[claude]

Requested by Samuel Attard · Slack thread

Bumps secret-service-action to v1.1.0, which points the secret exchange at secret-service's new home on ionic (secret-service.electronjs.org) instead of Heroku.

---

Generated by Claude Code

[claude]

I reviewed this PR and didn't find any bugs. This action fetches the release job's GitHub token, so it would be worth having a human confirm the new pinned SHA before merging.

What was reviewed:

• The one-line change in .github/workflows/release.yml: the secret-service step moves from 3476425… (v1.0.0) to 23b9042… (v1.1.0). It is still pinned to a full SHA with a version comment, and no inputs were added.
• The next step still reads fromJSON(steps.secret-service.outputs.secrets).GITHUB_TOKEN, so v1.1.0 has to keep that secrets output shape.
• I couldn't check from this checkout whether 23b9042… really is the upstream v1.1.0 tag of electron/secret-service-action.

Extended reasoning...

The change bumps the pinned SHA of electron/secret-service-action in the release workflow, a single line. The step it changes fetches the secrets, including the GitHub token, that semantic-trusted-release uses to publish. That job runs with id-token: write in the npm-trusted-publisher environment. CODEOWNERS assigns every path to a code-owner team, and I couldn't confirm the new SHA against the upstream tag, so I'm deferring instead of approving.