What the developer wrote
Authored by Nick Johnson
ci: remove github release workflow
What changed, and why it matters
This commit simply deletes a GitHub Actions workflow file that automatically created GitHub releases when new version tags were pushed. It is a routine CI/infrastructure change with no code changes and no apparent security relevance.
No security action required. Treat as a normal CI maintenance change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The removed .github/workflows/gh-release.yml workflow triggered on tag pushes, checked out the repository with persist-credentials: false, and used ncipollo/release-action to generate release notes and create a GitHub release. Removing it disables automated GitHub release creation; it does not modify source code, dependencies, permissions in a dangerous way, or introduce any vulnerability.
Changed components
.github/workflows/gh-release.ymlInspect captured patch +0 / −21
diff --git a/.github/workflows/gh-release.yml b/.github/workflows/gh-release.yml
deleted file mode 100644
index dd8502ce..00000000
--- a/.github/workflows/gh-release.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-name: GitHub Release
-
-on:
- push:
- tags:
- - '*'
-
-permissions: {}
-
-jobs:
- build:
- runs-on: ubuntu-24.04
- permissions:
- contents: write
- steps:
- - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- with:
- persist-credentials: false
- - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
- with:
- generateReleaseNotes: true
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.