[claude]

Requested by Samuel Attard · Slack thread

Bumps secret-service-action to v1.1.0, which points the secret exchange at secret-service's new home on ionic (secret-service.electronjs.org) instead of Heroku.

---

Generated by Claude Code

[claude]

I reviewed this PR and didn't find any bugs. This step gets the GitHub token that the release job publishes with, so a human should still confirm that the new pin is the real v1.1.0 release of electron/secret-service-action. I couldn't check the upstream repo from here.

What was reviewed:

• The one-line pin change in .github/workflows/release.yml: the action is still pinned to a full SHA, and the version comment matches the PR title.
• The step that uses it: semantic-trusted-release reads fromJSON(steps.secret-service.outputs.secrets).GITHUB_TOKEN. That only keeps working if v1.1.0 still returns a secrets JSON output, and I couldn't confirm that here.
• Job permissions (id-token: write, the npm-trusted-publisher environment) are unchanged.

Extended reasoning...

The change bumps the pinned SHA of electron/secret-service-action in the release workflow from v1.0.0 to v1.1.0. That action supplies the GitHub token used by the release job, which runs with id-token: write in the npm-trusted-publisher environment, so this is supply-chain and credential-sensitive. I couldn't confirm in this session that the new SHA is the v1.1.0 tag, or that the action's outputs are unchanged. The CODEOWNERS wildcard assigns every path, including this workflow, to the ecosystem working group. For these reasons I deferred instead of approving.

[electron-npm-package-publisher]

🎉 This PR is included in version 3.0.3 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