diff --git a/.github/workflows/CI-workflow.yml b/.github/workflows/CI-workflow.yml
index 212b411197..3fbe0f2c72 100644
--- a/.github/workflows/CI-workflow.yml
+++ b/.github/workflows/CI-workflow.yml
@@ -36,10 +36,16 @@ jobs:
           aws-region: us-west-2
 
       - name: Checkout MLCommons
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Build and Run Tests
         run: |
+          export OPENAI_KEY=$(aws secretsmanager get-secret-value --secret-id github_openai_key --query SecretString --output text)
+          export COHERE_KEY=$(aws secretsmanager get-secret-value --secret-id github_cohere_key --query SecretString --output text)
+          echo "::add-mask::$OPENAI_KEY"
+          echo "::add-mask::$COHERE_KEY"
           ./gradlew build
       - name: Publish to Maven Local
         run: |
@@ -122,17 +128,23 @@ jobs:
         with:
           java-version: ${{ matrix.java }}
 
-#      - uses: aws-actions/configure-aws-credentials@v2
-#        with:
-#          role-to-assume: ${{ secrets.ML_ROLE }}
-#          aws-region: us-west-2
+      - uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: ${{ secrets.ML_ROLE }}
+          aws-region: us-west-2
 
       # ml-commons
       - name: Checkout MLCommons
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Build and Run Tests
         run: |
+          export OPENAI_KEY=$(aws secretsmanager get-secret-value --secret-id github_openai_key --query SecretString --output text)
+          export COHERE_KEY=$(aws secretsmanager get-secret-value --secret-id github_cohere_key --query SecretString --output text)
+          echo "::add-mask::$OPENAI_KEY"
+          echo "::add-mask::$COHERE_KEY"
           ./gradlew.bat build
       - name: Publish to Maven Local
         run: |