fix(security): pin CI action SHAs and clean repository hygiene

[VariableThe]

Summary by CodeRabbit

• Security

  • Strengthened the release process by locking third-party build actions to fixed versions.
  • Removed tracked release artifacts and updated ignore rules to prevent accidental repository leaks.

• Chores

  • Added audit and changelog entries documenting the security and repository hygiene updates.

• Bug Fixes

  • Cleaned up a platform-specific constant so it only applies where it’s actually used, reducing warning noise.

[coderabbitai]

Warning

Review limit reached

@VariableThe, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 44 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 61794ad9-3703-43ab-b3f1-e94120607eda

📥 Commits

Reviewing files that changed from the base of the PR and between 797bae0 and 32c16e6.

📒 Files selected for processing (2)

• AUDIT_LOG.md
• CHANGELOG.md

📝 Walkthrough

Walkthrough

The release workflow pins all third-party GitHub Actions to immutable commit SHAs instead of floating version tags. A Rust constant (FOCUS_LOSS_DEBOUNCE_MS) is gated to non-macOS builds via #[cfg] instead of #[allow(dead_code)]. Changelog and audit log entries document both changes.

Changes

Security & Hygiene Fixes

Layer / File(s)	Summary
Pin GitHub Actions to commit SHAs .github/workflows/release.yml	Checkout, Rust toolchain, Node setup, and Tauri build/upload actions replaced with pinned SHA references across all three jobs (create-tag, build-and-release, update-homebrew).
Gate constant to non-macOS src-tauri/src/lib.rs	FOCUS_LOSS_DEBOUNCE_MS now uses #[cfg(not(target_os = "macos"))] instead of #[allow(dead_code)], removing the symbol from macOS builds entirely.
Changelog and audit log CHANGELOG.md, AUDIT_LOG.md	New ### Security section added under [v0.5.6]; audit log entry added for 2026-06-29 describing both fixes.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~4 minutes

Poem

🐇 A bunny pinned each action down,
No floating tags to wear the crown.
The constant hid on macOS days,
The audit log records our ways.
Supply chains locked, the repo clean — hooray! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: pinning CI action SHAs and cleaning up repository hygiene.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/security-and-repo-hygiene

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Line 38: Update the build-and-release job’s actions/checkout usage to disable
persisted checkout credentials, since this workflow only needs a read-only clone
and should not leave the repo token available to later steps. Adjust the
checkout configuration in the release workflow so the clone still succeeds but
no authentication credentials are stored for reuse.
- Around line 40-41: The Rust setup step using dtolnay/rust-toolchain is pinned
by commit SHA, so it no longer inherits the stable selector; update the Install
Rust step in the workflow to explicitly pass toolchain: stable to the
rust-toolchain action so the build consistently installs the stable toolchain.

🪄 Autofix (Beta)

❌ Autofix failed (check again to retry)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7a987b70-4194-4195-8a37-f7817518a35c

📥 Commits

Reviewing files that changed from the base of the PR and between 5feed52 and 797bae0.

📒 Files selected for processing (4)

• .github/workflows/release.yml
• AUDIT_LOG.md
• CHANGELOG.md
• src-tauri/src/lib.rs

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

The agent generated fixes only for .github/workflows/ files, which cannot be committed due to permission restrictions. Please apply these changes manually.

---

⚠️ 1 file(s) could not be committed — the agent does not have permission to push to .github/workflows/. Please apply these changes manually:

.github/workflows/release.yml — 1 change:

Lines 36–44

     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      
+        with:
+          persist-credentials: false
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          toolchain: stable
         
       - name: Install dependencies (Ubuntu only)
         if: matrix.os == 'ubuntu-latest'