Fix Tag-Push Token

Author: ric-evans

.github/workflows/tag-and-release.yml

@@ -68,7 +68,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0  # required to see tags and commits
-          ref: ${{ github.sha }}  # lock to triggered commit ('github.ref' is dynamic)
+          ref: ${{ github.ref }}  # dont lock to sha (action needs to push)
+          token: ${{ secrets.TOKEN || github.token }}
 
       # PYTHON ONLY: setup python
       - if: inputs.project-type == 'python'
@@ -90,13 +91,10 @@ jobs:
 
       - if: steps.next-version.outputs.version != ''
         name: Tag new version
-        env:
-          AUTH_TOKEN: ${{ secrets.TOKEN || github.token }}
         run: |
           set -euo pipefail; echo "now: $(date -u +"%Y-%m-%dT%H:%M:%S.%3N")"
-          echo "::add-mask::${AUTH_TOKEN}"  # logging safety
           git tag v${{ steps.next-version.outputs.version }}  # note: prepend 'v'
-          git push https://x-access-token:${AUTH_TOKEN}@github.com/${{ github.repository }} --tags
+          git push origin --tags
 
       # PYTHON ONLY: auto-build
       - if: |