.register("compileTestJava") { task ->
     task.setDescription("Compiles sources (javac) for all subprojects")
     task.setGroup(LifecycleBasePlugin.BUILD_GROUP)
-}
+} as Provider<Task>
+
+// gradle javaTest -Pcoordinates=<maven-coordinates>
+Provider<Task> javaTest = tasks.register("javaTest") { task ->
+    task.setDescription("Runs JVM tests (Gradle 'test') for all subprojects")
+    task.setGroup(JavaBasePlugin.VERIFICATION_GROUP)
+} as Provider<Task>
 
  // gradle nativeTestCompile -Pcoordinates=<maven-coordinates>
 Provider<Task> nativeTestCompile = tasks.register("nativeTestCompile") { task ->
     task.setDescription("Compiles native tests (nativeTestCompile) for all subprojects")
     task.setGroup(LifecycleBasePlugin.BUILD_GROUP)
-}
+} as Provider<Task>
+
+// gradle checkMetadataFiles -Pcoordinates=<maven-coordinates>
+Provider<Task> checkMetadataFiles = tasks.register("checkMetadataFiles") { task ->
+    task.setDescription("Checks content of metadata files for matching coordinates")
+    task.setGroup(METADATA_GROUP)
+} as Provider<Task>
 
- // gradle javaTest -Pcoordinates=<maven-coordinates>
-Provider<Task> javaTest = tasks.register("javaTest") { task ->
-    task.setDescription("Runs JVM tests (Gradle 'test') for all subprojects")
-    task.setGroup(JavaBasePlugin.VERIFICATION_GROUP)
-}
 
 tasks.named("check").configure {
     dependsOn(checkstyle)
 }
 
-// Here we want to configure all test and checkstyle tasks for all filtered subprojects
-for (String coordinates in matchingCoordinates) {
-    String testTaskName = generateTaskName("test", coordinates)
-    if ((!tasks.getNames().contains(testTaskName))) {
-        tasks.register(testTaskName, TestInvocationTask, coordinates)
-    }
-    test.configure {
-        dependsOn(testTaskName)
-    }
-
-    String checkstyleTaskName = generateTaskName("checkstyle", coordinates)
-    if ((!tasks.getNames().contains(checkstyleTaskName))) {
-        tasks.register(checkstyleTaskName, CheckstyleInvocationTask, coordinates)
-    }
-    checkstyle.configure {
-        dependsOn(checkstyleTaskName)
-    }
-
-    String cleanTaskName = generateTaskName("clean", coordinates)
-    if ((!tasks.getNames().contains(cleanTaskName))) {
-        tasks.register(cleanTaskName, CleanInvocationTask, coordinates)
-    }
-    clean.configure {
-        dependsOn(cleanTaskName)
-    }
-
-    String javacTaskName = generateTaskName("javac", coordinates)
-    if ((!tasks.getNames().contains(javacTaskName))) {
-        tasks.register(javacTaskName, JavacInvocationTask, coordinates)
-    }
-    javac.configure {
-        dependsOn(javacTaskName)
-    }
 
-    String nativeTestCompileTaskName = generateTaskName("nativeTestCompile", coordinates)
-    if ((!tasks.getNames().contains(nativeTestCompileTaskName))) {
-        tasks.register(nativeTestCompileTaskName, NativeTestCompileInvocationTask, coordinates)
+ // Here we want to configure all test and checkstyle tasks for all filtered subprojects
+// Extracted helper to register per-coordinate tasks and wire them to aggregate tasks.
+def registerPerCoordinateTask = { String coordinates, Object aggregate, String baseName, Class taskClass, boolean passCtorArg = true, Closure customConfigure = null ->
+    String taskName = generateTaskName(baseName, coordinates)
+    if ((!tasks.getNames().contains(taskName))) {
+        if (passCtorArg) {
+            tasks.register(taskName, taskClass, coordinates)
+        } else {
+            tasks.register(taskName, taskClass) { t ->
+                if (customConfigure != null) {
+                    customConfigure.call(t)
+                }
+            }
+        }
     }
-    nativeTestCompile.configure {
-        dependsOn(nativeTestCompileTaskName)
+    if (aggregate != null) {
+        if (aggregate instanceof org.gradle.api.provider.Provider) {
+            aggregate.configure {
+                dependsOn(taskName)
+            }
+        } else {
+            tasks.named(aggregate.toString()).configure {
+                dependsOn(taskName)
+            }
+        }
     }
+}
 
-    String javaTestTaskName = generateTaskName("javaTest", coordinates)
-    if ((!tasks.getNames().contains(javaTestTaskName))) {
-        tasks.register(javaTestTaskName, JavaTestInvocationTask, coordinates)
+for (String coordinates in matchingCoordinates) {
+    registerPerCoordinateTask(coordinates, checkstyle, "checkstyle", CheckstyleInvocationTask, true)
+    registerPerCoordinateTask(coordinates, "clean", "clean", CleanInvocationTask, true)
+    registerPerCoordinateTask(coordinates, compileTestJava, "compileTestJava", CompileTestJavaInvocationTask, true)
+    registerPerCoordinateTask(coordinates, javaTest, "javaTest", JavaTestInvocationTask, true)
+    registerPerCoordinateTask(coordinates, nativeTestCompile, "nativeTestCompile", NativeTestCompileInvocationTask, true)
+    // No aggregate wiring for per-coordinate docker pulls; they are invoked by dedicated workflows.
+    registerPerCoordinateTask(coordinates, null, "pullAllowedDockerImages", DockerTask.class, false) { t ->
+        t.setCoordinates(coordinates)
     }
-    javaTest.configure {
-        dependsOn(javaTestTaskName)
+    registerPerCoordinateTask(coordinates, checkMetadataFiles, "checkMetadataFiles", MetadataFilesCheckerTask.class, false) { t ->
+        t.setCoordinates(coordinates)
     }
+    registerPerCoordinateTask(coordinates, "test", "test", TestInvocationTask, true)
 }
 
 // gradle diff -PbaseCommit=<base-commit> -PnewCommit=<new-commit>
@@ -132,7 +153,6 @@ Provider<Task> diff = tasks.register("diff", DefaultTask) { task ->
 }
 
 List<String> diffCoordinates = new ArrayList<>()
-boolean testAll = false
 if (project.hasProperty("baseCommit")) {
     String baseCommit = project.findProperty("baseCommit")
     String newCommit = Objects.requireNonNullElse(project.findProperty("newCommit"), "HEAD")
@@ -146,19 +166,25 @@ if (project.hasProperty("baseCommit")) {
             dependsOn(taskTaskName)
         }
     }
-
-    testAll = tck.shouldTestAll()
 }
 
-def matrixDefault = [
-        "version": [
-            "17",
-            "latest-ea"
-        ],
-        "os"     : ["ubuntu-latest"] // TODO: Add support for "windows-latest", "macos-latest"
-]
+Map<String, Object> loadCi() {
+    File f = project.file("ci.json")
+    if (!f.exists()) {
+        throw new GradleException("Missing ci.json in repo root")
+    }
+    new JsonSlurper().parse(f) as Map<String, Object>
+}
 
