[claude]

Requested by Keeley Hammond · Slack thread

The release action pinned here ran the npm publish step on Node 24.10.0, which predates the October 2026 Node.js security release. v1.1.2 tracks the latest Node 24.x via check-latest, so future Node patch releases need no further pin bumps.

---

Generated by Claude Code

[claude]

I reviewed this PR and didn't find any bugs. It's a one-line bump, but it changes the pinned action in the publish workflow, which gets the release GITHUB_TOKEN, and the files are covered by CODEOWNERS, so a human look is still worth it.

What was reviewed:

• The uses: line in .github/workflows/release.yml is still pinned to a full commit SHA with a # v1.1.1 comment, and the github-token input is unchanged.
• I couldn't confirm from this checkout that 2a7b16df83a1f77339ad473654c5fbd2b32b193b is the commit behind the upstream v1.1.1 tag. Please check that before merging.

Extended reasoning...

The change touches one line in .github/workflows/release.yml. It moves the pinned electron/semantic-trusted-release action from the v1.1.0 SHA to a new SHA labeled v1.1.1. That step runs the npm publish and gets a GITHUB_TOKEN from the secret-service step, so it is supply-chain sensitive. The review could not check the new SHA against the upstream tag. CODEOWNERS assigns every path, including this workflow, to the Electron working groups, and that is why this defers instead of approving.

[claude]

I reviewed the latest push and didn't find any bugs. This changes the action that publishes the package to npm, and the file has code owners, so a code owner should still confirm the new pin.

• The action is still pinned to a full commit SHA with a version comment, and its inputs are unchanged. Only the SHA and the comment changed.
• I couldn't confirm that 672a62fe17fce21a0d10de5a6825ee54817af317 is the commit the v1.1.2 tag points to. This checkout has no tags and no access to the upstream repo, so a human should check that.
• The PR title and description still say v1.1.1 and Node 24.22.1, but the latest commit pins v1.1.2. You may want to update them.

Extended reasoning...

The change is one line in .github/workflows/release.yml. It moves the pin for electron/semantic-trusted-release, the step that runs semantic-release with id-token: write and a GitHub App token, from v1.1.0 to v1.1.2. That makes it a supply-chain-sensitive part of the publish path. The CODEOWNERS file assigns every path to three Electron working groups, which rules out auto-approval. I couldn't confirm the new SHA against the upstream tag, and the second commit (v1.1.1 to v1.1.2) arrived after the earlier review, so a short note is warranted.