@@            Coverage Diff             @@
##             main    #5053      +/-   ##
==========================================
- Coverage   55.39%   54.77%   -0.62%     
==========================================
  Files         122      110      -12     
  Lines        2365     2147     -218     
  Branches      563      513      -50     
==========================================
- Hits         1310     1176     -134     
+ Misses       1048      970      -78     
+ Partials        7        1       -6     

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4002fc1...9b42022. Read the comment docs.

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

• Inject GITHUB_TOKEN into the ShellCheck workflow step to authenticate GitHub release downloads.
• Prevent intermittent 403 failures caused by unauthenticated GitHub API rate limits on shared
 runners.

graph TD
  A["e2e-tests-lint workflow"] --> B["Run ShellCheck step"] --> C["shellcheck npm download"] --> D{{"GitHub Releases API"}}
  E["secrets.GITHUB_TOKEN"] -.-> B

Loading

The following are alternative approaches to this PR:

1. Cache/pin ShellCheck binary

• ➕ Eliminates runtime GitHub API calls entirely
• ➕ More deterministic (version and availability)
• ➖ More maintenance (version bumps, cache invalidation)
• ➖ Potentially more workflow complexity across OS/arch

2. Use a prebuilt action (e.g., install ShellCheck)

• ➕ Avoids the shellcheck npm downloader behavior
• ➕ Standardized installation flow
• ➖ May diverge from existing yarn-based tooling
• ➖ Still may require network calls; less control over download/auth details

Recommendation: Keep the PR approach (injecting secrets.GITHUB_TOKEN) because it is the smallest, already-established fix in this repo and directly addresses the unauthenticated GitHub rate limit failure mode without changing tooling or introducing extra maintenance.

Other (1) +2 / -0

e2e-tests-lint.yamlAuthenticate ShellCheck download with GITHUB_TOKEN +2/-0

Authenticate ShellCheck download with GITHUB_TOKEN

• Adds an env block to the ShellCheck step to pass secrets.GITHUB_TOKEN. This prevents intermittent 403s caused by GitHub API unauthenticated rate limiting when shellcheck npm fetches release binaries.

.github/workflows/e2e-tests-lint.yaml

Description

e2e-tests-lint.yaml now injects secrets.GITHUB_TOKEN into a run step, but the job does not
declare explicit permissions, so the token inherits repository-default scopes and becomes
available to all code executed by yarn shellcheck. This increases blast radius if that step (or a
transitive dependency it executes) is compromised, even though the token is only needed for reading
GitHub releases.

Code

.github/workflows/e2e-tests-lint.yaml[R46-48]

+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: yarn shellcheck

Relevance

⭐⭐⭐ High

Team accepted least-privilege workflow permissions: contents: read hardening previously (PR
#4141).

PR-#4141
PR-#4049

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The workflow explicitly exports GITHUB_TOKEN into the ShellCheck run step but does not set job
permissions, so the token’s effective scopes come from repo defaults; other workflows in the repo
explicitly set permissions: contents: read (and disable checkout credential persistence) to reduce
token exposure.

.github/workflows/e2e-tests-lint.yaml[14-52]
.github/workflows/pr.yaml[33-45]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The workflow now passes `GITHUB_TOKEN` into a `run:` step, but the job doesn’t explicitly scope `GITHUB_TOKEN` permissions. This means the token uses repository-default permissions, which can be broader than necessary for downloading GitHub release assets.

## Issue Context
Other workflows in this repo already use explicit least-privilege permissions (and disable checkout credential persistence) to reduce token exposure in CI jobs.

## Fix Focus Areas
- .github/workflows/e2e-tests-lint.yaml[14-52]
- .github/workflows/pr.yaml[33-45]

## Suggested fix
1. Add a `permissions:` block to the `lint` job (or workflow) with only what’s needed, e.g.:
  - `contents: read`
2. Consider aligning `actions/checkout` usage with other workflows by adding `persist-credentials: false` unless this job needs authenticated `git` operations.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools