release-please

The code is release automation documentation and does not itself show malware or deliberate data theft. However, the manual prerelease workflow contains a real shell command-injection vulnerability because untrusted workflow_dispatch input is interpolated directly into a run script executed with write and package permissions. Mutable action references and broad workflow permissions add CI supply-chain risk. Remediation is recommended before using the templates in a privileged repository.