diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index a4f37d039..b61b6b4bd 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -1,3 +1,4 @@
+---
 name: 'CodeQL'
 
 on:
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 749dbcd19..4c6d1ed00 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -1,3 +1,4 @@
+---
 name: Pull Request Labeler
 
 on:
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index c7ada4d99..1a63d13ba 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -1,3 +1,4 @@
+---
 name: Scorecard supply-chain security
 on:
   branch_protection_rule:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3e8e28ce0..e1aa41057 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,3 +1,4 @@
+---
 name: Publish package to npmjs
 
 on:
diff --git a/.github/workflows/spellcheck.yml b/.github/workflows/spellcheck.yml
index dd3336072..09f8b38f1 100644
--- a/.github/workflows/spellcheck.yml
+++ b/.github/workflows/spellcheck.yml
@@ -1,3 +1,4 @@
+---
 name: 'Check spelling'
 on:
   push:
diff --git a/.github/workflows/super-linter.yml b/.github/workflows/super-linter.yml
index 5c38e9943..9c0edb7ff 100644
--- a/.github/workflows/super-linter.yml
+++ b/.github/workflows/super-linter.yml
@@ -1,3 +1,4 @@
+---
 name: Lint Code Base
 
 on:
@@ -49,10 +50,7 @@ jobs:
           VALIDATE_HTML: false
           VALIDATE_HTML_PRETTIER: false
           VALIDATE_JAVASCRIPT_ES: false
-          VALIDATE_JAVASCRIPT_PRETTIER: false
           VALIDATE_JSON: false
-          VALIDATE_JSON_PRETTIER: false
           VALIDATE_JSCPD: false
           VALIDATE_NATURAL_LANGUAGE: false
           VALIDATE_TYPESCRIPT_ES: false
-          VALIDATE_TYPESCRIPT_PRETTIER: false
diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index 569574931..b32f40601 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -1,4 +1,5 @@
 # Sync GitHub labels in the declarative way
+---
 name: Sync labels
 
 on:
@@ -8,6 +9,9 @@ on:
     paths:
       - .github/labels.yml
 
+permissions:
+  contents: read
+
 jobs:
   configure-labels:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 77a7f9f87..05d7fde1a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,3 +1,4 @@
+---
 name: Development workflow
 
 on:
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index 42eb5efda..830d06420 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -1,3 +1,4 @@
+---
 name: Website
 
 on: