github-release

The fragment is release-workflow documentation with no direct evidence of malware or intentional data theft. It presents legitimate SBOM, provenance, and signing practices, but has meaningful workflow security weaknesses: mutable external references, broad job permissions, and non-enforcing tag signature verification. Pin reusable workflows and actions to trusted commit SHAs, make signature verification fail closed, and minimize permissions per job. The security risk concerns CI supply-chain exposure rather than malicious behavior in this fragment.

The workflow appears intended to release an extension and publish it to the TYPO3 Extension Repository. No direct malware, credential theft, obfuscated code, shell execution, or suspicious network destination is present in this file. The primary security risk is supply-chain exposure from invoking external reusable workflows at the mutable `main` branch, combined with write permissions, OIDC access, and publishing secrets. Pin the workflows to reviewed immutable commit SHAs and minimize permissions where possible.