diff --git a/.github/workflows/compliance.yml b/.github/workflows/compliance.yml
new file mode 100644
index 0000000..7d8b225
--- /dev/null
+++ b/.github/workflows/compliance.yml
@@ -0,0 +1,22 @@
+name: Compliance
+
+on:
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+
+jobs:
+  compliance:
+    runs-on: ubuntu-latest
+    steps:
+    - name: ⬇️ Checkout
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+    - name: Plumber
+      uses: outscale/.github/pipeline-compliance@2cbbe00ba9835f42809be7511fe7dba5a0dc0c15 # v1.0.0
+      with:
+        plumber-threshold: 100
+        github-token: ${{ secrets.PLUMBER_TOKEN }}
diff --git a/.github/workflows/cred-scan.yml b/.github/workflows/cred-scan.yml
deleted file mode 100644
index 06788f2..0000000
--- a/.github/workflows/cred-scan.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: Credential Scanner
-
-on:
-  pull_request:
-    branches: [ main ]
-
-jobs:
-  cred-scan:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-    - name: Scan credentials
-      uses: outscale/cred-scan@36ef82cc690d72a17bf0993ab323961f1b1f9c66 # main
-      with:
-        scan_path: "./"
\ No newline at end of file
diff --git a/.github/workflows/github-sanity-scan.yml b/.github/workflows/github-sanity-scan.yml
deleted file mode 100644
index 334c64c..0000000
--- a/.github/workflows/github-sanity-scan.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-name: Github sanity scanner
-
-on:
-  pull_request:
-    branches: [ main ]
-
-jobs:
-  github-sanity-scan:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-    - name: Github sanity scanner
-      uses: outscale/github-sanity-scan@380a9927b4be45d9c4f6f66a4e8dfd7cf7b18513 # main
-      with:
-        no-pull-request-target: true
\ No newline at end of file
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 803e11a..1a05a70 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,6 +6,10 @@ on:
       - "v*"
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build-and-publish:
     name: Build and Publish
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a0a0674..242b5f7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest