diff --git a/.github/workflows/build-macos-bypass.yaml b/.github/workflows/build-macos-bypass.yaml
new file mode 100644
index 0000000000000..e2931f6f2a1cc
--- /dev/null
+++ b/.github/workflows/build-macos-bypass.yaml
@@ -0,0 +1,33 @@
+# This workflow is required to ensure that required Github check passes even if
+# the actual "Build on Mac OS" workflow skipped due to path filtering. Otherwise
+# it will stay forever pending.
+#
+# See "Handling skipped but required checks" for more info:
+#
+# https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+#
+# Note both workflows must have the same name.
+
+name: Build on Mac OS
+run-name: Skip Build on Mac OS
+
+on:
+  pull_request:
+    paths-ignore:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - '**.rs'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+
+jobs:
+  build:
+    name: Skipped
+    runs-on: macos-12
+
+    permissions:
+      contents: none
+
+    steps:
+      - run: 'echo "No code changes"'
diff --git a/.github/workflows/build-macos.yaml b/.github/workflows/build-macos.yaml
new file mode 100644
index 0000000000000..55af74bcb294c
--- /dev/null
+++ b/.github/workflows/build-macos.yaml
@@ -0,0 +1,40 @@
+name: Build on Mac OS
+run-name: Build on Mac OS
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - '**.rs'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+
+jobs:
+  build:
+    name: Build all tools on Mac OS
+    runs-on: macos-12 # TODO(r0mant): Update with large runner when it's available
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout Teleport
+        uses: actions/checkout@v3
+
+      - name: Get Go version
+        id: go-version
+        shell: bash
+        run: echo "go-version=$(make --no-print-directory print-go-version | tr -d '\n')" >> $GITHUB_OUTPUT
+
+      - name: Setup Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: ${{ steps.go-version.outputs.go-version }}
+
+      - name: Build
+        run: make binaries
diff --git a/.github/workflows/build-windows-bypass.yaml b/.github/workflows/build-windows-bypass.yaml
new file mode 100644
index 0000000000000..1b2d666a7c230
--- /dev/null
+++ b/.github/workflows/build-windows-bypass.yaml
@@ -0,0 +1,32 @@
+# This workflow is required to ensure that required Github check passes even if
+# the actual "Build on Windows" workflow skipped due to path filtering. Otherwise
+# it will stay forever pending.
+#
+# See "Handling skipped but required checks" for more info:
+#
+# https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+#
+# Note both workflows must have the same name.
+
+name: Build on Windows
+run-name: Skip Build on Windows
+
+on:
+  pull_request:
+    # We only build tsh on Windows so only consider Go code as tsh doesn't
+    # run any Rust.
+    paths-ignore:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+
+jobs:
+  build:
+    name: Skipped
+    runs-on: windows-latest
+
+    permissions:
+      contents: none
+
+    steps:
+      - run: 'echo "No code changes"'
diff --git a/.github/workflows/build-windows.yaml b/.github/workflows/build-windows.yaml
new file mode 100644
index 0000000000000..53ee6ae7b52a7
--- /dev/null
+++ b/.github/workflows/build-windows.yaml
@@ -0,0 +1,41 @@
+name: Build on Windows
+run-name: Build on Windows
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    # We only build tsh on Windows so only consider Go code as tsh doesn't
+    # run any Rust.
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+
+jobs:
+  build:
+    name: Build tsh tool on Windows
+    runs-on: windows-2022-16core
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout Teleport
+        uses: actions/checkout@v3
+
+      - name: Get Go version
+        id: go-version
+        shell: bash
+        run: echo "go-version=$(make --no-print-directory print-go-version | tr -d '\n')" >> $GITHUB_OUTPUT
+
+      - name: Setup Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: ${{ steps.go-version.outputs.go-version }}
+
+      - name: Build
+        run: |
+          $Env:OS="windows"
+          make build/tsh
diff --git a/.github/workflows/integration-tests-non-root-bypass.yaml b/.github/workflows/integration-tests-non-root-bypass.yaml
new file mode 100644
index 0000000000000..e2aadf1d329e9
--- /dev/null
+++ b/.github/workflows/integration-tests-non-root-bypass.yaml
@@ -0,0 +1,30 @@
+# This workflow is required to ensure that required Github check passes even if
+# the actual "Integration Tests (Non-root)" workflow skipped due to path filtering.
+# Otherwise it will stay forever pending.
+#
+# See "Handling skipped but required checks" for more info:
+#
+# https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+#
+# Note both workflows must have the same name.
+
+name: Integration Tests (Non-root)
+run-name: Skip Integration Tests (Non-root) - ${{ github.run_id }} - @${{ github.actor }}
+
+on:
+  pull_request:
+    paths-ignore:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+
+jobs:
+  test:
+    name: Skipped
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: none
+
+    steps:
+      - run: 'echo "No changes to verify"'
diff --git a/.github/workflows/integration-tests-root-bypass.yaml b/.github/workflows/integration-tests-root-bypass.yaml
new file mode 100644
index 0000000000000..0b613031531e9
--- /dev/null
+++ b/.github/workflows/integration-tests-root-bypass.yaml
@@ -0,0 +1,30 @@
+# This workflow is required to ensure that required Github check passes even if
+# the actual "Integration Tests (Root)" workflow skipped due to path filtering.
+# Otherwise it will stay forever pending.
+#
+# See "Handling skipped but required checks" for more info:
+#
+# https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+#
+# Note both workflows must have the same name.
+
+name: Integration Tests (Root)
+run-name: Skip Integration Tests (Root) - ${{ github.run_id }} - @${{ github.actor }}
+
+on:
+  pull_request:
+    paths-ignore:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+
+jobs:
+  test:
+    name: Skipped
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: none
+
+    steps:
+      - run: 'echo "No changes to verify"'
diff --git a/.github/workflows/unit-tests-code-bypass.yaml b/.github/workflows/unit-tests-code-bypass.yaml
index 1c445b38a3af1..dacb147d6fa67 100644
--- a/.github/workflows/unit-tests-code-bypass.yaml
+++ b/.github/workflows/unit-tests-code-bypass.yaml
@@ -1,5 +1,15 @@
+# This workflow is required to ensure that required Github check passes even if
+# the actual "Unit Tests (Go)" workflow skipped due to path filtering. Otherwise
+# it will stay forever pending.
+#
+# See "Handling skipped but required checks" for more info:
+#
+# https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+#
+# Note both workflows must have the same name.
+
 name: Unit Tests (Go)
-run-name: Unit Tests (Go) - ${{ github.run_id }} - @${{ github.actor }}
+run-name: Skip Unit Tests (Go) - ${{ github.run_id }} - @${{ github.actor }}
 
