Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.dockerignore:
- Around line 7-8: Remove the allowlist entries that expose local secret files
(the lines matching "!.env" and "!.env*") and instead explicitly allow only
non-secret template files (for example add patterns like "!.env.example" or
"!.env.template" or specific template filenames you ship) so real .env files
remain excluded from the Docker build context; update the .dockerignore by
deleting the "!.env" / "!.env*" entries and adding explicit template patterns
for any env templates you need to include.

In @.env.test:
- Line 29: The VITE_APP_OIDC_SCOPE environment variable is unquoted and contains
spaces; update the VITE_APP_OIDC_SCOPE entry to wrap the multi-word value in
quotes (e.g., "openid profile email") so dotenv parses it consistently (match
the quoted style used in .env.example) and ensure any tooling that reads
VITE_APP_OIDC_SCOPE receives the full space-separated scope string.

In @.github/workflows/ci.yml:
- Line 12: Replace the mutable branch ref used for the reusable workflow with a
pinned commit SHA: update the uses entry
"City-of-Helsinki/.github/.github/workflows/ci-pnpm-node.yml@main" to point to
the exact commit hash (i.e.
"City-of-Helsinki/.github/.github/workflows/ci-pnpm-node.yml@<commit-sha>")
obtained from the repo (for example via the gh API or git) so the workflow is
immutable and supply-chain secure.

In `@package.json`:
- Line 116: The package.json npm script "test:debug" contains a typo in its
flags: replace the incorrect "----no-file-parallelism" with the correct
"--no-file-parallelism" in the "test:debug" script so the flag uses two hyphens;
update the value of the "test:debug" entry to use the corrected flag.

In `@pipelines/kultus-admin-ui-review.yml`:
- Around line 44-45: Remove the temporary pinned pipeline ref by deleting the
line containing "ref: refs/heads/feat/PT-2045-replace-yarn-with-pnpm" (and the
preceding TODO comment) in the pipelines/kultus-admin-ui-review.yml so the
pipeline no longer targets this PR branch; if a stable branch or tag is required
instead, replace that value with the intended branch/ref.

In `@pnpm-workspace.yaml`:
- Around line 1-3: The current minimumReleaseAge in pnpm-workspace.yaml is set
to 10 minutes which weakens supply-chain protections; update the
minimumReleaseAge setting to a more secure value (e.g., 1440 for 24 hours or
10080 for 1 week) in the pnpm-workspace.yaml file by changing the
minimumReleaseAge entry to the chosen higher integer to allow time for community
vetting and reduce risk from compromised or malicious new releases.

In `@src/clients/apiReportClient/apiReportClient.ts`:
- Around line 6-8: Ensure we fail fast if the environment var is missing: check
getEnvValue('VITE_APP_API_REPORT_URI') before creating axiosClient and throw a
clear error (or process.exit) when it's undefined/empty so axios.create({
baseURL: ... }) never receives an undefined baseURL; update the module that
defines axiosClient (the axiosClient constant in apiReportClient.ts) to read the
env into a local variable, validate it, and only then pass it into axios.create.

In `@src/index.tsx`:
- Around line 26-28: The tracePropagationTargets value produced by
getEnvValue('VITE_APP_SENTRY_TRACE_PROPAGATION_TARGETS') is split into [''] when
unset, which `@sentry/browser` treats as a wildcard; update the logic that builds
tracePropagationTargets so you split the env string, trim each entry, filter out
empty strings, and only include the tracePropagationTargets option when the
resulting array has at least one entry (otherwise omit the option so Sentry uses
its default allowlist). Reference the tracePropagationTargets assignment and the
getEnvValue call to locate and replace the current .split(',') handling.

In `@src/utils/getLinkedEventsInternalId.ts`:
- Around line 4-8: The helper getLinkedEventsInternalId builds a URL using
getEnvValue('VITE_APP_LINKEDEVENTS_API_URI') without guarding for a
missing/empty value, which can produce invalid IDs; update
getLinkedEventsInternalId to validate the env value returned by
getEnvValue('VITE_APP_LINKEDEVENTS_API_URI') (throw or return a clear
error/empty result) before interpolating, and construct the path using a
normalized base (ensure no duplicate slashes) so functions referencing
getLinkedEventsInternalId get only well-formed URLs.