-final String METADATA_GROUP = "Metadata"
+Map<String, List<String>> matrixDefaultsFor(String section) {
+    def ci = loadCi()
+    def sec = ci[section]
+    if (sec == null) throw new GradleException("Missing '${section}' in ci.json")
+    [
+        "version": (sec["java"] as List<String>),
+        "os": (sec["os"] as List<String>)
+    ]
+}
 
 // gradle generateMatrixMatchingCoordinates -Pcoordinates=<maven-coordinates>
 Provider<Task> generateMatrixMatchingCoordinates = tasks.register("generateMatrixMatchingCoordinates", DefaultTask) { task ->
@@ -168,13 +194,31 @@ Provider<Task> generateMatrixMatchingCoordinates = tasks.register("generateMatri
         def matrix = [
                 "coordinates": matchingCoordinates
         ]
-        matrix.putAll(matrixDefault)
-        new File(System.getenv("GITHUB_OUTPUT")).append("matrix=${JsonOutput.toJson(matrix)}\n")
+        matrix.putAll(matrixDefaultsFor("generateMatrixMatchingCoordinates"))
+        writeGithubOutput("matrix", JsonOutput.toJson(matrix))
+    }
+}
+
+ // gradle generateMatrixBatchedCoordinates [-Pbatches=<n>]
+Provider<Task> generateMatrixBatchedCoordinates = tasks.register("generateMatrixBatchedCoordinates", DefaultTask) { task ->
+    task.setDescription("Returns matrix definition populated with fractional batch coordinates (k/n)")
+    task.setGroup(METADATA_GROUP)
+    task.doFirst {
+        int batches = project.hasProperty("batches") ? Integer.parseInt(project.findProperty("batches").toString()) : 16
+        if (batches <= 0) {
+            throw new GradleException("Invalid 'batches' value: ${batches}")
+        }
+        List<String> coords = (1..batches).collect { i -> "${i}/${batches}" }
+        def matrix = [
+                "coordinates": coords
+        ]
+        matrix.putAll(matrixDefaultsFor("generateMatrixBatchedCoordinates"))
+        writeGithubOutput("matrix", JsonOutput.toJson(matrix))
     }
 }
 
-// gradle generateMatrixDiffCoordinates -PbaseCommit=<base-commit> -PnewCommit=<new-commit>
-Provider<Task> generateMatrixDiffCoordinates = tasks.register("generateMatrixDiffCoordinates", DefaultTask) { task ->
+// gradle generateChangedCoordinatesMatrix -PbaseCommit=<base-commit> -PnewCommit=<new-commit>
+Provider<Task> generateChangedCoordinatesMatrix = tasks.register("generateChangedCoordinatesMatrix", DefaultTask) { task ->
     task.setDescription("Returns matrix definition populated with coordinates of changed libraries")
     task.setGroup(METADATA_GROUP)
     task.doFirst {
@@ -182,40 +226,63 @@ Provider<Task> generateMatrixDiffCoordinates = tasks.register("generateMatrixDif
             throw new GradleException("Missing 'baseCommit' property! Rerun Gradle with '-PbaseCommit=<commit-hash>'")
         }
 
-        if (diffCoordinates.isEmpty()) {
-            def matrix = [
-                "coordinates": ["No matches found!"]
-            ]
-
-            matrix.putAll(matrixDefault)
+        boolean noneFound = diffCoordinates.isEmpty()
+        def matrix = [
+                "coordinates": noneFound ? [] : diffCoordinates
+        ]
+        matrix.putAll(matrixDefaultsFor("generateChangedCoordinatesMatrix"))
+        if (noneFound) {
             println "No changed coordinates were found!"
-            new File(System.getenv("GITHUB_OUTPUT")).append("matrix=${JsonOutput.toJson(matrix)}\n")
-            new File(System.getenv("GITHUB_OUTPUT")).append("none-found=true\n")
-        } else {
-            def matrix = [
-                    "coordinates": diffCoordinates
-            ]
-
-            matrix.putAll(matrixDefault)
-
-            /**
-             * if we changed some files from tck-build-logic or github workflows, we must run all tests
-             * to check if we accidentally broke something. In this case, we will have a lots of tests, so we can't
-             * run them with all possible JDK versions, because we will hit the following error:
-             * Strategy expansion exceeded 256 results for job 'test-changed-metadata'
-             */
-            if (!testAll) {
-                /**
-                 * when we are introducing a new metadata, we should test it against all versions,
-                 * not just the oldest and the newest one (which we are testing by default)
-                 */
-                matrix.version.add("21")
-                matrix.version.add("25")
-                matrix.version.add("latest-ea")
+        }
+
+
+        writeGithubOutput("matrix", JsonOutput.toJson(matrix))
+        writeGithubOutput("none-found", noneFound.toString())
+    }
+}
+
+// gradle generateInfrastructureChangedCoordinatesMatrix -PbaseCommit=<base-commit> -PnewCommit=<new-commit>
+Provider<Task> generateInfrastructureChangedCoordinatesMatrix = tasks.register("generateInfrastructureChangedCoordinatesMatrix", DefaultTask) { task ->
+    task.setDescription("Returns matrix definition populated with pre-selected coordinates when test infrastructure has changed")
+    task.setGroup(METADATA_GROUP)
+    task.doFirst {
+        List<String> selected = []
+        boolean infraChanged = true
+        // Pre-selected modules; keep stable for infra verification
+        List<String> preselectedModules = [
+                'ch.qos.logback:logback-classic',
+                'org.bouncycastle:bcpkix-jdk18on',
+                'io.netty:netty-common',
+                'io.grpc:grpc-core',
+                'org.postgresql:postgresql',
+                'org.apache.kafka:kafka-clients',
+                'com.zaxxer:HikariCP',
+                'org.hibernate.validator:hibernate-validator',
+                'io.undertow:undertow-core',
+                'com.hazelcast:hazelcast'
+        ]
+        preselectedModules.each { module ->
+            List<String> matches = tck.getMatchingCoordinates(module)
+            if (!matches.isEmpty()) {
+                def withVersions = matches.collect { c ->
+                    def v = c.substring(c.lastIndexOf(':') + 1)
+                    [coord: c, ver: v]
+                }
+                def latest = withVersions.max { a, b -> VersionNumber.parse(a.ver) <=> VersionNumber.parse(b.ver) }
+                selected.add(latest.coord)
+            } else {
+                throw new GradleException("No tested versions found for ${module}, skipping")
             }
-            new File(System.getenv("GITHUB_OUTPUT")).append("matrix=${JsonOutput.toJson(matrix)}\n")
-            new File(System.getenv("GITHUB_OUTPUT")).append("none-found=false\n")
         }
+
+        def matrix = [
+            "coordinates": selected
+        ]
+        matrix.putAll(matrixDefaultsFor("generateInfrastructureChangedCoordinatesMatrix"))
+
+
+        writeGithubOutput("matrix", JsonOutput.toJson(matrix))
+        writeGithubOutput("none-found", "false")
     }
 }
 
@@ -226,12 +293,6 @@ tasks.register("fetchExistingLibrariesWithNewerVersions", FetchExistingLibraries
     task.setAllLibraryCoordinates(matchingCoordinates)
 }
 
