diff --git a/.github/labeler.yml b/.github/labeler.yml
index 5d4b3d7..49abd17 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -12,5 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-source:
-  - '**/*'
\ No newline at end of file
+"documentation :notebook:":
+  - changed-files:
+      - any-glob-to-any-file: ['contrib/*', '**/*.md']
+kubernetes:
+  - changed-files:
+      - any-glob-to-any-file: ['kubernetes/*', 'hack/builder-gen.sh', 'hack/deepcopy-gen.sh', 'Makefile']
diff --git a/.github/labels.yml b/.github/labels.yml
deleted file mode 100644
index 7f6aa94..0000000
--- a/.github/labels.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-# Copyright 2022 The Serverless Workflow Specification Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-area:
-  - 'bug'
-  - 'important'
-  - 'feature'
-
-kind:
-  - 'failing-test'
-  - 'cleanup'
-
-priority:
-  - 'P0'
-  - 'P1'
-  - 'P2'
diff --git a/.github/workflows/Go-SDK-Check-k8s-integration.yaml b/.github/workflows/Go-SDK-Check-k8s-integration.yaml
index f91b740..6d97acb 100644
--- a/.github/workflows/Go-SDK-Check-k8s-integration.yaml
+++ b/.github/workflows/Go-SDK-Check-k8s-integration.yaml
@@ -22,6 +22,10 @@ on:
       - "Makefile"
     branches:
       - main
+
+permissions:
+  contents: read
+
 env:
   GO_VERSION: 1.22
 jobs:
diff --git a/.github/workflows/Go-SDK-PR-Check.yaml b/.github/workflows/Go-SDK-PR-Check.yaml
index aad9ec9..7b8a8a3 100644
--- a/.github/workflows/Go-SDK-PR-Check.yaml
+++ b/.github/workflows/Go-SDK-PR-Check.yaml
@@ -22,6 +22,10 @@ on:
       - "Makefile"
     branches:
       - main
+
+permissions:
+  contents: read
+
 env:
   GO_VERSION: 1.22
 jobs:
@@ -67,7 +71,7 @@ jobs:
           changed_files=$(git status -s | grep -v 'go.mod\|go.sum\|tools.mod\|tools.sum' || :)
           [[ -z "$changed_files" ]] ||  (printf "Some files are not formatted properly: \n$changed_files\n Did you run 'make test' before sending the PR?" && exit 1)
       - name: Check lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1 - Please ALWAYS use SHA to avoid GH sec issues
         with:
           version: latest
       - name: Install cover
diff --git a/.github/workflows/prow_commands.yml b/.github/workflows/prow_commands.yml
deleted file mode 100644
index d854fae..0000000
--- a/.github/workflows/prow_commands.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Copyright 2022 The Serverless Workflow Specification Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: "Prow github actions"
-on:
-  issue_comment:
-    types: [created]
-
-jobs:
-  execute:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: jpmcb/prow-github-actions@v1.1.3
-        with:
-          prow-commands: |
-            /assign
-            /unassign
-            /approve
-            /retitle
-            /area
-            /kind
-            /priority
-            /remove
-            /lgtm
-            /close
-            /reopen
-            /lock
-            /milestone
-            /hold
-            /cc
-            /uncc
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
\ No newline at end of file
diff --git a/.github/workflows/prow_cron_pull_request_merge.yml b/.github/workflows/prow_cron_pull_request_merge.yml
deleted file mode 100644
index e48e6e1..0000000
--- a/.github/workflows/prow_cron_pull_request_merge.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-# Copyright 2022 The Serverless Workflow Specification Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: "Merge on lgtm label"
-on:
-  schedule:
-  - cron: "30 * * * *"
-
-jobs:
-  execute:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: jpmcb/prow-github-actions@v1.1.3
-        with:
-          jobs: 'lgtm'
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-          merge-method: 'squash'
\ No newline at end of file
diff --git a/.github/workflows/prow_remove_lgtm.yml b/.github/workflows/prow_remove_lgtm.yml
deleted file mode 100644
index 455f696..0000000
--- a/.github/workflows/prow_remove_lgtm.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Copyright 2022 The Serverless Workflow Specification Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: "Pull Request update lgtm"
-on: pull_request
-
-jobs:
-  execute:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: jpmcb/prow-github-actions@v1.1.3
-        with:
-          jobs: 'lgtm'
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
\ No newline at end of file
diff --git a/.github/workflows/pull_request_labeler.yml b/.github/workflows/pull_request_labeler.yml
index f8eab65..f270294 100644
--- a/.github/workflows/pull_request_labeler.yml
+++ b/.github/workflows/pull_request_labeler.yml
@@ -14,15 +14,13 @@
 
 name: "Pull Request Labeler"
 on:
-- pull_request_target
+  - pull_request_target
 
 jobs:
-  triage:
+  labeler:
     permissions:
       contents: read
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@v4.0.2
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
\ No newline at end of file
+      - uses: actions/labeler@v5
\ No newline at end of file
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index ccd7367..826fe00 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -16,7 +16,9 @@ name: Mark stale issues and pull requests
 on:
   schedule:
     - cron: "0 0 * * *"
-
+permissions:
+  issues: write
+  pull-requests: write
 jobs:
   stale:
     runs-on: ubuntu-latest