fix(release): disable issue side effects

[devantler]

🤖 Generated by the Daily AI Engineer

Objective

Adopt the shared release-side-effect opt-in so the AWS release path stops requesting unused issue/pull-request permissions and remains insulated from ambiguous issue references if notification hooks are introduced later.

Evidence

The current .github/workflows/release.yaml caller pins Actions v9.0.0 and the shared workflow requests contents: write, issues: write, and pull-requests: write for its App token. AWS's current .releaserc explicitly loads only @semantic-release/commit-analyzer, so the issue/PR grants are unused today and notification hooks are not presently active.

The portfolio root cause and rollout are tracked by actions#610. Actions v10.1.1 exposes the default-off disable-issue-side-effects input at immutable commit 94146b00945cdcc75fbd99624d909a2345d2bf67; opted-in callers receive a contents-only App token and explicit --success false --fail false protection.

Audience and impact

AWS tenant maintainers and platform consumers need each Conventional-Commit merge to publish a signed manifests artifact reliably and with least privilege. The current caller over-requests permissions it does not use, while a future/default notification-hook change could reintroduce the post-publication failure mode already reproduced in the portfolio.

Proposed change

Pin the release caller to immutable Actions v10.1.1, enable disable-issue-side-effects: true, and set caller permissions: {} while preserving App-token contents publication and the separate tag-triggered OIDC signing flow.

Acceptance criteria

• The caller pins create-release.yaml to Actions v10.1.1 commit 94146b00945cdcc75fbd99624d909a2345d2bf67.
• disable-issue-side-effects: true is explicit.
• The caller token has no permissions and the workflow's App token requests contents only.
• Structural workflow validation and repository CI pass.
• A branch-dispatched release exercises the real caller without publishing off main.
• The next main release and tag-triggered manifest publication succeed.

Dependencies

Part of devantler-tech/actions#610.

Rough size

Small, one workflow caller plus real branch and production release proof.

[coderabbitai]

🔗 Related PRs

#2 - feat(eks-ci): declare the GitHub Actions OIDC identity provider [merged]
#3 - feat(eks-ci): declare the GitHub Actions OIDC identity provider [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!