obsidian-development

This workflow itself contains no direct malicious logic, but it introduces significant CI/CD supply-chain risk by delegating all build/release behavior to an external reusable workflow referenced via a mutable @main branch, granting broad write permissions, and forwarding a high-privilege RELEASE_TOKEN to that external workflow. To reduce risk, pin the reusable workflow to an immutable commit SHA, and audit the invoked workflow to ensure token handling is least-privilege and does not enable exfiltration or malicious publishing.