🤖 Generated by the Daily AI Engineer
Evidence
.github/workflows/release.yaml calls the shared create-release.yaml at v10.0.2 and grants issues: write + pull-requests: write at the workflow level. Those permissions exist only for semantic-release's success/fail hooks, which comment on issues/PRs a release closes. Per actions#610, an ambiguous bare cross-repo issue reference in a release commit (fix #N) makes @semantic-release/github fail its success handler and red main after the tag and GitHub Release are already published — a misleading partial-failure state.
Audience & impact
Maintainers and contributors of this template repo: a red release run on an already-published version encourages blind reruns. The template does not rely on release issue/PR notifications.
Expected behaviour
Adopt the default-off disable-issue-side-effects input (shipped in Actions v10.0.3) so success/fail hooks are skipped and their issues/pull-requests write permissions are dropped — with tags, notes, assets, provenance signing, and GitHub Release publication unchanged.
Acceptance criteria
release.yaml calls create-release.yaml ≥ v10.0.3 with disable-issue-side-effects: true.- Top-level
permissions: {}; the release job grants only contents: write + id-token: write.
- The next real
main release publishes green with the opt-in active (observation recorded here).
Rough size
XS — a single-file workflow change mirroring the proven platform / AS Coaching rollout.
Evidence
.github/workflows/release.yamlcalls the sharedcreate-release.yamlat v10.0.2 and grantsissues: write+pull-requests: writeat the workflow level. Those permissions exist only for semantic-release's success/fail hooks, which comment on issues/PRs a release closes. Per actions#610, an ambiguous bare cross-repo issue reference in a release commit (fix #N) makes@semantic-release/githubfail its success handler and redmainafter the tag and GitHub Release are already published — a misleading partial-failure state.Audience & impact
Maintainers and contributors of this template repo: a red release run on an already-published version encourages blind reruns. The template does not rely on release issue/PR notifications.
Expected behaviour
Adopt the default-off
disable-issue-side-effectsinput (shipped in Actions v10.0.3) so success/fail hooks are skipped and theirissues/pull-requestswrite permissions are dropped — with tags, notes, assets, provenance signing, and GitHub Release publication unchanged.Acceptance criteria
release.yamlcallscreate-release.yaml≥ v10.0.3 withdisable-issue-side-effects: true.permissions: {}; thereleasejob grants onlycontents: write+id-token: write.mainrelease publishes green with the opt-in active (observation recorded here).Rough size
XS — a single-file workflow change mirroring the proven platform / AS Coaching rollout.