-tasks.register("groupLibrariesByName", GroupUnsupportedLibraries.class) { task ->
-    task.setGroup(METADATA_GROUP)
-    task.setDescription("Extracts groups of libraries from github comments provided in a form of string.")
-}
-
-
 tasks.register("addTestedVersion", TestedVersionUpdaterTask.class) { task ->
     task.setDescription("Updates list of tested versions.")
     task.setGroup(METADATA_GROUP)
@@ -243,8 +304,8 @@ tasks.register("checkAllowedDockerImages", GrypeTask.class) { task ->
     task.setGroup(METADATA_GROUP)
 }
 
-tasks.register("pullAllowedDockerImages", DockerTask.class) { task ->
-    task.setDescription("Pull allowed docker images from list.")
+tasks.register("pullAllowedDockerImages", ComputeAndPullAllowedDockerImagesTask.class) { task ->
+    task.setDescription("Computes and pulls allowed docker images required by matching coordinates")
     task.setGroup(METADATA_GROUP)
 }
 
@@ -261,8 +322,3 @@ tasks.register("contribute", ContributionTask.class) { task ->
     task.setDescription("Generates metadata and prepares pull request for contibuting on metadata repository based on provided tests.")
     task.setGroup(METADATA_GROUP)
 }
-
-tasks.register("checkConfigFiles", ConfigFilesChecker.class) { task ->
-    task.setDescription("Checks content of config files for a new library.")
-    task.setGroup(METADATA_GROUP)
-}
diff --git a/tests/tck-build-logic/src/main/groovy/org.graalvm.internal.tck.gradle b/tests/tck-build-logic/src/main/groovy/org.graalvm.internal.tck.gradle
index d0b443eba..1b903e8db 100644
--- a/tests/tck-build-logic/src/main/groovy/org.graalvm.internal.tck.gradle
+++ b/tests/tck-build-logic/src/main/groovy/org.graalvm.internal.tck.gradle
@@ -6,6 +6,8 @@
  */
 
 
+import groovy.json.JsonSlurper
+
 plugins {
     id 'org.graalvm.internal.tck-base'
     id 'checkstyle'
@@ -18,7 +20,7 @@ repositories {
 }
 
 tasks.withType(JavaCompile).configureEach {
-    options.release = 17
+    options.release = 21
 }
 
 checkstyle {
@@ -51,6 +53,26 @@ String overrideVal = System.getenv("GVM_TCK_EXCLUDE") ?: providers.gradlePropert
 overrideVal = overrideVal ?: "false"
 boolean override = overrideVal.toBoolean()
 
+// Determine native-image build arguments from ci.json.
+def ciJsonFile = rootProject.file("ci.json")
+def nativeImageArgs = []
+if (ciJsonFile.exists()) {
+    try {
+        def parsed = new JsonSlurper().parse(ciJsonFile)
+        def argsFromCi = parsed?.buildArgs
+        if (argsFromCi instanceof Collection && !argsFromCi.isEmpty()) {
+            nativeImageArgs = argsFromCi.collect { it.toString() }
+            // Post-process placeholders in args
+            nativeImageArgs = nativeImageArgs.collect { arg ->
+                arg.replace('{{library.version}}', libraryVersion)
+                   .replace('{{library.coordinates}}', libraryGAV)
+            }
+        }
+    } catch (Exception ignored) {
+        throw new GradleException("ci.json must contain the buildArgs")
+    }
+}
+
 tck.testedLibraryVersion = libraryVersion
 // This value can be used to request specific library version to test with.
 
@@ -78,8 +100,7 @@ graalvmNative {
             if (override) {
                 excludeConfig.put(libraryGAV, [".*"])
             }
-            verbose = true
-            quickBuild = true
+            buildArgs.addAll(nativeImageArgs)
         }
     }
 }
diff --git a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/TckExtension.java b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/TckExtension.java
index eb31d97c4..d64e95c76 100644
--- a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/TckExtension.java
+++ b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/TckExtension.java
@@ -6,11 +6,6 @@
  */
 package org.graalvm.internal.tck.harness;
 
-import com.fasterxml.jackson.annotation.JsonInclude;
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.SerializationFeature;
-import org.graalvm.internal.tck.model.MetadataVersionsIndexEntry;
 import org.gradle.api.Project;
 import org.gradle.api.file.Directory;
 import org.gradle.api.file.DirectoryProperty;
@@ -18,6 +13,7 @@
 import org.gradle.api.provider.Property;
 import org.gradle.api.provider.Provider;
 import org.gradle.process.ExecOperations;
+import org.jetbrains.annotations.NotNull;
 
 import javax.inject.Inject;
 import java.io.ByteArrayOutputStream;
@@ -28,19 +24,13 @@
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.*;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
-import static org.graalvm.internal.tck.Utils.coordinatesMatch;
-import static org.graalvm.internal.tck.Utils.extractJsonFile;
-import static org.graalvm.internal.tck.Utils.readIndexFile;
-import static org.graalvm.internal.tck.Utils.splitCoordinates;
+import static org.graalvm.internal.tck.Utils.*;
 
 public abstract class TckExtension {
-    private static final List<String> REPO_ROOT_FILES = List.of("CONTRIBUTING.md", "metadata");
+    private static final List<String> REPO_ROOT_FILES = List.of("LICENSE", "metadata", "tests");
 
     public abstract DirectoryProperty getRepoRoot();
 
@@ -50,7 +40,7 @@ public abstract class TckExtension {
 
     public abstract DirectoryProperty getTckRoot();
 
-    public abstract Property<String> getTestedLibraryVersion();
+    public abstract Property<@NotNull String> getTestedLibraryVersion();
 
     @Inject
     public abstract ExecOperations getExecOperations();
@@ -58,8 +48,13 @@ public abstract class TckExtension {
     public TckExtension(Project project) {
         getRepoRoot().value(project.getObjects().directoryProperty().value(project.getLayout().getProjectDirectory()).map(dir -> {
             Directory current = dir;
+            var level = 0;
+            int maxLevel = 50;
             while (!isRootDir(current)) {
                 current = current.dir("..");
+                if (level++ == maxLevel) {
+                    throw new RuntimeException("Could not detect root dir at level " + maxLevel);
+                }
             }
             return current;
         })).finalizeValueOnRead();
@@ -72,7 +67,7 @@ private static boolean isRootDir(Directory dir) {
         return REPO_ROOT_FILES.stream().allMatch(fileName -> dir.file(fileName).getAsFile().exists());
     }
 
-    private static Path toPath(Provider<? extends FileSystemLocation> provider) {
+    private static Path toPath(Provider<? extends @NotNull FileSystemLocation> provider) {
         return provider.get().getAsFile().toPath();
     }
 
