Use PAT for automation

.github/workflows/auto-release.yml

@@ -99,7 +99,7 @@ jobs:
 
       - name: Create GitHub Release
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.PAT_RELEASE_ENGINEER }}
         run: |
           TAG_NAME="${{ github.ref_name }}"
           VERSION="${{ steps.validate.outputs.version }}"

.github/workflows/auto-tag.yml

@@ -85,8 +85,16 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
+      - name: Clear git credentials
+        run: |
+          git config --unset-all http.https://github.com/.extraheader || true
+          git config --global --unset-all credential.helper || true
+          git config --local --unset-all credential.helper || true
+
       - name: Create and push tag
         if: steps.check.outputs.is_version_bump == 'true' && steps.check_label.outputs.skip_tag == 'false'
+        env:
+          GH_TOKEN: ${{ secrets.PAT_RELEASE_ENGINEER }}
         run: |
           TAG_NAME="v${{ steps.check.outputs.version }}"
           echo "Creating tag: $TAG_NAME"
@@ -95,7 +103,7 @@ jobs:
           git tag -a "$TAG_NAME" -m "Release $TAG_NAME"
 
           # Push tag
-          git push origin "$TAG_NAME"
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" "$TAG_NAME"
 
           echo "✅ Successfully created and pushed tag $TAG_NAME"
           echo "This will trigger the release workflow."

.github/workflows/bump-version.yml

@@ -4,9 +4,9 @@ on:
   workflow_dispatch:
     inputs:
       bump_type:
-        description: 'Version bump type'
+        description: "Version bump type"
         required: true
-        default: 'patch'
+        default: "patch"
         type: choice
         options:
           - patch
@@ -98,7 +98,7 @@ jobs:
 
       - name: Create Pull Request
         env:
-          GH_TOKEN: ${{ secrets.PAT_OPEN_PR }}
+          GH_TOKEN: ${{ secrets.PAT_RELEASE_ENGINEER }}
         run: |
           gh pr create \
             --title "Release: Bump version to ${{ steps.version.outputs.new }}" \

RELEASING.md

@@ -11,6 +11,11 @@ The release process has been streamlined with automation to reduce manual steps.
 
 ## Option 1: GitHub Actions (Recommended)
 
+**NOTE**: This automation requires a Personal Access Token, defined in the secret `PAT_RELEASE_ENGINEER`, with the following permissions:
+- Contents: read/write
+- Metadata: read
+- Pull requests: read/write
+
 ### Step 1: Trigger Version Bump Workflow
 
 1. Go to the [Actions tab](../../actions/workflows/bump-version.yml) in GitHub