From 307943076dc6c260b1bc8ea9db27ccb3e581fcbe Mon Sep 17 00:00:00 2001
From: Tim Gossrau <tim.gossrau@3m5.de>
Date: Thu, 20 Aug 2026 15:11:50 +0200
Subject: [PATCH 1/2] ci: restore workflow hardening and tolerate an existing
 release

The OIDC switch was made against an older version of the file and
dropped the SHA pins, permissions default, --ignore-scripts and Node 24
along with it. Trusted publishing itself is unchanged.

allowUpdates stops a release created by hand for the tag from failing
the job with a 422, which is what happened on v0.1.4.

Refs #4, #16
---
 .github/workflows/build-release-changelog.yml | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build-release-changelog.yml b/.github/workflows/build-release-changelog.yml
index 269f148..c730e78 100644
--- a/.github/workflows/build-release-changelog.yml
+++ b/.github/workflows/build-release-changelog.yml
@@ -1,8 +1,12 @@
 name: Release
+
+permissions: {}
+
 on:
   push:
     tags:
       - 'v*'
+
 jobs:
 
   create-release:
@@ -12,21 +16,23 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '24'
           registry-url: 'https://registry.npmjs.org'
       - name: Install dependencies and build 🔧
-        run: npm ci && npm run build
+        run: npm ci --ignore-scripts && npm run build
+      # Node 24 already ships npm 11.9, but trusted publishing needs >= 11.5.1
+      # and we do not want a release to depend on what the runner happens to ship.
       - name: Update npm
         run: npm install -g npm@^11.5
       - name: Publish package on NPM 📦
         run: npm publish
       - name: Build Changelog
         id: build_changelog
-        uses: mikepenz/release-changelog-builder-action@v4
+        uses: mikepenz/release-changelog-builder-action@32e3c96f29a6532607f638797455e9e98cfc703d # v4.2.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -38,9 +44,11 @@ jobs:
               "pr_template": "● #{{TITLE}} by @#{{AUTHOR}}\n"
             }
       - name: Create Github release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           artifactErrorsFailBuild: true
+          # a release created by hand for the tag must not fail the job
+          allowUpdates: true
           # ToDo remove with v1.0.0
           prerelease: true
           body: ${{steps.build_changelog.outputs.changelog}}

From 3a55ec879c643fc0a8b82c20db25e76e02c7c1fc Mon Sep 17 00:00:00 2001
From: Tim Gossrau <tim.gossrau@3m5.de>
Date: Thu, 20 Aug 2026 15:12:03 +0200
Subject: [PATCH 2/2] fix: correct repository url format in package.json

npm publish warned it had auto-corrected this. Result of npm pkg fix.

Refs #9
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 6217493..4bddc03 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/3m5/squirrel-select"
+    "url": "git+https://github.com/3m5/squirrel-select.git"
   },
   "files": [
     "dist"