From a108cca958451252b07c47ed024f4e4dacbc1e3f Mon Sep 17 00:00:00 2001
From: Bin-Home <jimhongbin@gmail.com>
Date: Mon, 27 Apr 2026 19:52:07 +0800
Subject: [PATCH] ci: fix workflow shell safety, pin action SHAs, improve
 release quality

---
 .github/workflows/release.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bf6731c..8cf2d15 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,7 +3,7 @@ name: Release Obsidian plugin
 on:
   push:
     tags:
-      - "*"
+      - "[0-9]*"
 
 jobs:
   build:
@@ -12,9 +12,9 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
         with:
           node-version: "20"
 
@@ -29,11 +29,11 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           tag="${GITHUB_REF#refs/tags/}"
-          files="dist/main.js manifest.json"
+          files=("dist/main.js" "dist/manifest.json")
           if [ -f dist/styles.css ]; then
-            files="$files dist/styles.css"
+            files+=("dist/styles.css")
           fi
           gh release create "$tag" \
             --title="$tag" \
-            --repo="${GITHUB_REPOSITORY}" \
-            $files
+            --generate-notes \
+            "${files[@]}"