The workflow uses a popular third-party GitHub Action to create releases. While the same result could be achieved with a built-in command, using this action is standard practice and poses no security risk.
Technical evidence
Scanner reason: zizmor matched workflow-security rule superfluous-actions. The match applies to this repository.
Contextual assessment: The zizmor superfluous-actions rule flags that softprops/action-gh-release@v2 duplicates functionality available via the GitHub CLI already installed on the runner. This is an informational best-practice finding, not a security vulnerability. The action is pinned to a major version (v2), is widely used for creating GitHub Releases, and the workflow only uses it to publish a pre-built zip artifact. No credential exfiltration, code execution, or data flow concerns are present. The scanner severity is info, confirming this is a style/efficiency note rather than a security threat.
Impact: none · Exploitability: unlikely
Developer action: Consider replacing the third-party release action with the built-in GitHub CLI if you want to reduce third-party dependency, but this is optional and not security-critical.