From e491718983d83031e1f0b890882b304846c3ab1e Mon Sep 17 00:00:00 2001
From: Steven Gates <gates.steven@gmail.com>
Date: Tue, 8 Sep 2026 09:30:24 -0500
Subject: [PATCH] fix(tag): use the job's own GITHUB_TOKEN, not the release PAT
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Run 34238237358 reached `gh release create` and got
"HTTP 403: Resource not accessible by personal access token".

This workflow preferred RELEASE_TOKEN whenever it was set, which handed a job
that never needed the PAT a credential weaker than the one it already had.
Run 2 creates a tag and a release; tags are not covered by the branch ruleset,
and this workflow already declares permissions: contents: write, so
GITHUB_TOKEN is both sufficient and the right token for the job.

RELEASE_TOKEN stays in release.yml, where the merge genuinely needs to bypass
the ruleset. Narrowing where the PAT is used is the correct direction anyway —
it should be reachable by exactly the one step that cannot work without it.
---
 .github/workflows/tag.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
index d6283f2..23f6e5c 100644
--- a/.github/workflows/tag.yml
+++ b/.github/workflows/tag.yml
@@ -9,6 +9,12 @@ name: Release · tag
 #
 # scripts/tag-release.ps1 runs unmodified: it shells out only to `git` and `gh`, and both — plus
 # pwsh — are preinstalled on ubuntu runners.
+#
+# This workflow deliberately does NOT use RELEASE_TOKEN. Creating a tag and a release needs
+# contents: write, which the job's own GITHUB_TOKEN has (declared below); tags are not covered by
+# the branch ruleset, so there is nothing here to bypass. The PAT belongs to release.yml's merge
+# step and nowhere else — an earlier version preferred it here and got
+# "HTTP 403: Resource not accessible by personal access token" from `gh release create`.
 
 on:
   workflow_dispatch:
@@ -34,8 +40,6 @@ on:
         type: boolean
         default: false
 
-# Creating a tag and a GitHub release is a write. Tags are not covered by the branch ruleset, so
-# the job's own GITHUB_TOKEN is enough here — no PAT or App token needed for run 2.
 permissions:
   contents: write
 
@@ -48,7 +52,7 @@ jobs:
     name: Cut tag and GitHub release
     runs-on: ubuntu-latest
     env:
-      GH_TOKEN: ${{ secrets.RELEASE_TOKEN || github.token }}
+      GH_TOKEN: ${{ github.token }}
 
     steps:
       - name: Checkout
@@ -56,7 +60,7 @@ jobs:
         with:
           ref: main
           fetch-depth: 0
-          token: ${{ secrets.RELEASE_TOKEN || github.token }}
+          token: ${{ github.token }}
 
       # tag-release.ps1 warns when releases/openloop-<version>-<code>.aab is missing. In CI it
       # always would be, which turns a real safety check into noise — so pull the artifact the