From ec8d0d650413d5258b47ef489869b67ff3caf8e7 Mon Sep 17 00:00:00 2001
From: Hadrien David <h@driendavid.com>
Date: Sun, 2 Aug 2026 09:55:57 -0400
Subject: [PATCH] fix(ci): authenticate release pushes explicitly

---
 .github/workflows/release.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f39341a..5697b0e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ jobs:
       uses: actions/checkout@v7
       with:
         fetch-depth: 0
-        token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+        persist-credentials: false
     - name: 🔧 setup uv
       uses: ./.github/uv
     - name: 📜 semantic release version & publish on PyPI
@@ -43,7 +43,8 @@ jobs:
           uv run semantic-release version --no-push --no-vcs-release
           release_sha=$(git rev-parse HEAD)
           release_branch="release/${release_tag}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
-          git push origin "HEAD:refs/heads/${release_branch}"
+          release_remote="https://${GITHUB_ACTOR}:${RELEASE_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git push "$release_remote" "HEAD:refs/heads/${release_branch}"
 
           ci_run_id=""
           for _ in {1..120}; do
@@ -65,12 +66,13 @@ jobs:
           fi
 
           gh run watch "$ci_run_id" --exit-status
-          git push --atomic origin \
+          git push --atomic "$release_remote" \
             "HEAD:refs/heads/main" \
             "refs/tags/${release_tag}:refs/tags/${release_tag}"
-          git push origin --delete "$release_branch"
+          git push "$release_remote" --delete "$release_branch"
         fi
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        RELEASE_TOKEN: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
         TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }}
         TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}