@@ -96,7 +91,7 @@ private Path testRoot() {
      * Given full coordinates returns matching test directory
      */
     @SuppressWarnings("unchecked")
-    Path getTestDir(String coordinates) {
+    public Path getTestDir(String coordinates) {
         List<String> strings = splitCoordinates(coordinates);
         String groupId = strings.get(0);
         String artifactId = strings.get(1);
@@ -110,7 +105,7 @@ Path getTestDir(String coordinates) {
         for (Map<String, ?> entry : index) {
             boolean found = ((List<Map<String, ?>>) entry.get("libraries")).stream().anyMatch(
                     lib -> coordinatesMatch((String) lib.get("name"), groupId, artifactId) &&
-                           ((List<String>) lib.get("versions")).contains(version)
+                            ((List<String>) lib.get("versions")).contains(version)
             );
             if (found) {
                 return testRoot().resolve((String) entry.get("test-project-path"));
@@ -119,12 +114,6 @@ Path getTestDir(String coordinates) {
         throw new RuntimeException("Missing test-directory for coordinates `" + coordinates + "`");
     }
 
-    private boolean shouldTestAll = false;
-
-    public boolean shouldTestAll() {
-        return shouldTestAll;
-    }
-
     /**
      * Returns a list of coordinates that match changed files between baseCommit and newCommit.
      *
@@ -142,13 +131,11 @@ List<String> diffCoordinates(String baseCommit, String newCommit) {
         List<String> diffFiles = Arrays.asList(output.split("\\r?\\n"));
 
         Path workflowsRoot = repoRoot().resolve(".github").resolve("workflows");
-        AtomicBoolean testAll = new AtomicBoolean(false);
         // Group files by if they belong to 'metadata' or 'test' directory structures.
         Map<String, List<Path>> changed = diffFiles.stream()
                 .map(line -> repoRoot().resolve(line))
                 .collect(Collectors.groupingBy((Path path) -> {
                     if (path.startsWith(tckRoot()) || path.startsWith(workflowsRoot)) {
-                        testAll.set(true);
                         return "logic";
                     } else if (path.startsWith(testRoot())) {
                         return "test";
@@ -159,12 +146,6 @@ List<String> diffCoordinates(String baseCommit, String newCommit) {
                     }
                 }));
 
-        if (testAll.get()) {
-            shouldTestAll = true;
-            // If tck was changed we should retest everything, just to be safe.
-            return getMatchingCoordinates("");
-        }
-
         // if we didn't change any of metadata, tests or logic we don't need to test anything
         if (changed.get("metadata") != null && changed.get("metadata").isEmpty()
                 && changed.get("test") != null && changed.get("test").isEmpty()
@@ -180,10 +161,8 @@ List<String> diffCoordinates(String baseCommit, String newCommit) {
                 return true;
             }
             Path testDir = getTestDir(c);
-            if (changed.get("test") != null && changed.get("test").stream().anyMatch(f -> f.startsWith(testDir))) {
-                return true;
-            }
-            return false;
+            return changed.get("test") != null &&
+                    changed.get("test").stream().anyMatch(f -> f.startsWith(testDir));
         }).distinct().collect(Collectors.toList());
 
         // if we detected changes in repo, but not in metadata/index.json file, we should throw an exception
@@ -208,10 +187,11 @@ List<String> diffCoordinates(String baseCommit, String newCommit) {
     private boolean metadataIndexContainsChangedEntries(Set<String> changedCoordinates, List<String> changedEntries) {
         boolean containsAll = true;
         for (var n : changedEntries) {
-            boolean containsCurrent =false;
+            boolean containsCurrent = false;
             for (var c : changedCoordinates) {
-                if (n.startsWith(c.replace(":", "/"))){
+                if (n.startsWith(c.replace(":", "/"))) {
                     containsCurrent = true;
+                    break;
                 }
             }
 
@@ -263,7 +243,7 @@ Set<String> getMatchingMetadataDirs(String groupId, String artifactId) {
      * @return path to metadata directory
      */
     @SuppressWarnings("unchecked")
-    Path getMetadataDir(String coordinates) {
+    public Path getMetadataDir(String coordinates) {
         List<String> strings = splitCoordinates(coordinates);
         String groupId = strings.get(0);
         String artifactId = strings.get(1);
@@ -293,7 +273,7 @@ Path getMetadataDir(String coordinates) {
      * @return list of all coordinates that
      */
     @SuppressWarnings("unchecked")
-    List<String> getMatchingCoordinates(String coordinateFilter) {
+    public List<String> getMatchingCoordinates(String coordinateFilter) {
         List<String> strings = splitCoordinates(coordinateFilter);
         String groupId = strings.get(0);
         String artifactId = strings.get(1);
@@ -327,11 +307,10 @@ List<String> getMatchingCoordinates(String coordinateFilter) {
     /**
      * Returns a list of metadata files in a given directory.
      *
-     * @param directory
      * @return list of json files contained in it
      */
     @SuppressWarnings("unchecked")
-    List<String> getMetadataFileList(Path directory) throws IOException {
+    public List<String> getMetadataFileList(Path directory) throws IOException {
         List<String> foundFiles = new ArrayList<>();
         try (Stream<Path> paths = Files.walk(directory)) {
             paths.filter(Files::isRegularFile)
diff --git a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/AbstractSubprojectTask.groovy b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/AbstractSubprojectTask.groovy
index 8940a5ca4..355623216 100644
--- a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/AbstractSubprojectTask.groovy
+++ b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/AbstractSubprojectTask.groovy
@@ -110,7 +110,6 @@ abstract class AbstractSubprojectTask extends DefaultTask {
 
     /**
      * Given project dir returns a tuple that contains a list of inputs.
-     * @param projectDir
      * @return lists of input files
      */
     @Internal
diff --git a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/CleanInvocationTask.groovy b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/CleanInvocationTask.groovy
index 745537207..f8452ea0b 100644
--- a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/CleanInvocationTask.groovy
+++ b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/CleanInvocationTask.groovy
@@ -1,9 +1,17 @@
+/*
+ * Copyright and related rights waived via CC0
+ *
+ * You should have received a copy of the CC0 legalcode along with this
+ * work. If not, see <http://creativecommons.org/publicdomain/zero/1.0/>.
+ */
+
 package org.graalvm.internal.tck.harness.tasks
 
 import org.gradle.api.tasks.Input
 
 import javax.inject.Inject
 
+@SuppressWarnings('unused')
 abstract class CleanInvocationTask extends AbstractSubprojectTask {
 
     @Inject
diff --git a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/JavacInvocationTask.groovy b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/CompileTestJavaInvocationTask.groovy
similarity index 84%
rename from tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/JavacInvocationTask.groovy
rename to tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/CompileTestJavaInvocationTask.groovy
index 63434e2eb..2ca7bc355 100644
--- a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/JavacInvocationTask.groovy
+++ b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/CompileTestJavaInvocationTask.groovy
@@ -14,10 +14,10 @@ import javax.inject.Inject
  * Task that is used to compile subprojects with javac.
  */
 @SuppressWarnings("unused")
-abstract class JavacInvocationTask extends AbstractSubprojectTask {
+abstract class CompileTestJavaInvocationTask extends AbstractSubprojectTask {
 
