From 9266b9c9071aa42c5a1f84ab0365bcba85bb2270 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Mon, 14 Sep 2026 09:02:18 +0000
Subject: [PATCH 01/11] chore: pin third-party GitHub Actions to commit SHA

Pins actions/checkout, actions/setup-node, and
webiny/action-conventional-commits to their resolved commit SHAs
(with the tag kept as a trailing comment) to harden CI against
upstream tag mutation.
---
 .github/workflows/cli-pr-checks.yml                     | 4 ++--
 .github/workflows/conventional-commit-check-commits.yml | 4 ++--
 .github/workflows/reusable-compute-staging-version.yml  | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/cli-pr-checks.yml b/.github/workflows/cli-pr-checks.yml
index f63de681..849eacb2 100644
--- a/.github/workflows/cli-pr-checks.yml
+++ b/.github/workflows/cli-pr-checks.yml
@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
           cache: 'npm'
diff --git a/.github/workflows/conventional-commit-check-commits.yml b/.github/workflows/conventional-commit-check-commits.yml
index 11b58acc..bc608754 100644
--- a/.github/workflows/conventional-commit-check-commits.yml
+++ b/.github/workflows/conventional-commit-check-commits.yml
@@ -7,6 +7,6 @@ jobs:
   check-conventional-commits:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Check Commit Conventions
-        uses: webiny/action-conventional-commits@v1.3.0
+        uses: webiny/action-conventional-commits@8bc41ff4e7d423d56fa4905f6ff79209a78776c7 # v1.3.0
diff --git a/.github/workflows/reusable-compute-staging-version.yml b/.github/workflows/reusable-compute-staging-version.yml
index 740cecc7..3c3c6468 100644
--- a/.github/workflows/reusable-compute-staging-version.yml
+++ b/.github/workflows/reusable-compute-staging-version.yml
@@ -19,9 +19,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
       - name: Set publish version

From da9986a0431412f252176bdaca3e9b8684000041 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Mon, 14 Sep 2026 09:24:35 +0000
Subject: [PATCH 02/11] chore: update and pin
 iExecBlockchainComputing/github-actions-workflows refs

Bumps the reusable workflow calls to their latest published tags
(conventional-commits-v1.2.1, release-please-v2.2.1,
publish-npm-v1.7.1) and pins each to its resolved commit SHA, with
the tag kept as a trailing comment.
---
 .github/workflows/conventional-commit-check-pr-title.yml | 2 +-
 .github/workflows/release-please.yml                     | 2 +-
 .github/workflows/reusable-cli-npm.yml                   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/conventional-commit-check-pr-title.yml b/.github/workflows/conventional-commit-check-pr-title.yml
index 28a18f2a..64a0598a 100644
--- a/.github/workflows/conventional-commit-check-pr-title.yml
+++ b/.github/workflows/conventional-commit-check-pr-title.yml
@@ -12,4 +12,4 @@ jobs:
   lint-pr-title:
     permissions:
       pull-requests: read
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@conventional-commits-v1.1.0
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@7825b11bd6f0b141075368add5223c873d76a2d3 # conventional-commits-v1.2.1
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 183dfd79..bde68ba5 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -13,5 +13,5 @@ permissions:
 
 jobs:
   release-please:
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@release-please-v2.1.0
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@1c4f92368b01037ca4f209c2f9179cf8a07f00ff # release-please-v2.2.1
     secrets: inherit
diff --git a/.github/workflows/reusable-cli-npm.yml b/.github/workflows/reusable-cli-npm.yml
index 8e9d339a..c33d3cf5 100644
--- a/.github/workflows/reusable-cli-npm.yml
+++ b/.github/workflows/reusable-cli-npm.yml
@@ -20,7 +20,7 @@ on:
 
 jobs:
   npm-publish:
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/publish-npm.yml@publish-npm-v1.6.0
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/publish-npm.yml@1f9f07ab7380426fd6b59c32baa352a89e8a479b # publish-npm-v1.7.1
     with:
       working-directory: cli
       install-command: npm ci

