Pin and verify the optional Logitech release asset

[Blackspirits]

Purpose

Current-base security hardening/replacement for upstream PR SubtitleEdit#13875.

SubtitleEdit#13875 downloads the latest .lplug4 release from an external repository during Subtitle Edit's official release job and attaches it without a pinned tag or content digest. That makes the bytes distributed from the official Subtitle Edit release page depend on whatever third-party release is "latest" at release time.

The plugin author explicitly called out this trust decision in SubtitleEdit#13875 and offered a fixed tag + SHA-256 approach.

Trust boundary

The currently published plugin release is:

• repository: muaz978/subtitleedit-logi-plugin
• tag: v1.3.1
• asset: SubtitleEdit_1_3_1.lplug4
• GitHub asset digest: sha256:ec5c6b5e28bfe6ed8b8cb4a919c1bb7dd512100523fba811c3c6b10c32a8ea54

The GitHub release reports immutable: false, so the digest remains necessary even with a fixed tag.

Change

Instead of fetching an unpinned third-party binary inside create-release:

• the first-party Subtitle Edit release is created exactly as before;
• a separate optional attach-logi-plugin job runs afterwards;
• it downloads only tag v1.3.1 and the exact asset name;
• SHA-256 must match the maintainer-approved digest;
• only verified bytes are renamed and uploaded;
• the optional job uses continue-on-error: true, so an outage or integrity failure cannot block the first-party release;
• call-seconv continues to depend only on create-release, not on the third-party asset;
• release notes point to the Logi Marketplace and state that the pinned verified package is attached only when the external fetch succeeds, so there is no guaranteed broken asset link.

Maintenance

Updating the bundled plugin becomes an explicit review action: bump the tag, exact asset name and SHA-256 together after reviewing the new plugin release. A later "latest" release can never silently enter an already-approved Subtitle Edit workflow.

Validation

• based on current upstream c77c4b428649ce7030e6cf218b4d7c384b955232
• one workflow file only
• no C# or application runtime changes
• final HEAD: 962dbac0fe92dbdc371c957f54b7008acd6b3334
• the redistributed .lplug4 does not itself contain the full MIT license text, so the workflow also attaches SubtitleEdit-LogiOptionsPlus-Plugin-LICENSE.txt with the exact v1.3.1 license notice
• full solution restore passed
• full solution build passed
• full solution test suite passed on the first run
• SeConvTests: 475 passed, 2 skipped, 0 failed (477 total)
• LibUiLogicTests: 873 passed, 0 skipped, 0 failed
• LibSETests: 2,008 passed, 0 skipped, 0 failed
• UITests: 5,151 passed, 9 skipped, 0 failed (5,160 total)
• retry step was not used
• validation run: #34796895786
• audit draft only; no merge/promotion intended

AI assistance: ChatGPT was used to audit the third-party release-asset trust boundary and design a pinned, digest-verified post-release attachment flow.

[Blackspirits]

Independent adversarial re-check: the original SubtitleEdit#13875 trust boundary is replaced with a pinned tag + exact asset + SHA-256 verification, and the optional third-party fetch/upload occurs only after the first-party release exists, so outage or digest mismatch cannot block Subtitle Edit's own release. The v1.3.1 .lplug4 metadata says MIT but the package tree does not carry the full license text, so the final revision also attaches the exact MIT notice from the same tagged source. Full CI #34796895786 passed restore, build and the complete suite on the first run: SeConvTests 475/2/0, LibUiLogicTests 873/0/0, LibSETests 2008/0/0, UITests 5151/9/0. Retry was not used. No blocker identified. Keep draft; no merge performed.