[claude]

Requested by Samuel Attard · Slack thread

Bumps secret-service-action to v1.1.0, which points the secret exchange at secret-service's new home on ionic (secret-service.electronjs.org) instead of Heroku.

---

Generated by Claude Code

[claude]

I reviewed this PR and didn't find any bugs. This action hands the release job its GitHub token, so a human should still confirm the new pinned commit, preferably someone from the code owners.

What was reviewed:

• The one-line change to .github/workflows/release.yml keeps the action pinned to a full commit SHA with a version comment, which matches how the other actions in the file are pinned.
• The step id (secret-service) and how outputs.secrets is read by the semantic-release step are the same as before.
• I couldn't check from this checkout that 23b9042f… is the upstream v1.1.0 tag, or what changed in the action between the two commits. A human should check that upstream.

Extended reasoning...

The change bumps the SHA-pinned electron/secret-service-action from v1.0.0 to v1.1.0 in the release workflow. That action exchanges the job's OIDC identity (the job has id-token: write) for the GitHub token used to publish releases. The PR says the action now calls a new secret-service host, so this is credential-handling code in the release path. The workflow change itself is a correct mechanical bump, but I couldn't inspect the upstream diff between the two commits. A catch-all CODEOWNERS entry also covers this file, which is why I deferred instead of approving.