From af53aead966d98970705539ac68f03ed3f6b4412 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 13 Oct 2026 06:17:12 +0000
Subject: [PATCH 03/11] chore: bump pinned GitHub Actions and reusable
 workflows to latest versions

Bump actions/checkout and actions/setup-node from v4.4.0 to v7.0.1 and v7.1.0, and bump the iExecBlockchainComputing/github-actions-workflows conventional-commits, release-please and publish-npm reusable workflows to their latest tags, repinning each to the resolved commit SHA.
---
 .github/workflows/cli-pr-checks.yml                      | 4 ++--
 .github/workflows/conventional-commit-check-commits.yml  | 2 +-
 .github/workflows/conventional-commit-check-pr-title.yml | 2 +-
 .github/workflows/release-please.yml                     | 2 +-
 .github/workflows/reusable-cli-npm.yml                   | 2 +-
 .github/workflows/reusable-compute-staging-version.yml   | 4 ++--
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/cli-pr-checks.yml b/.github/workflows/cli-pr-checks.yml
index 849eacb2..2bf00846 100644
--- a/.github/workflows/cli-pr-checks.yml
+++ b/.github/workflows/cli-pr-checks.yml
@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
           cache: 'npm'
diff --git a/.github/workflows/conventional-commit-check-commits.yml b/.github/workflows/conventional-commit-check-commits.yml
index bc608754..5ec92aa2 100644
--- a/.github/workflows/conventional-commit-check-commits.yml
+++ b/.github/workflows/conventional-commit-check-commits.yml
@@ -7,6 +7,6 @@ jobs:
   check-conventional-commits:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check Commit Conventions
         uses: webiny/action-conventional-commits@8bc41ff4e7d423d56fa4905f6ff79209a78776c7 # v1.3.0
diff --git a/.github/workflows/conventional-commit-check-pr-title.yml b/.github/workflows/conventional-commit-check-pr-title.yml
index 64a0598a..e97edde8 100644
--- a/.github/workflows/conventional-commit-check-pr-title.yml
+++ b/.github/workflows/conventional-commit-check-pr-title.yml
@@ -12,4 +12,4 @@ jobs:
   lint-pr-title:
     permissions:
       pull-requests: read
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@7825b11bd6f0b141075368add5223c873d76a2d3 # conventional-commits-v1.2.1
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@080cd7070517853f1a1352855a6f47fa1725f08f # conventional-commits-v1.2.2
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index bde68ba5..79b2ff4f 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -13,5 +13,5 @@ permissions:
 
 jobs:
   release-please:
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@1c4f92368b01037ca4f209c2f9179cf8a07f00ff # release-please-v2.2.1
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@31ad5d9e686d47c7ebdd3c7df3f8c50f58415428 # release-please-v2.2.3
     secrets: inherit
diff --git a/.github/workflows/reusable-cli-npm.yml b/.github/workflows/reusable-cli-npm.yml
index c33d3cf5..a3dda871 100644
--- a/.github/workflows/reusable-cli-npm.yml
+++ b/.github/workflows/reusable-cli-npm.yml
@@ -20,7 +20,7 @@ on:
 
 jobs:
   npm-publish:
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/publish-npm.yml@1f9f07ab7380426fd6b59c32baa352a89e8a479b # publish-npm-v1.7.1
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/publish-npm.yml@c180a865f53d525d94e5ea7662892e60d66369f3 # publish-npm-v2.0.0
     with:
       working-directory: cli
       install-command: npm ci
diff --git a/.github/workflows/reusable-compute-staging-version.yml b/.github/workflows/reusable-compute-staging-version.yml
index 3c3c6468..fdee4987 100644
--- a/.github/workflows/reusable-compute-staging-version.yml
+++ b/.github/workflows/reusable-compute-staging-version.yml
@@ -19,9 +19,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '20'
       - name: Set publish version

From ce675934f5b87f6b7566bf30e348ef4849ac2f37 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 13 Oct 2026 08:21:47 +0200
Subject: [PATCH 04/11] ci: remove single conventional commit check

