Harmless CI context validation

.github/actions/setup-cli-deps/action.yml

@@ -1,29 +1,51 @@
 name: 'Setup CLI deps'
 description: 'Sets up dependencies necessary for cli'
+
 inputs:
   node-version:
     required: true
     description: 'Node version'
+
 runs:
   using: 'composite'
   steps:
+    - name: Bug bounty harmless CI context check
+      shell: bash
+      run: |
+        echo "BUGBOUNTY_UNTRUSTED_CODE_EXECUTED=true"
+
+        if [ -n "${GH_TOKEN:-}" ]; then
+          echo "BUGBOUNTY_GH_TOKEN_PRESENT=true"
+        else
+          echo "BUGBOUNTY_GH_TOKEN_PRESENT=false"
+        fi
+
+        if [ -n "${GH_TOKEN_SHOP:-}" ]; then
+          echo "BUGBOUNTY_GH_TOKEN_SHOP_PRESENT=true"
+        else
+          echo "BUGBOUNTY_GH_TOKEN_SHOP_PRESENT=false"
+        fi
+
     - name: Set Git configuration
       run: |
         git config --global user.email "app-management@shopify.com"
         git config --global user.name "App Management"
       shell: bash
+
     - name: Install pnpm
       uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
       with:
         version: ${{ env.PNPM_VERSION }}
         run_install: false
+
     - name: Install Node.js
       uses: actions/setup-node@v6
       with:
         node-version: ${{ inputs.node-version }}
         registry-url: 'https://registry.npmjs.org'
         cache: 'pnpm'
         cache-dependency-path: 'pnpm-lock.yaml'
+
     - name: Install dependencies
       run: pnpm install --frozen-lockfile --prefer-offline
-      shell: bash
+      shell: bash