From 5cb2abaa07abfdccbb4a84056481fc6e03f0b604 Mon Sep 17 00:00:00 2001
From: askalf <263217947+askalf@users.noreply.github.com>
Date: Sat, 11 Jul 2026 19:41:18 -0400
Subject: [PATCH 1/2] harden: scope checkout token in release-assets.yml
 (persist-credentials: false)

---
 .github/workflows/release-assets.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release-assets.yml b/.github/workflows/release-assets.yml
index 8e78ebe..e6a3635 100644
--- a/.github/workflows/release-assets.yml
+++ b/.github/workflows/release-assets.yml
@@ -22,6 +22,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          persist-credentials: false
           ref: ${{ github.event.release.tag_name }}
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

From 53d2232708626bf452183acc94f75e1f90bf3ff3 Mon Sep 17 00:00:00 2001
From: askalf <263217947+askalf@users.noreply.github.com>
Date: Sat, 11 Jul 2026 19:41:18 -0400
Subject: [PATCH 2/2] harden: scope checkout token in publish.yml
 (persist-credentials: false)

---
 .github/workflows/publish.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d514fff..6f1230d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -27,6 +27,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           # Trusted publishing (OIDC) needs npm >=11.5.1; Node 24 bundles npm 11.