ci: fix release push to protected main (bypass token)

[burnedikt]

Problem

The Release pipeline fails on the Semantic Release step (example run):

git push --tags https://github.com/Innoactive/Portal-Python-CLI HEAD:main
remote: error: GH006: Protected branch update failed for refs/heads/main.
- Changes must be made through a pull request.

.releaserc.json uses @semantic-release/git, which commits the version bump to pyproject.toml and pushes it to main. But main is protected (requires a PR, enforce_admins on), and the default GITHUB_TOKEN / github-actions[bot] is not on the bypass list — so the push is declined and no release is published.

Fix

Run semantic-release with a repo-scoped SEMANTIC_RELEASE_GH_TOKEN whose identity bypasses PR protection on main.

Notes on the approach:

• Inline, not the shared org workflow. This repo is public and the org's reusable semantic-release.yml lives in the private Portal-Backend repo. GitHub does not allow a public repo to call a private repo's reusable workflow, so the release job is defined directly here instead.
• persist-credentials: false on checkout is required: otherwise actions/checkout stores the default GITHUB_TOKEN as a git auth header and the push would use that (-> GH006 again) instead of the bypass token.
• Repo-scoped token was chosen over sharing the broad org-wide token with this public repo, to keep the credential's blast radius limited to this repo (a repo secret overrides the org secret of the same name).
• Dropped the inline Python/uv setup — the version bump (scripts/update-version-number.sh) is pure sed and there is no publish step.

Prerequisites (GitHub settings)

• Repo-scoped SEMANTIC_RELEASE_GH_TOKEN secret created
• Token identity added to main's branch-protection PR-bypass list (currently only burnedikt)
• Token has Contents: write

Testing

The release workflow only triggers on push to main, so this is validated by the next merge to main producing a release.

🤖 Generated with Claude Code