From b321f08d5d523e42ee9b725a046badeb0228e001 Mon Sep 17 00:00:00 2001
From: askalf <263217947+askalf@users.noreply.github.com>
Date: Sat, 11 Jul 2026 19:41:30 -0400
Subject: [PATCH] harden: scope release token out of npm test

---
 .github/workflows/auto-release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index c302f73..bb80932 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -42,6 +42,7 @@ jobs:
         with:
           ref: main
           fetch-depth: 2  # need HEAD^1 for the version-diff check
+          persist-credentials: false
 
       - name: Check if version actually changed
         id: ver