---
 .../workflows/conventional-commit-check-commits.yml  | 12 ------------
 1 file changed, 12 deletions(-)
 delete mode 100644 .github/workflows/conventional-commit-check-commits.yml

diff --git a/.github/workflows/conventional-commit-check-commits.yml b/.github/workflows/conventional-commit-check-commits.yml
deleted file mode 100644
index 5ec92aa2..00000000
--- a/.github/workflows/conventional-commit-check-commits.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Conventional Commit Check Commits
-description: checks every commit in the PR respects the conventional commit
-
-on: [pull_request]
-
-jobs:
-  check-conventional-commits:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Check Commit Conventions
-        uses: webiny/action-conventional-commits@8bc41ff4e7d423d56fa4905f6ff79209a78776c7 # v1.3.0

From 22413b75a0c3adba1ba9d39c3f05d04bf7090f8a Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 13 Oct 2026 06:33:44 +0000
Subject: [PATCH 05/11] ci: fix actionlint and shellcheck findings

Move the invalid top-level description key to a leading comment in four workflow files, and quote $GITHUB_OUTPUT in reusable-compute-staging-version.yml to satisfy shellcheck.
---
 .github/workflows/conventional-commit-check-pr-title.yml | 2 +-
 .github/workflows/release-please.yml                     | 2 +-
 .github/workflows/reusable-cli-npm.yml                   | 2 +-
 .github/workflows/reusable-compute-staging-version.yml   | 7 +++----
 4 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/conventional-commit-check-pr-title.yml b/.github/workflows/conventional-commit-check-pr-title.yml
index e97edde8..4df59f37 100644
--- a/.github/workflows/conventional-commit-check-pr-title.yml
+++ b/.github/workflows/conventional-commit-check-pr-title.yml
@@ -1,5 +1,5 @@
+# checks the PR title respects the conventional commit
 name: Conventional Commit Check PR Title
-description: checks the PR title respects the conventional commit
 
 on:
   pull_request_target:
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 79b2ff4f..a1b4071b 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -1,5 +1,5 @@
+# triggers release-please to open the next release PR
 name: release-please
-description: triggers release-please to open the next release PR
 
 on:
   push:
diff --git a/.github/workflows/reusable-cli-npm.yml b/.github/workflows/reusable-cli-npm.yml
index a3dda871..00d58a38 100644
--- a/.github/workflows/reusable-cli-npm.yml
+++ b/.github/workflows/reusable-cli-npm.yml
@@ -1,5 +1,5 @@
+# reusable npm workflow for this project
 name: npm publish
-description: reusable npm workflow for this project
 
 on:
   workflow_call:
diff --git a/.github/workflows/reusable-compute-staging-version.yml b/.github/workflows/reusable-compute-staging-version.yml
index fdee4987..86d76d31 100644
--- a/.github/workflows/reusable-compute-staging-version.yml
+++ b/.github/workflows/reusable-compute-staging-version.yml
@@ -1,6 +1,5 @@
+# compute a staging version from the current version, branch name and commit
 name: Compute staging version
-description:
-  compute a staging version from the current version, branch name and commit
 
 on:
   workflow_call:
@@ -32,8 +31,8 @@ jobs:
           COMMIT_SHA="${{ github.sha }}"
           CURRENT_VERSION=$(npm pkg get version | tr -d '"')
           STAGING_VERSION="${CURRENT_VERSION}-${BRANCH}-${COMMIT_SHA::7}"
-          echo "VERSION=${STAGING_VERSION}" | tee -a $GITHUB_OUTPUT
-          echo "DIST_TAG=${BRANCH}" | tee -a $GITHUB_OUTPUT
+          echo "VERSION=${STAGING_VERSION}" | tee -a "$GITHUB_OUTPUT"
+          echo "DIST_TAG=${BRANCH}" | tee -a "$GITHUB_OUTPUT"
     outputs:
       version: ${{ steps.set-publish-version.outputs.VERSION }}
       dist-tag: ${{ steps.set-publish-version.outputs.DIST_TAG }}

From c2342f80190074df094c7f9aefeb39ab8ee67ee8 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 13 Oct 2026 06:40:07 +0000
Subject: [PATCH 06/11] security: set persist-credentials false on checkout
 steps

