`.github/workflows/release.yml` without `workflows` permission

[shenxianpeng]

! [remote rejected] v2 -> v2 (refusing to allow a GitHub App to create or update workflow .github/workflows/release.yml without workflows permission)

Originally posted by @shenxianpeng in #315 (comment)

[2bndy5]

Change the token's permission

The repo needs to be checked out with a token that has permission to write contents (includes tags and releases). Currently, you are using the default github.token which does not imply permissions: { contents: write }.

You can use a PAT with write permission to contents. This is the approach I often use.

1. 
2. Set it to "read and write"
   
3. Use the PAT in the workflow

   jobs:
     steps:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           ref: ${{ inputs.ref }}
           # using a PAT that you created
           token: ${{ secrets.MY_CI_TOKEN }}

Or, you can add the required permission to the job (untested):

jobs:
  re-tag:
    runs-on: ubuntu-latest
    permissions:
      # allow `github.token` to `git push` and stuff
      contents: write
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
          ref: ${{ inputs.ref }}

Advice from experience

The following is the nushell script I use to move tag(s) during CI:

def mv-rolling-tags [
    ver: string # The fully qualified version of the new tag (without `v` prefixed).
] {
    let tags = ^git tag --list | lines
    let tag = $ver | parse "{major}.{minor}.{patch}" | first
    let major_tag = $"v($tag | get major)"
    let minor_tag = $"v($tag | get major).($tag | get minor)"
    for t in [$major_tag, $minor_tag] {
        if ($t in $tags) {
            # delete local tag
            git tag -d $t
            # delete remote tags
            git push origin $":refs/tags/($t)"
        }
        git tag $t
        git push origin $t
        print $"Adjusted tags ($t)"
    }
}