ci: update

.github/workflows/semantic-release.yml

@@ -2,11 +2,10 @@ name: Semantic Release
 
 on:
   workflow_call:
-
+    secrets:
-permissions:
+      GH_TOKEN:
-  contents: write
+        description: 'PAT with repo access, required to trigger workflows on tag push'
-  issues: write
+        required: false
-  pull-requests: write
 
 jobs:
   release:
@@ -15,14 +14,29 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
         with:
           fetch-depth: 0
+          token: ${{ secrets.GH_TOKEN || github.token }}
 
       - name: Setup semantic-release
         uses: https://gitea.ldpt.fr/actions/semantic-release/setup-semrel@main
         with:
           node-version: "24"
 
+      - name: Configure git remote with PAT
+        if: ${{ secrets.GH_TOKEN != '' }}
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+        run: |
+          set -euo pipefail
+          REMOTE_URL=$(git remote get-url origin)
+          # Inject PAT so tag pushes come from the PAT user, not the Actions runner token
+          NEW_URL=$(echo "$REMOTE_URL" | sed "s|https://|https://oauth2:${GH_TOKEN}@|")
+          git remote set-url origin "$NEW_URL"
+
       - name: Run semantic-release
+        env:
+          GITEA_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
         run: semantic-release

setup-semrel/package.json

@@ -1,14 +1,15 @@
 {
   "name": "semantic-release",
   "dependencies": {
+    "@saithodev/semantic-release-gitea": "^2.1.0",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^10.0.1",
-    "@semantic-release/npm": "^13.1.3",
+    "@semantic-release/npm": "^13.1.5",
     "@semantic-release/release-notes-generator": "^14.1.0",
     "@terrestris/maven-semantic-release": "^3.1.0",
-    "conventional-changelog-conventionalcommits": "^9.1.0",
+    "conventional-changelog-conventionalcommits": "^9.3.1",
     "semantic-release": "^25.0.3",
     "tsx": "^4.21.0"
   }