Prevent the git credential used by actions/checkout from persisting in the local git config, so later steps or artifacts in the job cannot leak it.
---
 .github/workflows/cli-pr-checks.yml                    | 2 ++
 .github/workflows/reusable-compute-staging-version.yml | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/cli-pr-checks.yml b/.github/workflows/cli-pr-checks.yml
index 2bf00846..c7536329 100644
--- a/.github/workflows/cli-pr-checks.yml
+++ b/.github/workflows/cli-pr-checks.yml
@@ -13,6 +13,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
diff --git a/.github/workflows/reusable-compute-staging-version.yml b/.github/workflows/reusable-compute-staging-version.yml
index 86d76d31..a51ef9c1 100644
--- a/.github/workflows/reusable-compute-staging-version.yml
+++ b/.github/workflows/reusable-compute-staging-version.yml
@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

From 14f442a5af81ad4ecfbf5c7ac49d2fab6ad7f7db Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 13 Oct 2026 06:40:21 +0000
Subject: [PATCH 07/11] security: use pull_request instead of
 pull_request_target for PR title check

pull_request_target runs with base-repo permissions and secrets even for PRs from forks, which is unnecessary here since the job only reads the PR title. pull_request is the safe default for that. Also react to new commits pushed to the PR (synchronize), not just title/PR metadata changes.
---
 .github/workflows/conventional-commit-check-pr-title.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/conventional-commit-check-pr-title.yml b/.github/workflows/conventional-commit-check-pr-title.yml
index 4df59f37..d5d2e61a 100644
--- a/.github/workflows/conventional-commit-check-pr-title.yml
+++ b/.github/workflows/conventional-commit-check-pr-title.yml
@@ -2,11 +2,12 @@
 name: Conventional Commit Check PR Title
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - edited
       - reopened
+      - synchronize
 
 jobs:
   lint-pr-title:

From 5395214b8859c69be401fd9d092328ec4fb0c796 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 13 Oct 2026 07:19:46 +0000
Subject: [PATCH 08/11] security: add explicit permissions to cli publish
 workflows

Set permissions: {} at the workflow level and the minimal permissions each job actually needs (contents: read, plus packages: write and id-token: write for jobs that call publish-npm), instead of relying on the default GITHUB_TOKEN permissions.
---
 .github/workflows/cli-npm-publish.yml | 12 ++++++++++++
 .github/workflows/cli-pr-checks.yml   |  9 +++++++++
 2 files changed, 21 insertions(+)

diff --git a/.github/workflows/cli-npm-publish.yml b/.github/workflows/cli-npm-publish.yml
index d01e9ad0..cd03f539 100644
--- a/.github/workflows/cli-npm-publish.yml
+++ b/.github/workflows/cli-npm-publish.yml
@@ -8,11 +8,15 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
   compute-staging-version:
     # Only run for manual dispatch (staging)
     if: github.event_name == 'workflow_dispatch'
     uses: ./.github/workflows/reusable-compute-staging-version.yml
+    permissions:
+      contents: read
     with:
       working-directory: cli
 
@@ -20,6 +24,10 @@ jobs:
     # Only run for manual dispatch (staging)
     if: github.event_name == 'workflow_dispatch'
     uses: ./.github/workflows/reusable-cli-npm.yml
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     needs: compute-staging-version
     with:
       version: ${{ needs.compute-staging-version.outputs.version }}
@@ -30,5 +38,9 @@ jobs:
     if:
       ${{ github.event_name == 'release' && startsWith(github.ref_name,'iapp-v') }}
     uses: ./.github/workflows/reusable-cli-npm.yml
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     with:
       tag: 'latest'
diff --git a/.github/workflows/cli-pr-checks.yml b/.github/workflows/cli-pr-checks.yml
index c7536329..4a78f1c5 100644
--- a/.github/workflows/cli-pr-checks.yml
+++ b/.github/workflows/cli-pr-checks.yml
@@ -3,6 +3,8 @@ on:
   pull_request:
     paths: ['cli/**']
 
