diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b4fece12..71a8605c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -2,13 +2,21 @@
 
 name: MLGO CI
 
-on: [push, repository_dispatch, pull_request]
+permissions:
+  contents: read
+
+on:
+  push:
+    branches:
+      - 'main'
+  repository_dispatch:
+  pull_request:
 
 jobs:
   LicenseCheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: ./check-license.sh
   Envvars:
     runs-on: ubuntu-latest
@@ -46,17 +54,17 @@ jobs:
           - task: Test
             cmd: pytest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Install Python With Cached pip Packages
         if: needs.Envvars.outputs.do_cache == '1'
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'pipenv'
           cache-dependency-path: Pipfile.lock
       - name: Install Python, no cache
         if: needs.Envvars.outputs.do_cache == '0'
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install Pipenv