From 70caea1eabb8fad5d786e243a91cbe660fbef81b Mon Sep 17 00:00:00 2001
From: Lev Gelfenbuim <hi@lev.engineer>
Date: Sun, 25 Oct 2026 12:42:51 +0200
Subject: [PATCH] ci(auto-tag): use GITHUB_TOKEN and dispatch publish instead
 of a PAT

The v1.2.1 auto-tag failed at checkout because PAT_TOKEN (created
2025-10-10) expired. The PAT existed only so the pushed tag would
trigger the publish workflow, which a GITHUB_TOKEN push doesn't.

Push the tag with GITHUB_TOKEN and start publish explicitly with
'gh workflow run publish.yml --ref <tag>' (workflow_dispatch is exempt
from that rule; github.ref is still refs/tags/<tag>, so the release
step runs). Restrict the job to main, since the default branch is now
develop and a bare manual dispatch would otherwise tag develop.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/auto-tag.yml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/auto-tag.yml b/.github/workflows/auto-tag.yml
index 91addac4..251bc829 100644
--- a/.github/workflows/auto-tag.yml
+++ b/.github/workflows/auto-tag.yml
@@ -8,17 +8,24 @@ on:
     paths:
       - 'package.json'
 
+# Uses the built-in GITHUB_TOKEN, so there is no PAT to expire. A tag
+# pushed with GITHUB_TOKEN doesn't trigger other workflows, so this
+# dispatches the publish workflow on the new tag explicitly
+# (workflow_dispatch is exempt from that rule).
 jobs:
   tag:
+    # Only tag main. The default branch is develop, so a manual dispatch
+    # without --ref main would otherwise tag develop.
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      actions: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
-          token: ${{ secrets.PAT_TOKEN }}
 
       - name: Get version from package.json
         id: version
@@ -44,6 +51,12 @@ jobs:
           git tag -a "${{ steps.version.outputs.tag }}" -m "Release ${{ steps.version.outputs.tag }}"
           git push origin "${{ steps.version.outputs.tag }}"
 
+      - name: Trigger publish
+        if: steps.check_tag.outputs.exists == 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh workflow run publish.yml --repo "${{ github.repository }}" --ref "${{ steps.version.outputs.tag }}"
+
       - name: Tag already exists
         if: steps.check_tag.outputs.exists == 'true'
         run: echo "Tag ${{ steps.version.outputs.tag }} already exists, skipping"