Check if this issue is valid — if so, understand the root cause and fix it. At .env.example, line 515:

<comment>Ad tracking features should default to disabled (`=0` or empty) in `.env.example`, consistent with other feature flags like `GOOGLE_LOGIN_ENABLED=false` and `ORGANIZATIONS_ENABLED=`. Self-hosters copying this example would have tracking enabled by default, which may not be desired for privacy-conscious deployments.</comment>

<file context>
@@ -509,4 +509,7 @@ SEED_PLATFORM_OAUTH_CLIENT_SECRET=
+TRIGGER_DEV_PROJECT_REF=
+
+GOOGLE_ADS_ENABLED=1      # To enable Google Ads tracking (gclid)
+LINKEDIN_ADS_ENABLED=1    # To enable LinkedIn Ads tracking (li_fat_id)
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/labeler.yml, line 26:

<comment>Using `@main` for a third-party action is a security risk. Pin to a specific commit SHA (e.g., `equitybee/team-label-action@abc123...`) to prevent unexpected changes or supply chain attacks.</comment>

<file context>
@@ -14,7 +14,20 @@ jobs:
+    if: ${{ secrets.EQUITY_BEE_TEAM_LABELER_ACTION_TOKEN != &#39;&#39; }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: equitybee/team-label-action@main
+        with:
+          repo-token: ${{ secrets.EQUITY_BEE_TEAM_LABELER_ACTION_TOKEN }}
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/labeler.yml, line 23:

<comment>Secrets context is not available in job-level `if:` conditionals. This condition will not work as expected. Consider using a different approach, such as checking the secret in a step or using a repository variable to gate this job.</comment>

<file context>
@@ -14,7 +14,20 @@ jobs:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    if: ${{ secrets.EQUITY_BEE_TEAM_LABELER_ACTION_TOKEN != &#39;&#39; }}
+    steps:
+      - uses: actions/checkout@v4
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/pr.yml, line 283:

<comment>The new failure detection only checks for `failure` results, but per team policy, `skipped` (and `cancelled`) jobs should also block merges. All required checks must run and succeed before a PR can merge.

(Based on your team&#39;s feedback about treating &#39;skipped&#39; as non-success for merge requirements.) </comment>

<file context>
@@ -264,18 +271,18 @@ jobs:
+          # Use jq to list jobs with result == &quot;failure&quot;
+          echo &#39;${{ toJson(needs) }}&#39; &gt; /tmp/needs.json
+          cat /tmp/needs.json
+          failures=$(jq -r &#39;to_entries | map(select(.value.result==&quot;failure&quot;)) | .[].key&#39; /tmp/needs.json || true)
+          if [ -n &quot;$failures&quot; ]; then
+            echo &quot; Failed jobs: $failures&quot;
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/pr.yml, line 275:

<comment>Bug: Reference to renamed job `needs.changes` should be `needs.prepare`. The `changes` job was renamed to `prepare` but this reference wasn&#39;t updated, which will cause the condition to malfunction.</comment>

<file context>
@@ -264,18 +271,18 @@ jobs:
-            needs.build-companion.result != &#39;success&#39;
-          )
+      - name: Dump dependent job results and fail only on &#39;failure&#39;
+        if: needs.changes.outputs.has-files-requiring-all-checks == &#39;true&#39;
+        run: |
+          echo &#39;Dependent job results:&#39;
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/v2/src/ee/bookings/2024-08-13/services/booking-location.service.ts, line 110:

<comment>This log statement serializes the entire `loc` object which can contain PII such as phone numbers and physical addresses. Instead of logging the full object, log only the non-sensitive `loc.type` field to debug unsupported location types.</comment>

<file context>
@@ -0,0 +1,118 @@
+    if (loc.type === &quot;attendeePhone&quot;) return loc.phone;
+    if (loc.type === &quot;attendeeDefined&quot;) return loc.location;
+
+    this.logger.log(
+      `Booking location service getLocationValue - loc ${JSON.stringify(
+        loc
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/labeler.yml, line 26:

<comment>Unpinned third‑party action in pull_request_target receives secret token, enabling supply-chain/secret exfiltration risk</comment>

<file context>
@@ -14,7 +14,20 @@ jobs:
+    if: ${{ secrets.EQUITY_BEE_TEAM_LABELER_ACTION_TOKEN != '' }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: equitybee/team-label-action@main
+        with:
+          repo-token: ${{ secrets.EQUITY_BEE_TEAM_LABELER_ACTION_TOKEN }}
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At packages/testing/src/lib/bookingScenario/expects.ts, line 720:

<comment>bookerReschedule flag ignored; test now accepts any email type for old organizer, weakening scenario coverage</comment>

<file context>
@@ -712,62 +712,115 @@ export function expectCalendarEventCreationFailureEmails({
   prevOrganizer,
-  bookerReschedule,
+   
+  bookerReschedule: _bookerReschedule,
 }: {
   emails: Fixtures["emails"];
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At packages/trpc/server/routers/viewer/slots/util.ts, line 1225:

<comment>Booker availability is dropped in fallback round‑robin recalculations, so fallback slots ignore booker conflicts</comment>

<file context>
@@ -1181,6 +1205,35 @@ export class AvailableSlotsService {
+      });
+
+      if (bookerWithCredentials) {
+        allHosts = [
+          ...allHosts,
+          {
</file context>