Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/merge-jules.yml:
- Around line 1-8: Add an explicit top-level permissions stanza to the "Merge
Jules" workflow instead of relying on defaults: add a permissions block (key
name "permissions") at the top-level of the YAML and grant only the minimum
scopes needed by the merge jobs (for example pull-requests: write, contents:
read, checks: read, id-token: write or none if not used); ensure you remove
broad defaults and keep permissions scoped to the exact actions your jobs use.
Reference adding the top-level "permissions:" key in the same file where "name:
Merge Jules" and triggers (workflow_dispatch, push, pull_request) are defined
and update any job steps that require different scopes to explicitly request
them if needed.
- Line 13: The workflow is pinning an old checkout action ("uses:
actions/checkout@v2") which depends on Node 12; update every occurrence of the
checkout step (the lines that say "uses: actions/checkout@v2") to a current
release (e.g., "uses: actions/checkout@v4" or "@v3") to move off Node 12, test
the workflow, and ensure any inputs (fetch-depth, path, etc.) remain valid with
the newer action version.
- Line 17: Replace the mutable tag usage of the third‑party action
"bobvanderlinden/combine-pull-requests@v4" with the corresponding full commit
SHA across all occurrences of that action string in the workflow; update each
"uses: bobvanderlinden/combine-pull-requests@v4" entry to "uses:
bobvanderlinden/combine-pull-requests@<full-sha>" and add a trailing comment
preserving the original `@v4` tag for future reference (e.g., "# pinned from `@v4`")
so it remains clear which tag/version was pinned and can be updated via
Dependabot/Renovate.
- Around line 2-7: The job conditions currently assume a pull_request label
context and exclude manual runs; update each job (e.g., the sentinel and bolt
jobs) so they allow workflow_dispatch and avoid accessing github.event.label
unless the event is a pull_request with action that provides a label: prefix the
existing label-based condition with "github.event_name == 'workflow_dispatch'
||" to permit manual runs, and wrap any uses of github.event.label in a guard
like "github.event_name == 'pull_request' && github.event.action == 'labeled' &&
github.event.label.name == '...'" (or similarly check actions/opened) so opened
events do not reference missing label fields; apply the same pattern to sentinel
and bolt job conditions.

In @.github/workflows/merge-pr.yml:
- Line 3: The job condition currently blocks manual runs because it expects
github.event_name == 'push' and reads github.event.label (which only exists for
label actions); update the job-level if expression to explicitly allow
workflow_dispatch and to safely check PR labels by using github.event_name and
the pull_request labels array (e.g. github.event_name == 'workflow_dispatch' ||
github.event_name == 'push' || (github.event_name == 'pull_request' &&
contains(github.event.pull_request.labels.*.name, 'your-label')) ), and avoid
reading github.event.label directly; modify the existing if that references
github.event_name and github.event.label to this combined, null-safe expression
so manual triggers, pushes, and PRs with the target label all run.

In `@close_prs.py`:
- Around line 14-21: The current loop that checks "if 'github.com' in line" is
vulnerable to substring attacks; replace that naive check by parsing each line
as a URL (use urllib.parse.urlparse) and verify parsed.hostname == 'github.com'
(or parsed.netloc appropriately) before extracting credentials; then obtain the
username/password via parsed.username/parsed.password (or parsed.netloc split)
instead of splitting on '@' and '//' so only credentials for the real github.com
host are returned (update the loop that iterates over variable line and the
userpass/parts extraction logic accordingly).
- Around line 25-30: Fix the indentation and make YAML parsing robust in the
block that reads ~/.config/gh/hosts.yml in close_prs.py: remove the stray extra
space before the with statement so the try/with are aligned, and stop splitting
on every ':'; either parse the file with yaml.safe_load and read the oauth_token
key, or at minimum change line.split(':') to line.split(':', 1). Ensure you
reference the same token-extraction logic (the code that checks if
'oauth_token:' in line) when making the change.

In `@list_all_env.py`:
- Around line 3-5: The script prints partial secrets by slicing environment
values in the loop (for key, value in os.environ.items())—replace that behavior
with masked output: reuse the masking logic from list_env.py (or implement a
mask_value(key, value) helper) and call it for each key so only non-sensitive
metadata or a masked version of sensitive values is printed; ensure tokens,
passwords, API keys and any key matching common secret patterns are obfuscated
rather than showing the first 20 characters.

In `@playwright.config.ts`:
- Line 79: The SUPABASE_URL in the Playwright startup command is pointing to
PostgreSQL port 5432 (in the command string containing
SUPABASE_URL="http://localhost:5432"), which is incorrect for the Supabase REST
API; update the command to use the API port 54321 (e.g.,
SUPABASE_URL="http://localhost:54321") so `@supabase/supabase-js` talks to the
REST API, and remove or correct the misleading inline comment about port 5432;
keep the change confined to the command string in playwright.config.ts.

In `@src/layouts/General.astro`:
- Around line 33-43: Replace the hardcoded ProductBridge script URL and org ID
and the unconditional ProductBridge.init call by reading
PUBLIC_PRODUCTBRIDGE_URL and PUBLIC_PRODUCTBRIDGE_ORG_ID environment variables
and only loading/initializing when the cookie consent API indicates acceptance;
specifically, change the script injection that sets s.src and the
ProductBridge.init block in src/layouts/General.astro to use
import.meta.env.PUBLIC_PRODUCTBRIDGE_URL and
import.meta.env.PUBLIC_PRODUCTBRIDGE_ORG_ID (or your framework's PUBLIC_ prefix)
and wrap the script creation + ProductBridge.init in a consent check against
your cookieconsent API (e.g., CookieYes/cookieyes) so the script is fetched and
ProductBridge.init is run only after consent is granted.

---

Nitpick comments:
In `@close_prs.py`:
- Around line 101-119: Add a timeout argument to all urllib.request.urlopen
calls to prevent indefinite hangs: update the two urlopen calls that use
close_req and del_req to call urllib.request.urlopen(close_req, timeout=10) and
urllib.request.urlopen(del_req, timeout=10) (pick an appropriate seconds value
for your environment), and do the same for the initial PR fetch urlopen call
earlier in the script (the one that performs the initial PR list/request) so
every external HTTP request uses a timeout.

In `@get_token.py`:
- Around line 1-3: Remove the unused json import from get_token.py: delete the
"import json" line and keep only the necessary imports (e.g., urllib.request and
os) so the module no longer imports an unused symbol; run linting or tests to
confirm no usage of json remains (search for "json" references) before
committing.

In `@list_env.py`:
- Around line 4-10: Extract the long filter into a clear boolean using a
collection of sensitive terms and helper vars: create e.g. sensitive_terms =
{'token','pass','key','auth','git'} and compute is_sensitive_key = any(term in
key.lower() for term in sensitive_terms) and is_long_value = len(value) > 20,
then replace the big if with if is_sensitive_key or is_long_value; keep the
special-case branch that masks token keys by checking if 'token' in key.lower()
when printing. This refactors the loop over os.environ (for key, value in
os.environ.items()) for readability without changing behavior.

In `@src/layouts/General.astro`:
- Around line 28-47: This PR unintentionally adds a third-party widget injection
(the inline script that creates a script element with src
'https://test.productbridge.io/sdk/pb-widget.js' and calls ProductBridge.init)
into the global layout; remove that entire script block from this change and
revert the modifications around the floating button (the inline <script> that
appends pb-widget.js and calls ProductBridge.init with
organizationId/position/theme/buttonColor/buttonText) so this PR only contains
the date-formatting perf work, then create a separate feature PR that adds the
widget script (or implements it behind a feature flag) so it can be reviewed,
tested, and rolled back independently.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@close_prs.py`:
- Around line 105-116: The branch deletion code interpolates pr['head']['ref']
into del_url without URL-encoding, so branch names with slashes or special chars
break the request; update the branch handling in close_prs.py to URL-encode the
branch variable before building del_url (use urllib.parse.quote on branch, e.g.,
quote(branch, safe='') to ensure slashes and special characters are encoded),
and then use the encoded value when constructing del_url and sending the DELETE
request (references: variable branch, del_url, and the DELETE request creation
using urllib.request.Request).

---

Duplicate comments:
In `@close_prs.py`:
- Around line 15-21: The credential parsing incorrectly requires exactly two '@'
parts; change the logic in the block that builds parts = line.strip().split('@')
so it checks the host with parts[-1] == 'github.com' and derives the userpass by
joining all parts except the last (e.g., '@'.join(parts[:-1])) then splitting by
'//' and extracting the token after ':' as done currently; update the condition
(remove len(parts) == 2) and use parts[-1] and the joined prefix to correctly
handle tokens containing '@'.

---

Nitpick comments:
In `@close_prs.py`:
- Around line 95-100: The PATCH request building block (close_url, data,
close_req) is missing the Content-Type header for the JSON payload; update the
code that constructs close_req to add close_req.add_header('Content-Type',
'application/json') (alongside the existing Authorization and Accept headers) so
the JSON body encoded from json.dumps(...) is explicitly declared when closing
PRs identified by pr_num using the provided token.