diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index abf6932b2..5e24b49bc 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -13,17 +13,18 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ 'master', 'stable*', 'v[0-9]*' ]
+    branches: [ 'main', 'stable*', 'v[0-9]*' ]
     paths-ignore:
       - webapp/public/vs/language/typescript/tsWorker.js
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ master ]
+    branches: [ main ]
   schedule:
     - cron: '34 6 * * 0'
 
-  # Permissions required by OpenID Connect to access Azure.
 permissions:
+  contents: read
+  actions: read
   security-events: write
 
 jobs:
@@ -39,9 +40,10 @@ jobs:
         # Learn more:
         # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
 
+
     steps:
     - name: Checkout repository
-      uses: actions/checkout@main
+      uses: actions/checkout@v3
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/pxt-buildpush.yml b/.github/workflows/pxt-buildpush.yml
index 954c1eaf8..c867e7569 100644
--- a/.github/workflows/pxt-buildpush.yml
+++ b/.github/workflows/pxt-buildpush.yml
@@ -9,6 +9,9 @@ on:
 
 permissions:
   contents: write
+  issues: write
+  pull-requests: write
+  actions: write
 
 jobs:
   filter-vtags:
diff --git a/webapp/src/blocks.tsx b/webapp/src/blocks.tsx
index 61f875dd6..8b639986a 100644
--- a/webapp/src/blocks.tsx
+++ b/webapp/src/blocks.tsx
@@ -619,11 +619,11 @@ export class Editor extends toolboxeditor.ToolboxEditor {
         Blockly.config.connectingSnapRadius = 96;
 
         this.editor = Blockly.inject(blocklyDiv, this.getBlocklyOptions(forceHasCategories)) as Blockly.WorkspaceSvg;
-        
+
         // Add block change listener to log block changes
         this.editor.addChangeListener((ev: any) => {
-            if (ev.type === Blockly.Events.CREATE || 
-                ev.type === Blockly.Events.DELETE || 
+            if (ev.type === Blockly.Events.CREATE ||
+                ev.type === Blockly.Events.DELETE ||
                 ev.type === Blockly.Events.CHANGE) {
                 this.logCurrentBlocks();
             }
@@ -1031,11 +1031,11 @@ export class Editor extends toolboxeditor.ToolboxEditor {
 
     private logCurrentBlocks() {
         if (!this.editor) return;
-        
+
         const blocks = this.editor.getAllBlocks(false); // Don't include child blocks
         const blockTypes = blocks.map(block => block.type);
         console.log('Current blocks in workspace:', blockTypes);
-        
+
         // Group and count block types
         const blockCounts: pxt.Map<number> = {};
         blocks.forEach(block => {
@@ -1051,14 +1051,14 @@ export class Editor extends toolboxeditor.ToolboxEditor {
 
     public getBlockTypeCounts(): pxt.Map<number> {
         if (!this.editor) return {};
-        
+
         const blocks = this.editor.getAllBlocks(false);
         const counts: pxt.Map<number> = {};
-        
+
         blocks.forEach(block => {
             counts[block.type] = (counts[block.type] || 0) + 1;
         });
-        
+
         return counts;
     }