ci: update

.github/workflows/semantic-release.yml

@@ -2,11 +2,10 @@ name: Semantic Release
 
 on:
   workflow_call:
-
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+    secrets:
+      GH_TOKEN:
+        description: 'PAT with repo access, required to trigger workflows on tag push'
+        required: false
 
 jobs:
   release:
@@ -15,14 +14,29 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
         with:
           fetch-depth: 0
+          token: ${{ secrets.GH_TOKEN || github.token }}
 
       - name: Setup semantic-release
-        uses: actions/semantic-release/setup-semantic-release@master
+        uses: https://gitea.ldpt.fr/actions/semantic-release/setup-semrel@main
         with:
           node-version: "24"
 
+      - name: Configure git remote with PAT
+        if: ${{ secrets.GH_TOKEN != '' }}
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+        run: |
+          set -euo pipefail
+          REMOTE_URL=$(git remote get-url origin)
+          # Inject PAT so tag pushes come from the PAT user, not the Actions runner token
+          NEW_URL=$(echo "$REMOTE_URL" | sed "s|https://|https://oauth2:${GH_TOKEN}@|")
+          git remote set-url origin "$NEW_URL"
+
       - name: Run semantic-release
-        run: npx semantic-release
+        env:
+          GITEA_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
+        run: semantic-release

setup-semantic-release/action.yml

@@ -1,24 +0,0 @@
-name: "Setup semantic-release"
-description: "Prepare Node.js and install semantic-release dependencies"
-inputs:
-  node-version:
-    description: "Node.js version"
-    required: false
-    default: "20"
-  install-command:
-    description: "Command used to install project dependencies"
-    required: false
-    default: "npm ci"
-runs:
-  using: "composite"
-  steps:
-    - name: Setup Node.js
-      uses: actions/setup-node@v4
-      with:
-        node-version: ${{ inputs.node-version }}
-        cache: "npm"
-
-    - name: Install dependencies
-      shell: bash
-      run: |
-        npm install --no-save semantic-release @semantic-release/commit-analyzer @semantic-release/changelog @semantic-release/git @semantic-release/exec @semantic-release/npm

setup-semrel/action.yml

@@ -0,0 +1,48 @@
+name: 'Setup Semantic Release'
+description: 'Setup Node.js and install semantic-release with all necessary plugins'
+author: 'zertus'
+
+inputs:
+  node-version:
+    description: 'Node.js version to setup'
+    required: false
+    default: '24'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version: ${{ inputs.node-version }}
+
+    - name: Cache semantic-release dependencies
+      id: cache-semantic-release
+      uses: actions/cache@v5
+      with:
+        path: ${{ github.action_path }}/node_modules
+        key: semantic-release-${{ runner.os }}-node${{ inputs.node-version }}-${{ hashFiles(format('{0}/package.json', github.action_path)) }}
+
+    - name: Install semantic-release dependencies
+      if: steps.cache-semantic-release.outputs.cache-hit != 'true'
+      shell: bash
+      working-directory: ${{ github.action_path }}
+      run: |
+        set -euo pipefail
+        npm ci && npm cache clean --force
+        echo "✓ Semantic-release dependencies installed"
+
+    - name: Add semantic-release to PATH
+      shell: bash
+      run: |
+        set -euo pipefail
+        echo "${{ github.action_path }}/node_modules/.bin" >> $GITHUB_PATH
+        echo "NODE_PATH=${{ github.action_path }}/node_modules${NODE_PATH:+:$NODE_PATH}" >> $GITHUB_ENV
+        if [ ! -e "${{ github.workspace }}/node_modules" ]; then
+          ln -s "${{ github.action_path }}/node_modules" "${{ github.workspace }}/node_modules"
+        fi
+        echo "✓ Semantic-release added to PATH"
+
+branding:
+  icon: 'tag'
+  color: 'purple'

setup-semrel/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "semantic-release",
+  "dependencies": {
+    "@saithodev/semantic-release-gitea": "^2.1.0",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/exec": "^7.1.0",
+    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/npm": "^13.1.5",
+    "@semantic-release/release-notes-generator": "^14.1.0",
+    "@terrestris/maven-semantic-release": "^3.1.0",
+    "conventional-changelog-conventionalcommits": "^9.3.1",
+    "semantic-release": "^25.0.3",
+    "tsx": "^4.21.0"
+  }
+}