github-release

The workflow appears intended to release an extension and publish it to the TYPO3 Extension Repository. No direct malware, credential theft, obfuscated code, shell execution, or suspicious network destination is present in this file. The primary security risk is supply-chain exposure from invoking external reusable workflows at the mutable `main` branch, combined with write permissions, OIDC access, and publishing secrets. Pin the workflows to reviewed immutable commit SHAs and minimize permissions where possible.