From c167caf40eda91aaf1e14206408a9a67af0a2175 Mon Sep 17 00:00:00 2001 From: Pim Feltkamp <48278217+pimfeltkamp@users.noreply.github.com> Date: Mon, 9 Nov 2026 01:55:11 +0100 Subject: [PATCH] Security: pin softprops/action-gh-release to commit SHA in release workflow The tag-triggered publish job holds contents: write and id-token: write and uses NPM_TOKEN, but ran softprops/action-gh-release by the mutable @v3 tag. Pin it to the commit that v3 / v3.0.4 resolve to today so a moved tag cannot run different code with the job's token. Dependabot's github-actions ecosystem keeps the pin updated via the version comment. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2859bb0..7ec7bf9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -41,7 +41,7 @@ jobs: env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@8a0cd651e5b2365bd640854a3fa5dfc70e4875f3 # v3.0.4 with: generate_release_notes: true prerelease: true