[claude]

Requested by Samuel Attard · Slack thread

Bumps secret-service-action to v1.1.0, which points the secret exchange at secret-service's new home on ionic (secret-service.electronjs.org) instead of Heroku.

---

Generated by Claude Code

[claude]

I reviewed this PR and found no bugs. The diff is a one-line pin bump, but the action it changes fetches the secrets the release job publishes with. A human should still confirm that 23b9042f797e34674f0fe2c91608f57f9661ccf2 really is the v1.1.0 tag of electron/secret-service-action.

What was reviewed:

• The diff changes only the commit pin for the "Get GitHub app token" step. The action stays pinned to a full SHA with a version comment, matching the other steps.
• The next step reads fromJSON(steps.secret-service.outputs.secrets).GITHUB_TOKEN, so v1.1.0 has to keep the secrets output in the same shape. I couldn't check this or the tag SHA from this shallow checkout.

Extended reasoning...

The change edits one line in .github/workflows/release.yml: it moves the electron/secret-service-action pin from the v1.0.0 SHA to a SHA labeled v1.1.0. That step supplies the GitHub token to semantic-trusted-release in a job with id-token: write that publishes to npm, so it touches the release secret-handling path. CODEOWNERS assigns every file to the ecosystem working group. The new SHA and the action's output contract couldn't be checked against upstream from here. These facts are why a human should take a look instead of the PR getting an automatic approval.