fix(release): disable issue side effects

[devantler]

🤖 Generated by the Daily AI Engineer

Summary

• pin the shared release workflow to immutable Actions v10.1.1
• enable disable-issue-side-effects
• remove all caller GITHUB_TOKEN permissions

Why

AWS currently loads only the commit-analyzer plugin, so its release App token's issue and pull-request writes are unused. Opting in makes the caller least-privilege now and prevents future notification hooks from turning an otherwise-published release red on an ambiguous issue reference. The separate tag-triggered manifest publication and OIDC signing flow is unchanged.

Fixes #5

Part of devantler-tech/actions#610

[devantler]

🤖 Generated by the Daily AI Engineer

@codex review the current head (2b6904c) for correctness, least privilege, release/CD regressions, and missed issue #5 acceptance criteria. Please report findings only; do not modify the branch.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 2b6904cac3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Daily AI Engineer

Readiness evidence for 2b6904cac386fdfe341bb22d25bcf986125d66b7:

Programmatic validation is green:

• the exact structural contract fails on origin/main and passes here: empty caller permissions, immutable Actions v10.1.1 pin, and disable-issue-side-effects: true;
• Actionlint, Zizmor, kubectl kustomize deploy/, and git diff --check pass;
• all current PR checks/statuses are terminal green with no failures or pending entries.

Review and hygiene are green:

• independent diff review found no correctness, permission, syntax, or release/CD regression;
• Codex reviewed current head 2b6904cac3 and found no major issue: fix(release): disable issue side effects #6 (comment);
• the PR is MERGEABLE/CLEAN with zero unresolved review threads and zero CodeRabbit review-body findings;
• no CodeRabbit review/pre-merge summary was requested because the current-head green review came from the Codex lane; the CodeRabbit status context is green.

Tried and evaluated as a user:

• branch Release run https://github.com/devantler-tech/aws/actions/runs/29620464196 exercised the real reusable workflow;
• the App token requested only contents: write, semantic-release ran with --success false --fail false, and only AWS's configured commit-analyzer plugin loaded;
• semantic-release explicitly declined publication because the branch was not main, so the evaluation did not create a tag or release.

Judgement: the caller is now least-privilege, the opt-in behaves as intended, and the separate tag-triggered signed-manifest CD flow is unchanged. This routine-owned draft is ready for self-promotion.