The PR test LoC job fetched .github/scripts/pr-test-loc-*.mjs from
pull/<n>/head and ran them with node while holding a GITHUB_TOKEN scoped
pull-requests: write, so PR-authored code executed under a write token.
Pin the fetch to the repository default branch. base.sha is not enough:
for stacked PRs it is an unreviewed feature-branch commit any collaborator
can push to, while main is gated by branch protection.
Also pass event data via env instead of shell interpolation, and add
set -euo pipefail so a failed download cannot leave a truncated script.
* ci: color added/deleted LoC counts in PR summary
* ci: use GitHub color-swatch dots for added/deleted LoC counts
* ci: color LoC counts with LaTeX textsf
* ci: bold LoC counts; render zero in white
* ci: render LoC counts large bold sans-serif
* ci: use bold math font for LoC counts
* ci: color only the + and - signs on LoC counts
#14738 landed a template literal interpolating an untyped fetch url, which
fails audit:code-quality:type-aware. That audit runs in the static analysis
job, so main is currently red and every open PR inherits the failure.
Neil