[haskou]

Summary

• Disable persisted checkout credentials in the release publish job.
• Pass GITHUB_TOKEN only to the release-version and tag git push commands through an explicit Git HTTP auth header.
• Reduce the amount of time earlier install/build/publish steps can use the job's contents: write token for Git operations.

Validation

• Parsed .github/workflows/ci.yml with js-yaml.
• git diff --check.

Notes

This is CI credential hardening. The publish job still has contents: write and id-token: write, but repository write credentials are no longer persisted by checkout for the whole job.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!