From 2e0884a43a7c9d0207387db785970bfb137d28fa Mon Sep 17 00:00:00 2001
From: "jorisjonkers-dev-agents[bot]"
 <290081373+jorisjonkers-dev-agents[bot]@users.noreply.github.com>
Date: Fri, 10 Jul 2026 07:01:34 +0000
Subject: [PATCH] chore(main): release 0.12.4

---
 .release-please-manifest.json | 2 +-
 CHANGELOG.md                  | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index e1a55a3..e939560 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.12.3"
+  ".": "0.12.4"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 74676d1..7b93d8b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,13 @@
 * enforce zero-warning reusable CI gates for Node, Nix, Python, and JVM workflows
 * fail Gradle warnings and deprecations while making JVM lint static-only by default
 
+## [0.12.4](https://github.com/JorisJonkers-dev/github-workflows/compare/v0.12.3...v0.12.4) (2026-07-10)
+
+
+### Bug Fixes
+
+* **leak-scan:** install gitleaks+trufflehog with SHA pins; fail-closed all-refs mode ([#63](https://github.com/JorisJonkers-dev/github-workflows/issues/63)) ([1ddf81e](https://github.com/JorisJonkers-dev/github-workflows/commit/1ddf81e6128055f44585c449aee1b445faf40f67))
+
 ## [0.12.3](https://github.com/JorisJonkers-dev/github-workflows/compare/v0.12.2...v0.12.3) (2026-07-10)