Revert "[StepSecurity] Apply security best practices"

[alexprudhomme]

Reverts #7371

Why

The StepSecurity PR (#7371) replaced changesets/action with step-security/changeset-action. This broke the "Create release" CD workflow with:

Error: Unexpected executable file at .husky/pre-commit, GitHub API only supports non-executable files and directories.

Root cause

The upstream changesets/action includes fix #563 — "Don't error on symlinks and executables when they don't have to be touched anyway" (commit).

The step-security/changeset-action fork is missing this fix. Their automated cherry-pick workflow (PR #70) picked up upstream commits #545, #566, and #564, but skipped #563 — likely due to a merge conflict with their own audit/vulnerability patches.

Upstream issue

Filed: step-security/changeset-action#75

Once the fork picks up the missing fix, StepSecurity can re-propose the action swap.

KIT-282

[louis-bompart]

(please explain why, prolly someone from sec that'll stumble here eventually)

[Copilot]

Pull request overview

Reverts the previous StepSecurity change for the Changesets release step in the CD workflow, restoring the upstream Changesets GitHub Action used for creating release PRs and publishing.

Changes:

• Replace step-security/changeset-action with changesets/action in the release workflow step.

[alexprudhomme]

(please explain why, prolly someone from sec that'll stumble here eventually)

Done 👍

[pkg-pr-new]

Open in StackBlitz

@coveo/atomic

npm i https://pkg.pr.new/@coveo/atomic@7379

@coveo/atomic-hosted-page

npm i https://pkg.pr.new/@coveo/atomic-hosted-page@7379

@coveo/atomic-legacy

npm i https://pkg.pr.new/@coveo/atomic-legacy@7379

@coveo/atomic-react

npm i https://pkg.pr.new/@coveo/atomic-react@7379

@coveo/auth

npm i https://pkg.pr.new/@coveo/auth@7379

@coveo/bueno

npm i https://pkg.pr.new/@coveo/bueno@7379

@coveo/create-atomic

npm i https://pkg.pr.new/@coveo/create-atomic@7379

@coveo/create-atomic-component

npm i https://pkg.pr.new/@coveo/create-atomic-component@7379

@coveo/create-atomic-component-project

npm i https://pkg.pr.new/@coveo/create-atomic-component-project@7379

@coveo/create-atomic-result-component

npm i https://pkg.pr.new/@coveo/create-atomic-result-component@7379

@coveo/create-atomic-rollup-plugin

npm i https://pkg.pr.new/@coveo/create-atomic-rollup-plugin@7379

@coveo/headless

npm i https://pkg.pr.new/@coveo/headless@7379

@coveo/headless-react

npm i https://pkg.pr.new/@coveo/headless-react@7379

@coveo/shopify

npm i https://pkg.pr.new/@coveo/shopify@7379

commit: 8b19207

[svcsnykcoveo]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.