arch-tsdown

This is a release automation workflow that invokes an external reusable workflow to publish packages when version tags are pushed. The fragment itself contains no evident malware or malicious behavior. The main supply-chain risk is trust in the external workflow and its mutable `v1` reference; an attacker who compromises or changes that tag could execute code with repository write and OIDC publishing privileges. Pinning the reusable workflow to a reviewed immutable commit SHA and minimizing permissions would reduce this risk.