I noticed that the current CI workflow in this repository could benefit from some updates. Specifically:

1. The Coverage setup could also be optimized:

   • Currently, the workflow uses the coverallsapp/github-action@master which points to v1 of this action. This v1 action uses node16 as runtime which is deprecated.

2. Minimum token permissions for the GITHUB_TOKEN:

   • GitHub Actions workflows have a GITHUB_TOKEN with write access to multiple scopes.
   • It is a best practice to reduce the scopes to the minimum needed for each workflow / step.
   • GitHub recommends defining minimum GITHUB_TOKEN permissions. https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
   • The Open Source Security Foundation (OpenSSF) Scorecards also treats not setting token permissions as a high-risk issue. This change will help increase the Scorecard score for this repository.

3. lint step

   • I created an extra lint step similar to the workflow of the main express repo.

4. Test Matrix

   • I added Node.js v19, v21 and v23 to the test matrix to test all supported Node.js versions.
   • I added windows-latest and ubuntu-latest to the test matrix to test on both

5. Removed obsolete AppVeyor

   • Removed obsolete appveyor.yml file
   • Removed the appveyor badge from README.md

6. Updated test scripts in package.json

   • removed --bail from the test script
   • use lcovonly reporter for the test-ci script to skip creation of the html report in CI