ci: fix workflow shell safety, pin action SHAs, improve release quality

.github/workflows/release.yml

@@ -3,7 +3,7 @@ name: Release Obsidian plugin
 on:
   push:
     tags:
-      - "*"
+      - "[0-9]*"
 
 jobs:
   build:
@@ -12,9 +12,9 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
         with:
           node-version: "20"
 
@@ -29,11 +29,11 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           tag="${GITHUB_REF#refs/tags/}"
-          files="dist/main.js manifest.json"
+          files=("dist/main.js" "dist/manifest.json")
           if [ -f dist/styles.css ]; then
-            files="$files dist/styles.css"
+            files+=("dist/styles.css")
           fi
           gh release create "$tag" \
             --title="$tag" \
-            --repo="${GITHUB_REPOSITORY}" \
-            $files
+            --generate-notes \
+            "${files[@]}"