     @Inject
-    JavacInvocationTask(String coordinates) {
+    CompileTestJavaInvocationTask(String coordinates) {
         super(coordinates)
     }
 
diff --git a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/ComputeAndPullAllowedDockerImagesTask.java b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/ComputeAndPullAllowedDockerImagesTask.java
new file mode 100644
index 000000000..b0318f853
--- /dev/null
+++ b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/ComputeAndPullAllowedDockerImagesTask.java
@@ -0,0 +1,138 @@
+package org.graalvm.internal.tck.harness.tasks;
+
+import org.graalvm.internal.tck.DockerUtils;
+import org.graalvm.internal.tck.harness.TckExtension;
+import org.graalvm.internal.tck.utils.CoordinateUtils;
+import org.gradle.api.DefaultTask;
+import org.gradle.api.GradleException;
+import org.gradle.api.provider.Property;
+import org.gradle.api.tasks.Input;
+import org.gradle.api.tasks.Optional;
+import org.gradle.api.tasks.TaskAction;
+import org.gradle.api.tasks.options.Option;
+import org.gradle.process.ExecOperations;
+import org.jetbrains.annotations.NotNull;
+
+import javax.inject.Inject;
+import java.io.File;
+import java.io.IOException;
+import java.net.URI;
+import java.nio.file.Files;
+import java.util.*;
+
+/**
+ * Single task that:
+ * 1) Computes the union of required docker images across selected coordinates (supports fractional batching k/n)
+ * 2) Validates them against the allowed-docker-images list
+ * 3) Writes them to the provided output file
+ * 4) Immediately pulls those images
+ * </p>
+ * Coordinates can be provided via:
+ * - -Pcoordinates=<filter> (preferred)
+ * - --coordinates=<filter>
+ * The filter can be <code>group:artifact:version</code> or a fractional batch in the form <code>k/n</code> (e.g., 1/16), or 'all'.
+ */
+public abstract class ComputeAndPullAllowedDockerImagesTask extends DefaultTask {
+
+    @Input
+    @Optional
+    public abstract Property<@NotNull String> getCoordinates();
+
+    @Option(option = "coordinates", description = "Coordinate filter (group[:artifact[:version]] or k/n fractional batch)")
+    public void setCoordinatesOption(String value) {
+        getCoordinates().set(value);
+    }
+
+    @Inject
+    protected abstract ExecOperations getExecOperations();
+
+    protected String effectiveCoordinateFilter() {
+        // Prefer task option, fallback to -Pcoordinates, then empty string (all)
+        String opt = getCoordinates().getOrNull();
+        if (opt != null) {
+            return opt;
+        }
+        Object prop = getProject().findProperty("coordinates");
+        return prop == null ? "" : prop.toString();
+    }
+
+    @TaskAction
+    public void run() throws IOException {
+        TckExtension tck = Objects.requireNonNull(getProject().getExtensions().findByType(TckExtension.class));
+
+        // Resolve coordinates
+        String filter = effectiveCoordinateFilter();
+
+        List<String> matching;
+        if (CoordinateUtils.isFractionalBatch(filter)) {
+            int[] frac = CoordinateUtils.parseFraction(filter);
+            assert frac != null : "Already checked";
+            List<String> all = tck.getMatchingCoordinates("all");
+            matching = CoordinateUtils.computeBatchedCoordinates(all, frac[0], frac[1]);
+        } else {
+            matching = tck.getMatchingCoordinates(filter);
+        }
+
+        if (matching == null || matching.isEmpty()) {
+            throw new GradleException("No matching coordinates found. Provide --coordinates=<filter> (preferred) or -Pcoordinates=<filter>, or a fractional batch 'k/n'.");
+        }
+
+        // Collect union of required docker images
+        Set<String> requiredImages = new LinkedHashSet<>();
+        for (String c : matching) {
+            String[] parts = c.split(":");
+            if (parts.length < 3) {
+                throw new GradleException("Invalid coordinates: " + c);
+            }
+            String group = parts[0];
+            String artifact = parts[1];
+            String version = parts[2];
+            File f = getProject().file("tests/src/" + group + "/" + artifact + "/" + version + "/required-docker-images.txt");
+            if (f.exists()) {
+                Files.readAllLines(f.toPath()).stream()
+                        .map(String::trim)
+                        .filter(s -> !s.isEmpty())
+                        .filter(s -> !s.startsWith("#"))
+                        .forEach(requiredImages::add);
+            }
+        }
+
+        // Validate against allowed images
+        validateRequiredImages(requiredImages);
+
+        // Pull images immediately
+        for (String image : requiredImages) {
+            getLogger().lifecycle("Pulling docker image {}", image);
+            try {
+                getExecOperations().exec(spec -> {
+                    spec.setExecutable("docker");
+                    spec.args("pull", image);
+                });
+            } catch (Exception e) {
+                throw new GradleException("Failed to pull image " + image + ": " + e.getMessage(), e);
+            }
+        }
+
+        if (requiredImages.isEmpty()) {
+            getLogger().lifecycle("No required docker images found for coordinates filter '{}'. If your tests use docker, please read: {}", filter,
+                    URI.create("https://github.com/oracle/graalvm-reachability-metadata/blob/master/CONTRIBUTING.md#providing-the-tests-that-use-docker"));
+        }
+    }
+
+    private static void validateRequiredImages(Set<String> requiredImages) {
+        Set<String> allowed = DockerUtils.getAllAllowedImages();
+        List<String> notAllowed = new ArrayList<>();
+        for (String img : requiredImages) {
+            if (!allowed.contains(img)) {
+                notAllowed.add(img);
+            }
+        }
+        if (!notAllowed.isEmpty()) {
+            throw new GradleException("""
+                    The following images are not in the allowed list: %s. \
+                    If you need them, add Dockerfiles under tests/tck-build-logic/src/main/resources/allowed-docker-images \
+                    per docs/CONTRIBUTING.md, or adjust required-docker-images.txt files.
+                    """.formatted(notAllowed));
+        }
+    }
+}
diff --git a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/updaters/FetchExistingLibrariesWithNewerVersionsTask.groovy b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/FetchExistingLibrariesWithNewerVersionsTask.groovy
similarity index 97%
rename from tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/updaters/FetchExistingLibrariesWithNewerVersionsTask.groovy
rename to tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/FetchExistingLibrariesWithNewerVersionsTask.groovy
index c230a5693..4982b9610 100644
--- a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/updaters/FetchExistingLibrariesWithNewerVersionsTask.groovy
+++ b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/FetchExistingLibrariesWithNewerVersionsTask.groovy
@@ -1,4 +1,4 @@
-package org.graalvm.internal.tck.updaters
+package org.graalvm.internal.tck.harness.tasks
 
 
 import com.fasterxml.jackson.annotation.JsonInclude
@@ -9,16 +9,14 @@ import groovy.json.JsonOutput
 import org.graalvm.internal.tck.model.MetadataVersionsIndexEntry
 import org.gradle.api.DefaultTask
 import org.gradle.api.provider.ListProperty
-import org.gradle.api.provider.Property
 import org.gradle.api.tasks.Input
 import org.gradle.api.tasks.TaskAction
-import org.gradle.api.tasks.options.Option
 import org.gradle.util.internal.VersionNumber
 
 import java.util.regex.Matcher
 import java.util.regex.Pattern
 
-
+@SuppressWarnings("unused")
 abstract class FetchExistingLibrariesWithNewerVersionsTask extends DefaultTask {
 
     @Input
diff --git a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/TeeOutputStream.java b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/TeeOutputStream.java
index dd296db7e..ffc6273b6 100644
--- a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/TeeOutputStream.java
+++ b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/TeeOutputStream.java
@@ -7,6 +7,8 @@
 
 package org.graalvm.internal.tck.harness.tasks;
 
