Gavin K 045126c9af fix: security hardening — GHA injection, wrong constant, invalid JSON ...

- .github/workflows/release.yml: Fix script injection by moving
  user-controlled inputs (module_path, tag_suffix) to env vars instead
  of direct ${{ }} interpolation in shell blocks. Pin
  softprops/action-gh-release to SHA (v2.6.2). Add explicit
  permissions: contents: read to the detect job.

- collection/ai_surface/ai_surface.c: Replace INVALID_FILE_ATTRIBUTES
  with the correct (DWORD)0xFFFFFFFF for GetFileSize error check.
  Both happen to be 0xFFFFFFFF but the former is semantically wrong.

- discovery/wallpaper_enum/metadata.json: Remove trailing comma that
  made the file invalid JSON.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-06-11 03:21:24 +00:00

..

release.yml

fix: security hardening — GHA injection, wrong constant, invalid JSON

2026-06-11 03:21:24 +00:00