diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index dc4b92ba..f01cdf4c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,8 +15,37 @@ env:
   DOCKERHUB_SLUG: distribution/distribution
 
 jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        go:
+          - 1.17
+          - 1.18
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v3
+      -
+        name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.go }}
+      -
+        name: Test
+        run: |
+          make coverage
+      -
+        name: Codecov
+        uses: codecov/codecov-action@v3
+        with:
+          directory: ./
+
   build:
     runs-on: ubuntu-latest
+    needs:
+      - test
     steps:
       -
         name: Checkout
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index a36a7738..00000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: CI
-
-
-on:
-  push:
-    branches:
-    - main
-  pull_request:
-    branches:
-    - main
-
-jobs:
-
-  build:
-    strategy:
-      matrix:
-        go-version: ["1.17.x", "1.18.x"]
-        platform: ["ubuntu-latest"]
-    runs-on: ${{ matrix.platform }}
-    env:
-      DOCKER_BUILDTAGS: "include_oss include_gcs"
-      CGO_ENABLED: 1
-      GO111MODULE: "auto"
-      GOPATH: ${{ github.workspace }}
-      GOOS: linux
-      COMMIT_RANGE: ${{ github.event_name == 'pull_request' && format('{0}..{1}',github.event.pull_request.base.sha, github.event.pull_request.head.sha) || format('{0}..{1}', github.event.before, github.event.after) }}
-
-    steps:
-    - uses: actions/checkout@v2
-      with:
-        path: src/github.com/distribution/distribution
-        fetch-depth: 50
-
-    - name: Set up Go
-      uses: actions/setup-go@v2
-      with:
-        go-version: ${{ matrix.go-version }}
-
-    - name: Dependencies
-      run: |
-          sudo apt-get -q update
-          sudo -E apt-get -yq --no-install-suggests --no-install-recommends install python2-minimal
-          cd /tmp && go install github.com/vbatts/git-validation@latest
-
-    - name: Build
-      working-directory: ./src/github.com/distribution/distribution
-      run: |
-        DCO_VERBOSITY=-q script/validate/dco
-        go build -i .
-        make build
-        make binaries
-        if [ "$GOOS" = "linux" ]; then make coverage ; fi
-
-    - uses: codecov/codecov-action@v1
-      with:
-        directory: ./src/github.com/distribution/distribution
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 9a5b4dec..73e953af 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -8,8 +8,6 @@ on:
     tags:
       - 'v*'
   pull_request:
-    branches:
-      - '*'
 
 jobs:
   validate:
@@ -20,11 +18,14 @@ jobs:
         target:
           - lint
           - validate-vendor
+          - validate-git
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       -
         name: Run
         run: |
           make ${{ matrix.target }}
+        env:
+          COMMIT_RANGE: ${{ format('{0}..{1}', github.sha, 'HEAD') }}
diff --git a/Dockerfile b/Dockerfile
index 276b68f4..d99d8288 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,11 @@
 # syntax=docker/dockerfile:1
 
 ARG GO_VERSION=1.18
+ARG ALPINE_VERSION=3.16
 ARG XX_VERSION=1.1.1
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS base
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS base
 COPY --from=xx / /
 RUN apk add --no-cache bash coreutils file git
 ENV GO111MODULE=auto
@@ -23,11 +24,11 @@ ARG TARGETPLATFORM
 ARG LDFLAGS="-s -w"
 ARG BUILDTAGS="include_oss include_gcs"
 RUN --mount=type=bind,target=/src,rw \
-  --mount=type=cache,target=/root/.cache/go-build \
-  --mount=target=/go/pkg/mod,type=cache \
-  --mount=type=bind,source=/tmp/.ldflags,target=/tmp/.ldflags,from=version \
-  set -x ; xx-go build -trimpath -ldflags "$(cat /tmp/.ldflags) ${LDFLAGS}" -o /usr/bin/registry ./cmd/registry \
-  && xx-verify --static /usr/bin/registry
+    --mount=type=cache,target=/root/.cache/go-build \
+    --mount=target=/go/pkg/mod,type=cache \
+    --mount=type=bind,source=/tmp/.ldflags,target=/tmp/.ldflags,from=version \
+      set -x ; xx-go build -trimpath -ldflags "$(cat /tmp/.ldflags) ${LDFLAGS}" -o /usr/bin/registry ./cmd/registry \
+      && xx-verify --static /usr/bin/registry
 