 on:
   pull_request:
@@ -8,7 +18,7 @@ on:
 
 jobs:
   test:
-    name: Unit Tests (Go)
+    name: Skipped
     runs-on: ubuntu-latest
 
     permissions:
diff --git a/.github/workflows/unit-tests-helm-bypass.yaml b/.github/workflows/unit-tests-helm-bypass.yaml
index beaee5aabc17b..b7a7fbdc5aabb 100644
--- a/.github/workflows/unit-tests-helm-bypass.yaml
+++ b/.github/workflows/unit-tests-helm-bypass.yaml
@@ -1,6 +1,15 @@
+# This workflow is required to ensure that required Github check passes even if
+# the actual "Unit Tests (Helm)" workflow skipped due to path filtering. Otherwise
+# it will stay forever pending.
+#
+# See "Handling skipped but required checks" for more info:
+#
 # https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+#
+# Note both workflows must have the same name.
+
 name: Unit Tests (Helm)
-run-name: Unit Tests (Helm) - ${{ github.run_id }} - @${{ github.actor }}
+run-name: Skip Unit Tests (Helm) - ${{ github.run_id }} - @${{ github.actor }}
 
 on:
   pull_request:
@@ -9,7 +18,7 @@ on:
 
 jobs:
   test:
-    name: Unit Tests (Helm)
+    name: Skipped
     runs-on: ubuntu-latest
 
