pdf-translate

This workflow builds and publishes desktop release artifacts, but the Windows tag check unsafely interpolates `github.ref_name` into PowerShell, creating a command-injection risk for a crafted tag. Because workflow-level `contents: write` also applies to build jobs, successful injection could have repository write impact. The WebView2 installer is downloaded from go.microsoft[.]com and signature-checked before execution. Severity is a security warning requiring remediation; the fragment does not by itself establish malicious intent.