diff --git a/.github/workflows/ci-shopify-next-tailwind.yml b/.github/workflows/ci-shopify-next-tailwind.yml
index 630e9e595..af5eaa2ef 100644
--- a/.github/workflows/ci-shopify-next-tailwind.yml
+++ b/.github/workflows/ci-shopify-next-tailwind.yml
@@ -10,6 +10,9 @@ on:
     paths:
       - 'starters/shopify-next-tailwind/**'
 
+permissions:
+  contents: read
+
 jobs:
   format-check:
     runs-on: ubuntu-latest
@@ -23,13 +26,13 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Use Node.js 
+      - name: Use Node.js
         uses: actions/setup-node@v3
         with:
           node-version: 16.x
           cache: ''
 
-      - name: Install dependencies 
+      - name: Install dependencies
         run: npm i
         working-directory: starters/shopify-next-tailwind
 
@@ -39,13 +42,6 @@ jobs:
 
   build:
     runs-on: ubuntu-latest
-    env:
-      SESSION_SECRET: ${{ secrets.SHOPIFY_NEXT_SESSION_SECRET }}
-      STOREFRONT_API_KEY: ${{ secrets.SHOPIFY_NEXT_STOREFRONT_API_KEY }}
-      STOREFRONT_API_SECRET: ${{ secrets.SHOPIFY_NEXT_STOREFRONT_API_SECRET }}
-      PUBLIC_STOREFRONT_API_TOKEN: ${{ secrets.SHOPIFY_NEXT_PUBLIC_STOREFRONT_API_TOKEN }}
-      PUBLIC_STOREFRONT_API_VERSION: ${{ secrets.SHOPIFY_NEXT_PUBLIC_STOREFRONT_API_VERSION }}
-      PUBLIC_STORE_DOMAIN: ${{ secrets.SHOPIFY_NEXT_PUBLIC_STORE_DOMAIN }}
 
     needs:
       - format-check
@@ -75,5 +71,13 @@ jobs:
         working-directory: starters/shopify-next-tailwind
 
       - name: Build Project
+        if: github.event_name == 'push'
         run: npm run build
-        working-directory: starters/shopify-next-tailwind
\ No newline at end of file
+        working-directory: starters/shopify-next-tailwind
+        env:
+          SESSION_SECRET: ${{ secrets.SHOPIFY_NEXT_SESSION_SECRET }}
+          STOREFRONT_API_KEY: ${{ secrets.SHOPIFY_NEXT_STOREFRONT_API_KEY }}
+          STOREFRONT_API_SECRET: ${{ secrets.SHOPIFY_NEXT_STOREFRONT_API_SECRET }}
+          PUBLIC_STOREFRONT_API_TOKEN: ${{ secrets.SHOPIFY_NEXT_PUBLIC_STOREFRONT_API_TOKEN }}
+          PUBLIC_STOREFRONT_API_VERSION: ${{ secrets.SHOPIFY_NEXT_PUBLIC_STOREFRONT_API_VERSION }}
+          PUBLIC_STORE_DOMAIN: ${{ secrets.SHOPIFY_NEXT_PUBLIC_STORE_DOMAIN }}
diff --git a/packages/create-starter/src/utils.ts b/packages/create-starter/src/utils.ts
index 4099b402a..eda32ea9b 100644
--- a/packages/create-starter/src/utils.ts
+++ b/packages/create-starter/src/utils.ts
@@ -1,6 +1,6 @@
 import path from 'path';
 import fs from 'fs/promises';
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 
 export async function fileExists(path: string) {
   try {
@@ -15,23 +15,43 @@ export async function fileExists(path: string) {
   }
 }
 
-export async function initGitRepo(path: string, packageManager: string) {
+function run(command: string, args: string[], cwd: string): Promise<void> {
   return new Promise((resolve, reject) => {
-    exec(
-      `cd ${path} && git init && ${packageManager} ${
-        packageManager === 'deno' ? 'cache --lock=deno.lock --lock-write deps.ts' : 'install'
-      } && git add . && git commit -m 'init commit generated by starter.dev CLI' && cd ../`,
-      (err) => {
-        if (err) {
-          reject(err);
-        } else {
-          resolve(undefined);
-        }
+    execFile(command, args, { cwd }, (err) => {
+      if (err) {
+        reject(err);
+      } else {
+        resolve();
       }
-    );
+    });
   });
 }
 
+export async function initGitRepo(directoryPath: string, packageManager: string) {
+  const packageManagerExecutables = {
+    deno: 'deno',
+    npm: 'npm',
+    pnpm: 'pnpm',
+    yarn: 'yarn',
+  } as const;
+  const packageManagerExecutable = packageManagerExecutables[packageManager as keyof typeof packageManagerExecutables];
+
+  if (!packageManagerExecutable) {
+    throw new Error(`Unsupported package manager: ${packageManager}`);
+  }
+
+  await run('git', ['init'], directoryPath);
+  const packageManagerArgs = packageManager === 'deno' ? ['cache', '--lock=deno.lock', '--lock-write', 'deps.ts'] : ['install'];
+
+  if (process.platform === 'win32' && packageManager !== 'deno') {
+    await run('cmd.exe', ['/d', '/s', '/c', packageManagerExecutable, ...packageManagerArgs], directoryPath);
+  } else {
+    await run(packageManagerExecutable, packageManagerArgs, directoryPath);
+  }
+  await run('git', ['add', '.'], directoryPath);
+  await run('git', ['commit', '-m', 'init commit generated by starter.dev CLI'], directoryPath);
+}
+
 export async function removeLockFileIfExists(fileName: string, directoryPath: string): Promise<boolean> {
   let removed: boolean;
   try {
diff --git a/packages/metrics-handler/serverless.yml b/packages/metrics-handler/serverless.yml
index 88fbf4765..e0a86198e 100644
--- a/packages/metrics-handler/serverless.yml
+++ b/packages/metrics-handler/serverless.yml
@@ -14,13 +14,6 @@ provider:
   environment:
     GOOGLE_ANALYTICS_API_SECRET: ${env:GOOGLE_ANALYTICS_API_SECRET}
     GOOGLE_ANALYTICS_MEASUREMENT_ID: ${env:GOOGLE_ANALYTICS_MEASUREMENT_ID}
-  iam:
-    role:
-      statements:
-        - Effect: 'Allow'
-          Resource: 'arn:aws:lambda:*:*:*'
-          Action:
-            - lambda:InvokeFunction
   tracing:
     apiGateway: true
     lambda: true