fix(release): restore the release workflow

[2heal1]

Summary

• pin every release workflow action to a full commit SHA
• grant the release job contents: write so the changelog step can create a GitHub Release

Root cause

The repository action policy rejected version-tag action references. After those references were pinned, npm publishing succeeded, but conventional-github-releaser received a read-only GITHUB_TOKEN and failed with Resource not accessible by integration (403).

Impact

Future release runs can load the approved actions and create the GitHub Release after publishing packages and pushing the version tag.

Validation

• parsed .github/workflows/release.yml successfully
• verified all four action references use full 40-character SHAs
• git diff --check passed

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
garfish	Ready	Preview	Aug 4, 2026 7:47am