diff --git a/.github/workflows/autograding.yml b/.github/workflows/autograding.yml
new file mode 100644
index 0000000000..574f99042a
--- /dev/null
+++ b/.github/workflows/autograding.yml
@@ -0,0 +1,84 @@
+name: 'Build and autograde'
+
+on:
+  push:
+    branches:
+      - master
+      - main
+  pull_request:
+
+jobs:
+  Build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          check-latest: true
+          cache: 'maven'
+      - name: Compile, Test and Analysis
+        run: mvn -V --color always -ntp clean verify -Dmaven.test.failure.ignore=true | tee maven.log
+      - name: Mutation Coverage
+        run: mvn -V --color always -ntp org.pitest:pitest-maven:mutationCoverage
+      - name: Autograding
+        uses: uhafner/autograding-github-action@v1.7.0
+        with:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_SHA: ${{github.event.pull_request.head.sha}}
+          CONFIG: >
+            {
+              "analysis": {
+                "tools": [
+                  {
+                    "id": "error-prone",
+                    "pattern": "**/*.log"
+                  },
+                  {
+                    "id": "java",
+                    "pattern": "**/*.log"
+                  },
+                  {
+                    "id": "javadoc-warnings",
+                    "pattern": "**/*.log"
+                  },
+                  {
+                    "id": "checkstyle",
+                    "pattern": "**/checkstyle-result.xml"
+                  },
+                  {
+                    "id": "pmd",
+                    "pattern": "**/pmd.xml"
+                  },
+                  {
+                    "id": "spotbugs",
+                    "pattern": "**/spotbugsXml.xml"
+                  }
+                ],
+                "maxScore": 100,
+                "errorImpact": -5,
+                "highImpact": -2,
+                "normalImpact": -1,
+                "lowImpact": -1
+              },
+              "tests": {
+                "maxScore": 100,
+                "passedImpact": 0,
+                "failureImpact": -5,
+                "skippedImpact": -1
+              },
+              "coverage": {
+                "maxScore": 100,
+                "coveredPercentageImpact": 0,
+                "missedPercentageImpact": -1
+              },
+              "pit": {
+                "maxScore": 100,
+                "detectedImpact": 0,
+                "undetectedImpact": -1,
+                "detectedPercentageImpact": 0,
+                "undetectedPercentageImpact": 0
+              }
+            }
diff --git a/.github/workflows/check-md-links.yml b/.github/workflows/check-md-links.yml
index 4650cbb7d8..da894cd57f 100644
--- a/.github/workflows/check-md-links.yml
+++ b/.github/workflows/check-md-links.yml
@@ -7,8 +7,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - name: fix permission issue
-        run: git config --global --add safe.directory /github/workspace
       - uses: gaurav-nelson/github-action-markdown-link-check@v1
         with:
-          check-modified-files-only: 'yes'
+          check-modified-files-only: 'no'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000000..020ae810b7
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,51 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - master
+      - main
+  pull_request:
+    branches:
+      - master
+      - main
+  schedule:
+    - cron: "32 3 * * 0"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ java ]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Setup Java
+        uses: actions/setup-java@v3
+        with:
+          distribution: temurin
+          java-version: 11
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+          queries: +security-and-quality
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
+        with:
+          category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 9dedd7a470..c537e72440 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -4,12 +4,13 @@ on:
   push:
     branches:
       - master
+      - main
   pull_request:
 
 jobs:
   coverage:
 
-    runs-on: [ubuntu-latest]
+    runs-on: ubuntu-latest
     name: Coverage on Ubuntu
 
     steps:
@@ -20,14 +21,10 @@ jobs:
           distribution: 'temurin'
           java-version: '11'
           check-latest: true
-          cache: 'maven'
       - name: Generate coverage with JaCoCo
-        env:
-          BROWSER: firefox-container
-        run: mvn -V --color always -ntp clean verify jacoco:prepare-agent test integration-test jacoco:report --file plugin/pom.xml '-Dgpg.skip'
-
+        run: mvn -V --color always -ntp clean verify --file pom.xml '-Dgpg.skip'
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3.1.1
+        uses: codecov/codecov-action@v3
         with:
+          files: 'target/site/jacoco/jacoco.xml'
           token: ${{secrets.CODECOV_TOKEN}}
-          file: ./plugin/target/site/jacoco/jacoco.xml
diff --git a/.github/workflows/enforce-labels.yml b/.github/workflows/enforce-labels.yml
new file mode 100644
index 0000000000..e38c08cf4e
--- /dev/null
+++ b/.github/workflows/enforce-labels.yml
@@ -0,0 +1,14 @@
+name: Enforce PR labels
+
+on:
+  pull_request:
+    types: [unlabeled]
+jobs:
+  enforce-label:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: yogevbd/enforce-label-action@2.1.0
+        with:
+          REQUIRED_LABELS_ANY: "bug,feature,enhancement,deprecated,removed,tests,documentation,internal,dependencies"
+          REQUIRED_LABELS_ANY_DESCRIPTION: "Maintainer needs to assign at least one label before merge"
+          BANNED_LABELS: "banned"
diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index e2f3e9f07d..a0779e7a5c 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -3,8 +3,10 @@ on:
   push:
     branches:
       - master
+      - main
     paths:
       - .github/labels.yml
+      - .github/workflows/sync-labels.yml
 
 jobs:
   build: