diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4825d9bd..1b37ba57 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -6,6 +6,12 @@ env:
   # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
   BUILD_TYPE: Release
 
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions: read-all
+
 jobs:
   # macos:
   #   name: macos / clang
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 3d8e4aff..fa834622 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -2,18 +2,24 @@ name: Code Quality
 
 on:
   push:
-    branches: [ main, master, develop ]
+    branches: [main, master, develop]
   pull_request:
-    branches: [ main, master, develop ]
+    branches: [main, master, develop]
+
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions: read-all
 
 jobs:
   code-quality:
     name: Code Quality Checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
-          fetch-depth: 0  # Fetch all history for proper git diff
+          fetch-depth: 0 # Fetch all history for proper git diff
 
       - name: Install dependencies
         run: |
@@ -40,7 +46,7 @@ jobs:
         run: |
           echo "Running clang-format checks..."
           FORMAT_ERRORS=0
-          
+
           for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
             echo "Checking formatting for $file"
             if ! clang-format --dry-run --Werror "$file" >> logs/format.log 2>&1; then
@@ -48,7 +54,7 @@ jobs:
               FORMAT_ERRORS=$((FORMAT_ERRORS + 1))
             fi
           done
-          
+
           if [ $FORMAT_ERRORS -gt 0 ]; then
             echo "Found formatting issues in $FORMAT_ERRORS files."
             echo "You can fix these issues with: clang-format -i <file>"
@@ -72,11 +78,11 @@ jobs:
       #   run: |
       #     echo "Running clang-tidy checks..."
       #     FILES_WITH_ISSUES=0
-          
+
       #     for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
       #       echo "Checking $file with clang-tidy"
       #       LOG_FILE="logs/tidy_$(basename "$file").log"
-            
+
       #       # Run clang-tidy with selected checks (same as pre-commit hook)
       #       if ! clang-tidy -p=build \
       #         -checks='-*,bugprone-*,cert-*,clang-analyzer-*,cppcoreguidelines-*,performance-*,portability-*,readability-*,-readability-magic-numbers,-readability-braces-around-statements,-cppcoreguidelines-avoid-magic-numbers,-readability-identifier-length,-clang-diagnostic-unused-command-line-argument' \
@@ -86,7 +92,7 @@ jobs:
       #         FILES_WITH_ISSUES=$((FILES_WITH_ISSUES + 1))
       #       fi
       #     done
-          
+
       #     if [ $FILES_WITH_ISSUES -gt 0 ]; then
       #       echo "clang-tidy found issues in $FILES_WITH_ISSUES files."
       #       exit 1
@@ -104,4 +110,11 @@ jobs:
             echo "Compilation failed. Please fix the warnings."
             cat logs/compile.log
             exit 1
-          fi 
+          fi
+
+      - name: Trunk Check
+        if: steps.changed-files.outputs.any_changed == 'true'
+        uses: trunk-io/trunk-action@v1
+        with:
+          check-mode: all
+
diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml
index ba293ee4..1ed481c1 100644
--- a/.github/workflows/npm-release.yml
+++ b/.github/workflows/npm-release.yml
@@ -9,6 +9,10 @@ on:
     paths:
       - 'libCacheSim-node/**'
 
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 env:
   BUILD_TYPE: Release