ci: fix release push to protected main (bypass token)

.github/workflows/release.yml

@@ -7,24 +7,26 @@ on:
 
 jobs:
   release:
-    name: Release
+    name: Semantic Release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v7
-      - name: Setup python version
-        uses: actions/setup-python@v7
         with:
-          python-version: "3.12"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-      - name: Install dependecies
-        run: uv sync --locked
+          # Full history + tags so semantic-release can determine the next version.
+          fetch-depth: 0
+          # Must be false: otherwise checkout stores the default GITHUB_TOKEN as a git
+          # auth header and the release push would use it (github-actions[bot], which is
+          # NOT on main's bypass list → GH006). With no persisted credentials, the push
+          # uses the SEMANTIC_RELEASE_GH_TOKEN below instead.
+          persist-credentials: false
       - name: Semantic Release
         uses: cycjimmy/semantic-release-action@v6
         with:
           extra_plugins: |
             @semantic-release/exec
             @semantic-release/git
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Repo-scoped token whose identity bypasses PR protection on main, so the
+          # @semantic-release/git version-bump commit can be pushed to the protected branch.
+          GITHUB_TOKEN: ${{ secrets.SEMANTIC_RELEASE_GH_TOKEN }}