From 7287823b13e5bfcf88f08920ff4ef154e1d7d34a Mon Sep 17 00:00:00 2001
From: Mark Stuart <mstuart@users.noreply.github.com>
Date: Sat, 22 Aug 2026 22:21:19 -0700
Subject: [PATCH 1/2] ci: publish npm package with trusted OIDC

Grant the publish job an OIDC token, use a supported Node/npm runtime, and remove the long-lived NPM_TOKEN credential.
---
 .github/workflows/release.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 28d2f2f..b777d73 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -87,13 +87,17 @@ jobs:
   publish-npm:
     needs: release
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '24'
           registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
 
       - name: Update npm package version
         run: |
@@ -104,5 +108,3 @@ jobs:
 
       - name: Publish to npm
         run: cd npm && npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

From 32443e7360aa15647f99862b6b5c6ea87d2caddd Mon Sep 17 00:00:00 2001
From: Mark Stuart <mstuart@users.noreply.github.com>
Date: Sat, 22 Aug 2026 22:26:31 -0700
Subject: [PATCH 2/2] ci: pin release actions and scope permissions

Pin each release action to the verified commit behind its existing ref and grant GITHUB_TOKEN permissions only to the job that needs them.
---
 .github/workflows/release.yml | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b777d73..0ef8ef5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,8 +5,7 @@ on:
     tags:
       - 'v*'
 
-permissions:
-  contents: write
+permissions: {}
 
 jobs:
   build:
@@ -30,12 +29,14 @@ jobs:
             artifact: code-memory.exe
 
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           targets: ${{ matrix.target }}
 
@@ -62,7 +63,7 @@ jobs:
           7z a ../../../code-memory-${{ github.ref_name }}-${{ matrix.target }}.zip ${{ matrix.artifact }}
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: code-memory-${{ matrix.target }}
           path: code-memory-${{ github.ref_name }}-${{ matrix.target }}.*
@@ -70,16 +71,18 @@ jobs:
   release:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: artifacts
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           files: artifacts/**/*
           generate_release_notes: true
@@ -91,9 +94,9 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'