From 621a25793c582fe23ef55a7b42ab20a8cd35d8da Mon Sep 17 00:00:00 2001 From: leemour Date: Sat, 10 Oct 2026 20:37:13 +0200 Subject: [PATCH 1/2] chore: run heavy security checks at release only --- .github/workflows/release.yml | 6 +++++- CHANGELOG.md | 5 +++++ socket.yml | 3 +++ 3 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 socket.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a865cae..09f8a13 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,7 +25,11 @@ jobs: if: github.ref == 'refs/heads/main' || inputs.dry_run permissions: contents: read - uses: WireCatLabs/cli-core/.github/workflows/release-checks.yml@b36a30fb6037b457001bd2db860949f64512ecdd # v0.17.3 + actions: read + security-events: write + uses: WireCatLabs/cli-core/.github/workflows/release-checks.yml@1183bfb970330989ad8acec917b14b7e6187de15 + with: + languages: '["actions","javascript-typescript","python"]' build: needs: checks diff --git a/CHANGELOG.md b/CHANGELOG.md index ce1623a..5083c78 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,11 @@ Every entry says what changed as a caller sees it, why, and what to watch for ## Unreleased +### Security + +- Fast secret checks remain on PRs; source, production dependency and workflow security checks run before publication. Automatic Socket checks are disabled. + + ### Added - On-demand offline search verification for exact published Telegram and MAX packages, with diff --git a/socket.yml b/socket.yml new file mode 100644 index 0000000..b5c0fa2 --- /dev/null +++ b/socket.yml @@ -0,0 +1,3 @@ +version: 2 +githubApp: + enabled: false From 7e79c5c5e7ac144536e564f9c8eaba296323e2ec Mon Sep 17 00:00:00 2001 From: leemour Date: Sat, 10 Oct 2026 20:41:02 +0200 Subject: [PATCH 2/2] docs: normalize release note spacing --- CHANGELOG.md | 1 - 1 file changed, 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5083c78..33b6054 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,7 +12,6 @@ Every entry says what changed as a caller sees it, why, and what to watch for - Fast secret checks remain on PRs; source, production dependency and workflow security checks run before publication. Automatic Socket checks are disabled. - ### Added - On-demand offline search verification for exact published Telegram and MAX packages, with