fix(ci): configure git credentials explicitly for semantic-release PAT

persist-credentials: false prevents actions/checkout from overriding
git auth with GITHUB_TOKEN. Manual credential store setup ensures
all git pushes (including from @semantic-release/git) use the PAT,
which is required to trigger the build workflow on tag push.

.github/workflows/release.yml

@@ -20,12 +20,20 @@ jobs:
     name: Semantic Release
     runs-on: ubuntu-latest
     steps:
-      # Use a PAT so that the tag push triggers the build workflow.
+      # persist-credentials: false prevents actions/checkout from setting up
-      # GITHUB_TOKEN events don't trigger other workflows (by design).
+      # the credential helper with GITHUB_TOKEN. We configure git auth manually
+      # with the PAT so that tag pushes trigger downstream workflows.
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.RELEASE_TOKEN }}
+          persist-credentials: false
+
+      - name: Configure git credentials
+        run: |
+          git config --global credential.helper store
+          echo "https://x-access-token:${{ secrets.RELEASE_TOKEN }}@github.com" > ~/.git-credentials
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
       - uses: actions/setup-node@v4
         with:
@@ -45,4 +53,8 @@ jobs:
       - name: Run semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GIT_AUTHOR_NAME: github-actions[bot]
+          GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
+          GIT_COMMITTER_NAME: github-actions[bot]
+          GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
         run: npx semantic-release