diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..411f3c4
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,4 @@
+# Default reviewers for all files
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+* @dlaw4608 @ekuris-redhat @eshulman2 @gryf @imatza-rh @mandre @stephenfin @tusharjadhav3302 @winiciusallan
diff --git a/.github/workflows/ansible-lint.yml b/.github/workflows/ansible-lint.yml
new file mode 100644
index 0000000..868ab4f
--- /dev/null
+++ b/.github/workflows/ansible-lint.yml
@@ -0,0 +1,25 @@
+---
+name: Ansible Lint
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  ansible-lint:
+    runs-on: ubuntu-latest
+    container:
+      image: quay.io/shiftstack-qe/shiftstack-client
+      options: --user root
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Ansible collections
+        run: ansible-galaxy collection install -r requirements.yaml
+
+      - name: Run ansible-lint
+        run: ansible-lint --strict
+        env:
+          ANSIBLE_VAULT_PASSWORD_FILE: /home/cloud-admin/.vault-pass
diff --git a/OWNERS b/OWNERS
new file mode 100644
index 0000000..3dd3091
--- /dev/null
+++ b/OWNERS
@@ -0,0 +1,8 @@
+# See the OWNERS docs: https://git.k8s.io/community/contributors/guide/owners.md
+# This file just uses aliases defined in OWNERS_ALIASES.
+
+approvers:
+  - shiftstack-approvers
+
+reviewers:
+  - shiftstack-reviewers
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
new file mode 100644
index 0000000..b340475
--- /dev/null
+++ b/OWNERS_ALIASES
@@ -0,0 +1,23 @@
+# See the OWNERS_ALIASES docs: https://git.k8s.io/community/contributors/guide/owners.md#OWNERS_ALIASES
+
+aliases:
+  shiftstack-approvers:
+    - dlaw4608
+    - ekuris-redhat
+    - eshulman2
+    - gryf
+    - imatza-rh
+    - mandre
+    - stephenfin
+    - tusharjadhav3302
+    - winiciusallan
+  shiftstack-reviewers:
+    - dlaw4608
+    - ekuris-redhat
+    - eshulman2
+    - gryf
+    - imatza-rh
+    - mandre
+    - stephenfin
+    - tusharjadhav3302
+    - winiciusallan
diff --git a/collection/tools/roles/tools_get_openshift_release/tasks/get_openshift_release_binaries.yml b/collection/tools/roles/tools_get_openshift_release/tasks/get_openshift_release_binaries.yml
index a53995a..fdafb0c 100644
--- a/collection/tools/roles/tools_get_openshift_release/tasks/get_openshift_release_binaries.yml
+++ b/collection/tools/roles/tools_get_openshift_release/tasks/get_openshift_release_binaries.yml
@@ -27,6 +27,7 @@
       when: openshift_release_pull_spec is not defined or openshift_release_pull_spec == ''
 
     - name: Extract pull secret from host cluster via Kubernetes API
+      changed_when: true
       ansible.builtin.shell: |
         python3 << 'PYEOF'
         import yaml, json, base64, subprocess, os, sys, tempfile
@@ -127,6 +128,7 @@
         mode: u=rwx,g=rw,o=r
 
     - name: Extract OCP tools from release image {{ openshift_release_pull_spec }}
+      changed_when: true
       ansible.builtin.command:
         cmd: >-
           timeout 900