+permissions: {}
+
 concurrency:
   group: ${{ github.ref }}-cli-pr-checks
   cancel-in-progress: true
@@ -10,6 +12,8 @@ concurrency:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -52,5 +56,10 @@ jobs:
 
   npm-dry-run:
     uses: ./.github/workflows/reusable-cli-npm.yml
+    # publish-npm requests these permissions statically, even in dry-run
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     with:
       dry-run: true

From e773e083411a15db1fad90a402eba8defa57286e Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 13 Oct 2026 07:20:08 +0000
Subject: [PATCH 09/11] security: replace secrets: inherit with explicit
 secrets in release-please

Pass only the two secrets the reusable release-please workflow actually declares (RELEASE_PLEASE_APPLICATION_ID, RELEASE_PLEASE_PRIVATE_KEY) instead of inheriting every repo secret. Also drop the workflow-level permissions block to {}, since the called workflow mints its own scoped GitHub App token and never uses GITHUB_TOKEN.
---
 .github/workflows/release-please.yml | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index a1b4071b..8124e4fc 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -6,12 +6,11 @@ on:
     branches:
       - main
 
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   release-please:
     uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@31ad5d9e686d47c7ebdd3c7df3f8c50f58415428 # release-please-v2.2.3
-    secrets: inherit
+    secrets:
+      RELEASE_PLEASE_APPLICATION_ID: ${{ secrets.RELEASE_PLEASE_APPLICATION_ID }}
+      RELEASE_PLEASE_PRIVATE_KEY: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }}

From 0da5063a793600d1401db2d0e40d6ab04f330b34 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 13 Oct 2026 07:20:19 +0000
Subject: [PATCH 10/11] fix: correct dry-run ternary for npm publish
 environment input

(inputs.dry-run && '') || inputs.tag always falls through to inputs.tag because an empty string is falsy, so environment got set to the tag even during a dry run. Negate the condition so dry-run correctly yields an empty environment.
---
 .github/workflows/reusable-cli-npm.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/reusable-cli-npm.yml b/.github/workflows/reusable-cli-npm.yml
index 00d58a38..eb3d1022 100644
--- a/.github/workflows/reusable-cli-npm.yml
+++ b/.github/workflows/reusable-cli-npm.yml
@@ -28,5 +28,5 @@ jobs:
       dry-run: ${{ inputs.dry-run }}
       tag: ${{ inputs.tag }}
       version: ${{ inputs.version }}
-      environment: ${{ (inputs.dry-run && '') || inputs.tag }}
+      environment: ${{ (!inputs.dry-run && inputs.tag) || '' }}
       provenance: ${{ !inputs.dry-run }}

From 364658e9111c0a1cb1584923d0488f54f7440edc Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 13 Oct 2026 07:20:35 +0000
Subject: [PATCH 11/11] security: avoid template injection in staging version
 script

Read the branch name and commit SHA from the GITHUB_REF_NAME and GITHUB_SHA environment variables instead of interpolating ${{ github.ref_name }} and ${{ github.sha }} directly into the shell script, where a crafted branch name could otherwise inject arbitrary commands.
---
 .github/workflows/reusable-compute-staging-version.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/reusable-compute-staging-version.yml b/.github/workflows/reusable-compute-staging-version.yml
index a51ef9c1..86f1c8fd 100644
--- a/.github/workflows/reusable-compute-staging-version.yml
+++ b/.github/workflows/reusable-compute-staging-version.yml
@@ -29,8 +29,8 @@ jobs:
         id: set-publish-version
         working-directory: ${{ inputs.working-directory }}
         run: |
-          BRANCH=$(echo "${{ github.ref_name }}" | sed 's|/|-|g')
-          COMMIT_SHA="${{ github.sha }}"
+          BRANCH="${GITHUB_REF_NAME//\//-}"
+          COMMIT_SHA="${GITHUB_SHA}"
           CURRENT_VERSION=$(npm pkg get version | tr -d '"')
           STAGING_VERSION="${CURRENT_VERSION}-${BRANCH}-${COMMIT_SHA::7}"
           echo "VERSION=${STAGING_VERSION}" | tee -a "$GITHUB_OUTPUT"