diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..0d74932
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,37 @@
+name: ci
+permissions:
+  contents: read
+  id-token: write
+on:
+  push:
+env:
+  SCORE_HUMANITEC_VERSION: 'latest'
+jobs:
+  job:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: checkout code
+        uses: actions/checkout@v3
+      - name: install score-humanitec
+        uses: score-spec/setup-score@v2
+        with:
+          file: score-humanitec
+          token: ${{ secrets.GITHUB_TOKEN }}
+          version: ${{ env.SCORE_HUMANITEC_VERSION }}
+      - name: score-humanitec run - app1
+        run: |
+          score-humanitec run \
+              --env development \
+              -f score/app1/score.yaml \
+              --extensions score/app1/humanitec.score.yaml
+      - name: score-humanitec run - app2
+        run: |
+          score-humanitec run \
+              --env development \
+              -f score/app2/score.yaml \
+              --extensions score/app2/humanitec.score.yaml
+      - name: terraform validate
+        run: |
+          cd humanitec
+          terraform init -backend=false
+          terraform validate
\ No newline at end of file
diff --git a/score/app1/humanitec.score.yaml b/score/app1/humanitec.score.yaml
new file mode 100644
index 0000000..4a5b8e1
--- /dev/null
+++ b/score/app1/humanitec.score.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: humanitec.org/v1b1
+
+resources:
+  dns:
+    scope: shared
+
+spec:
+  replicas: 2
+  labels:
+    "labelkey": "value"
+  annotations:
+    "annotationkey": "value"
diff --git a/score/sh-demo.yaml b/score/app1/score.yaml
similarity index 88%
rename from score/sh-demo.yaml
rename to score/app1/score.yaml
index 81b6431..2158dda 100644
--- a/score/sh-demo.yaml
+++ b/score/app1/score.yaml
@@ -43,12 +43,18 @@ containers:
         memory: "64Mi"
         cpu: "251m"
 resources:
-  "mydns":
+  mydns:
     type: dns
-  "okta":
+  route:
+    type: route
+    params:
+      host: ${resources.mydns.host}
+      path: /
+      port: 80
+  okta:
     #class: specialoktaforApp1
     type: oauth-client-identity
-  "mongo":
+  mongo:
     type: mongodb
-  "mypvc":
+  mypvc:
     type: volume
diff --git a/score/app2/humanitec.score.yaml b/score/app2/humanitec.score.yaml
new file mode 100644
index 0000000..4a5b8e1
--- /dev/null
+++ b/score/app2/humanitec.score.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: humanitec.org/v1b1
+
+resources:
+  dns:
+    scope: shared
+
+spec:
+  replicas: 2
+  labels:
+    "labelkey": "value"
+  annotations:
+    "annotationkey": "value"
diff --git a/score/sh-demo2.yaml b/score/app2/score.yaml
similarity index 87%
rename from score/sh-demo2.yaml
rename to score/app2/score.yaml
index 03dfd20..2c8b8b7 100644
--- a/score/sh-demo2.yaml
+++ b/score/app2/score.yaml
@@ -43,11 +43,17 @@ containers:
         memory: "64Mi"
         cpu: "251m"
 resources:
-  "mydns":
+  mydns:
     type: dns
-  "okta":
+  route:
+    type: route
+    params:
+      host: ${resources.mydns.host}
+      path: /
+      port: 80
+  okta:
     type: oauth-client-identity
-  "mongo":
+  mongo:
     type: mongodb
-  "mypvc":
+  mypvc:
     type: volume
diff --git a/score/sh-demo-extensions.yaml b/score/sh-demo-extensions.yaml
deleted file mode 100644
index 9a7acdf..0000000
--- a/score/sh-demo-extensions.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
----
-apiVersion: humanitec.org/v1b1
-
-resources:
-  "dns":
-    scope: shared
-
-spec:
-  replicas: 2
-  "labels":
-    "labelkey": "value"
-  "annotations":
-    "annotationkey": "value"
-  "ingress":
-    rules:
-      "${resources.mydns}":
-        http:
-          "/":
-            type: prefix
-            port: 80
diff --git a/score/sh-demo2-extensions.yaml b/score/sh-demo2-extensions.yaml
deleted file mode 100644
index 9a7acdf..0000000
--- a/score/sh-demo2-extensions.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
----
-apiVersion: humanitec.org/v1b1
-
-resources:
-  "dns":
-    scope: shared
-
-spec:
-  replicas: 2
-  "labels":
-    "labelkey": "value"
-  "annotations":
-    "annotationkey": "value"
-  "ingress":
-    rules:
-      "${resources.mydns}":
-        http:
-          "/":
-            type: prefix
-            port: 80