[claude]

Requested by Keeley Hammond · Slack thread

The release action pinned here ran the npm publish step on Node 24.10.0, which predates the October 2026 Node.js security release. v1.1.2 of electron/semantic-trusted-release tracks the latest Node 24.x via check-latest, so future Node patch releases need no further pin bumps.

---

Generated by Claude Code

[claude]

I reviewed this PR and didn't find any bugs. The bumped action runs in the npm publish job, so a maintainer should still confirm the new SHA before merging.

What was reviewed:

• The one-line change in .github/workflows/release.yml. It still pins to a full commit SHA with a version comment, which matches the convention for the other actions in the file.
• The step's inputs are unchanged, and so are the job's permissions (id-token: write, npm-trusted-publisher environment) and the persist-credentials: false checkout.
• I couldn't check from this checkout that 2a7b16df83a1f77339ad473654c5fbd2b32b193b is the upstream v1.1.1 tag, or what changed between v1.1.0 and v1.1.1.

Extended reasoning...

The change bumps the pinned commit of electron/semantic-trusted-release in the release workflow from v1.1.0 to v1.1.1, and nothing else changes. That action runs in the job that publishes to npm through OIDC trusted publishing and receives a GitHub app token, so the change touches the supply-chain and publish-credential surface. The review couldn't confirm that the new SHA matches the upstream v1.1.1 tag, because this shallow clone has no tags and outbound API calls weren't available. All paths are covered by a CODEOWNERS entry, which rules out auto-approval on its own.

[claude]

I reviewed the latest push and didn't find any bugs. This step publishes releases using the GitHub token from secret-service, so a code owner should still confirm the new pin.

What was reviewed:

• The one-line change in .github/workflows/release.yml moves electron/semantic-trusted-release to 672a62fe17fce21a0d10de5a6825ee54817af317 # v1.1.2. It is still pinned to a full SHA, and the github-token input is unchanged.
• I couldn't confirm from this checkout that this SHA is the upstream v1.1.2 tag. That needs a check against electron/semantic-trusted-release.
• The PR title and description still say v1.1.1 and describe that release's Node 24.22.1 change. The second commit moved the pin to v1.1.2, so the title and description may need updating to match.

Extended reasoning...

The change touches one line in the release workflow and bumps the pinned SHA of the action that runs semantic release / npm publish. That action receives a GitHub token pulled from secret-service. The pinned SHA is a supply-chain surface, and this review couldn't map it to the claimed upstream tag. .github/CODEOWNERS assigns every path to a code-owner team, so this review defers rather than approving. Since the earlier review, a new commit moved the pin from v1.1.1 to v1.1.2, and the PR title and description were not updated.