fix(ci): stop persisting a write-scoped git credential through npm ci

.github/workflows/release.yml

@@ -56,6 +56,15 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
+          # The release job declares `contents: write`, which overrides this repo's
+          # read-only default workflow permission -- so the checkout's default
+          # persisted credential is WRITE-scoped and stays live in .git/config
+          # through `npm ci` below. A compromised dependency lifecycle script
+          # could read it off disk and push. semantic-release authenticates its
+          # own pushes from GITHUB_TOKEN, so it does not need the persisted
+          # credential; `persist-credentials: false` is semantic-release's own
+          # documented GitHub Actions recipe. (CWE-250)
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0

CHANGELOG.md

@@ -43,6 +43,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+
+- **The release job no longer persists a write-scoped git credential across `npm ci`.** It declares `contents: write`, which overrides this repo's read-only default workflow permission, so `actions/checkout`'s default persisted credential was write-scoped and lived in `.git/config` through the release job's dependency install and build steps — readable by any compromised dependency lifecycle script. `persist-credentials: false` is semantic-release's own documented GitHub Actions recipe; it authenticates its pushes from `GITHUB_TOKEN` directly and never needed the persisted credential. (CWE-250)
+
 - Initial scaffold of `@wyre-technology/node-iqms` SDK.
 - Oracle read driver with parameterized query layer for work orders, inventory, BOMs,
   sales orders, purchase orders, schedule, and quality entities. Queries are marked