---

Outside diff comments:
In `@src/test/apollo-mocks/headerMenuMock.ts`:
- Around line 15-527: The footer mock still uses padded base64 IDs (e.g.,
menu.id 'dGVybTo1Nw==' and menuItems.nodes[].id 'cG9zdDo0MjY=', 'cG9zdDo0Mjc=')
while headerMenuMock uses unpadded IDs; update
src/test/apollo-mocks/footerMenuMock.ts to use the unpadded forms (remove
trailing '=' padding) for the same fields so they match the MenuQueryResponse
shape used elsewhere (update the values for menu.id and each
menuItems.nodes[].id), or add a short comment in the file documenting that
padded IDs are intentionally kept if that was the deliberate choice.

---

Nitpick comments:
In @.env.runtime.template:
- Around line 23-24: Add a short comment above VITE_APP_APPLICATION_NAME and
VITE_APP_VERSION explaining these values are auto-populated/overridden by the
generator script from package.json (so values in this template are ignored) or
remove these lines entirely; update the .env.runtime.template to either include
that explanatory comment referencing VITE_APP_APPLICATION_NAME and
VITE_APP_VERSION or delete those two entries to avoid confusion.

In @.env.test:
- Around line 5-6: Remove the non-expanding placeholder assignments for
VITE_APP_APPLICATION_NAME and VITE_APP_VERSION in .env.test (the lines using
$npm_package_name and $npm_package_version); either delete these two lines or
replace them with concrete values (e.g., the actual app name and version) so
dotenv isn't given unusable placeholders—note the generator already pulls these
from package.json, so keep .env.test free of $npm_package_* placeholders and
rely on the generator or explicit literal values instead.

In @.github/workflows/ci.yml:
- Around line 11-16: The workflow currently inherits default permissions for the
reusable job "common" (uses:
City-of-Helsinki/.github/.github/workflows/ci-pnpm-node.yml@main); add an
explicit permissions block under that job to restrict token scopes to the
minimum required by the reusable workflow (e.g., explicitly set permissions:
contents: read, packages: read, pull-requests: write or whatever the reusable
workflow needs) instead of relying on defaults—review the reusable workflow's
steps to determine exact scopes and add only those permission keys.

In `@scripts/update-runtime-env.ts`:
- Around line 28-31: The path for configurationFile is built with string
concatenation; update the construction to use path.join for cross-platform
correctness. In the configurationFile assignment (the variable named
configurationFile that currently uses __dirname and configFile), call path.join
with components (e.g., __dirname, '..', 'public', configFile) instead of
concatenating '../public/' + configFile so separators are handled correctly
across OSes.

In `@src/utils/__tests__/envUtils.test.ts`:
- Around line 5-34: Add a test that verifies getEnvValue falls back to
process.env: set (globalThis.window as Window & { _env_?: Record<string,
unknown> })._env_ = undefined, assign process.env.TEST_ENV_UTILS_VALUE = '456'
(or another distinct value), then assert
expect(getEnvValue('TEST_ENV_UTILS_VALUE')).toBe('456'); name the test to
reflect the "process.env fallback" and rely on the existing afterEach cleanup
that deletes TEST_ENV_UTILS_VALUE and restores process.env/runtime env.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile`:
- Line 19: The Dockerfile COPY currently uses a wildcard `.env*` which can
accidentally include local secret files; update the COPY command that includes
index.html, vite.config.ts, eslint.config.mjs, .prettierrc.json to explicitly
list only allowed env template files (e.g., .env.example or .env.production)
instead of `.env*`, ensuring you preserve the --chown=default:root flag and only
add the specific filenames you intend to bake into the image so secrets like
.env.local are not copied into image layers.

In `@README.md`:
- Line 310: The ordered list in README.md has a numbering gap: the step "Run the
Node application in development mode with `pnpm dev`. At this point you should
be also running the local APIs if you have selected to use them." is labeled
`5.` but should follow the previous top-level `3.` — change that list item to
`4.` (or renumber the sequence so top-level steps are sequential) and verify
nested items/indentation are correct so Markdown renders the steps in proper
order.

