From ee3ea9340e0ca681e911136a38a32204f3e0e32f Mon Sep 17 00:00:00 2001
From: Mike Heffner <mikeh@fesnel.com>
Date: Mon, 19 Jan 2026 20:57:16 -0500
Subject: [PATCH 1/2] Use PAT for automation

---
 .github/workflows/auto-release.yml |  2 +-
 .github/workflows/auto-tag.yml     | 10 +++++++++-
 .github/workflows/bump-version.yml |  6 +++---
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index 313499e..63e4a46 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -99,7 +99,7 @@ jobs:
 
       - name: Create GitHub Release
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.PAT_RELEASE_ENGINEER }}
         run: |
           TAG_NAME="${{ github.ref_name }}"
           VERSION="${{ steps.validate.outputs.version }}"
diff --git a/.github/workflows/auto-tag.yml b/.github/workflows/auto-tag.yml
index 3c910c3..a592f15 100644
--- a/.github/workflows/auto-tag.yml
+++ b/.github/workflows/auto-tag.yml
@@ -85,8 +85,16 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
+      - name: Clear git credentials
+        run: |
+          git config --unset-all http.https://github.com/.extraheader || true
+          git config --global --unset-all credential.helper || true
+          git config --local --unset-all credential.helper || true
+
       - name: Create and push tag
         if: steps.check.outputs.is_version_bump == 'true' && steps.check_label.outputs.skip_tag == 'false'
+        env:
+          GH_TOKEN: ${{ secrets.PAT_RELEASE_ENGINEER }}
         run: |
           TAG_NAME="v${{ steps.check.outputs.version }}"
           echo "Creating tag: $TAG_NAME"
@@ -95,7 +103,7 @@ jobs:
           git tag -a "$TAG_NAME" -m "Release $TAG_NAME"
 
           # Push tag
-          git push origin "$TAG_NAME"
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" "$TAG_NAME"
 
           echo "✅ Successfully created and pushed tag $TAG_NAME"
           echo "This will trigger the release workflow."
diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
index 376e7ed..f0c787c 100644
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@@ -4,9 +4,9 @@ on:
   workflow_dispatch:
     inputs:
       bump_type:
-        description: 'Version bump type'
+        description: "Version bump type"
         required: true
-        default: 'patch'
+        default: "patch"
         type: choice
         options:
           - patch
@@ -98,7 +98,7 @@ jobs:
 
       - name: Create Pull Request
         env:
-          GH_TOKEN: ${{ secrets.PAT_OPEN_PR }}
+          GH_TOKEN: ${{ secrets.PAT_RELEASE_ENGINEER }}
         run: |
           gh pr create \
             --title "Release: Bump version to ${{ steps.version.outputs.new }}" \

From 065b7e1aea2c16817e0fc7f55c86d6eb858367f5 Mon Sep 17 00:00:00 2001
From: Mike Heffner <mikeh@fesnel.com>
Date: Mon, 19 Jan 2026 21:00:19 -0500
Subject: [PATCH 2/2] Document PAT needs

---
 RELEASING.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/RELEASING.md b/RELEASING.md
index d8ba4eb..b5c166b 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -11,6 +11,11 @@ The release process has been streamlined with automation to reduce manual steps.
 
 ## Option 1: GitHub Actions (Recommended)
 
+**NOTE**: This automation requires a Personal Access Token, defined in the secret `PAT_RELEASE_ENGINEER`, with the following permissions:
+- Contents: read/write
+- Metadata: read
+- Pull requests: read/write
+
 ### Step 1: Trigger Version Bump Workflow
 
 1. Go to the [Actions tab](../../actions/workflows/bump-version.yml) in GitHub