diff --git a/actions/setup/js/mcp_cli_bridge.cjs b/actions/setup/js/mcp_cli_bridge.cjs
index 04f3a452b1d..e887c470195 100644
--- a/actions/setup/js/mcp_cli_bridge.cjs
+++ b/actions/setup/js/mcp_cli_bridge.cjs
@@ -565,13 +565,13 @@ function showToolHelp(serverName, toolName, tools) {
  */
 function formatResponse(responseBody, serverName) {
   const core = global.core;
-  const resp = /** @type {Record<string, unknown>} */ responseBody;
+  const resp = responseBody;
 
   // Check for JSON-RPC error
-  if (resp && resp.error) {
-    const err = /** @type {Record<string, unknown>} */ resp.error;
-    const message = String(err.message || "Unknown error");
-    const code = err.code != null ? String(err.code) : "";
+  if (resp && typeof resp === "object" && "error" in resp && resp.error && typeof resp.error === "object") {
+    const errRecord = resp.error;
+    const message = "message" in errRecord ? String(errRecord.message || "Unknown error") : "Unknown error";
+    const code = "code" in errRecord && errRecord.code != null ? String(errRecord.code) : "";
     const errText = code ? `Error [${code}]: ${message}` : `Error: ${message}`;
     process.stderr.write(errText + "\n");
     core.error(`[${serverName}] Tool call error: ${errText}`);
@@ -581,9 +581,9 @@ function formatResponse(responseBody, serverName) {
   }
 
   // Extract result content
-  if (resp && resp.result) {
-    const result = /** @type {Record<string, unknown>} */ resp.result;
-    if (Array.isArray(result.content)) {
+  if (resp && typeof resp === "object" && "result" in resp && resp.result && typeof resp.result === "object") {
+    const result = resp.result;
+    if ("content" in result && Array.isArray(result.content)) {
       const outputParts = [];
       for (const item of result.content) {
         const entry = /** @type {Record<string, unknown>} */ item;
diff --git a/actions/setup/js/mount_mcp_as_cli.cjs b/actions/setup/js/mount_mcp_as_cli.cjs
index dbadbd4a85e..7cf10b308f5 100644
--- a/actions/setup/js/mount_mcp_as_cli.cjs
+++ b/actions/setup/js/mount_mcp_as_cli.cjs
@@ -196,10 +196,10 @@ async function fetchMCPTools(serverUrl, apiKey, core) {
   // Step 3: tools/list – get the available tool definitions
   try {
     const listResp = await httpPostJSON(serverUrl, { ...authHeaders, ...sessionHeader }, { jsonrpc: "2.0", id: 2, method: "tools/list" }, DEFAULT_HTTP_TIMEOUT_MS);
-    const respBody = /** @type {Record<string, unknown>} */ listResp.body;
-    if (respBody && respBody.result && typeof respBody.result === "object") {
-      const result = /** @type {Record<string, unknown>} */ respBody.result;
-      if (Array.isArray(result.tools)) {
+    const respBody = listResp.body;
+    if (respBody && typeof respBody === "object" && "result" in respBody && respBody.result && typeof respBody.result === "object") {
+      const result = respBody.result;
+      if ("tools" in result && Array.isArray(result.tools)) {
         return /** @type {Array<{name: string, description?: string, inputSchema?: unknown}>} */ result.tools;
       }
     }
diff --git a/actions/setup/js/setup_globals.cjs b/actions/setup/js/setup_globals.cjs
index 24c61151f4b..faeca9534fb 100644
--- a/actions/setup/js/setup_globals.cjs
+++ b/actions/setup/js/setup_globals.cjs
@@ -25,13 +25,11 @@ const { createRateLimitAwareGithub } = require("./github_rate_limit_logger.cjs")
  * @param {typeof getOctokit} getOctokitFn - The getOctokit function (builtin in actions/github-script@v9)
  */
 function setupGlobals(coreModule, githubModule, contextModule, execModule, ioModule, getOctokitFn) {
-  // @ts-expect-error - Assigning to global properties that are declared as const
   global.core = coreModule;
   // @ts-expect-error - Assigning to global properties that are declared as const
   // Wrap the github object so every github.rest.*.*() call automatically logs
   // x-ratelimit-* headers to github_rate_limits.jsonl for observability.
   global.github = createRateLimitAwareGithub(githubModule);
-  // @ts-expect-error - Assigning to global properties that are declared as const
   global.context = contextModule;
   // @ts-expect-error - Assigning to global properties that are declared as const
   global.exec = execModule;
diff --git a/actions/setup/js/shim.cjs b/actions/setup/js/shim.cjs
index 937175cdf15..c3f628f0013 100644
--- a/actions/setup/js/shim.cjs
+++ b/actions/setup/js/shim.cjs
@@ -12,9 +12,7 @@
  * `github-script`) the respective block is a no-op.
  */
 
