From 183e9b1e2a0813446134f32724d41fc59a834682 Mon Sep 17 00:00:00 2001
From: pgherveou <pgherveou@gmail.com>
Date: Wed, 15 Jul 2026 16:03:50 +0200
Subject: [PATCH] fix(release): create tags through API

The checkout intentionally omits persisted Git credentials. Use the\nauthenticated GitHub API instead of an HTTPS Git push.
---
 .github/workflows/release.yml | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d1d0b1ed..409d8bf4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -171,26 +171,21 @@ jobs:
       - name: Create release tags
         if: steps.version.outputs.proceed == 'true'
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_SHA: ${{ github.event.workflow_run.head_sha }}
           STEPS_VERSION_OUTPUTS_PACKAGES: ${{ steps.version.outputs.packages }}
         run: |
           set -euo pipefail
-          auth_header="AUTHORIZATION: bearer ${GITHUB_TOKEN}"
-          push_refs=()
           while IFS='|' read -r name path version tag; do
-            if git -c http.extraheader="${auth_header}" ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
+            if git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
               echo "Tag ${tag} already exists; skipping create."
               continue
             fi
-            git tag --force "${tag}" "${RELEASE_SHA}"
-            push_refs+=("refs/tags/${tag}:refs/tags/${tag}")
+            gh api --method POST "repos/${{ github.repository }}/git/refs" \
+              -f ref="refs/tags/${tag}" \
+              -f sha="${RELEASE_SHA}"
           done <<< "${STEPS_VERSION_OUTPUTS_PACKAGES}"
 
-          if [ "${#push_refs[@]}" -gt 0 ]; then
-            git -c http.extraheader="${auth_header}" push origin "${push_refs[@]}"
-          fi
-
       - name: Create GitHub Release
         if: steps.version.outputs.proceed == 'true'
         env: