diff --git a/.github/actions/run-browserstack-maestro/action.yml b/.github/actions/run-browserstack-maestro/action.yml
index 1380f332..bfcf82d0 100644
--- a/.github/actions/run-browserstack-maestro/action.yml
+++ b/.github/actions/run-browserstack-maestro/action.yml
@@ -74,7 +74,7 @@ runs:
         TIMEOUT: ${{ fromJson(inputs.timeout) }}
         MAX_ATTEMPTS: ${{ fromJson(inputs.max_attempts) }}
       shell: bash
-      run: |
+      run: | #shell
         set -o pipefail
 
         API="https://api-cloud.browserstack.com/app-automate/maestro/v2"
@@ -256,7 +256,7 @@ runs:
         BROWSERSTACK_USERNAME: ${{ inputs.browserstack_username }}
         BROWSERSTACK_ACCESS_KEY: ${{ inputs.browserstack_access_key }}
       shell: bash
-      run: |
+      run: | #shell
         [[ "$BUILD_ID" == "null" ]] && exit 0
         echo "Stopping BrowserStack build $BUILD_ID"
         curl --show-error -s -u "$BROWSERSTACK_USERNAME:$BROWSERSTACK_ACCESS_KEY" \
diff --git a/.github/workflows/bump-first-party-deps.yml b/.github/workflows/bump-first-party-deps.yml
index afb9fbc5..d12c38a0 100644
--- a/.github/workflows/bump-first-party-deps.yml
+++ b/.github/workflows/bump-first-party-deps.yml
@@ -36,7 +36,7 @@ jobs:
       - uses: actions/create-github-app-token@v3
         id: app-token
         with:
-          app-id: ${{ vars.PR_BOT_APP_ID }}
+          client-id: ${{ vars.PR_BOT_CLIENT_ID }}
           private-key: ${{ secrets.PR_BOT_PRIVATE_KEY }}
 
       - uses: actions/checkout@v7
@@ -48,7 +48,7 @@ jobs:
           node-version-file: package.json
 
       - name: Bump in lockfiles
-        run: |
+        run: | #shell
           set -euo pipefail
           for dir in . backend; do
             ( cd "$dir"
@@ -69,7 +69,7 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
           BOT_USER_ID: ${{ vars.PR_BOT_USER_ID }}
-        run: |
+        run: | #shell
           set -euo pipefail
           if git diff --quiet; then echo "${PACKAGE} already current; nothing to bump."; exit 0; fi
           slug="${PACKAGE#@}"; slug="${slug//\//-}"
diff --git a/.github/workflows/detect-heavy-ci.yml b/.github/workflows/detect-heavy-ci.yml
index 11273afb..eaa9b673 100644
--- a/.github/workflows/detect-heavy-ci.yml
+++ b/.github/workflows/detect-heavy-ci.yml
@@ -27,7 +27,7 @@ jobs:
       - uses: actions/github-script@v9
         id: script
         with:
-          script: |
+          script: | #js
             const ev = context.eventName;
             // Manual dispatch is an explicit request — run unconditionally.
             if (ev === 'workflow_dispatch') {
diff --git a/.github/workflows/e2e-reusable.yml b/.github/workflows/e2e-reusable.yml
index a785b882..78990b5a 100644
--- a/.github/workflows/e2e-reusable.yml
+++ b/.github/workflows/e2e-reusable.yml
@@ -61,7 +61,7 @@ jobs:
       - uses: actions/github-script@v9
         id: classify
         with:
-          script: |
+          script: | #js
             const ev = context.eventName;
             // Manual dispatch is an explicit request — run unconditionally.
             if (ev === 'workflow_dispatch') {
@@ -262,7 +262,7 @@ jobs:
 
       - name: Build .ipa
         working-directory: apps/e2e/ios
-        run: |
+        run: | #shell
           xcodebuild archive \
             -workspace corereactnativee2e.xcworkspace \
             -scheme corereactnativee2e \
@@ -304,7 +304,7 @@ jobs:
         env:
           BROWSERSTACK_ACCESS_KEY: ${{ secrets.BROWSERSTACK_ACCESS_KEY_TESTS }}
           BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME_TESTS }}
-        run: |
+        run: | #shell
           RESPONSE=$(curl --show-error -sS -w '\n%{http_code}' \
             -u "$BROWSERSTACK_USERNAME:$BROWSERSTACK_ACCESS_KEY" \
             -X POST "https://api-cloud.browserstack.com/app-automate/upload" \
@@ -343,7 +343,7 @@ jobs:
         env:
           BROWSERSTACK_ACCESS_KEY: ${{ secrets.BROWSERSTACK_ACCESS_KEY_TESTS }}
           BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME_TESTS }}
-        run: |
+        run: | #shell
           RESPONSE=$(curl --show-error -sS -w '\n%{http_code}' \
             -u "$BROWSERSTACK_USERNAME:$BROWSERSTACK_ACCESS_KEY" \
             -X POST "https://api-cloud.browserstack.com/app-automate/upload" \
@@ -388,7 +388,7 @@ jobs:
         env:
           BROWSERSTACK_ACCESS_KEY: ${{ secrets.BROWSERSTACK_ACCESS_KEY_TESTS }}
           BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME_TESTS }}
-        run: |
+        run: | #shell
           ZIP_NAME="flows.zip"
 
           zip -r "$ZIP_NAME" maestro/e2e.yaml maestro/fgs-restart.yaml maestro/rootkey-persistence.yaml
@@ -509,7 +509,7 @@ jobs:
           UPLOAD_SUITE: ${{ needs.upload-test-suite.result }}
           TEST_ANDROID: ${{ needs.test-android.result }}
           TEST_IOS: ${{ needs.test-ios.result }}
-        run: |
+        run: | #shell
           set -euo pipefail
           echo "changes=$CHANGES run_e2e=$RUN_E2E"
           echo "build: android=$BUILD_ANDROID ios=$BUILD_IOS"
diff --git a/.github/workflows/e2e-trusted.yml b/.github/workflows/e2e-trusted.yml
index 3897a34d..fc40e510 100644
--- a/.github/workflows/e2e-trusted.yml
+++ b/.github/workflows/e2e-trusted.yml
@@ -84,7 +84,7 @@ jobs:
       - name: Remove safe-to-test label on new commits
         env:
           GH_TOKEN: ${{ github.token }}
-        run: |
+        run: | #shell
           gh pr edit "${{ github.event.pull_request.number }}" \
             --repo "${{ github.repository }}" \
             --remove-label safe-to-test || true
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index 55e4e193..36936a12 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -57,7 +57,7 @@ jobs:
       # Title-only — never checks out PR code, so pull_request_target is safe here.
       - uses: actions/github-script@v9
         with:
-          script: |
+          script: | #js
             const title = context.payload.pull_request.title;
             const body = context.payload.pull_request.body || '';
             const m = title.match(/^(\w+)(\(([\w$.\-*/ ]+)\))?(!)?:/);