diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 33eff9532..9b9e7ec32 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,11 +34,11 @@ jobs:
       matrix:
         language: ['javascript']
         # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
-        # Learn more about CodeQL language support at https://git.io/codeql-language-support
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
@@ -48,7 +48,9 @@ jobs:
           # If you wish to specify custom queries, you can do so here or in a config file.
           # By default, queries listed here will override any specified in a config file.
           # Prefix the list here with "+" to use these queries and those in the config file.
-          # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+          # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+          # queries: security-extended,security-and-quality
 
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml
index 4d52885b7..ca743d00e 100644
--- a/.github/workflows/pr-lint.yml
+++ b/.github/workflows/pr-lint.yml
@@ -5,6 +5,7 @@ on: [push, pull_request_target]
 jobs:
   linter:
     name: Lint
+    if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -17,6 +18,7 @@ jobs:
         run: yarn lint
   reviewdog:
     name: reviewdog
+    if: ${{ github.event_name == 'pull_request' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -30,7 +32,7 @@ jobs:
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
   titleLint:
-    if: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }}
+    if: ${{ github.event_name == 'pull_request_target' }}
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2bcd3e70c..b2f47b70a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,6 +4,14 @@ on:
   push:
     branches-ignore:
       - 'dependabot/**'
+    paths:
+      - 'lib/**'
+      - '!**/maintainer.js'
+      - '!**/radar.js'
+      - '!**/radar-rules.js'
+      - 'package.json'
+      - 'yarn.lock'
+      - '.github/workflows/test.yml'
   pull_request: ~
 
 permissions:
diff --git a/.github/workflows/yarn-lock-changes.yml b/.github/workflows/yarn-lock-changes.yml
index 59842d453..2c8e80e1f 100644
--- a/.github/workflows/yarn-lock-changes.yml
+++ b/.github/workflows/yarn-lock-changes.yml
@@ -6,6 +6,7 @@ jobs:
     runs-on: ubuntu-latest
     # Permission overwrite is required for Dependabot PRs, see https://github.com/marketplace/actions/yarn-lock-changes#-common-issues.
     permissions:
+      contents: write
       pull-requests: write
     steps:
       - name: Checkout