+import org.jetbrains.annotations.NotNull;
+
 import java.io.IOException;
 import java.io.OutputStream;
 
@@ -26,13 +28,13 @@ public void write(int b) throws IOException {
     }
 
     @Override
-    public void write(byte[] b) throws IOException {
+    public void write(byte @NotNull [] b) throws IOException {
         out1.write(b);
         out2.write(b);
     }
 
     @Override
-    public void write(byte[] b, int off, int len) throws IOException {
+    public void write(byte @NotNull [] b, int off, int len) throws IOException {
         out1.write(b, off, len);
         out2.write(b, off, len);
     }
diff --git a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/updaters/GroupUnsupportedLibraries.groovy b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/updaters/GroupUnsupportedLibraries.groovy
deleted file mode 100644
index edf3874f7..000000000
--- a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/updaters/GroupUnsupportedLibraries.groovy
+++ /dev/null
@@ -1,53 +0,0 @@
-package org.graalvm.internal.tck.updaters
-
-import org.gradle.api.DefaultTask
-import org.gradle.api.provider.Property
-import org.gradle.api.tasks.Input
-import org.gradle.api.tasks.TaskAction
-import org.gradle.api.tasks.options.Option
-import org.gradle.util.internal.VersionNumber
-
-abstract class GroupUnsupportedLibraries extends DefaultTask {
-
-    @Input
-    @Option(option = "libraries", description = "Provides list of libraries that should be grouped.")
-    abstract Property<String> getLibraries()
-
-    @TaskAction
-    void action() {
-        def libraries = getLibraries().get().split("\n")
-
-        Map<String, List<String>> libraryGroups = new HashMap<String, List<String>>()
-        for (def library : libraries) {
-            def coordinatesPart = library.split("_")
-            def artifactKey = coordinatesPart[0] + ":" + coordinatesPart[1]
-            def version = coordinatesPart[2]
-
-            if (libraryGroups.get(artifactKey) == null) {
-                libraryGroups.put(artifactKey, new ArrayList<String>())
-            }
-
-            libraryGroups.get(artifactKey).add(version)
-            libraryGroups.get(artifactKey).sort(Comparator.comparing(VersionNumber::parse))
-        }
-
-        print generateGroupedComment(libraryGroups)
-    }
-
-    private static String generateGroupedComment(Map<String, List<String>> groups) {
-        def sb = new StringBuilder("List of all unsupported libraries:\n")
-
-        for (String library : groups.keySet()) {
-            sb.append("- ").append(library).append(":\n")
-
-            for (String version : groups.get(library)) {
-                sb.append("\t").append("- ").append(version).append("\n")
-            }
-
-            sb.append("\n")
-        }
-
-        return sb.toString()
-    }
-
-}
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/ContributionTask.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/ContributionTask.java
index c0b76b306..dbb687b1a 100644
--- a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/ContributionTask.java
+++ b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/ContributionTask.java
@@ -10,6 +10,7 @@
 import org.graalvm.internal.tck.model.MetadataIndexEntry;
 import org.graalvm.internal.tck.model.contributing.Question;
 import org.graalvm.internal.tck.utils.ConfigurationStringBuilder;
+import org.graalvm.internal.tck.utils.CoordinateUtils;
 import org.graalvm.internal.tck.utils.FilesUtils;
 import org.graalvm.internal.tck.utils.InteractiveTaskUtils;
 import org.gradle.api.DefaultTask;
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/CoordinateUtils.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/CoordinateUtils.java
deleted file mode 100644
index e71173e06..000000000
--- a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/CoordinateUtils.java
+++ /dev/null
@@ -1,27 +0,0 @@
-package org.graalvm.internal.tck;
-
-
-public abstract class CoordinateUtils {
-    public static String replace(String template, Coordinates coordinates) {
-        return template
-                .replace("$group$", coordinates.group())
-                .replace("$sanitizedGroup$", coordinates.sanitizedGroup())
-                .replace("$artifact$", coordinates.artifact())
-                .replace("$sanitizedArtifact$", coordinates.sanitizedArtifact())
-                .replace("$capitalizedSanitizedArtifact$", coordinates.capitalizedSanitizedArtifact())
-                .replace("$version$", coordinates.version());
-    }
-
-    public static Coordinates fromString(String coordinates) throws IllegalArgumentException {
-        String[] coordinatesParts = coordinates.split(":");
-        if (coordinatesParts.length != 3) {
-            throw new IllegalArgumentException("Maven coordinates not provided in the correct format.");
-        }
-
-        String group = coordinatesParts[0];
-        String artifact = coordinatesParts[1];
-        String version = coordinatesParts[2];
-        return new Coordinates(group, artifact, version);
-    }
-
-}
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/Coordinates.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/Coordinates.java
index 83e90604b..e14a421ee 100644
--- a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/Coordinates.java
+++ b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/Coordinates.java
@@ -1,16 +1,18 @@
 package org.graalvm.internal.tck;
 
+import org.jetbrains.annotations.NotNull;
+
 import java.util.Set;
 
 /**
  * Dependency coordinates in the form 'group:artifact:version'.
  */
-record Coordinates(String group, String artifact, String version) {
+public record Coordinates(String group, String artifact, String version) {
     private static final Set<Character> FORBIDDEN_CHARS = Set.of(
             ':', '-', '.'
     );
 
-    Coordinates {
+    public Coordinates {
         if (group == null || group.isEmpty()) {
             throw new IllegalArgumentException("group must not be empty");
         }
@@ -22,15 +24,15 @@ record Coordinates(String group, String artifact, String version) {
         }
     }
 
-    String sanitizedGroup() {
+    public String sanitizedGroup() {
         return sanitize(group);
     }
 
-    String sanitizedArtifact() {
+    public String sanitizedArtifact() {
         return sanitize(artifact);
     }
 
-    String capitalizedSanitizedArtifact() {
+    public String capitalizedSanitizedArtifact() {
         String sanitizedArtifact = sanitizedArtifact();
         if (sanitizedArtifact.isEmpty()) {
             return sanitizedArtifact;
@@ -39,7 +41,7 @@ String capitalizedSanitizedArtifact() {
     }
 
     @Override
-    public String toString() {
+    public @NotNull String toString() {
         return group + ":" + artifact + ":" + version;
     }
 
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/DockerTask.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/DockerTask.java
index b7321bd4f..ad07c5db9 100644
--- a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/DockerTask.java
+++ b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/DockerTask.java
@@ -1,5 +1,6 @@
 package org.graalvm.internal.tck;
 
+import org.graalvm.internal.tck.utils.CoordinateUtils;
 import org.gradle.api.DefaultTask;
 import org.gradle.api.file.RegularFileProperty;
 import org.gradle.api.tasks.InputFiles;
@@ -20,6 +21,7 @@
 
 import static org.graalvm.internal.tck.DockerUtils.getAllAllowedImages;
 
+@SuppressWarnings("unused")
 public abstract class DockerTask extends DefaultTask {
 
     @InputFiles
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/GrypeTask.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/GrypeTask.java
index 3d53fd987..8a6ffab66 100644
--- a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/GrypeTask.java
+++ b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/GrypeTask.java
@@ -21,7 +21,7 @@
 import java.util.*;
 import java.util.stream.Collectors;
 
-
+@SuppressWarnings("unused")
 public abstract class GrypeTask extends DefaultTask {
 
     @Inject
@@ -181,13 +181,13 @@ private Vulnerabilities getVulnerabilities(String image) throws IOException {
      * Get all docker images introduced between two commits
      */
     private Set<String> getChangedImages() throws IOException, URISyntaxException {
-        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
         getExecOperations().exec(spec -> {
-            spec.setStandardOutput(baos);
+            spec.setStandardOutput(outputStream);
             spec.commandLine("git", "diff", "--name-only", "--diff-filter=ACMRT", baseCommit, newCommit);
         });
 
-        String output = baos.toString(StandardCharsets.UTF_8);
+        String output = outputStream.toString(StandardCharsets.UTF_8);
         List<URL> diffFiles = Arrays.stream(output.split("\\r?\\n"))
                 .filter(path -> path.contains(DOCKERFILE_DIRECTORY))
                 .map(path -> path.substring(path.lastIndexOf("/") + 1))
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/ConfigFilesChecker.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/MetadataFilesCheckerTask.java
similarity index 92%
rename from tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/ConfigFilesChecker.java
rename to tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/MetadataFilesCheckerTask.java
index b68e4e1ec..db2302d4e 100644
--- a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/ConfigFilesChecker.java
+++ b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/MetadataFilesCheckerTask.java
@@ -1,30 +1,25 @@
 package org.graalvm.internal.tck;
 
 import groovy.json.JsonSlurper;
+import org.graalvm.internal.tck.utils.CoordinateUtils;
 import org.gradle.api.DefaultTask;
 import org.gradle.api.file.RegularFileProperty;
 import org.gradle.api.tasks.InputFiles;
 import org.gradle.api.tasks.TaskAction;
 import org.gradle.api.tasks.options.Option;
 
-import java.util.Scanner;
 import java.io.File;
 import java.io.FileNotFoundException;
-import java.util.Arrays;
-import java.util.List;
-import java.util.ArrayList;
-import java.util.Map;
-import java.util.HashMap;
-import java.util.Set;
-import java.util.HashSet;
+import java.util.*;
 import java.util.stream.Collectors;
 
 /**
  * Checks content of config files for a new library.
  * <p>
- * Run with {@code gradle checkConfigFiles --coordinates com.example:library:1.0.0}.
+ * Run with {@code gradle checkMetadataFiles -Pcoordinates com.example:library:1.0.0}.
  */
-public abstract class ConfigFilesChecker extends DefaultTask {
+@SuppressWarnings("unused")
+public abstract class MetadataFilesCheckerTask extends DefaultTask {
 
     @InputFiles
     protected abstract RegularFileProperty getMetadataRoot();
@@ -32,12 +27,17 @@ public abstract class ConfigFilesChecker extends DefaultTask {
     @InputFiles
     protected abstract RegularFileProperty getIndexFile();
 
-    private final Set<String> EXPECTED_FILES = new HashSet<>(Arrays.asList("index.json", "reflect-config.json", "resource-config.json", "serialization-config.json",
-            "jni-config.json", "proxy-config.json", "predefined-classes-config.json"));
+    private final Set<String> EXPECTED_FILES = new HashSet<>(List.of(
+            "index.json",
+            "reflect-config.json",
+            "resource-config.json",
+            "serialization-config.json",
+            "jni-config.json",
+            "proxy-config.json"));
 
     private final Set<String> ILLEGAL_TYPE_VALUES = new HashSet<>(List.of("java.lang"));
 
-    private final Set<String> PREDEFINED_ALLOWED_PACKAGES = new HashSet<>(Arrays.asList("java.lang", "java.util"));
+    private final Set<String> PREDEFINED_ALLOWED_PACKAGES = new HashSet<>(List.of("java.lang", "java.util"));
 
     Coordinates coordinates;
     List<String> allowedPackages;
@@ -98,7 +98,7 @@ void run() throws IllegalArgumentException, FileNotFoundException {
 
     private List<File> getConfigFilesForMetadataDir(File root) throws RuntimeException {
         List<File> files = new ArrayList<>();
-        File [] content = root.listFiles();
+        File[] content = root.listFiles();
 
         if (content == null) {
             throw new RuntimeException("ERROR: Failed to load content of " + root.toURI());
@@ -121,7 +121,7 @@ private List<Map<String, Object>> getConfigEntries(File file) {
         return ((List<Object>) new JsonSlurper()
                 .parse(file))
                 .stream()
-                .map(e -> (Map<String, Object>)e)
+                .map(e -> (Map<String, Object>) e)
                 .collect(Collectors.toList());
     }
 
@@ -134,7 +134,7 @@ private Map<String, Object> getConfigEntry(File file) {
     private boolean reflectConfigFileContainsErrors(File file) {
         List<Map<String, Object>> entries = getConfigEntries(file);
 
-        if (entries.size() == 0) {
+        if (entries.isEmpty()) {
             System.out.println("ERROR: empty reflect-config detected: " + file.toURI());
             return true;
         }
@@ -159,7 +159,7 @@ private boolean resourceConfigFileContainsErrors(File file) {
             List<Map<String, Object>> includes = (List<Map<String, Object>>) resources.get("includes");
             List<Map<String, Object>> excludes = (List<Map<String, Object>>) resources.get("excludes");
 
-            if (listNullOrEmpty(includes) && listNullOrEmpty(excludes) && listNullOrEmpty(bundles)){
+            if (listNullOrEmpty(includes) && listNullOrEmpty(excludes) && listNullOrEmpty(bundles)) {
                 System.out.println("ERROR: empty resource-config detected: " + file.toURI());
                 return true;
             }
@@ -189,7 +189,7 @@ private boolean resourceConfigFileContainsErrors(File file) {
 
     private boolean checkOldSerializationConfig(File file) {
         List<Map<String, Object>> entries = getConfigEntries(file);
-        
+
         if (entries.isEmpty()) {
             System.out.println("ERROR: empty serialization-config detected: " + file.toURI());
             return true;
@@ -248,7 +248,7 @@ private boolean serializationConfigFileContainsErrors(File file) throws FileNotF
     private boolean proxyConfigFileContainsErrors(File file) {
         List<Map<String, Object>> entries = getConfigEntries(file);
 
-        if (entries.size() == 0) {
+        if (entries.isEmpty()) {
             System.out.println("ERROR: empty proxy-config detected: " + file.toURI());
             return true;
         }
@@ -265,7 +265,7 @@ private boolean proxyConfigFileContainsErrors(File file) {
     private boolean jniConfigFileContainsErrors(File file) {
         List<Map<String, Object>> entries = getConfigEntries(file);
 
-        if (entries.size() == 0) {
+        if (entries.isEmpty()) {
             System.out.println("ERROR: empty jni-config detected: " + file.toURI());
             return true;
         }
@@ -300,7 +300,6 @@ private boolean containsDuplicatedEntries(List<Map<String, Object>> entries, Fil
         return containsDuplicates;
     }
 
