diff --git a/.github/workflows/build_on_pr.yml b/.github/workflows/build_on_pr.yml
index 0c3a55905764..f3fa2e140746 100644
--- a/.github/workflows/build_on_pr.yml
+++ b/.github/workflows/build_on_pr.yml
@@ -199,6 +199,7 @@ jobs:
 
       - name: Upload test coverage artifact
         uses: actions/upload-artifact@v3
+        if: success()
         with:
           name: report
           path: report/
diff --git a/.github/workflows/compatiblity_test_on_schedule.yml b/.github/workflows/compatiblity_test_on_schedule.yml
index 3dc8a5a328a6..e53e968573a4 100644
--- a/.github/workflows/compatiblity_test_on_schedule.yml
+++ b/.github/workflows/compatiblity_test_on_schedule.yml
@@ -10,6 +10,7 @@ jobs:
   matrix_preparation:
     name: Prepare Container List
     runs-on: ubuntu-latest
+    if: ${{github.event_name != 'schedule' || github.repository == 'hpcaitech-colossalai'}}
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
diff --git a/.github/workflows/draft_github_release_post_after_merge.yml b/.github/workflows/draft_github_release_post_after_merge.yml
index 53bfa9e8deb6..ac785806b7ca 100644
--- a/.github/workflows/draft_github_release_post_after_merge.yml
+++ b/.github/workflows/draft_github_release_post_after_merge.yml
@@ -13,6 +13,8 @@ jobs:
     name: Draft Release Post
     if: ( github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true ) && github.repository == 'hpcaitech/ColossalAI'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v2
         with:
diff --git a/.github/workflows/report_test_coverage.yml b/.github/workflows/report_test_coverage.yml
index c9dc541b8a33..548c8e47c5d7 100644
--- a/.github/workflows/report_test_coverage.yml
+++ b/.github/workflows/report_test_coverage.yml
@@ -10,6 +10,8 @@ jobs:
   report-test-coverage:
     runs-on: ubuntu-latest
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    permissions:
+      contents: write
     steps:
       - name: "Download artifact"
         uses: actions/github-script@v6
diff --git a/.github/workflows/submodule.yml b/.github/workflows/submodule.yml
index 4ffb261183f1..fecbdf3f8a22 100644
--- a/.github/workflows/submodule.yml
+++ b/.github/workflows/submodule.yml
@@ -9,6 +9,9 @@ jobs:
   sync-submodule:
     runs-on: ubuntu-latest
     if: github.repository == 'hpcaitech/ColossalAI'
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@v2