[claude]

Requested by Keeley Hammond · Slack thread

The release action pinned here ran the npm publish step on Node 24.10.0, which predates the October 2026 Node.js security release. v1.1.2 tracks the latest Node 24.x via check-latest, so future Node patch releases need no further pin bumps.

---

Generated by Claude Code

[claude]

I reviewed this PR and didn't find any bugs. The release workflow uses this action to publish with a GitHub token from the secret service, so a human should also confirm the new pin.

What was reviewed:

• The one-line change to .github/workflows/release.yml. The action is still pinned by full commit SHA with a version comment, and its github-token input is unchanged.
• I could not confirm from this checkout that 2a7b16df83a1f77339ad473654c5fbd2b32b193b is the commit behind the upstream v1.1.1 tag. Check that, and look at the v1.1.0 to v1.1.1 diff.

Extended reasoning...

The change replaces the pinned commit SHA of electron/semantic-trusted-release (v1.1.0 to v1.1.1) in the release workflow and touches nothing else. This is the npm publish path, and the action receives a GitHub token from the secret-service step, so whatever code sits at the new SHA runs with release credentials. The new SHA could not be checked against the upstream tag from this shallow checkout. CODEOWNERS assigns every path to the wg-ecosystem team, so the change needs owner review whatever this review concludes.

[claude]

I reviewed the latest push and didn't find any bugs. This step runs with id-token: write to publish to npm, and the file has a CODEOWNER, so a maintainer should still check the new pin.

What was reviewed:

• The only change in .github/workflows/release.yml line 42 is the pin for electron/semantic-trusted-release. It moves from 0351784… (v1.1.0) to 672a62f… (v1.1.2) and is still pinned to a full SHA. The github-token input is unchanged.
• I couldn't check from this checkout that 672a62f… is the real v1.1.2 tag commit, or what changed in the action since v1.1.0. A maintainer should confirm both upstream.
• The PR title and description still say v1.1.1, but the second commit pins v1.1.2. It's worth updating them so the commit history matches what actually ships.

Extended reasoning...

This is a one-line change in the release workflow. It re-pins the third-party action that runs semantic-release and npm trusted publishing. That job has id-token: write and a GitHub App token from the secret-service step, so it's a supply-chain-sensitive path. CODEOWNERS assigns every file, including this one, to electron/wg-ecosystem, so this review doesn't approve. The upstream tag-to-SHA mapping couldn't be checked from the shallow clone.