From cbda8a4aaf8a9924507e9721d920fba144168da6 Mon Sep 17 00:00:00 2001
From: Robert McConnell <robert@mcc0nnell.org>
Date: Fri, 18 Sep 2026 18:38:49 +0000
Subject: [PATCH] ci: keep alpha release token out of push URL

---
 .github/workflows/alpha-releases.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/alpha-releases.yml b/.github/workflows/alpha-releases.yml
index 11e9b8411a5..8ae067ec6ac 100644
--- a/.github/workflows/alpha-releases.yml
+++ b/.github/workflows/alpha-releases.yml
@@ -36,4 +36,8 @@ jobs:
         run: git tag v${NEXT_ALPHA}-ember-source
       - name: push tag
         # Push in a way that WILL trigger other workflows
-        run: git push https://${GITHUB_ACTOR}:${{ secrets.PERSONAL_TOKEN }}@github.com/${GITHUB_REPOSITORY} v${NEXT_ALPHA}-ember-source
+        env:
+          PERSONAL_TOKEN: ${{ secrets.PERSONAL_TOKEN }}
+        run: |
+          credential_helper='!f() { echo "username=$GITHUB_ACTOR"; echo "password=$PERSONAL_TOKEN"; }; f'
+          git -c credential.helper= -c credential.helper="$credential_helper" push "https://github.com/${GITHUB_REPOSITORY}" "v${NEXT_ALPHA}-ember-source"