From 0b27b8501a9e2224b3a515228f390f352e6ff704 Mon Sep 17 00:00:00 2001
From: Johann Diedrick <johann@mozillafoundation.org>
Date: Thu, 20 Nov 2025 14:21:27 -0500
Subject: [PATCH] using PAT-authenticated URLs explictly

---
 .github/workflows/publish.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index eeb5b65..ab1ded3 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -64,8 +64,8 @@ jobs:
       - name: Push version bump commit and tags
         if: github.event.pull_request.base.ref == 'main' && steps.prepare_main.conclusion == 'success'
         run: |
-          git push origin HEAD:${{ github.event.pull_request.base.ref }}
-          git push origin --tags
+          git push https://x-access-token:${{ secrets.RELEASE_PAT }}@github.com/${{ github.repository }}.git HEAD:${{ github.event.pull_request.base.ref }}
+          git push https://x-access-token:${{ secrets.RELEASE_PAT }}@github.com/${{ github.repository }}.git --tags
 
       - name: Publish to TestPyPI
         if: github.event.pull_request.base.ref == 'test-pypi'