Enhance GitHub Actions workflows with improved authentication and validation

.github/workflows/create-pr.yml

@@ -35,13 +35,29 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     env:
-      GH_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
+      # ACTIONS_TOKEN (PAT) preferred - PRs created with github.token won't trigger CI workflows
+      GH_TOKEN: ${{ secrets.ACTIONS_TOKEN || github.token }}
     steps:
+      - name: Check token configuration
+        run: |
+          if [ -z "${{ secrets.ACTIONS_TOKEN }}" ]; then
+            echo "::warning::ACTIONS_TOKEN not set - using github.token as fallback"
+            echo ""
+            echo "⚠️  PRs created with github.token have limitations:"
+            echo "   - Won't trigger on:pull_request workflows (CI won't run automatically)"
+            echo "   - May be blocked by branch protection rules"
+            echo ""
+            echo "To enable full functionality, set ACTIONS_TOKEN secret:"
+            echo "   gh secret set ACTIONS_TOKEN"
+          else
+            echo "✅ Using ACTIONS_TOKEN for full PR functionality"
+          fi
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.ref }}
-          token: ${{ secrets.ACTIONS_TOKEN }}
+          # ACTIONS_TOKEN preferred for pushing to protected branches
+          token: ${{ secrets.ACTIONS_TOKEN || github.token }}
           fetch-depth: 0
 
       - name: Determine source branch

.github/workflows/create-release.yml

@@ -26,7 +26,6 @@ jobs:
         with:
           ref: main
           fetch-depth: 0
-          token: ${{ secrets.ACTIONS_TOKEN }}
 
       - name: Setup Python
         uses: actions/setup-python@v5
@@ -70,6 +69,20 @@ jobs:
 
           echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
           echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
+          echo "New version: $NEW_VERSION"
+          echo "Branch name: $BRANCH_NAME"
+
+      - name: Check if branch already exists
+        run: |
+          BRANCH_NAME="${{ steps.new-version.outputs.branch_name }}"
+
+          # Check if branch exists locally or remotely
+          if git show-ref --verify --quiet refs/heads/$BRANCH_NAME || git show-ref --verify --quiet refs/remotes/origin/$BRANCH_NAME; then
+            echo "❌ Branch $BRANCH_NAME already exists"
+            exit 1
+          else
+            echo "✅ Branch $BRANCH_NAME does not exist, proceeding..."
+          fi
 
       - name: Configure Git
         run: |

.github/workflows/tag-release.yml

@@ -18,8 +18,6 @@ on:
         description: 'The GitHub release URL'
         value: ${{ jobs.tag.outputs.release_url }}
     secrets:
-      ACTIONS_TOKEN:
-        required: true
       ANTHROPIC_API_KEY:
         required: true
 
@@ -38,7 +36,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ inputs.branch_ref }}
-          token: ${{ secrets.ACTIONS_TOKEN }}
+          token: ${{ github.token }}
           fetch-depth: 0
 
       - name: Get Version from pyproject.toml
@@ -258,7 +256,7 @@ jobs:
           draft: false
           prerelease: false
         env:
-          GITHUB_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
 
       - name: Create release summary
         if: steps.check-tag.outputs.tag_exists == 'false'