[claude]

Requested by Samuel Attard · Slack thread

Bumps secret-service-action to v1.1.0, which points the secret exchange at secret-service's new home on ionic (secret-service.electronjs.org) instead of Heroku.

---

Generated by Claude Code

[claude]

I reviewed this PR and didn't find any bugs. This step fetches the release secrets, and I couldn't check the new pin from this checkout, so a maintainer should confirm that 23b9042f797e34674f0fe2c91608f57f9661ccf2 is the real v1.1.0 tag of electron/secret-service-action.

What was reviewed:

• The one-line change to the secret-service step in .github/workflows/release.yml. It is still pinned to a full commit SHA, and the version comment matches.
• The semantic release step that follows still reads fromJSON(steps.secret-service.outputs.secrets).GITHUB_TOKEN. The new version needs to keep the secrets output in the same JSON shape.

Extended reasoning...

The change moves the pinned commit of electron/secret-service-action in the release workflow. That action gets the GitHub token used to publish releases, and by the PR's own description, v1.1.0 also changes which server the secrets come from. This is credential-handling code that runs on pushes to main in the npm-trusted-publisher environment. CODEOWNERS assigns every path to a team. GitHub was out of reach from this run, so the new SHA and the action's output contract couldn't be checked against the upstream tag.