diff --git a/.github/workflows/crosscheck.yml b/.github/workflows/crosscheck.yml
index a2454dd4a..5db7bb341 100644
--- a/.github/workflows/crosscheck.yml
+++ b/.github/workflows/crosscheck.yml
@@ -6,38 +6,38 @@ on:
 jobs:
   crosscheck:
     runs-on: ubuntu-latest
+    env:
+      YARN_ENABLE_SCRIPTS: false
+      CI_LOG: 123
+      GITHUB_TOKEN: ${{ secrets.GH_PAT_BOT }}
     steps:
     - uses: actions/checkout@v2
     - name: check
-      env:
-        CI_LOG: 123
       run: |
         yarn install --immutable | grep -v 'YN0013'
         yarn phishing:crosscheck
     - name: issue
       if: ${{ failure() }}
       uses: JasonEtco/create-an-issue@v2
-      env:
-        GITHUB_TOKEN: ${{ secrets.GH_PAT_BOT }}
       with:
         filename: .github/crosscheck.md
         update_existing: true
 
   addrcheck:
     runs-on: ubuntu-latest
+    env:
+      YARN_ENABLE_SCRIPTS: false
+      CI_LOG: 123
+      GITHUB_TOKEN: ${{ secrets.GH_PAT_BOT }}
     steps:
     - uses: actions/checkout@v2
     - name: check
-      env:
-        CI_LOG: 123
       run: |
         yarn install --immutable | grep -v 'YN0013'
         yarn phishing:addrcheck
     - name: issue
       if: ${{ failure() }}
       uses: JasonEtco/create-an-issue@v2
-      env:
-        GITHUB_TOKEN: ${{ secrets.GH_PAT_BOT }}
       with:
         filename: .github/addrcheck.md
         update_existing: true
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 3f7698529..add3cf284 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -7,6 +7,8 @@ on:
 jobs:
   lock:
     runs-on: ubuntu-latest
+    env:
+      YARN_ENABLE_SCRIPTS: false
     steps:
       - uses: dessant/lock-threads@v2
         with:
diff --git a/.github/workflows/pr-any.yml b/.github/workflows/pr-any.yml
index aa54c52de..135b5be94 100644
--- a/.github/workflows/pr-any.yml
+++ b/.github/workflows/pr-any.yml
@@ -8,11 +8,12 @@ jobs:
         step: ['lint', 'test', 'build']
     name: ${{ matrix.step }}
     runs-on: ubuntu-latest
+    env:
+      YARN_ENABLE_SCRIPTS: false
+      CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
     steps:
     - uses: actions/checkout@v2
     - name: ${{ matrix.step }}
-      env:
-        CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
       run: |
         yarn install --immutable | grep -v 'YN0013'
         yarn ${{ matrix.step }}
diff --git a/.github/workflows/push-master.yml b/.github/workflows/push-master.yml
index 6eb1c1e01..575ce02ed 100644
--- a/.github/workflows/push-master.yml
+++ b/.github/workflows/push-master.yml
@@ -12,16 +12,17 @@ jobs:
         step: ['build:release']
     name: ${{ matrix.step }}
     runs-on: ubuntu-latest
+    env:
+      YARN_ENABLE_SCRIPTS: false
+      GH_PAT: ${{ secrets.GH_PAT }}
+      GH_RELEASE_GITHUB_API_TOKEN: ${{ secrets.GH_PAT }}
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
     - uses: actions/checkout@v2
       with:
         fetch-depth: 0
         token: ${{ secrets.GH_PAT }}
     - name: ${{ matrix.step }}
-      env:
-        GH_PAT: ${{ secrets.GH_PAT }}
-        GH_RELEASE_GITHUB_API_TOKEN: ${{ secrets.GH_PAT }}
-        NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       run: |
         yarn install --immutable | grep -v 'YN0013'
         yarn ${{ matrix.step }}
@@ -34,13 +35,14 @@ jobs:
         step: ['build:release:ipfs']
     name: ${{ matrix.step }}
     runs-on: ubuntu-latest
+    env:
+      YARN_ENABLE_SCRIPTS: false
+      CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
+      PINATA_API_KEY: ${{ secrets.PINATA_API_KEY }}
+      PINATA_SECRET_KEY: ${{ secrets.PINATA_SECRET_KEY }}
     steps:
     - uses: actions/checkout@v2
     - name: ${{ matrix.step }}
-      env:
-        CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
-        PINATA_API_KEY: ${{ secrets.PINATA_API_KEY }}
-        PINATA_SECRET_KEY: ${{ secrets.PINATA_SECRET_KEY }}
       run: |
         yarn install --immutable | grep -v 'YN0013'
         ./scripts/ipfsPrep.sh
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 9c4afb9ae..d2339ac33 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -9,6 +9,8 @@ jobs:
   check:
     if: "! startsWith(github.event.head_commit.message, '[CI Skip]') && (!github.event.pull_request || github.event.pull_request.head.repo.full_name == github.repository)"
     runs-on: ubuntu-latest
+    env:
+      YARN_ENABLE_SCRIPTS: false
     steps:
       - uses: actions/checkout@v2
       - uses: returntocorp/semgrep-action@v1
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 000f30c00..68c1f828f 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -6,6 +6,8 @@ on:
 jobs:
   stale:
     runs-on: ubuntu-latest
+    env:
+      YARN_ENABLE_SCRIPTS: false
     steps:
       - uses: actions/stale@v3
         with: