[claude]

Requested by Samuel Attard · Slack thread

Bumps secret-service-action to v1.1.0, which points the secret exchange at secret-service's new home on ionic (secret-service.electronjs.org) instead of Heroku.

---

Generated by Claude Code

[claude]

I reviewed this PR and didn't find any bugs. The bumped action is the one that fetches the release job's GitHub token, so a human should still confirm the new pin before merging.

What was reviewed:

• The only change is the electron/secret-service-action pin in .github/workflows/release.yml. It's still a full 40-character SHA with a # v1.1.0 comment, which matches how the repo pins its other actions.
• The step id and the later fromJSON(steps.secret-service.outputs.secrets).GITHUB_TOKEN usage are unchanged, and the job's permissions are unchanged.
• I couldn't check from this checkout that 23b9042f… is the upstream v1.1.0 tag, or that v1.1.0 still returns the secrets output in the same shape.

Extended reasoning...

The change is a one-line bump of the pinned SHA for electron/secret-service-action in the release workflow. That step gets the GITHUB_TOKEN that semantic-trusted-release uses, and the job runs with id-token: write in the npm-trusted-publisher environment, so this touches credential handling. A CODEOWNERS rule (*) covers every file in the repo, including this one. I couldn't confirm the new SHA against the upstream tag, so I deferred instead of approving.