Pin external GitHub Action softprops/action-gh-release to a commit SHA (code scanning S7637)

[404-Page-Found]

Summary

Code scanning (rule githubactions:S7637) flags softprops/action-gh-release@v2 in .github/workflows/publish.yml:81 — an external GitHub Action referenced by a mutable tag (@v2) instead of a pinned commit SHA.

Expected behavior

Third-party actions are pinned to a full commit SHA to prevent supply-chain tampering (a tag can be force-moved by the action owner).

Actual behavior

uses: softprops/action-gh-release@v2 resolves to whatever the tag points at when the workflow runs.

Suggested fix

1. Resolve the current v2 commit SHA of softprops/action-gh-release (e.g. git ls-remote https://github.com/softprops/action-gh-release refs/tags/v2).
2. Pin the step to the SHA: uses: softprops/action-gh-release@<full-sha> (optionally append # v2 as a comment for readability).
3. Consider also pinning actions/checkout@v4 and actions/setup-node@v4 for consistency (they were not flagged, but the same risk applies).

Environment

• Workflow: .github/workflows/publish.yml, binaries job

Additional context

Source: GitHub code scanning alert #6. Severity: high.