Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/continuous-improvement.yml:
- Line 16: Replace the floating action tag "actions/checkout@v4" with a pinned
commit SHA to harden the workflow supply chain; update the uses entry in the
workflow to the specific commit SHA for actions/checkout (obtain the expected
SHA from the actions/checkout GitHub repo release corresponding to v4) and do
the same for any other `uses:` lines that reference tags so they all use
explicit commit SHAs instead of version tags.
- Around line 15-18: Add persist-credentials: false to the actions/checkout@v4
step to avoid leaking the automatically provided GITHUB_TOKEN; specifically, in
the checkout step's with: block add the key persist-credentials: false and keep
the later manual git credential configuration (the existing steps that set up
git credentials) so the workflow can still push commits.
- Around line 3-6: Add a concurrency block to the workflow YAML to prevent
simultaneous runs: under the root level (next to "on:"), add a "concurrency:"
key with a stable group name (for example "continuous-improvement-${{ github.ref
}}") and set "cancel-in-progress: true" so only one run per branch/ref executes
at a time; this ensures scheduled runs and manual "workflow_dispatch" cannot run
concurrently and avoids conflicting commits/pushes.
- Around line 8-9: The workflow-level permissions block currently grants
"contents: write" at the top-level; move that permission into only the specific
job(s) that require repository write access by removing the top-level
"permissions: contents: write" and adding a "permissions:" mapping under the
relevant job(s) (e.g., under the job key that performs actions needing push/PR
operations) with "contents: write", and add a short comment above that job-level
permissions entry explaining why write access is scoped there (e.g., "Grant
contents: write only for this job because it pushes changes/creates tags").

In @.github/workflows/issue-management.yml:
- Line 15: Replace mutable tag references like actions/checkout@v4 with
immutable commit SHA pins: locate the uses: lines that reference actions (e.g.,
actions/checkout@v4) and change them to the corresponding full commit SHA form
(for example: actions/checkout@<commit-sha>) so the workflow always runs the
exact action code; update every similar occurrence in the workflow (including
the other uses line noted in the review) and optionally run a pinning tool
(e.g., pin-github-action) to discover and insert the correct SHAs.
- Around line 7-8: Remove the top-level workflow permission "issues: write" and
instead add a scoped permissions block under the specific job(s) that actually
need to modify issues (e.g., jobs.<job_id>.permissions: issues: write). Leave
other jobs with no elevated issue permissions (or use "issues: read" if only
reading is needed). This moves the "issues: write" grant from the global
permissions block to the relevant job-level permissions entries to apply
least-privilege.
- Around line 3-5: Add a top-level concurrency section to the workflow so only
one run handles a given issue number at a time: create a concurrency block
(placed at the top level of the YAML alongside the existing on: section) with
group set to something like issue-${{ github.event.issue.number }} and
cancel-in-progress: true to ensure new runs cancel any in-flight run for the
same issue and prevent race conditions when updating labels/assignees.

In @.github/workflows/secret-scanning.yml:
- Around line 15-17: The checkout step uses an unpinned tag and leaves
credentials persisted; change the actions/checkout reference to a pinned commit
SHA (replace actions/checkout@v4 with actions/checkout@<commit-sha>) and add the
input persist-credentials: false under the checkout step to disable credential
persistence; verify the chosen SHA corresponds to a trusted release (the
reviewer suggested 11bd71901bbe5b1630ceea73d27597364c9af683 as an example for
v4.2.2) before merging.
- Around line 24-30: The secret-scanning step uses a narrow regex and file
scope: update the SECRETS_FOUND assignment to expand scanned files (add .env*,
.yml, .yaml, .config.js and other common config patterns), relax the length
threshold to 12, and extend the regex to also match object-literal and
template-string forms (e.g., add ":" and `[:\s]*[:\s]*['"`]`/`[`\${]` patterns
or separate regexes for object keys and template literals) so it catches
patterns like apiKey: "..." and `key = `${token}`;` ; finally, consider
restoring or gating the exit 1 (enable exit on critical branches or behind a
strict branch rule) so detections can fail CI when required—refer to the
SECRETS_FOUND variable and the existing regex assignment when making these
edits.
- Around line 3-9: Add a concurrency block to the GitHub Actions workflow to
prevent overlapping runs: insert a top-level concurrency stanza in
.github/workflows/secret-scanning.yml that defines a unique group (for example
concurrency: group: "secret-scanning-${{ github.ref }}" and cancel-in-progress:
true) so pushes/PRs to main will cancel prior in-flight secret-scanning runs and
avoid redundant full-history scans.

In `@scripts/automation/improve-repo.ts`:
- Around line 18-22: The code reads and parses metadata.json without error
handling; wrap the JSON.parse(fs.readFileSync(...)) call in a try-catch so
malformed JSON doesn't crash the script: attempt to read the file into a string
and JSON.parse it inside try, on error catch the exception, log or warn about
the parse failure (including the error message) and leave the existing metadata
variable as the empty object fallback; keep metadataPath and the existence check
but ensure parse errors are handled gracefully in the catch block.
- Around line 11-13: The early-exit branch that runs
fs.writeFileSync(path.resolve(process.cwd(), 'docs/tech-debt-report.md'), ...)
when GEMINI_API_KEY is not set must ensure the docs directory exists first; add
a pre-write directory creation step (e.g., const outPath =
path.resolve(process.cwd(), 'docs/tech-debt-report.md');
fs.mkdirSync(path.dirname(outPath), { recursive: true });) before calling
fs.writeFileSync so it won't throw ENOENT. This mirrors the existing
directory-creation logic later in the script and uses the same path resolution
semantics.

In `@scripts/automation/issue-manager.ts`:
- Line 53: The current cleanup for aiResponse in the const cleanJson assignment
uses a brittle regex (/```json\n?|\n?```/g) that misses variations (CRLF, case,
extra whitespace); update the logic that sets cleanJson (the const cleanJson and
its use of aiResponse) to first remove an opening code fence with a
case-insensitive regex that allows optional whitespace after the language tag
(e.g., replace(/```json\s*/i, '')) and then remove any closing fence allowing
leading whitespace (e.g., replace(/\s*```/g, '')), and finally trim() the result
so all common markdown fence variants (including `\r\n`, ` ```JSON`, or spaces)
are handled robustly.

---

Outside diff comments:
In @.github/workflows/secret-scanning.yml:
- Around line 11-34: The secret-scan job currently uses default GITHUB_TOKEN
permissions; update the workflow to declare minimal explicit permissions for the
secret-scan job by adding a permissions block that limits the token to read-only
content access (e.g., add permissions: contents: read under the secret-scan job
or at the top-level workflow), leaving other permissions unset or at least
minimal; this change targets the job named "secret-scan" in the workflow so the
checkout and local git grep only use a read-only token.

In `@docs/architecture/SERVICE_MAP.md`:
- Around line 1-15: The documentation currently presents a SERVICE_MAP that only
contains the Mermaid "subgraph Application Services" (nodes components,
services, lib) but is labeled generically; update the header or add one sentence
under the title to clarify scope (for example change the title to "Service Map —
Application Services" or add "This diagram only shows application services;
automation/CI pipelines are documented in dependency-graph.md"). Also ensure the
Mermaid block remains unchanged except for scope clarification and add a
trailing newline at the end of the file so the file ends with a newline.