     permissions:
diff --git a/.github/workflows/unit-tests-operator-bypass.yaml b/.github/workflows/unit-tests-operator-bypass.yaml
index 6fbdcf266d48c..19669eb66deb5 100644
--- a/.github/workflows/unit-tests-operator-bypass.yaml
+++ b/.github/workflows/unit-tests-operator-bypass.yaml
@@ -1,5 +1,15 @@
+# This workflow is required to ensure that required Github check passes even if
+# the actual "Unit Tests (Operator)" workflow skipped due to path filtering. Otherwise
+# it will stay forever pending.
+#
+# See "Handling skipped but required checks" for more info:
+#
+# https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+#
+# Note both workflows must have the same name.
+
 name: Unit Tests (Operator)
-run-name: Unit Tests (Operator) - ${{ github.run_id }} - @${{ github.actor }}
+run-name: Skip Unit Tests (Operator) - ${{ github.run_id }} - @${{ github.actor }}
 
 on:
   pull_request:
@@ -12,7 +22,7 @@ on:
 
 jobs:
   test:
-    name: Unit Tests (Operator)
+    name: Skipped
     runs-on: ubuntu-latest
 
     permissions:
diff --git a/.github/workflows/unit-tests-rust-bypass.yaml b/.github/workflows/unit-tests-rust-bypass.yaml
index d32119a822b23..ebcd6be9a11ed 100644
--- a/.github/workflows/unit-tests-rust-bypass.yaml
+++ b/.github/workflows/unit-tests-rust-bypass.yaml
@@ -1,5 +1,15 @@
+# This workflow is required to ensure that required Github check passes even if
+# the actual "Unit Tests (Rust)" workflow skipped due to path filtering. Otherwise
+# it will stay forever pending.
+#
+# See "Handling skipped but required checks" for more info:
+#
+# https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+#
+# Note both workflows must have the same name.
+
 name: Unit Tests (Rust)
-run-name: Unit Tests (Rust) - ${{ github.run_id }} - @${{ github.actor }}
+run-name: Skip Unit Tests (Rust) - ${{ github.run_id }} - @${{ github.actor }}
 
 on:
   pull_request:
@@ -10,7 +20,7 @@ on:
 
 jobs:
   test:
-    name: Unit Tests (Rust)
+    name: Skipped
     runs-on: ubuntu-latest
 
     permissions:
diff --git a/Makefile b/Makefile
index 6890832000d34..6698f18c59b1f 100644
--- a/Makefile
+++ b/Makefile
@@ -268,6 +268,13 @@ all: version
 	@echo "---> Building OSS binaries."
 	$(MAKE) $(BINARIES)
 
+#
+# make binaries builds all binaries defined in the BINARIES environment variable
+#
+.PHONY: binaries
+binaries:
+	$(MAKE) $(BINARIES)
+
 # By making these 3 targets below (tsh, tctl and teleport) PHONY we are solving
 # several problems:
 # * Build will rely on go build internal caching https://golang.org/doc/go1.10 at all times
@@ -909,6 +916,13 @@ sloccount:
 remove-temp-files:
 	find . -name flymake_* -delete
 
+#
+# print-go-version outputs Go version as a semver without "go" prefix
+#
+.PHONY: print-go-version
+print-go-version:
+	@$(MAKE) -C build.assets print-go-version | sed "s/go//"
+
 # Dockerized build: useful for making Linux releases on OSX
 .PHONY:docker
 docker:
diff --git a/api/types/user.go b/api/types/user.go
index fb036c91611d7..d4e6e12555e2e 100644
--- a/api/types/user.go
+++ b/api/types/user.go
@@ -26,7 +26,7 @@ import (
 	"github.com/gravitational/teleport/api/utils"
 )
 
-// User represents teleport embedded user or external user
+// User represents teleport embedded user or external user.
 type User interface {
 	// ResourceWithSecrets provides common resource properties
 	ResourceWithSecrets
diff --git a/lib/srv/desktop/rdp/rdpclient/build.rs b/lib/srv/desktop/rdp/rdpclient/build.rs
index 52fa90e1876db..ec8059bcc8115 100644
--- a/lib/srv/desktop/rdp/rdpclient/build.rs
+++ b/lib/srv/desktop/rdp/rdpclient/build.rs
@@ -13,7 +13,7 @@
 // limitations under the License.
 
 fn main() {
-    // the cwd of build scripts is the root of the crate
+    // the cwd of build scripts is the root of the crate.
     let bindings = cbindgen::Builder::new()
         .with_crate(".")
         .with_language(cbindgen::Language::C)