 FROM scratch AS binary
 COPY --from=build /usr/bin/registry /
@@ -38,18 +39,18 @@ ARG TARGETARCH
 ARG TARGETVARIANT
 WORKDIR /work
 RUN --mount=from=binary,target=/build \
-  --mount=type=bind,target=/src \
-  --mount=type=bind,source=/tmp/.version,target=/tmp/.version,from=version \
-  VERSION=$(cat /tmp/.version) \
-  && mkdir -p /out \
-  && cp /build/registry /src/README.md /src/LICENSE . \
-  && tar -czvf "/out/registry_${VERSION#v}_${TARGETOS}_${TARGETARCH}${TARGETVARIANT}.tar.tgz" * \
-  && sha256sum -z "/out/registry_${VERSION#v}_${TARGETOS}_${TARGETARCH}${TARGETVARIANT}.tar.tgz" | awk '{ print $1 }' > "/out/registry_${VERSION#v}_${TARGETOS}_${TARGETARCH}${TARGETVARIANT}.tar.tgz.sha256"
+    --mount=type=bind,target=/src \
+    --mount=type=bind,source=/tmp/.version,target=/tmp/.version,from=version \
+      VERSION=$(cat /tmp/.version) \
+      && mkdir -p /out \
+      && cp /build/registry /src/README.md /src/LICENSE . \
+      && tar -czvf "/out/registry_${VERSION#v}_${TARGETOS}_${TARGETARCH}${TARGETVARIANT}.tar.tgz" * \
+      && sha256sum -z "/out/registry_${VERSION#v}_${TARGETOS}_${TARGETARCH}${TARGETVARIANT}.tar.tgz" | awk '{ print $1 }' > "/out/registry_${VERSION#v}_${TARGETOS}_${TARGETARCH}${TARGETVARIANT}.tar.tgz.sha256"
 
 FROM scratch AS artifact
 COPY --from=releaser /out /
 
-FROM alpine:3.16
+FROM alpine:${ALPINE_VERSION}
 RUN apk add --no-cache ca-certificates
 COPY cmd/registry/config-dev.yml /etc/docker/registry/config.yml
 COPY --from=binary /registry /bin/registry
diff --git a/Makefile b/Makefile
index 2f58f44f..42db005e 100644
--- a/Makefile
+++ b/Makefile
@@ -38,7 +38,7 @@ BINARIES=$(addprefix bin/,$(COMMANDS))
 TESTFLAGS ?= -v $(TESTFLAGS_RACE)
 TESTFLAGS_PARALLEL ?= 8
 
-.PHONY: all build binaries clean test test-race test-full integration coverage validate lint validate-vendor vendor mod-outdated
+.PHONY: all build binaries clean test test-race test-full integration coverage validate lint validate-git validate-vendor vendor mod-outdated
 .DEFAULT: all
 
 all: binaries
@@ -103,6 +103,9 @@ validate: ## run all validators
 lint: ## run all linters
 	docker buildx bake $@
 
+validate-git: ## validate git
+	docker buildx bake $@
+
 validate-vendor: ## validate vendor
 	docker buildx bake $@
 
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 4b776fcc..db9fa1f5 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -3,7 +3,7 @@ group "default" {
 }
 
 group "validate" {
-  targets = ["lint", "validate-vendor"]
+  targets = ["lint", "validate-git", "validate-vendor"]
 }
 
 target "lint" {
@@ -11,6 +11,19 @@ target "lint" {
   output = ["type=cacheonly"]
 }
 
+variable "COMMIT_RANGE" {
+  default = ""
+}
+target "validate-git" {
+  dockerfile = "./dockerfiles/git.Dockerfile"
+  target = "validate"
+  args = {
+    COMMIT_RANGE = COMMIT_RANGE
+    BUILDKIT_CONTEXT_KEEP_GIT_DIR = 1
+  }
+  output = ["type=cacheonly"]
+}
+
 target "validate-vendor" {
   dockerfile = "./dockerfiles/vendor.Dockerfile"
   target = "validate"
diff --git a/dockerfiles/git.Dockerfile b/dockerfiles/git.Dockerfile
new file mode 100644
index 00000000..38effe42
--- /dev/null
+++ b/dockerfiles/git.Dockerfile
@@ -0,0 +1,23 @@
+# syntax=docker/dockerfile:1
+
+ARG GO_VERSION=1.18
+ARG ALPINE_VERSION=3.16
+
+FROM alpine:${ALPINE_VERSION} AS base
+RUN apk add --no-cache git gpg
+
+FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS gitvalidation
+ARG GIT_VALIDATION_VERSION=v1.1.0
+RUN --mount=type=cache,target=/root/.cache \
+    --mount=type=cache,target=/go/pkg/mod \
+      GOBIN=/out go install "github.com/vbatts/git-validation@${GIT_VALIDATION_VERSION}"
+
+FROM base AS validate
+ARG COMMIT_RANGE
+RUN if [ -z "$COMMIT_RANGE" ]; then echo "COMMIT_RANGE required" && exit 1; fi
+ENV GIT_CHECK_EXCLUDE="./vendor"
+WORKDIR /src
+RUN --mount=type=bind,target=. \
+    --mount=type=cache,target=/root/.cache \
+    --mount=from=gitvalidation,source=/out/git-validation,target=/usr/bin/git-validation \
+      git-validation -q -range "${COMMIT_RANGE}" -run short-subject,dangling-whitespace
diff --git a/dockerfiles/lint.Dockerfile b/dockerfiles/lint.Dockerfile
index 2f24d0d0..113db75a 100644
--- a/dockerfiles/lint.Dockerfile
+++ b/dockerfiles/lint.Dockerfile
@@ -1,17 +1,18 @@
 # syntax=docker/dockerfile:1
 
 ARG GO_VERSION=1.18
+ARG ALPINE_VERSION=3.16
 ARG GOLANGCI_LINT_VERSION=v1.45
 
 FROM golangci/golangci-lint:${GOLANGCI_LINT_VERSION}-alpine AS golangci-lint
 
-FROM golang:${GO_VERSION}-alpine AS base
+FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS base
 RUN apk add --no-cache gcc musl-dev
 WORKDIR /src
 
 FROM base
 ENV GOFLAGS="-buildvcs=false"
 RUN --mount=type=bind,target=. \
-  --mount=type=cache,target=/root/.cache \
-  --mount=from=golangci-lint,source=/usr/bin/golangci-lint,target=/usr/bin/golangci-lint \
-  golangci-lint run
+    --mount=type=cache,target=/root/.cache \
+    --mount=from=golangci-lint,source=/usr/bin/golangci-lint,target=/usr/bin/golangci-lint \
+      golangci-lint run
diff --git a/dockerfiles/vendor.Dockerfile b/dockerfiles/vendor.Dockerfile
index 339b0e33..b56e5ee9 100644
--- a/dockerfiles/vendor.Dockerfile
+++ b/dockerfiles/vendor.Dockerfile
@@ -1,22 +1,23 @@
 # syntax=docker/dockerfile:1
 
 ARG GO_VERSION=1.18
+ARG ALPINE_VERSION=3.16
 ARG MODOUTDATED_VERSION=v0.8.0
 
-FROM golang:${GO_VERSION}-alpine AS base
+FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS base
 RUN apk add --no-cache git rsync
 WORKDIR /src
 
 FROM base AS vendored
 RUN --mount=target=/context \
-  --mount=target=.,type=tmpfs  \
-  --mount=target=/go/pkg/mod,type=cache <<EOT
-set -e
-rsync -a /context/. .
-go mod tidy
-go mod vendor
-mkdir /out
-cp -r go.mod go.sum vendor /out
+    --mount=target=.,type=tmpfs  \
+    --mount=target=/go/pkg/mod,type=cache <<EOT
+  set -e
+  rsync -a /context/. .
+  go mod tidy
+  go mod vendor
+  mkdir /out
+  cp -r go.mod go.sum vendor /out
 EOT
 
 FROM scratch AS update
@@ -24,23 +25,23 @@ COPY --from=vendored /out /out
 
 FROM vendored AS validate
 RUN --mount=target=/context \
-  --mount=target=.,type=tmpfs <<EOT
-set -e
-rsync -a /context/. .
-git add -A
-rm -rf vendor
-cp -rf /out/* .
-if [ -n "$(git status --porcelain -- go.mod go.sum vendor)" ]; then
-  echo >&2 'ERROR: Vendor result differs. Please vendor your package with "make vendor"'
-  git status --porcelain -- go.mod go.sum vendor
-  exit 1
-fi
+    --mount=target=.,type=tmpfs <<EOT
+  set -e
+  rsync -a /context/. .
+  git add -A
+  rm -rf vendor
+  cp -rf /out/* .
+  if [ -n "$(git status --porcelain -- go.mod go.sum vendor)" ]; then
+    echo >&2 'ERROR: Vendor result differs. Please vendor your package with "make vendor"'
+    git status --porcelain -- go.mod go.sum vendor
+    exit 1
+  fi
 EOT
 
 FROM psampaz/go-mod-outdated:${MODOUTDATED_VERSION} AS go-mod-outdated
 FROM base AS outdated
 ARG _RANDOM
 RUN --mount=target=.,ro \
-  --mount=target=/go/pkg/mod,type=cache \
-  --mount=from=go-mod-outdated,source=/home/go-mod-outdated,target=/usr/bin/go-mod-outdated \
-  go list -mod=readonly -u -m -json all | go-mod-outdated -update -direct
+    --mount=target=/go/pkg/mod,type=cache \
+    --mount=from=go-mod-outdated,source=/home/go-mod-outdated,target=/usr/bin/go-mod-outdated \
+      go list -mod=readonly -u -m -json all | go-mod-outdated -update -direct
diff --git a/script/validate/dco b/script/validate/dco
deleted file mode 100755
index 401f3642..00000000
--- a/script/validate/dco
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-
-set -eu -o pipefail
-
-if ! command -v git-validation; then
-    >&2 echo "ERROR: git-validation not found. Install with:"
-    >&2 echo "    go install github.com/vbatts/git-validation@latest"
-    exit 1
-fi
-
-verbosity="${DCO_VERBOSITY--v}"
-GIT_CHECK_EXCLUDE="./vendor:./script/validate/template" git-validation "$verbosity" -range "$COMMIT_RANGE" -run DCO,short-subject,dangling-whitespace
\ No newline at end of file