In `@scripts/update-runtime-env.ts`:
- Around line 17-23: The code is currently serializing the entire env map (env)
into the public browser config, exposing non-public keys; update the logic that
writes/serializes env so it filters env to only include public keys (e.g., keys
that start with "VITE_APP_" or your chosen public prefix) before creating the JS
output. Locate the dotenv.config usage and the code that writes the browser
config from env (references: env, USE_TEST_ENV) and replace the direct
serialization with a new object built by iterating env and copying only keys
matching /^VITE_APP_/ (or configured public prefix), then serialize that
filtered object into the generated file. Ensure override behavior is preserved
and no other env values are written to the client bundle.

---

Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 10-16: Add an explicit least-privilege permissions block to the
workflow job (the "common" job that uses
City-of-Helsinki/.github/.github/workflows/ci-pnpm-node.yml@main) so the
workflow token isn't granted repo/org defaults; insert a top-level permissions:
mapping that declares only the scopes required by your CI (for example at
minimum permissions: contents: read and actions: read, and add checks: write or
id-token: write only if the shared workflow requires them) to harden the
workflow.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile`:
- Around line 16-19: The Dockerfile runs the command pnpm update-runtime-env
before the .env.runtime.template is added to the image, causing builds to fail
or produce wrong runtime config; fix by ensuring .env.runtime.template (or other
env templates) are copied into the image before invoking pnpm
update-runtime-env—either move the pnpm update-runtime-env step to after the
COPY that includes .env* or add an earlier COPY that places
.env.runtime.template into the image prior to running pnpm update-runtime-env so
the update-runtime-env script can read the template.

In `@src/headless-cms/components/__tests__/CmsPage.test.tsx`:
- Around line 124-131: Update the test comment to correctly describe why we pass
deterministic overrides to fakePost: the id/postId values are used only as React
keys in CmsSidebarContent (not as DOM id attributes for LayoutArticles); the
sidebar HTML id is generated from LayoutLinkList.anchor in
CmsSidebarContentLayoutLinkList.tsx, which is what the test queries—so change or
remove the current comment to state that deterministic values keep React keys
stable rather than claiming jsdom selector safety.

---

Duplicate comments:
In `@Dockerfile`:
- Line 19: The Dockerfile COPY line currently uses a glob `.env*` which risks
including local secret env files; update the COPY invocation that contains "COPY
--chown=default:root index.html vite.config.ts eslint.config.mjs
.prettierrc.json .env* ./" to explicitly list only safe template/example env
files (for example `.env.example` and/or `.env.template`) instead of the `.env*`
glob so no accidental local `.env` or `.env.local` files are baked into the
image.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 381-383: The README’s doctoc example command ("pnpm doctoc .")
does not match the pre-commit hook which runs "pnpm doctoc . -u"; update the
README entry to use the exact command used by the hook ("pnpm doctoc . -u") so
docs match behavior, or alternatively change the hook to remove the "-u"
flag—make the change where the README lists the doctoc command and ensure the
string "pnpm doctoc . -u" is used if choosing to align docs to the hook.
- Line 386: Update the README line that points to the lint-staged config:
replace the incorrect reference to "./lint-staged.config.js" with an instruction
that the lint-staged configuration lives in package.json under the "lint-staged"
field (e.g., mention "see package.json -> lint-staged"). Ensure the command
description remains the same and that the README clearly directs readers to the
package.json lint-staged entry.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 11-16: Add an explicit GitHub Actions permissions block
immediately under the reusable workflow invocation (the common: uses:
City-of-Helsinki/... entry) to avoid default token scopes; update the job that
contains the uses: line (the "common" job) to include a minimal permissions set
that only grants what CI needs (for example, at minimum contents: read and
actions: read, and add checks: write or id-token: write only if the workflow
actually requires them)—ensure you place the new permissions: block at the same
level as uses:, secrets:, and with: and remove reliance on default scopes.

In `@index.html`:
- Around line 51-52: Update the development command in the HTML template
comment: replace the incorrect "pnpm start" string with the project's actual dev
command "pnpm dev" in the comment block that currently reads "To begin the
development, run `pnpm start`." so the docs match the real script used by the
project.