-// @ts-expect-error - global.core is not declared in TypeScript but is provided by github-script
 if (!global.core) {
-  // @ts-expect-error - Assigning to global properties that are declared as const
   global.core = {
     debug: /** @param {string} message */ message => console.debug(`[debug] ${message}`),
     info: /** @param {string} message */ message => console.info(`[info] ${message}`),
@@ -35,7 +33,6 @@ if (!global.core) {
   };
 }
 
-// @ts-expect-error - global.context is not declared in TypeScript but is provided by github-script
 if (!global.context) {
   // Build a context object from GitHub Actions environment variables,
   // mirroring the shape of @actions/github's Context class.
@@ -59,7 +56,6 @@ if (!global.context) {
   const owner = slashIdx >= 0 ? repository.slice(0, slashIdx) : "";
   const repo = slashIdx >= 0 ? repository.slice(slashIdx + 1) : "";
 
-  // @ts-expect-error - Assigning to global properties that are declared as const
   global.context = {
     eventName: process.env.GITHUB_EVENT_NAME || "",
     sha: process.env.GITHUB_SHA || "",
diff --git a/actions/setup/js/start_mcp_gateway.cjs b/actions/setup/js/start_mcp_gateway.cjs
index 310332c32a5..57f2e0b5603 100644
--- a/actions/setup/js/start_mcp_gateway.cjs
+++ b/actions/setup/js/start_mcp_gateway.cjs
@@ -236,21 +236,21 @@ async function main() {
 
   // Validate gateway section
   core.info("Validating gateway configuration...");
-  const gw = /** @type {Record<string, unknown> | undefined} */ configObj.gateway;
-  if (!gw) {
+  const gw = configObj.gateway;
+  if (!gw || typeof gw !== "object") {
     core.error("ERROR: Configuration is missing required 'gateway' section");
     core.error("Per MCP Gateway Specification v1.0.0 section 4.1.3, the gateway section is required");
     process.exit(1);
   }
-  if (gw.port == null) {
+  if (!("port" in gw) || gw.port == null) {
     core.error("ERROR: Gateway configuration is missing required 'port' field");
     process.exit(1);
   }
-  if (gw.domain == null) {
+  if (!("domain" in gw) || gw.domain == null) {
     core.error("ERROR: Gateway configuration is missing required 'domain' field");
     process.exit(1);
   }
-  if (gw.apiKey == null) {
+  if (!("apiKey" in gw) || gw.apiKey == null) {
     core.error("ERROR: Gateway configuration is missing required 'apiKey' field");
     process.exit(1);
   }
@@ -274,7 +274,11 @@ async function main() {
 
   // Split docker command into args, respecting simple quoting
   const args = dockerCommand.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [];
-  const cmd = /** @type {string} */ args.shift();
+  const cmd = args.shift();
+  if (!cmd) {
+    core.error("ERROR: MCP_GATEWAY_DOCKER_COMMAND did not contain an executable command");
+    process.exit(1);
+  }
 
   const outputFd = fs.openSync(outputPath, "w", 0o600);
   const stderrFd = fs.openSync(stderrLogPath, "w", 0o600);
@@ -286,6 +290,10 @@ async function main() {
   });
 
   // Write configuration to stdin then close
+  if (!child.stdin) {
+    core.error("ERROR: Gateway process stdin is not available");
+    process.exit(1);
+  }
   child.stdin.write(mcpConfig);
   child.stdin.end();
 
diff --git a/actions/setup/js/types/github-script.d.ts b/actions/setup/js/types/github-script.d.ts
index 093ef3e1f11..33997f9800d 100644
--- a/actions/setup/js/types/github-script.d.ts
+++ b/actions/setup/js/types/github-script.d.ts
@@ -27,13 +27,13 @@ declare global {
    * GitHub Actions context object provided by github-script action
    * Contains information about the workflow run context
    */
-  const context: Context;
+  var context: any;
 
   /**
    * Actions core utilities provided by github-script action
    * For setting outputs, logging, and other workflow operations
    */
-  const core: typeof __actionsCore;
+  var core: any;
 
   /**
    * Actions exec utilities provided by github-script action