diff --git a/.github/workflows/conventional-commits.yml b/.github/workflows/conventional-commits.yml
index ae0e33e..2ea04ff 100644
--- a/.github/workflows/conventional-commits.yml
+++ b/.github/workflows/conventional-commits.yml
@@ -4,12 +4,21 @@ on:
   pull_request:
     types: [ opened, synchronize, reopened, edited ]
 
+permissions: { }
+
 jobs:
   build:
     name: conventional commits
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: read
+      packages: read
+      statuses: write
     steps:
-      - uses: actions/checkout@v3
-      - uses: webiny/action-conventional-commits@v1.3.0
+      - name: checkout code
+        uses: actions/checkout@v3
+      - name: conventional commits check
+        uses: webiny/action-conventional-commits@v1.3.0
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/conventional-pull-requests.yml b/.github/workflows/conventional-pull-requests.yml
index 525552e..65331b2 100644
--- a/.github/workflows/conventional-pull-requests.yml
+++ b/.github/workflows/conventional-pull-requests.yml
@@ -4,11 +4,19 @@ on:
   pull_request:
     types: [ opened, synchronize, reopened, edited ]
 
+permissions: { }
+
 jobs:
-  validate-pr-title:
+  build:
+    name: conventional pull requests
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: read
+      packages: read
+      statuses: write
     steps:
-      - name: PR Conventional Commit Validation
+      - name: conventional pull requests check
         uses: ytanikin/PRConventionalCommits@1.1.0
         with:
           task_types: '["build","chore","ci","docs","feat","fix","perf","refactor","revert","style","test"]'
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000..274d9d8
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,37 @@
+name: lint
+
+on:
+  pull_request:
+    types: [ opened, synchronize, reopened, edited ]
+
+permissions: { }
+
+jobs:
+  build:
+    name: lint
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      packages: read
+      statuses: write
+    steps:
+      - name: checkout code
+        uses: actions/checkout@v4
+        with:
+          # Super-linter needs the full git history to get the list of files that changed across commits
+          fetch-depth: 0
+      - name: Super-linter check
+        uses: super-linter/super-linter@v6.9.0 # x-release-please-version
+        env:
+          # to report GitHub Actions status checks
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VALIDATE_ALL_CODEBASE: false
+          FIX_CSS_PRETTIER: true
+          FIX_HTML_PRETTIER: true
+          FIX_JAVASCRIPT_ES: true
+          FIX_JSON_PRETTIER: true
+          FIX_RUST_2021: true
+          FIX_RUST_CLIPPY: true
+          FIX_TYPESCRIPT_ES: true
+          FIX_YAML_PRETTIER: true