-    @SuppressWarnings("unchecked")
     private boolean checkTypeReachable(Map<String, Object> entry, File file) {
         String typeReachable = getEntryTypeReachable(entry);
         String entryName = getEntryName(entry);
@@ -366,15 +365,15 @@ private String getEntryTypeReachable(Map<String, Object> entry) {
             return null;
         }
 
-        return  (String) condition.get("typeReachable");
+        return (String) condition.get("typeReachable");
     }
 
     private String getEntryName(Map<String, Object> entry) {
-        return  (String) entry.get("name");
+        return (String) entry.get("name");
     }
 
-    private boolean listNullOrEmpty(List list) {
-        return list == null || list.size() == 0;
+    private boolean listNullOrEmpty(List<?> list) {
+        return list == null || list.isEmpty();
     }
 
     @SuppressWarnings("unchecked")
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/ScaffoldTask.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/ScaffoldTask.java
index 7eba4e8f8..3014e2482 100644
--- a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/ScaffoldTask.java
+++ b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/ScaffoldTask.java
@@ -7,6 +7,7 @@
 import org.graalvm.internal.tck.model.MetadataIndexEntry;
 import org.graalvm.internal.tck.model.MetadataVersionsIndexEntry;
 import org.graalvm.internal.tck.model.TestIndexEntry;
+import org.graalvm.internal.tck.utils.CoordinateUtils;
 import org.gradle.api.DefaultTask;
 import org.gradle.api.logging.LogLevel;
 import org.gradle.api.tasks.Input;
@@ -30,6 +31,7 @@
  *
  * @author Moritz Halbritter
  */
+@SuppressWarnings("unused")
 class ScaffoldTask extends DefaultTask {
     private final ObjectMapper objectMapper = new ObjectMapper()
             .enable(SerializationFeature.INDENT_OUTPUT)
@@ -333,5 +335,3 @@ private void writeToFile(Path path, String content) throws IOException {
         Files.writeString(path, content, StandardCharsets.UTF_8);
     }
 }
-
-
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/TestedVersionUpdaterTask.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/TestedVersionUpdaterTask.java
index 1ec9a7346..5100d6b17 100644
--- a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/TestedVersionUpdaterTask.java
+++ b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/TestedVersionUpdaterTask.java
@@ -8,6 +8,7 @@
 import com.fasterxml.jackson.databind.SerializationFeature;
 import org.graalvm.internal.tck.model.MetadataVersionsIndexEntry;
 
+import org.graalvm.internal.tck.utils.CoordinateUtils;
 import org.gradle.api.DefaultTask;
 import org.gradle.api.file.RegularFileProperty;
 import org.gradle.api.provider.Property;
@@ -16,6 +17,7 @@
 import org.gradle.api.tasks.TaskAction;
 import org.gradle.api.tasks.options.Option;
 import org.gradle.util.internal.VersionNumber;
+import org.jetbrains.annotations.NotNull;
 
 import java.io.File;
 import java.io.IOException;
@@ -23,6 +25,7 @@
 import java.util.Comparator;
 import java.util.List;
 
+@SuppressWarnings("unused")
 public abstract class TestedVersionUpdaterTask extends DefaultTask {
 
     @Option(option = "coordinates", description = "GAV coordinates of the library")
@@ -42,10 +45,10 @@ void extractInformationFromCoordinates(String c) {
 
     @Input
     @Option(option = "lastSupportedVersion", description = "Last version of the library that passed tests")
-    protected abstract Property<String> getLastSupportedVersion();
+    protected abstract Property<@NotNull String> getLastSupportedVersion();
 
     @Input
-    protected abstract Property<String> getNewVersion();
+    protected abstract Property<@NotNull String> getNewVersion();
 
     @OutputFiles
     protected abstract RegularFileProperty getIndexFile();
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/utils/CoordinateUtils.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/utils/CoordinateUtils.java
new file mode 100644
index 000000000..fc1c49368
--- /dev/null
+++ b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/utils/CoordinateUtils.java
@@ -0,0 +1,95 @@
+package org.graalvm.internal.tck.utils;
+
+import org.graalvm.internal.tck.Coordinates;
+import org.gradle.api.GradleException;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+public abstract class CoordinateUtils {
+    public static String replace(String template, Coordinates coordinates) {
+        return template
+                .replace("$group$", coordinates.group())
+                .replace("$sanitizedGroup$", coordinates.sanitizedGroup())
+                .replace("$artifact$", coordinates.artifact())
+                .replace("$sanitizedArtifact$", coordinates.sanitizedArtifact())
+                .replace("$capitalizedSanitizedArtifact$", coordinates.capitalizedSanitizedArtifact())
+                .replace("$version$", coordinates.version());
+    }
+
+    public static Coordinates fromString(String coordinates) throws IllegalArgumentException {
+        String[] coordinatesParts = coordinates.split(":");
+        if (coordinatesParts.length != 3) {
+            throw new IllegalArgumentException("Maven coordinates not provided in the correct format.");
+        }
+
+        String group = coordinatesParts[0];
+        String artifact = coordinatesParts[1];
+        String version = coordinatesParts[2];
+        return new Coordinates(group, artifact, version);
+    }
+
+    // Fractional batching utilities moved from CoordinateUtils
+
+    private static final Pattern FRACTIONAL = Pattern.compile("(\\d+)/(\\d+)");
+
+    /**
+     * Returns true if the provided string matches the fractional batch form "k/n".
+     */
+    public static boolean isFractionalBatch(String s) {
+        if (s == null) return false;
+        return FRACTIONAL.matcher(s).matches();
+    }
+
+    /**
+     * Parses a fractional batch "k/n" into an int[]{k, n}.
+     * Returns null if the string does not match the pattern.
+     * Throws GradleException on invalid values.
+     */
+    public static int[] parseFraction(String s) {
+        Matcher m = FRACTIONAL.matcher(s);
+        if (!m.matches()) {
+            return null;
+        }
+        int k = Integer.parseInt(m.group(1));
+        int n = Integer.parseInt(m.group(2));
+        if (k <= 0) {
+            throw new GradleException("Cannot have a batch number less than 1");
+        }
+        if (n <= 0) {
+            throw new GradleException("Cannot have a batch size less than 1");
+        }
+        if (k > n) {
+            throw new GradleException("Cannot have a batch number larger than the batch size");
+        }
+        return new int[]{k, n};
+    }
+
+    /**
+     * Given a list of coordinates, returns the k-th batch (1-based) out of n batches,
+     * by sorting and selecting every n-th element starting from index (k-1).
+     */
+    public static List<String> computeBatchedCoordinates(List<String> coordinates, int index, int batches) {
+        if (batches <= 0) {
+            throw new GradleException("Invalid batches denominator: " + batches);
+        }
+        if (index < 1 || index > batches) {
+            throw new GradleException("Invalid batch index: " + index + "/" + batches);
+        }
+        List<String> sorted = new ArrayList<>(coordinates);
+        Collections.sort(sorted);
+        int target = (index - 1);
+        List<String> result = new ArrayList<>();
+        int i = 0;
+        for (String c : sorted) {
+            if ((i % batches) == target) {
+                result.add(c);
+            }
+            i++;
+        }
+        return result;
+    }
+}